Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The FBI Identified a Tor User

vice.com

Post reply on HN
Print view View original

321–330 of 367 posts

Re: The FBI Identified a Tor User

#321

Post by TechBro8615 »

markus_zhang wrote: post #190
r3trohack3r wrote: post #95

I have second hand knowledge of lawsuits that have been dropped by the FBI during discovery because it would require them revealing zero days they have on Tor. Recently this has started getting increasing levels of press exposure[1] including in CSAM cases. The FBI has also continued to run CSAM websites after takeover to collect intel, and likely run honeypots for other content. If your adversary is a state actor, p…

I figured unless working for an intelligence agency or some ideological reasons there is no reason to go against the US government. I don't think there is enough protection against such actor unless you are working directly for another state actor. And even that you won't keep anonymity. Check the North Korean gov cracker case. DoJ managed to figure out his name and photo despite that he works for a state actor. That…

Most US law enforcement ability comes from their subpoena power, so you could presumably stay out of reach of that by limiting your infrastructure to be located in countries without friendly relations with the US. I doubt some babushka's VPS provider in Belarus is going to respond to a subpoena from the FBI. (However, the FBI probably knows this, and they know you know this... so they might purchase a VPS from that same babushka, to spy on the traffic of neighboring hosts via ARP spoofing and similar network-level attacks.)

Another area of exposure is payment networks (cryptocurrency or otherwise), so ideally you wouldn't purchase any infrastructure at all. But that's not always feasible.

And of course, to be absolutely safe you'd also need to limit your own physical location to countries that don't extradite to the US (and hope they don't sign an extradition treaty before the statute of limitations runs out).

Re: The FBI Identified a Tor User

#322

Post by TecoAndJix »

heavyset_go wrote: post #238
magnat wrote: post #177

Earlier quoted context omitted.

Not if you brought your cellphone on the trip. Or used a car that has a built-in SIM card and cellular modem. Or you bought that laptop from a supplier that registers all MAC addresses of sold devices. Or that laptop had Computrace or some other firmware-based anti-theft mechanism.

Even if you had a car without a cell connection, license plate readers and cameras make it easy for anyone with access to replay and reverse any traveling you do with any car.

not to mention the Bluetooth in your car that gets logged on some highways as you drive to help detect and improve traffic patterns.

https://www.wired.com/2012/12/calgary-travel-time-informatio...

Re: The FBI Identified a Tor User

#323

Post by noodleman »

zxcvbn4038 wrote: post #209

I think a lot of this has been covered elsewhere before: - when using tor you should disable javascript because a malicious or compromised site can use javascript to do non-tor stuff that potentially compromises your location. (can be a big pill to swallow, web without javacript is very 90s) - Run torbrowser within a secure VM or separate device using Tails to minimize your activity footprint - Use a VPN when connect…

Why would you put TOR behind a VPN? That just increases the surface area for attack.

Re: The FBI Identified a Tor User

#324

Post by mr_woozy »

geepound wrote: post #197
advisedwang wrote: post #168

Earlier quoted context omitted.

If becomes widely known that the government can de-cloak Tor users, that will change the behaviour of their targets and so hurt their surveillance, so it's fairly common that the government wants to hide this fact. (same with stingrays, for example). But just wanting to keep it secret is not enough. So they will claim that this has national security implications, saying some targets are terrorists. And courts defer v…

>If becomes widely known that the government can de-cloak Tor users, that will change the behaviour of their targets and so hurt their surveillance, so it's fairly common that the government wants to hide this fact. (same with stingrays, for example). As was discussed verbally at Defcon, a huge chunk of the exit nodes are either in the US or EU. Same for guards. (The whole GCHQ vs several EU countries trying to do in…

[dead]

Re: The FBI Identified a Tor User

#325

Post by emeril »

pfisherman wrote: post #282
troad wrote: post #247

Earlier quoted context omitted.

> I would say that if you are doing something the US government has a significant interest in prosecuting, you might want to reevaluate your life choices and think about whether it is something you ought to be doing in the first place. Sounds like the people who ran the Underground Railroad would have had significant thinking to do, by your logic. They probably should have gone home and abided by the law of the land,…

I am pretty sure the people who ran the Underground Railroad thought very long and hard about what they were doing. I think a much stronger / more contemporary argument for you would be something like facilitating access to abortion for people residing in states where it is now illegal. But a few questions here. Is something like this an exception rather than the rule? Do you think the FBI would burn a zero day to pr…

doubt it because I suspect the FBI is mostly run by science believing democrats rather than cave dwelling science denying republicans

Re: The FBI Identified a Tor User

#326

Post by oldgradstudent »

vkou wrote: post #257
gregshap wrote: post #236

Earlier quoted context omitted.

Why wouldn't parallel construction be perjury, even if the real search was legal?

Why would it be? The purpose of laws like the 4A is to prevent the police from harassing innocent people by going on fishing expeditions. The purpose of the poisoned tree doctrine is to prevent the police from committing crimes as part of their work. But if a plains-clothes police officer sees you load a kilo of cocaine into your car every Tuesday, on the same street corner, there's nothing illegal or immoral about h…

> I see no reason why the uniformed cop should be compelled to reveal his source.

If the defense asks at trial, what legitimate reason is there not to answer?

Re: The FBI Identified a Tor User

#327

Post by TechBro8615 »

PartiallyTyped wrote: post #191
kerpotgh wrote: post #170

Earlier quoted context omitted.

Probably. If you use a laptop once, on a public Wi-Fi hundreds of miles from where you live, while not being caught on surveillance, while using a stripped down privacy based OS, and then route yourself through Tor, you might be okay.

The most paranoid plan i have come up with: - tor + cubesOS set up by somebody you deeply trust (person A) - on a USB bought by a different person (person B) - with a network card bought by a different person (person C) - many miles away, wearing generic clothes in a cafe where people go to work - different hairstyle and facial hair - mask - without having a phone (obv) - navigating there by changing multiple cars wi…

Walking and driving without a mobile device on your person is sufficiently unusual that it's a form of metadata in itself. Look at the Kohberger case - they're using the fact he turned his phone off as evidence. In fact, this kind of pattern was even used by the Obama administration while targeting humans in the Middle East for extrajudicial killings. It's even more precise when coupled with traffic analysis: if every Tuesday, an IMEI disappears from the network shortly before another IMEI comes online, then those two devices are likely related. In your scenario, the phone disappearing from the network could be coupled with your car showing up on a traffic camera leaving your house. Ironically, you draw attention to yourself by _not_ advertising your metadata.

At a certain point, the world is full of so much metadata that you really can't control your own. Want to turn off location services? Make sure you turn off WiFi too, because a list of nearby access points and SSIDs is enough to pinpoint you down to a few meters. Want to spoof your location when using an app with network services permission? You'll need to spoof nearby access points and their transmission power to match them to somewhere in the real world. And you better make sure to do it inside a Faraday cage. Because no matter how careful you are, if someone else is walking by your clever hacking nest, and they do have location services enabled, then their phone will be able to pair their geolocation with your unique access point topology. Oh, and even with the Faraday cage, the fact your phone is seeing access points that no other phone has seen is a unique data point in itself.

Point is, you can be compromised without any action on your own part. Traffic analysis is hard to defeat, but you can mitigate against it by not committing crimes that motivate the government to spend resources on tracking you across disparate systems like mobile networks and traffic cameras. Or if you must commit those crimes, then you'll need to make sure everything you do is in the fattest part of the bell curve for every possible statistical test the government can use to analyze common behaviors.

Re: The FBI Identified a Tor User

#328

Post by TechBro8615 »

noodleman wrote: post #323
zxcvbn4038 wrote: post #209

I think a lot of this has been covered elsewhere before: - when using tor you should disable javascript because a malicious or compromised site can use javascript to do non-tor stuff that potentially compromises your location. (can be a big pill to swallow, web without javacript is very 90s) - Run torbrowser within a secure VM or separate device using Tails to minimize your activity footprint - Use a VPN when connect…

Why would you put TOR behind a VPN? That just increases the surface area for attack.

It does add another entity who can identify you (your VPN provider), but it doesn't strictly increase the surface area, since it avoids passive surveillance tripwires at your ISP looking for "interesting" traffic like active connections to Tor nodes. Now, if your ISP is monitoring Tor connections, they're probably monitoring VPN connections too. But at this point VPN services like Apple Private Relay are so commonplace that it's not too unusual to route all your traffic through a WireGuard endpoint. So the burden of surveillance shifts to your VPN provider, who may be worse or better than your ISP in terms of keeping logs, respecting privacy and responding to subpoenas.

Note that "VPN provider" could refer to any entity who is next in the connection chain after your ISP. That could be some public VPN providers like Cloudflare or Apple Private Relay (which is run by Cloudflare and Akamai). Or, if you host your own VPN, it could be your VPS provider. If your goal is to blend in, you probably want to use the public VPN provider where exit IP addresses are (theoretically) shared between a (limited) number of users at any given time. Whereas a VPN on your own box will have an exit IP that is uniquely attributable to you, making you not only easier to trace, but also easier to hack, through any vulnerabilities you might have introduced when setting up the server.

Re: The FBI Identified a Tor User

#329

Post by TechBro8615 »

meep0l wrote: post #196
lysergia wrote: post #144

I have a Glinet[0] router that has Tor functionality and 'torifies' your connection, so even if there's some JS 0day that executes trying to decloak me, the adversary just gets a Tor IP instead of my home connection IP. Note: I connect to Tor from my torified Glinet router which is doing Tor-over-Tor which is considered 'dangerous'[1] but I do it anyway. This might be overkill for most, and I'm not doing anything ill…

Out of curiosity, what is the benefit of using Tor just to browse legal clearnet sites?

I'm using Tor right now, because it's the only way I can access HN while my SelfControl.app is blocking it for the next 24 hours :)

Re: The FBI Identified a Tor User

#330

Post by TechBro8615 »

causi wrote: post #26

I will never understand people who do illegal things over their own IP. Is it really that hard to find an open access point? Way back in the day when I torrented all my content I used a long-range wifi antenna connected to a public AP and a dedicated PC with a scrubbed drive that never connected to my home network.

The long-range wifi antenna has always sounded like an opsec urban legend to me. You'll be able to transmit signals to the router, but can you really receive them with any sufficient fidelity if the router itself does not also have a long range antenna or unusually high transmission power?
Post reply on HN