51–60 of 73 posts
the FBI lied? no way.
according to the defendant.
This doesn't even purport to be written by an expert. It's literally by the guys defense attorney. They didn't even bother getting an expert to sign off on it.
It's very common to have two highly qualified expert declarations saying the exact opposite of each other.
Some researchers at Yale have been working on a project [1], due to be presented this weekend, that disables the FBI from gaining any meaningful information via Javascript exploits. The idea is to contain each "pseudonym" in its own virtual "nymbox", and only that one box. Read the paper for more, it's interesting. [1] http://arxiv.org/pdf/1312.3665.pdf
I also have an idea to stop the FBI from gaining any meaningful information via Javascript exploits: PGP or Ed25519 sign all .js files and have a browser that only executes signed code. Not only do you need to obtain access to the server, you also need the private key of its operator. (Which should be kept offline for signing.) If they don't surrender the key, then you cannot compromise their visitors. This can also…
Earlier quoted context omitted.
How does the browser get the public key in order to verify the signature? And how is this any different from just serving scripts over HTTPS?
You could just make it an HTML meta tag which specifies trusted keys. And add an attribute to the script tag which contains the signature. Might need to disable inline JavaScript, though. And double-check that meta tags are only meaningful when located in their proper place in the head tag. I don't like the HTTP header idea, 'cause it precludes static content unless you modify the web server. And I don't like externa…
Earlier quoted context omitted.
I also have an idea to stop the FBI from gaining any meaningful information via Javascript exploits: PGP or Ed25519 sign all .js files and have a browser that only executes signed code. Not only do you need to obtain access to the server, you also need the private key of its operator. (Which should be kept offline for signing.) If they don't surrender the key, then you cannot compromise their visitors. This can also…
It's an interesting idea, but currently quite impractical as there's no infrastructure for it. The most secure way right now is to isloate your Tor browsing activities to a virtual machine which is only able to access the internet via Tor. Create a VM to act as a middle node with 2 NICs, the first of which will connect to the internet and the second of which will connect to the other VM. Disable any unnecessary servi…
If TOR and Namecoin hooked up, Namecoin could provide a list of page hashes for a given onion address. Better still, interrogate Namecoin's DNS system into TOR and then make Hidden Services accessible via human readable domain names.
Earlier quoted context omitted.
I also have an idea to stop the FBI from gaining any meaningful information via Javascript exploits: PGP or Ed25519 sign all .js files and have a browser that only executes signed code. Not only do you need to obtain access to the server, you also need the private key of its operator. (Which should be kept offline for signing.) If they don't surrender the key, then you cannot compromise their visitors. This can also…
None of the vendors have javascript enabled though, how to disable .js was in the vendor guide and all over their forums as a warning.
Well, fuck. Regardless of the rest, if the government's story changed in a factual way before vs. after the government acquired the Silk Road server ... well, further confirmation that parallel construction is in use and the "foreign tools" are being used in domestic cases. "the account by former Special Agent Tarbell in his Declaration differs in important respects from the government’s June 12, 2013, letter to Icel…
> "[...]For instance, former SA Tarbell asserts that, “[w]hen I typed the Subject IP Address into an ordinary (non-Tor) web browser, a part of the Silk Road login screen (the CAPTCHA prompt) appeared.” Tarbell Decl. at ¶ 8. As explained below, based upon the Nginx server configuration files provided in discovery, that was not possible. " I've not been following this closely, so the following question is based just on…
"The mtime for the live-ssl configuration file provided in Item 1 of discovery is June 7, 2013, and the phpmyadmin configuration is July 6, 2013"
Quite an interesting read. Summary? Silk Road used a pair of nginx servers, one as front-end, one as back-end. The server images (captured forensically) show that the then-in-place configuration made it impossible for the FBI agent to do what he claims, that is, connect to the back-end by using the server's IP address (the allow/deny settings forbade this). The log files on the servers lack entries to support FBI cla…
> Without identification by the Government, it was impossible to pinpoint the 19 lines in the access logs showing the date and time of law enforcement access to the .49 server. Unless I missed something, this is the only point in the document where the defense suggests that they couldn't find the log lines provided by the FBI. It seems like a weak claim, since they could have said "could not locate" or "could not fin…
Earlier quoted context omitted.
No more than NoScript forks the web.
So if I hack a website what's stopping me from serving javascript with no signature or my own signature?
From a legal perspective, why does it matter how the FBI got access to the server or determined it was a Silk Road server? I assume they got a warrant for the server itself, and therefore the evidence found on the server is a candidate for inclusion in the trial.
Yes, there was a warrant, but that warrant must be obtained based on legally obtained information, or else the warrant is invalid as is all information gathered through the execution of that warrant. Here's an example: Suppose you have drugs in your house, and no one knows that but you. The police may suspect that that's the case, but they need some kind of information that provides probable cause in order to obtain…
So basically the prosecutors have to explain probable cause to justify the warrant, and that explanation cannot include information that could only be found in the evidence captured as a result of the warrant.
Is there no legal process to ensure that the original warrant request (probable cause justification) is not changed once the warrant is issued? The warrant itself does not have to be public immediately but some aspect of it, like a case# and hash of the document could be preserved as part of the warrant (or embedded in the warrant). I assume these documents form a critical part of the due process.