Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The FBI Identified a Tor User

vice.com

Post reply on HN
Print view View original

151–160 of 367 posts

Re: The FBI Identified a Tor User

#151

Post by monero-xmr »

adenozine wrote: post #83

From Bruce of all people, this is a wildly provocative, unsubstantiated claim about routine takedown behavior from the feds. I mean, nobody hates the gov side of the cryptography wars more than me, but this type of article is well below table-stakes for discussion. Especially by legendary professionals of repute like Bruce. It's very disappointing to me. The price of clicks truly deconstructs the modern man's integri…

Bruce has also been hardcore anti-cryptocurrency. From a pure cryptography perspective the innovations around zero knowledge proofs are very intriguing and it’s highly unlikely they would have happened as quickly without the monetary benefit of cryptocurrency pushing such research forwards. However Bruce is an extreme statist, and if he had his way I’m sure all cryptography would be backdoored.

Re: The FBI Identified a Tor User

#152

Post by notch656c »

Veen wrote: post #147
notch656c wrote: post #138

Earlier quoted context omitted.

Lol if you don't want to be fucked with by the government, just don't break the law! Unfortunately that doesn't work. Sometimes legal activities are best kept under wraps. I have a signed and executed federal search warrant in my drawer. I was tossed in a cell. I was dragged to a hospital. I was sent the bill for the "search" and am currently being hounded by debt collectors. Nothing was found and I did nothing wrong…

Aren't you mixing up two different things? There's your problem, being harassed for something you say you didn't do. And there is the criminal's problem, being found out for something they did do. For the latter problem, not doing the illegal thing sounds like a solid strategy.

Actually I could have avoided the warrant had I broke the law. It was because I followed the law that I was harassed.

I could have easily jumped the fence to the US, and as a citizen unless caught in the act it'd be nigh impossible to prove I did anything wrong. Instead I presented at a port of entry where an insane officer claimed there was drugs up my ass.

Re: The FBI Identified a Tor User

#153

Post by jdfellow »

notch656c wrote: post #138
Fnoord wrote: post #110

Earlier quoted context omitted.

> If you're sitting in front of a computer that you're using for something the U.S. government has significant interest in prosecuting, that device should be considered compromised and adversarial - you should act accordingly. Yep: stop breaking the law. The vast majority the US government has significant interest in prosecuting, the general public is OK with.

Lol if you don't want to be fucked with by the government, just don't break the law! Unfortunately that doesn't work. Sometimes legal activities are best kept under wraps. I have a signed and executed federal search warrant in my drawer. I was tossed in a cell. I was dragged to a hospital. I was sent the bill for the "search" and am currently being hounded by debt collectors. Nothing was found and I did nothing wrong…

Wait, there's bills for search warrants, like in Brazil (the movie)?

Re: The FBI Identified a Tor User

#154

Post by notch656c »

jdfellow wrote: post #153
notch656c wrote: post #138

Earlier quoted context omitted.

Lol if you don't want to be fucked with by the government, just don't break the law! Unfortunately that doesn't work. Sometimes legal activities are best kept under wraps. I have a signed and executed federal search warrant in my drawer. I was tossed in a cell. I was dragged to a hospital. I was sent the bill for the "search" and am currently being hounded by debt collectors. Nothing was found and I did nothing wrong…

Wait, there's bills for search warrants, like in Brazil (the movie)?

Yes. IF an officer accuses you of having controlled substances inside your body you'll be dragged to a hospital, which will perform the search, and then send you the bill. It doesn't matter that nothing was found and it was performed against your will at the behest of the government.

Re: The FBI Identified a Tor User

#155

Post by Run_DOS_Run »

DarkmSparks wrote: post #39
nibbleshifter wrote: post #27

Sounds like his box was compromised, possibly by owning the site he visited first. The FBI has done this before - inject a browser exploit into a site they compromised to identify its users.

yep, this, I ran a tor webserver for discussing geopolitics with friends on a pi for a few months before finding it had been compromised. that was shortly after intel exchange had been taken down. Tor services just arent secure in any sense imho. especially not from the people who wrote them. sigh.

>I ran a tor webserver for discussing geopolitics with friends on a pi for a few months before finding it had been compromised.

Not the fault of Tor. HSDir nodes could snoop on announced v1 .onion adresses. This isn't the case anymore for Onion v2 addresses. But even if an attacker has the onion address of your webserver, he needs a way to compromise it.

Either through a vuln in your website or your webserver.

Re: The FBI Identified a Tor User

#156

Post by 0xCMP »

lysergia wrote: post #144

I have a Glinet[0] router that has Tor functionality and 'torifies' your connection, so even if there's some JS 0day that executes trying to decloak me, the adversary just gets a Tor IP instead of my home connection IP. Note: I connect to Tor from my torified Glinet router which is doing Tor-over-Tor which is considered 'dangerous'[1] but I do it anyway. This might be overkill for most, and I'm not doing anything ill…

If you read through the 10 year old presentation linked[0] you'll see they have ways to break just running over Tor. You really need to be running Tor on the machine, possibly via a VPN (like Mullvad or VPS+Wireguard/SSH), and either using Tor Browser, Whonix/Tails, or QubesOS.

My (updated) understanding is that running all things via Tor is slow without as much benefit as just a normal VPN and that if anything you use throw away VMs or Tor Browser sessions to avoid any way to correlate. Also note that a well known attack is simply knowing a connection is currently happening (preferably a long-running one) and cutting off the internet in suspected areas until the connection drops. So I guess either you need to avoid long running connections (I think you could do this in the local firewall?) or have redundant network connections like Dual ISP or ISP + LTE on something like Opnsense (cause wow, is it difficult to do this on Linux. I intend to blog about it someday soon).

[0]: https://www.theguardian.com/world/interactive/2013/oct/04/to...

Re: The FBI Identified a Tor User

#157

Post by curiousllama »

from wrote: post #74
curiousllama wrote: post #36

Earlier quoted context omitted.

My favorite theory is that the US, China, NK, Russia, Israel, et al. are all running a large number of malicious servers, all of which adds up to a secure Tor network, since they'll never cooperate

I wish! But there most be some return on investment or they wouldn't be doing it. Tor is so much faster than it used to be so I think it is likely there is well resourced person who is up to something on Tor .

If nation-states stop running servers, then the last one standing gets control of the network. The ROI is defensive (denying your adversary a resource), rather than offensive (dominating that resource yourself).

Re: The FBI Identified a Tor User

#158

Post by jollyllama »

notch656c wrote: post #112
VWWHFSfQ wrote: post #98

Earlier quoted context omitted.

McDonald's has video cameras pointing at every inch of their property 24/7. All they need is a timestamp from the AP and they'll go find your license plate in the parking lot on the surveillance tapes.

What kind of idiot drives a car with a valid personal license plate while committing crime? I don't even drive a car when I'm selling shit on craigslist for fear they'll look up the plate and do dumb shit when they're mad the drill I sold them has normal battery life.

Most criminals (they're risk takers) don't really think these things out and a large percentage of them get away all the time. Stuff goes wrong, footage goes missing, cameras don't work, prosecution bungles some rules, etc.

Re: The FBI Identified a Tor User

#159

Post by nyanpasu64 »

Scoundreller wrote: post #102
johnisgood wrote: post #77

Earlier quoted context omitted.

That said, popular websites on/for Tor are free of JavaScript and they have implemented everything (such as captchas, or the "JavaScript is enabled" warning, and so forth) using pure HTML and CSS. They do use OpenResty[1], too, which is NGINX + Lua. Good stuff. [1] https://openresty.org/ , https://github.com/openresty/lua-nginx-module

What I despise is clearnet sites that refuse to open if you don’t execute JavaScript even when I perfectly well known the page doesn’t depend on it. (Fuck you imgur)

LibRedirect (https://libredirect.github.io/) can proxy Imgur, Fandom, Medium, and other links to no-JS alternative proxies, though some of the proxies are down or have broken Fandom images, and you have to disable the specific websites so you won't be redirected again.

Re: The FBI Identified a Tor User

#160

Post by dmatech »

Ajedi32 wrote: post #44
DoItToMe81 wrote: post #22

I wouldn't get so excited about this. There have been tons of javascript exploits to leak IP addresses in the past, it's more likely that than the FBI running thousands of servers.

Or even something way simpler, like the FBI secretly compromising the user's PC with malware prior to the arrest. Without more detail it's impossible to know whether this is even news.

Perhaps, but the only references I saw to 2019 in the criminal complaint[1] were with respect to Tor and his phone. I don't know if he was actually under surveillance that early or if this is just stuff they later found. While there are plenty of ways this guy could have attracted the attention of California, Florida, or federal law enforcement, it's entirely possible that seeing a US residential IP address is what started this case. I can't really tell without seeing dated search warrant applications.

The latest PDF[2] states:

    In discovery, the Government has declined to provide any information related
    to its TOR operation. The Defense therefore researched and drafted a motion to
    compel such discovery. In the course of this research, the Defense discovered an
    exhibit filed on the public docket in at least two federal cases with similar issues
    (“Exhibit 2”). The document is partially redacted, purports to be the work of a U.S.
    government agency, and is marked “Top Secret.” Outside of these public docket
    filings, Exhibit 2 is widely available on public internet sources. A Google search for
    Exhibit 2’s title yields 102,000 results. All of the top results apparently provide the
    document itself, and most of these date back to 2013.
That would likely be a reference to something leaked by Edward Snowden given the year mentioned.

1. https://www.justice.gov/opa/press-release/file/1279441/downl...

2. https://www.documentcloud.org/documents/23569961-motion-to-r...

Post reply on HN