Earlier quoted context omitted.
Europeans point of view: European bureaucrats are not any better, think about David Cameron idea of Porngate
AFAIK, the European parliament is so far reasonable regarding the Internet and privacy. However, the Commission (the executive branch, and especially the Trade Commisioner, Karel De Gucht) has been pushing hard for ACTA, going as far as lying, several times, to the Parliament. When the Parliament rejected ACTA, De Gucht said he would look for other means to bypass the decision.
Freedom Hosting sites compromised, founder arrested
51–60 of 140 posts
Re: Freedom Hosting sites compromised, founder arrested
#52I must yet again point to a company like Endgame Systems[1] as being a likely contractor for this service rendered for the FBI. Some of Endgame's products used by the likes of the NSA: "There are even target packs for democratic countries in Europe and other U.S. allies. Maui (product names tend toward alluring warm-weather locales) is a package of 25 zero-day exploits that runs clients $2.5 million a year. The Cayma…
Re: Freedom Hosting sites compromised, founder arrested
#53This whole post is a mess. Someone distributes an exploit via a popular hosting provider for onion sites (and it's curious why anyone with a serious interest in privacy would outsource onion site hosting anyway) and suddenly Tor is damaged? There's a link to a paper that claims people can do things you're not supposed to be able to do with onion sites, but I don't see how that's relevant -- this post is conflating at…
I'm pretty sure that most of the upvoters did just read the title, not the article.
Re: Freedom Hosting sites compromised, founder arrested
#54Earlier quoted context omitted.
TBB does not disallow javascript by default. In fact they recommend you do not disable javascript because it makes your browser fingerprint more traceable.
Checking on this now. I find it dubious, but possible. I haven't used the Tor Browser Bundle for quite a while, but last I recall they definitely had a mechanism to keep JavaScript from executing. It seems ridiculous that they wouldn't, given their long history of advocacy for NoScript et al. Will edit when done installing/checking. EDIT: So it seems that NoScript is installed as part of the package, but that scripts…
[EDIT: edited typo, clarified what TAILS was] I had mentioned (split between a couple other posts) that even with JS enabled, Noscript will prevent many XSS/CSRF and clickjacking attempts, which has been explained to me as the reason for its inclusion. And That disabling Javascript actually makes you more fingerprintable because it's rare for browsers to do this.
I am guessing that the payload that article mentions s/he does not have included a Windows (or Windows Firefox)-specific exploit which bypassed the tor tunnel so that they could then match the cookie in and out of Tor to identify the traffic origin. Otherwise, just having the cookie through Tor would be pretty worthless.
Other people that could be dinged by this would be anybody usuing that specific version of Firefox, without Torbutton. Torbutton wipes cookies when you switch between Tor and not-Tor, but Torbutton as a separate tool has been discontinued and TBB promoted, because to be safe you really need to have a separate browser profile.
On Linux (not targeted by this exploit, but maybe someday) you could avoid this using an Apparmor/SeLinux profile that prevented TBB Firefox from even making a network connection that's not to the Tor tunnel, or possibly even prevent Firefox from knowing it's own IP. Dunno if something like this is even possible on Windows. For traveling, I currently have been experimenting with a VM with TBB and an apparmor profile, and an iptables rule to prevent ANY outside traffic, except Tor. It works but it's a pain in the ass and nobody could be expected to install all that shit. That's what they made TAILS (A bootable disc image with only Tor, saves nothing to your machine, contains no known exploitable extraneous apps) for, people could check that out. Even running TAILS in a VM would have prevented this, though they recommend for maximum security you burn it and boot it.
No sympathy for child pornographers, but obv. this could be used against anybody seeking anonymity.
Re: Freedom Hosting sites compromised, founder arrested
#55I must yet again point to a company like Endgame Systems[1] as being a likely contractor for this service rendered for the FBI. Some of Endgame's products used by the likes of the NSA: "There are even target packs for democratic countries in Europe and other U.S. allies. Maui (product names tend toward alluring warm-weather locales) is a package of 25 zero-day exploits that runs clients $2.5 million a year. The Cayma…
"Exploiting an unknowable amount of users of a service as to hunt them. Using illegally harvested data from botnets, while others get hunted and prosecuted for coding them. This tiered society where the legally immune can profit off acts that get others jailed." Not that I disagree with this sentiment, but how is this different from the fact the government is "legally immune" from using/possessing weapons and firearm…
It's more like the government hiring non-government forces that can then legally possess arms that other "non-affiliated" people (i.e. civilians) can't, and being given legal immunity for killing random people, some of which might turn out to be criminals. I.e. Batman, with a bit less moral compass.
Re: Freedom Hosting sites compromised, founder arrested
#56They make note that the vulnerability used is only in Firefox 17--the current ESR (extended support release). What they do not mention is that the Tor Browser Bundle[1]--created so users can simply download one executable and feel protected by Tor--is based on this very release. Among all internet users, Firefox 17 is probably rare, but among Tor users? My bet is that it owns a significantly higher chunk of the marke…
The quote in the article claims that the exploit affects 17 and higher , only on NT-based platforms. Furthermore, Tor Browser Bundle disallows JavaScript by default, and one should be cautious while allowing execution of arbitrary client-side code whilst intent on keeping their direct IP address secret. You have to take at least a couple of steps to be affected by this bug. EDIT: The author has updated the OP and now…
> The quote in the article claims that the exploit affects 17 and higher, only on NT-based platforms.
It does a check for NT-based platforms, the TBB will always identify itself as Windows/NT, even on Linux.
>Tor Browser Bundle disallows JavaScript by default
It has JS globally enabled by default.
Re: Freedom Hosting sites compromised, founder arrested
#57This whole post is a mess. Someone distributes an exploit via a popular hosting provider for onion sites (and it's curious why anyone with a serious interest in privacy would outsource onion site hosting anyway) and suddenly Tor is damaged? There's a link to a paper that claims people can do things you're not supposed to be able to do with onion sites, but I don't see how that's relevant -- this post is conflating at…
Here is a statement by the tor project about it:
https://blog.torproject.org/blog/hidden-services-current-eve...
Re: Freedom Hosting sites compromised, founder arrested
#58Earlier quoted context omitted.
> America The American government, you mean.
For us foreigners, knowing that America has strong democratic roots, it is obvious (and worrying) that the majority of american citizens actually agree with that.
Well, as a republic, the government is usually about 2 years out of sync with the public: we won't actually get a chance to yell at them until next election.
Re: Freedom Hosting sites compromised, founder arrested
#59Re: Freedom Hosting sites compromised, founder arrested
#60Anyone who was using Windows for TOR browsing was already asking for trouble. Anyone browsing outside a "sealed" VM setup such as Whonix was also asking for trouble.
Browsing in a VM doesn't help: the VM still has an IP address.