Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

antilop.cc

Post reply on HN
Print view View original

11–20 of 73 posts

Re: U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

#11

Post by eli »

sarciszewski wrote: post #6
chatmasta wrote: post #2

Some researchers at Yale have been working on a project [1], due to be presented this weekend, that disables the FBI from gaining any meaningful information via Javascript exploits. The idea is to contain each "pseudonym" in its own virtual "nymbox", and only that one box. Read the paper for more, it's interesting. [1] http://arxiv.org/pdf/1312.3665.pdf

I also have an idea to stop the FBI from gaining any meaningful information via Javascript exploits: PGP or Ed25519 sign all .js files and have a browser that only executes signed code. Not only do you need to obtain access to the server, you also need the private key of its operator. (Which should be kept offline for signing.) If they don't surrender the key, then you cannot compromise their visitors. This can also…

So you're going to fork the web?

Re: U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

#12

Post by teraflop »

sarciszewski wrote: post #6
chatmasta wrote: post #2

Some researchers at Yale have been working on a project [1], due to be presented this weekend, that disables the FBI from gaining any meaningful information via Javascript exploits. The idea is to contain each "pseudonym" in its own virtual "nymbox", and only that one box. Read the paper for more, it's interesting. [1] http://arxiv.org/pdf/1312.3665.pdf

I also have an idea to stop the FBI from gaining any meaningful information via Javascript exploits: PGP or Ed25519 sign all .js files and have a browser that only executes signed code. Not only do you need to obtain access to the server, you also need the private key of its operator. (Which should be kept offline for signing.) If they don't surrender the key, then you cannot compromise their visitors. This can also…

How does the browser get the public key in order to verify the signature? And how is this any different from just serving scripts over HTTPS?

Re: U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

#13

Post by deskamess »

From a legal perspective, why does it matter how the FBI got access to the server or determined it was a Silk Road server? I assume they got a warrant for the server itself, and therefore the evidence found on the server is a candidate for inclusion in the trial.

Re: U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

#14

Post by btouellette »

It was pretty obvious that the FBI was lying (or misrepresenting or whatever weasel word you want to use) in their original claims. The real question in my mind, which still remains unanswered, is why? The most optimistic explanation is that they just botched the investigation and then spectacularly confused the prosecution as they were preparing their claims. I'd rather not think too hard about the most pessimistic explanation.

Re: U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

#15

Post by [deleted] »

ultramancool wrote: post #10
sarciszewski wrote: post #6

Earlier quoted context omitted.

I also have an idea to stop the FBI from gaining any meaningful information via Javascript exploits: PGP or Ed25519 sign all .js files and have a browser that only executes signed code. Not only do you need to obtain access to the server, you also need the private key of its operator. (Which should be kept offline for signing.) If they don't surrender the key, then you cannot compromise their visitors. This can also…

It's an interesting idea, but currently quite impractical as there's no infrastructure for it. The most secure way right now is to isloate your Tor browsing activities to a virtual machine which is only able to access the internet via Tor. Create a VM to act as a middle node with 2 NICs, the first of which will connect to the internet and the second of which will connect to the other VM. Disable any unnecessary servi…

[deleted]

Re: U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

#16

Post by cryoshon »

opendais wrote: post #5

Well, fuck. Regardless of the rest, if the government's story changed in a factual way before vs. after the government acquired the Silk Road server ... well, further confirmation that parallel construction is in use and the "foreign tools" are being used in domestic cases. "the account by former Special Agent Tarbell in his Declaration differs in important respects from the government’s June 12, 2013, letter to Icel…

Agreed regarding the usage of parallel construction-- I am sure that somewhere in the government's internal guidelines on when to use parallel construction there is a catchall clause providing exemption for "exigent circumstances" which allows it to be abused domestically for any purpose.

This case now reeks of heavy NSA involvement merely passed to the FBI for the actual enforcement side of things.

I'm not sure if there's actually an angle here, but it would be extremely interesting if the defendants were able to impeach the FBI's evidence to such a degree so as to force an admittance of parallel construction. It's a no brainer that something fishy happened here.

Re: U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

#17

Post by btouellette »

deskamess wrote: post #13

From a legal perspective, why does it matter how the FBI got access to the server or determined it was a Silk Road server? I assume they got a warrant for the server itself, and therefore the evidence found on the server is a candidate for inclusion in the trial.

Since a warrant would otherwise involve violating the rights of the person being investigated you typically need to have some evidence that a crime is being committed. The ends do not justify the means in a court of law.

Re: U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

#18

Post by icebraining »

teraflop wrote: post #12
sarciszewski wrote: post #6

Earlier quoted context omitted.

I also have an idea to stop the FBI from gaining any meaningful information via Javascript exploits: PGP or Ed25519 sign all .js files and have a browser that only executes signed code. Not only do you need to obtain access to the server, you also need the private key of its operator. (Which should be kept offline for signing.) If they don't surrender the key, then you cannot compromise their visitors. This can also…

How does the browser get the public key in order to verify the signature? And how is this any different from just serving scripts over HTTPS?

Not OP, but I think there's a big difference. HTTPS protects code in transit, but if you can hack the server, you can change the JS code. This proposal would cover that gap.

Re: U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

#19

Post by tomp »

btouellette wrote: post #14

It was pretty obvious that the FBI was lying (or misrepresenting or whatever weasel word you want to use) in their original claims. The real question in my mind, which still remains unanswered, is why? The most optimistic explanation is that they just botched the investigation and then spectacularly confused the prosecution as they were preparing their claims. I'd rather not think too hard about the most pessimistic…

Isn't it obvious? They wanted him gone. This is just like what happened to Kim Dotcom - the US government/elite wanted him gone, so they used whatever methods they wanted, executed by the Law Enforcement, to try and remove him. Sure, they might lose in court now, but most of the damage is done - Megavideo is gone, Silk Road is gone - just what they wanted.

EDIT: I guess the biggest problem here is that the people responsible for actually perpetrating the crimes (e.g. the police officers lying in court) will most likely not be held responsible.

Re: U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

#20

Post by freehunter »

deskamess wrote: post #13

From a legal perspective, why does it matter how the FBI got access to the server or determined it was a Silk Road server? I assume they got a warrant for the server itself, and therefore the evidence found on the server is a candidate for inclusion in the trial.

If the investigation is not performed in a forensically valid way, then there will always be a suspicion of evidence tampering. The law is like that for a reason. You have to prove that you captured the evidence exactly as it was, and not only you, but everyone who touched it made sure of that fact too. If you can't prove that, the evidence could be tampered with. Planting evidence, or even changing the circumstances under which existing evidence is seen can have a major impact on a trial.
Post reply on HN