Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

antilop.cc

Post reply on HN
Print view View original

21–30 of 73 posts

Re: U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

#21

Post by chatmasta »

sarciszewski wrote: post #6
chatmasta wrote: post #2

Some researchers at Yale have been working on a project [1], due to be presented this weekend, that disables the FBI from gaining any meaningful information via Javascript exploits. The idea is to contain each "pseudonym" in its own virtual "nymbox", and only that one box. Read the paper for more, it's interesting. [1] http://arxiv.org/pdf/1312.3665.pdf

I also have an idea to stop the FBI from gaining any meaningful information via Javascript exploits: PGP or Ed25519 sign all .js files and have a browser that only executes signed code. Not only do you need to obtain access to the server, you also need the private key of its operator. (Which should be kept offline for signing.) If they don't surrender the key, then you cannot compromise their visitors. This can also…

That's a cool idea, but it comes with a lot of overhead. Javascript files are one of the most heavily-cached on the web, and by signing them with PGP, you cripple your caching ability.

Or am I missing something?

Re: U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

#22

Post by mabbo »

deskamess wrote: post #13

From a legal perspective, why does it matter how the FBI got access to the server or determined it was a Silk Road server? I assume they got a warrant for the server itself, and therefore the evidence found on the server is a candidate for inclusion in the trial.

Because you can't get a warrant without probable cause. That's why it's illegal for the police to just arbitrarily decide to get a warrant and search your house for drugs because you look like the kind of guy who might have drugs.

And the police can't say "Well, we didn't have a warrant, but we were right so who cares" either.

If they never had probable cause to get images of this server, what gave them the right to a warrant for it?

More importantly, the world needs to know how the heck they did know, so that we all know what the government is capable of.

Ulbricht is still an idiot, and it's not surprise he got caught eventually- but we can't let the police bullshit their way into convicting anyone, even idiots.

Re: U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

#23

Post by sarciszewski »

icebraining wrote: post #18
teraflop wrote: post #12

Earlier quoted context omitted.

How does the browser get the public key in order to verify the signature? And how is this any different from just serving scripts over HTTPS?

Not OP, but I think there's a big difference. HTTPS protects code in transit, but if you can hack the server, you can change the JS code. This proposal would cover that gap.

That's exactly the issue. This is designed to work in conjunction with HTTPS/Tor such that if the server is compromised, unsigned JS payloads cannot compromise the user.

Re: U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

#24

Post by sarciszewski »

eli wrote: post #11
sarciszewski wrote: post #6

Earlier quoted context omitted.

I also have an idea to stop the FBI from gaining any meaningful information via Javascript exploits: PGP or Ed25519 sign all .js files and have a browser that only executes signed code. Not only do you need to obtain access to the server, you also need the private key of its operator. (Which should be kept offline for signing.) If they don't surrender the key, then you cannot compromise their visitors. This can also…

So you're going to fork the web?

No more than NoScript forks the web.

Re: U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

#25

Post by sp332 »

tomp wrote: post #19
btouellette wrote: post #14

It was pretty obvious that the FBI was lying (or misrepresenting or whatever weasel word you want to use) in their original claims. The real question in my mind, which still remains unanswered, is why? The most optimistic explanation is that they just botched the investigation and then spectacularly confused the prosecution as they were preparing their claims. I'd rather not think too hard about the most pessimistic…

Isn't it obvious? They wanted him gone. This is just like what happened to Kim Dotcom - the US government/elite wanted him gone, so they used whatever methods they wanted, executed by the Law Enforcement, to try and remove him. Sure, they might lose in court now, but most of the damage is done - Megavideo is gone, Silk Road is gone - just what they wanted. EDIT: I guess the biggest problem here is that the people res…

https://en.wikipedia.org/wiki/DeLorean_Motor_Company#Downtur...

Also, isn't there a new Silk Road already?

Re: U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

#26

Post by btouellette »

cryoshon wrote: post #16
opendais wrote: post #5

Well, fuck. Regardless of the rest, if the government's story changed in a factual way before vs. after the government acquired the Silk Road server ... well, further confirmation that parallel construction is in use and the "foreign tools" are being used in domestic cases. "the account by former Special Agent Tarbell in his Declaration differs in important respects from the government’s June 12, 2013, letter to Icel…

Agreed regarding the usage of parallel construction-- I am sure that somewhere in the government's internal guidelines on when to use parallel construction there is a catchall clause providing exemption for "exigent circumstances" which allows it to be abused domestically for any purpose. This case now reeks of heavy NSA involvement merely passed to the FBI for the actual enforcement side of things. I'm not sure if t…

They'd drop the case before they admitted parallel construction. The old Silk Road is gone and if Ross Ulbricht isn't innocent he won't ever be trying anything like this again knowing that the NSA and the FBI are going to be surveilling him to the best of their ability so they only thing they lose is locking him up in prison.

Re: U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

#28

Post by sarciszewski »

chatmasta wrote: post #21
sarciszewski wrote: post #6

Earlier quoted context omitted.

I also have an idea to stop the FBI from gaining any meaningful information via Javascript exploits: PGP or Ed25519 sign all .js files and have a browser that only executes signed code. Not only do you need to obtain access to the server, you also need the private key of its operator. (Which should be kept offline for signing.) If they don't surrender the key, then you cannot compromise their visitors. This can also…

That's a cool idea, but it comes with a lot of overhead. Javascript files are one of the most heavily-cached on the web, and by signing them with PGP, you cripple your caching ability. Or am I missing something?

The original idea I had was to have an index (think hybrid cache.manifest and Content-Security-Policy header) of relative URLs and their SHA3 hashes, then that file was signed. If anything fails to validate, it doesn't run.

Re: U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

#29

Post by chatmasta »

btouellette wrote: post #14

It was pretty obvious that the FBI was lying (or misrepresenting or whatever weasel word you want to use) in their original claims. The real question in my mind, which still remains unanswered, is why? The most optimistic explanation is that they just botched the investigation and then spectacularly confused the prosecution as they were preparing their claims. I'd rather not think too hard about the most pessimistic…

They changed their story because the truth is that they violated the 4th amendement rights of anyone who browsed Silk Road for a period of time. They executed drive-by Javascript code on the computers of hundreds of unknowing silk road users, without a warrant. At worst, that's extremely illegal, and at best, it's in a definite gray area. I don't blame the FBI for trying to cover it up.

(Citation -- wired article I read at some point; maybe someone else can find it.)

Re: U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

#30

Post by btouellette »

sp332 wrote: post #25
tomp wrote: post #19

Earlier quoted context omitted.

Isn't it obvious? They wanted him gone. This is just like what happened to Kim Dotcom - the US government/elite wanted him gone, so they used whatever methods they wanted, executed by the Law Enforcement, to try and remove him. Sure, they might lose in court now, but most of the damage is done - Megavideo is gone, Silk Road is gone - just what they wanted. EDIT: I guess the biggest problem here is that the people res…

https://en.wikipedia.org/wiki/DeLorean_Motor_Company#Downtur... Also, isn't there a new Silk Road already?

And a new DPR to go along with it
Post reply on HN