Freedom Hosting sites compromised, founder arrested • Hacker News Board

Re: Freedom Hosting sites compromised, founder arrested

#101

Post by makomk » Sun, Aug 04, 2013, 10:59 PM UTC

cookiecaper wrote: post #27

This whole post is a mess. Someone distributes an exploit via a popular hosting provider for onion sites (and it's curious why anyone with a serious interest in privacy would outsource onion site hosting anyway) and suddenly Tor is damaged? There's a link to a paper that claims people can do things you're not supposed to be able to do with onion sites, but I don't see how that's relevant -- this post is conflating at…

The exploit is targeted at the version of Firefox in the Tor Browser Bundle on Windows, which means most Tor users are vulnerable. While you can use a different browser the Tor developers have generally recommended that people don't; it's hard to lock down browsers against information leaks, and the fact that someone's using an unusual browser helps an attacker track them.

Re: Freedom Hosting sites compromised, founder arrested

#102

Post by pygy_ » Sun, Aug 04, 2013, 11:06 PM UTC

redblacktree wrote: post #66

pygy_ wrote: post #29

Earlier quoted context omitted.

I didn't know that. It plugs a hole in the targeted surveillance programs, at the expense of all prepaid users. The target demographics for prepaid is mostly kids and teens, poor people, and people concerned about their privacy, split between sensitized geeks, unfaithful lovers and criminals. For the first two demographics cheap monthly plans are now emerging (in France, Free offers two hours of talk and infinite SMS…

> On a slightly related topic, in demonstrations, people caught without a cell phone during an ID check often end up arrested for "administrative reasons". So the likely reason for this is so that they can get an accounting of who was there, right? Where are you referring to?

I guess it's because no cell phone means no mean to track you remotely, which can otherwise be done, even if your phone is turned off.

It is definitely taken as suspicious.

Source: an alter-globalist activist acquaintance who demonstrates (peacefully) every other day.

Re: Freedom Hosting sites compromised, founder arrested

#103

Post by Cthulhu_ » Sun, Aug 04, 2013, 11:12 PM UTC

return0 wrote: post #37

duaneb wrote: post #20

Earlier quoted context omitted.

> America The American government, you mean.

For us foreigners, knowing that America has strong democratic roots, it is obvious (and worrying) that the majority of american citizens actually agree with that.

And yet, the vast majority of US citizens still agrees. I mean, they have the right to bear arms so that when they strongly disagree with their government, they can form an army and overthrow it (or something, whatever that amendment is for). If not that, at the very least they can strongly protest against the decisions and policy made, vote for a third party and break the two-party system, or vote / demand the voting and government system to be upturned to stop having to choose for the lesser or two evils in the form of a single man who will get most of the blame and responsibility for poor governmental decisions.

Re: Freedom Hosting sites compromised, founder arrested

#104

Post by andrewcooke » Sun, Aug 04, 2013, 11:15 PM UTC

popee wrote: post #17

Here is real reason why little sisters force everything into browser. Because they care about security >:-) People should stop using web/browsers for everything.

little sisters?

Re: Freedom Hosting sites compromised, founder arrested

#105

Post by cookiecaper » Sun, Aug 04, 2013, 11:16 PM UTC

hnnnnng wrote: post #97

cookiecaper wrote: post #86

Earlier quoted context omitted.

The headline implies that the "compromise" is an inherent failure in the protocol (or else how could "half" of all sites be infected?) instead of the reality that the hosting provider intentionally placed an exploit in all of their pages. A better title may be like: "major .onion hosting service infiltrated by feds, all sites converted to honeypots; founder arrested". This does not imply any fundamental flaws in Tor…

'infiltrated by feds' is a presumption based on speculation at this point. Assumptions dont 'correctly reflect events'. If you want to fix something, fix it entirely.

It correctly reflects events as detailed by the post. The post clearly assumes that "the FBI" originated the exploit code and has been using it to harvest visitor IP addresses. I believe "infiltrated" is a fine summarization for that.

I suppose it's possible that the founder had a change of heart two days prior to his arrest and started collecting everyone's IP and sending it to the FBI based on nothing but a sense of personal moral obligation, but it doesn't seem too likely, and it's irrelevant either way because again, the proposed title is an accurate description of the posted article, even if the posted article is an inaccurate depiction of Real Life(tm).

Re: Freedom Hosting sites compromised, founder arrested

#106

Post by andrewcooke » Sun, Aug 04, 2013, 11:17 PM UTC

iM8t wrote: post #3

Europeans point of view: Am I the only one who feels that the US is taking over the Internet and all of our privacy with it?

you're from latvia? i suspect it seems worse to you at the moment because of the extradition case. and in many ways the uk is as bad (or worse, at least the americans are in trouble for spying on americans) (and they're vaguely european).

but yes.

Re: Freedom Hosting sites compromised, founder arrested

#107

Post by pyre » Sun, Aug 04, 2013, 11:35 PM UTC

cookiecaper wrote: post #86

aqme28 wrote: post #83

Earlier quoted context omitted.

How is it sensationalist? The headline was not that there is a vulnerability in TOR, but a vulnerability in "half of all TOR sites."

The headline implies that the "compromise" is an inherent failure in the protocol (or else how could "half" of all sites be infected?) instead of the reality that the hosting provider intentionally placed an exploit in all of their pages. A better title may be like: "major .onion hosting service infiltrated by feds, all sites converted to honeypots; founder arrested". This does not imply any fundamental flaws in Tor…

> The headline implies that the "compromise" is an inherent failure in the protocol

Personally, I didn't read it that way at all. My first assumption was a hack, because it's more likely that a website was hacked than that the Tor protocol was so severely compromised.

> or else how could "half" of all sites be infected?

To me it sounded like a possible major law enforcement operation against 'rogue' sites. If someone was able to compromise Tor so completely, the idea that they would turn around and just hack half of the hidden sites doesn't make sense. Such an exploit would be worth major cash on the exploit market (mostly due to governments bidding against each other to get it).

Re: Freedom Hosting sites compromised, founder arrested

#108

Post by vacri » Sun, Aug 04, 2013, 11:36 PM UTC

smsm42 wrote: post #95

vacri wrote: post #78

Earlier quoted context omitted.

You make it sound like there was a viable alternative, like the other party in the two-party system wasn't being held to ransom by ultra-nationalists.

That's because it is exactly the situation. Nobody is "held ransom" by anybody. But voters that think like you - low-information voters that can vote for anybody provided that he is "our guy" because "their guy" is The Devil himself - are exactly the reason why it happens again and again. And will happen until the majority abandons such mentality - which I personally wouldn't expect happening any time soon.

Voters that think like me live in a multipolar democracy that currently has a minority government in power. It's a tacit weakness of the US system that there can only be two viable parties. "If everyone changed and voted for a third person" is not a retort, because it still requires everyone jumping on the same bandwagon to effect a win; it'll just be a different brand of wagon.

Re: Freedom Hosting sites compromised, founder arrested

#109

Post by belorn » Mon, Aug 05, 2013, 12:10 AM UTC

I think there is a large insight to be had by all this.

State can and will use computer exploits in military and law enforcement. Like with PRISM, its no longer just the tinfoil - Its confirmed. The businesses model for a few companies are to hoard zero-day exploits, and sell it on the market. The military, police, "business intelligence" a.k.a industry spying, and criminals are their customers. In contrast to disease research, software virus research are not regulated or illegal, so both good and bad is the result. It is good when independent research find vulnerabilities in software we use, and less so when its hoarded and sold to be used against us.

Re: Freedom Hosting sites compromised, founder arrested

#110

Post by Volpe » Mon, Aug 05, 2013, 12:15 AM UTC

vacri wrote: post #108

smsm42 wrote: post #95

Earlier quoted context omitted.

That's because it is exactly the situation. Nobody is "held ransom" by anybody. But voters that think like you - low-information voters that can vote for anybody provided that he is "our guy" because "their guy" is The Devil himself - are exactly the reason why it happens again and again. And will happen until the majority abandons such mentality - which I personally wouldn't expect happening any time soon.

Voters that think like me live in a multipolar democracy that currently has a minority government in power. It's a tacit weakness of the US system that there can only be two viable parties. "If everyone changed and voted for a third person" is not a retort, because it still requires everyone jumping on the same bandwagon to effect a win; it'll just be a different brand of wagon.

It's a two party system, but the two parties don't have to be the same ones that are their now.

I don't understand the "viable alternative" arguement. You are saying "I won't vote for who I really want to vote, because they'll never win, because everyone else won't vote for them" ...