This was fascinating, 10 years old now: https://www.theguardian.com/world/interactive/2013/oct/04/to...
If you had 10 years and the resources of the US Government, I am sure Tor has been broken many times over now...
The FBI Identified a Tor User
131–140 of 367 posts
Re: The FBI Identified a Tor User
#132Earlier quoted context omitted.
Is there really any way to hide from a motivated state actor? Asking about it on HN is definitely not one. Relevant xkcd: 538 [1] [1] https://xkcd.com/538/
No. Which is why Agora marketplace, digital lawyers, and a slew of others have simply said: "we no longer operate under any assumption of privacy regardless of measures taken, and have simple refused to operate on the internet any longer." Which is what the 3 letters want, a chilling-effect to reduce their Herculean-effort to just an Athenian one.
Physical measures might make yourself much more expensive to surveil, to the point of not being worth it.
You can avoid being the "easy picking".
Re: The FBI Identified a Tor User
#133I doubt the Tor user was identified on the Tor network.
Most likely his Bitcoin donations gave him away, since Bitcoin is far from anonymous. He might also have left other clues such as an email address which he accessed from clearnet.
Anyway, it's pretty obvious LEA cannot identify Tor users en-masse. There have been several CP websites taken down which had hundreds of thousands of users, yet they only managed to arrest the website administrators. Only a handful of users were arrested, and mostly because of dumb mistakes.
Re: The FBI Identified a Tor User
#134Earlier quoted context omitted.
I don't think that is how timing analisis works. User can say to "entrance node" that it is also a node and that is how it can deny that it is originator. "Entrance node" doesn't know its position in a chain. Only Exit node knows its position.
It is a volume+timing attack. From 2014: https://www.bbc.com/news/technology-28573625 "The Tor Project suggests the perpetrator compromised the network via a "traffic confirmation attack". This involves the attacker controlling both the first part of the circuit of nodes involved - known as the "entry relay" - as well as the exit relay. By matching the volumes and timings of the data sent at one end of the circuit to…
See my reply above, this are just bugs that are fixable.
"Timing attack" that will not be fixed is when police has warrant for your ISP, and police has ISP logs and destination server logs. (so it can compare the two)
Re: The FBI Identified a Tor User
#135I wouldn't get so excited about this. There have been tons of javascript exploits to leak IP addresses in the past, it's more likely that than the FBI running thousands of servers.
But then you'd need to entice Tor users to turn on Javascript since it's turned off by default.
Re: The FBI Identified a Tor User
#136I will never understand people who do illegal things over their own IP. Is it really that hard to find an open access point? Way back in the day when I torrented all my content I used a long-range wifi antenna connected to a public AP and a dedicated PC with a scrubbed drive that never connected to my home network.
Your strategy might be safer but it also shows criminal intent. Also- the secret about torrents is that nobody really gives a shit. They're more worried about pedos and terrorists.
My crime showed criminal intent. Nothing new there.
Re: The FBI Identified a Tor User
#137can you not use nordvpn first, then tor?
Mullvad, please.
nordvpn has been acquired by some private equity that's acquiring all the vpns.
Re: The FBI Identified a Tor User
#138I have second hand knowledge of lawsuits that have been dropped by the FBI during discovery because it would require them revealing zero days they have on Tor. Recently this has started getting increasing levels of press exposure[1] including in CSAM cases. The FBI has also continued to run CSAM websites after takeover to collect intel, and likely run honeypots for other content. If your adversary is a state actor, p…
> If you're sitting in front of a computer that you're using for something the U.S. government has significant interest in prosecuting, that device should be considered compromised and adversarial - you should act accordingly. Yep: stop breaking the law. The vast majority the US government has significant interest in prosecuting, the general public is OK with.
Lol if you don't want to be fucked with by the government, just don't break the law! Unfortunately that doesn't work. Sometimes legal activities are best kept under wraps.
I have a signed and executed federal search warrant in my drawer. I was tossed in a cell. I was dragged to a hospital. I was sent the bill for the "search" and am currently being hounded by debt collectors. Nothing was found and I did nothing wrong. Sadly just following the law didn't work.
Re: The FBI Identified a Tor User
#139I have second hand knowledge of lawsuits that have been dropped by the FBI during discovery because it would require them revealing zero days they have on Tor. Recently this has started getting increasing levels of press exposure[1] including in CSAM cases. The FBI has also continued to run CSAM websites after takeover to collect intel, and likely run honeypots for other content. If your adversary is a state actor, p…
> If you're sitting in front of a computer that you're using for something the U.S. government has significant interest in prosecuting, that device should be considered compromised and adversarial - you should act accordingly. Yep: stop breaking the law. The vast majority the US government has significant interest in prosecuting, the general public is OK with.
So no one should ever do illegal stuff to expose illegal stuff?
Re: The FBI Identified a Tor User
#140Earlier quoted context omitted.
No. Which is why Agora marketplace, digital lawyers, and a slew of others have simply said: "we no longer operate under any assumption of privacy regardless of measures taken, and have simple refused to operate on the internet any longer." Which is what the 3 letters want, a chilling-effect to reduce their Herculean-effort to just an Athenian one.
Physical measures might make yourself much more expensive to surveil, to the point of not being worth it. You can avoid being the "easy picking".
Bingo. Tor is just a layer. You still have to take measures to separate your identity from the device, the behavior, and the location.
When tor falls, the next question is "what do they see?" You have control over that.