Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The FBI Identified a Tor User

vice.com

Post reply on HN
Print view View original

201–210 of 367 posts

Re: The FBI Identified a Tor User

#201

Post by sokoloff »

brookst wrote: post #145
Fnoord wrote: post #110

Earlier quoted context omitted.

> If you're sitting in front of a computer that you're using for something the U.S. government has significant interest in prosecuting, that device should be considered compromised and adversarial - you should act accordingly. Yep: stop breaking the law. The vast majority the US government has significant interest in prosecuting, the general public is OK with.

> The vast majority the US government has significant interest in prosecuting, the general public is OK with. Did you really just shoot down your own argument by acknowledging that there are some things the government has a significant interest in prosecuting, but which the general public doesn’t find objectionable?

I read it as “the vast majority of people the government is after, the general public is okay with them being pursued.”

Re: The FBI Identified a Tor User

#202

Post by PartiallyTyped »

RcouF1uZ4gsC wrote: post #198
PartiallyTyped wrote: post #191

Earlier quoted context omitted.

The most paranoid plan i have come up with: - tor + cubesOS set up by somebody you deeply trust (person A) - on a USB bought by a different person (person B) - with a network card bought by a different person (person C) - many miles away, wearing generic clothes in a cafe where people go to work - different hairstyle and facial hair - mask - without having a phone (obv) - navigating there by changing multiple cars wi…

> - ordering the most boring coffee The fatal flaw in the plan: Barista talking to news after person is arrested by FBI: "As soon as they ordered the brewed coffee with no customizations after standing in line for 10 minutes, I knew something was suspicious. Who comes to Starbucks, stands in line for 10 minutes, and then orders boring coffee?"

Good point! Let's make it a caramel macchiato with two pumps vanilla and sugar free creamer! Oh god I am leaking information!

Re: The FBI Identified a Tor User

#203

Post by Veen »

1shooner wrote: post #184
Veen wrote: post #147

Earlier quoted context omitted.

Aren't you mixing up two different things? There's your problem, being harassed for something you say you didn't do. And there is the criminal's problem, being found out for something they did do. For the latter problem, not doing the illegal thing sounds like a solid strategy.

What's the purpose of this distinction, if the actor (law enforcement) does not effectively make this distinction?

Law enforcement and the courts mostly do make the distinction effectively—it's what they are for. That they sometimes accidentally or deliberately fail to do so is true, but it doesn't license lawbreaking. In the US, there's a small chance of an innocent being harassed for something they didn't do, but a much larger chance of a criminal being arrested, charged, and jailed for something they did do.

If you don't want to be treated like a criminal, the smart choice is not to commit crimes, even though there is small chance you'll be treated like a criminal anyway.

Re: The FBI Identified a Tor User

#204

Post by tylersmith »

meep0l wrote: post #196
lysergia wrote: post #144

I have a Glinet[0] router that has Tor functionality and 'torifies' your connection, so even if there's some JS 0day that executes trying to decloak me, the adversary just gets a Tor IP instead of my home connection IP. Note: I connect to Tor from my torified Glinet router which is doing Tor-over-Tor which is considered 'dangerous'[1] but I do it anyway. This might be overkill for most, and I'm not doing anything ill…

Out of curiosity, what is the benefit of using Tor just to browse legal clearnet sites?

Privacy. The con is a very annoying latency.

Re: The FBI Identified a Tor User

#205

Post by geepound »

PartiallyTyped wrote: post #191
kerpotgh wrote: post #170

Earlier quoted context omitted.

Probably. If you use a laptop once, on a public Wi-Fi hundreds of miles from where you live, while not being caught on surveillance, while using a stripped down privacy based OS, and then route yourself through Tor, you might be okay.

The most paranoid plan i have come up with: - tor + cubesOS set up by somebody you deeply trust (person A) - on a USB bought by a different person (person B) - with a network card bought by a different person (person C) - many miles away, wearing generic clothes in a cafe where people go to work - different hairstyle and facial hair - mask - without having a phone (obv) - navigating there by changing multiple cars wi…

[dead]

Re: The FBI Identified a Tor User

#206

Post by hooande »

PartiallyTyped wrote: post #191
kerpotgh wrote: post #170

Earlier quoted context omitted.

Probably. If you use a laptop once, on a public Wi-Fi hundreds of miles from where you live, while not being caught on surveillance, while using a stripped down privacy based OS, and then route yourself through Tor, you might be okay.

The most paranoid plan i have come up with: - tor + cubesOS set up by somebody you deeply trust (person A) - on a USB bought by a different person (person B) - with a network card bought by a different person (person C) - many miles away, wearing generic clothes in a cafe where people go to work - different hairstyle and facial hair - mask - without having a phone (obv) - navigating there by changing multiple cars wi…

What you're describing is likely overkill. Just buy a used laptop on Craigslist. Drive about 50 mi away. Park at a motel and take a yellow cab to a moderately busy Starbucks. Hack away, and then leave via yellow cab. Leave your phone in your car. Pay for everything in cash. Throw away the laptop.

There's a chance that you'll get caught on camera at Starbucks. But the cameras there, if any, aren't set up to provide full coverage and are rotated every few days.

Don't involve any other people , don't wear a disguise. If you're going to alter your appearance in any way, do it when you meet the seller to pick up the laptop.

added: You might want a burner phone to call the cab. But normally a motel desk will do that if you ask nicely.

Re: The FBI Identified a Tor User

#207

Post by roughly »

Fnoord wrote: post #110
r3trohack3r wrote: post #95

I have second hand knowledge of lawsuits that have been dropped by the FBI during discovery because it would require them revealing zero days they have on Tor. Recently this has started getting increasing levels of press exposure[1] including in CSAM cases. The FBI has also continued to run CSAM websites after takeover to collect intel, and likely run honeypots for other content. If your adversary is a state actor, p…

> If you're sitting in front of a computer that you're using for something the U.S. government has significant interest in prosecuting, that device should be considered compromised and adversarial - you should act accordingly. Yep: stop breaking the law. The vast majority the US government has significant interest in prosecuting, the general public is OK with.

The law is a social, not a moral, construct, and tends to lag behind both. Ten years ago selling weed would’ve had the government using these same tactics against you; today you’ve got a shop front downtown. Fifty years ago being gay would’ve been cause for the FBI to surveil you. 70 years ago, supporting the policies of someone like Bernie Sanders would’ve done it.

Re: The FBI Identified a Tor User

#208

Post by flutas »

dmatech wrote: post #160
Ajedi32 wrote: post #44

Earlier quoted context omitted.

Or even something way simpler, like the FBI secretly compromising the user's PC with malware prior to the arrest. Without more detail it's impossible to know whether this is even news.

Perhaps, but the only references I saw to 2019 in the criminal complaint[1] were with respect to Tor and his phone. I don't know if he was actually under surveillance that early or if this is just stuff they later found. While there are plenty of ways this guy could have attracted the attention of California, Florida, or federal law enforcement, it's entirely possible that seeing a US residential IP address is what s…

> Perhaps, but the only references I saw to 2019 in the criminal complaint[1] were with respect to Tor and his phone. I don't know if he was actually under surveillance that early or if this is just stuff they later found.

From a doc I found[0] he was under aerial surveillance (aka, the FBI Cesnas {related [1]}) since June 2018.

Also some of the facts in the case are...well this is from doc [0].

> Some of the surveillance footage is itself incriminating. (See Doc. 5, pp. 50-51) (asserting that Mr. Alazhari’s travel on certain days in May 2020 shows that he was “scouting targets fora potential mass shooting attack.”).

[0]: https://www.documentcloud.org/documents/21052490-motion-to-s...

[1]: https://news.ycombinator.com/item?id=34109507

Re: The FBI Identified a Tor User

#209

Post by zxcvbn4038 »

I think a lot of this has been covered elsewhere before:

- when using tor you should disable javascript because a malicious or compromised site can use javascript to do non-tor stuff that potentially compromises your location. (can be a big pill to swallow, web without javacript is very 90s)

- Run torbrowser within a secure VM or separate device using Tails to minimize your activity footprint

- Use a VPN when connecting to TOR (I also put my TOR services behind their own VPN so even if the entry point is known you can't get the origin IP from it)

- As an added protection I use firewall rules to ensure that only the tor client process can communicate out, any other attempt to send or receive traffic to the public internet gets dropped.

Post reply on HN