Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The FBI Identified a Tor User

vice.com

Post reply on HN
Print view View original

261–270 of 367 posts

Re: The FBI Identified a Tor User

#261

Post by DarkmSparks »

titaniumtown wrote: post #76
DarkmSparks wrote: post #39

Earlier quoted context omitted.

yep, this, I ran a tor webserver for discussing geopolitics with friends on a pi for a few months before finding it had been compromised. that was shortly after intel exchange had been taken down. Tor services just arent secure in any sense imho. especially not from the people who wrote them. sigh.

> for discussing geopolitics with friends on a pi for a few months before finding it had been compromised. that's very suspicious

now mostly fall back on cryptome.org

dont get the more juicy military stuff, but it's much less effort.

Re: The FBI Identified a Tor User

#262

Post by NN88 »

r3trohack3r wrote: post #95

I have second hand knowledge of lawsuits that have been dropped by the FBI during discovery because it would require them revealing zero days they have on Tor. Recently this has started getting increasing levels of press exposure[1] including in CSAM cases. The FBI has also continued to run CSAM websites after takeover to collect intel, and likely run honeypots for other content. If your adversary is a state actor, p…

https://en.wikipedia.org/wiki/Graymail

https://en.wikipedia.org/wiki/Parallel_construction

Re: The FBI Identified a Tor User

#263

Post by staringback »

CommitSyn wrote: post #105
seanw444 wrote: post #79

Earlier quoted context omitted.

Yikes. I thought the point of Tor was uncompromising security? This is going to bite some less-experienced people in the ass.

JavaScript used to be disabled by default but too many users were complaining about pages not working. It's not very useful if you're a CFO trying to leak financial documents to a journalist but the website won't work. Tech-literate people use JavaScript.enabled=false in about:config.

You don't even need to use about:config, it is as simple as setting Security level to "Highest" using the button on the toolbar

Re: The FBI Identified a Tor User

#264

Post by DarkmSparks »

Run_DOS_Run wrote: post #155
DarkmSparks wrote: post #39

Earlier quoted context omitted.

yep, this, I ran a tor webserver for discussing geopolitics with friends on a pi for a few months before finding it had been compromised. that was shortly after intel exchange had been taken down. Tor services just arent secure in any sense imho. especially not from the people who wrote them. sigh.

>I ran a tor webserver for discussing geopolitics with friends on a pi for a few months before finding it had been compromised. Not the fault of Tor. HSDir nodes could snoop on announced v1 .onion adresses. This isn't the case anymore for Onion v2 addresses. But even if an attacker has the onion address of your webserver, he needs a way to compromise it. Either through a vuln in your website or your webserver.

the malicious process had tor as a parent process/uid. Which makes me say it was definately the tor server that had some rce.

Re: The FBI Identified a Tor User

#265

Post by PartiallyTyped »

dmux wrote: post #221
PartiallyTyped wrote: post #99

Earlier quoted context omitted.

Is there really any way to hide from a motivated state actor? Asking about it on HN is definitely not one. Relevant xkcd: 538 [1] [1] https://xkcd.com/538/

One of my favorite HN comments of all time [0] suggested that MMO's provide plentiful means of covertly communicating: >MMO's are packed with possible communication channels in addition to chat. Ever wonder if that annoying gnome in the auction hall is jumping in morse code? Could signals be sent with bids? Could a character's inventory contents be arranged to leave a message to someone else who shares the login info…

Reminds me of this:

https://www.forbes.com/sites/insertcoin/2015/11/14/why-the-p...

>

The hunt for those responsible (eight terrorists were killed Saturday night, but accomplices may still be at large) led to a number of raids in nearby Brussels. Belgian federal home affairs minister Jan Jambon has said outright that the PS4 is used by ISIS agents to communicate, and was selected due to the fact that it’s notoriously hard to monitor. “PlayStation 4 is even more difficult to keep track of than WhatsApp,” he said.

Re: The FBI Identified a Tor User

#266

Post by phil21 »

DoItToMe81 wrote: post #22

I wouldn't get so excited about this. There have been tons of javascript exploits to leak IP addresses in the past, it's more likely that than the FBI running thousands of servers.

> it's more likely that than the FBI running thousands of servers.

Why not both?

From my experience over the years doing datacenter/transit/fiber/etc. type of infrastructure - just assume a government agency of some sort either outright operates an exit node, or has a wiretap on it. You can be the most trustworthy person in the world operating in the name of freedom - outright working for a say a colo provider. Unless you are the CEO, legal team, or the individual engineer responsible for it - you will have no idea you are also operating an exit node under surveillance.

I'd put money on well over 50% of the world's exit nodes being packet captured 24x7.

Re: The FBI Identified a Tor User

#267

Post by plugin-baby »

skippyboxedhero wrote: post #249
bmn__ wrote: post #242

Earlier quoted context omitted.

> MMO's provide plentiful means of covertly communicating This is a plot device in http://enwp.org/Little_Brother_%28Doctorow_novel%29 >.

Also in the film Four Lions where terrorists use an online game to communicate (basically an unbranded Club Penguin). Wouldn't particularly recommend watching the film (it isn't bad, it is just depressing...which is the aim) but the media coverage of this does suggest it is occurring.

> Wouldn't particularly recommend watching the film (it isn't bad, it is just depressing...which is the aim)

It’s a comedy, I don’t think it aims to depress.

Re: The FBI Identified a Tor User

#269

Post by yifanl »

monero-xmr wrote: post #216
czx4f4bd wrote: post #193

Earlier quoted context omitted.

Really? Bruce is pro-backdoor? Where's that pro-backdoor advocacy in this essay from 2013 on evading NSA surveillance and warning about the risk of backdoored cryptography? https://www.schneier.com/essays/archives/2013/09/nsa_surveil... Or this essay from 2016 arguing that backdoors sabotage security? https://www.schneier.com/essays/archives/2016/04/the_value_o... Or this essay from 2019 decrying yet another effort t…

This is, without a doubt, the craziest thing I have ever seen pushed out by a someone who purports to know something about cryptography, law, and political advocacy: https://www.lawfareblog.com/tornado-cash-not-free-speech-its... Schneier has gone off the deep end

Do you have a substantial argument against Schneier beyond "Schneier is a crazy statist"?

Re: The FBI Identified a Tor User

#270

Post by eat »

warinukraine wrote: post #57
optimalsolver wrote: post #41

I keep saying this, but the inescapable fact about Tor is that its traffic patterns make you stand out prominently. Just the fact you’re using it automatically makes you interesting and worthy of a closer look. All well and good if you’re just maintaining a cookie recipe site on the dark web, but it’s rarely ever that, is it?

[flagged]

Perhaps that's why the person you're replying to prefaced their comment with:

> I keep saying this, but...

Post reply on HN