Global Web Crackdown Arrests 17, Seizes Hundreds Of Dark Net Domains

Don't think that'd add anything. The people investigating you would presumably look at your network traffic and see all of the non-anonymized TLS packets traveling between your VPS and the real server. And they shouldn't need to bring the VPS down to get an image of its disk (or its RAM).

So like the distributed tracker system in bittorrent I guess: http://en.wikipedia.org/wiki/BitTorrent#Distributed_trackers Some background research on a distributed key/value system that this could serve as a basis for a peer-to-peer distributed marketplace: http://www.cs.rice.edu/Conferences/IPTPS02/109.pdf

> Then the authorities trace the server component to the person who sold it on Craigslist. And if your opsec isn't perfect, you're busted right there: Did you forget to set up a new email account for all of your craigslist transactions? Did you forget to set them up and connect to them only through Tor?

If your opsec isn't perfect you are busted anyway. You already said that in the OP. ;)

> Did the person you met with write down your license plate number? Seem unlikely? Think again. Cameras write down your license plate number as you drive. Constantly. So the authorities will simply look up where the person drove to meet you (parking lot, etc) and any cars that drove to the area at the time. You'll probably be on a highway at some point, which is a highway of data collection. There weren't that many people who drove a long distance to go to the meetup area. Now the authorities know which of 1,000 people you are. The more times you do this, the fewer the number of suspects there are, until they're down to a number that they can just investigate one by one. Then you're caught.

We are assuming a criminal here. You use a fake license plate that you change regularly. You also move regularly and pay cash. Once again, your OpSec needs to be perfect but it is the only real obstacle. If they know which cluster of 1,000 people you are, your license plate gets changed, and you leave at the end of the month forever...they'd have to investigate all 1,000 people to maybe-possibly-id-you then try to figure out who and where you changed your license plate. But you are assuming they can trace the hardware of an anonymous cash transaction on craigslist again. I highly doubt that.

> Or did you take your cell phone with you, and did the person who sold you components take their cell phone? Yes, you're caught. The operation in the previous paragraph, which assumes that you're just driving to meet someone and both parties are leaving their cell phones at home, is already busted. So if you've taken your cell phone on top of it, then it's even easier. Anything involving correlating cell phone movements is trivial for authorities. And if you don't take your cell phone, how are you going to let them know you've arrived? What if they're late? Or you're late? Now you have two problems: Set up a burner phone in an anonymous way (hello, in-store security cameras) and then never, ever use this cell phone in the same place as your main cell phone. Not a good position to be in.

The last time I bought one, I met them at their house and rung the door bell. No phone required. You can also pay a bum to go in and buy the burners for you. Admittedly, I was just buying something to experiment with on the cheap so I didn't really care about anonymity.

However, you are making the assumption these components are easily traced in after market cash sales. I doubt strongly that they are that easy. And given you are trying to be anonymous, you don't care if either party is late since you'd wait a reasonable amount of time and if that failed, setup a new transaction elsewhere.

> I've ignored the whole "fake ID" aspect, because if you're in a position where someone is putting their face onto a forged legal document, that person is going to be persuaded by authorities to betray you. And if that person is you, then obviously you're caught at this point. Your face is probably on Facebook, and facial recognition software is getting pretty good nowadays. In general, physical ops are the most dangerous of all ops, and should be avoided until every other avenue has been explored. Better to anonymize your cash (which is also a physical op) and then use that cash to rent a single remote server.

You can't anonymize your cash for digital transactions given sufficient effort being expended to find you. If you don't do physical ops, you aren't paying cash. If you aren't paying cash, they will find you because the banks [which are intentionally letting things slide to increase business] can't hide it from the regulators forever. They've proven that repeatedly with billion+ dollar fines.

Honestly, it doesn't matter tho. I have no real interest in hiding to that degree. Everything I do is legal. :P Its just a fun mental exercise to me.

If you have enough of a view of the network it is running over, TOR has major weaknesses.

TOR has always been traceable to anyone with enough resources as it makes no attempt to guard against timing attacks.

TOR has never been a secure defense against a collaboration between rich states, especially if you are running permanent services with lots of users.

Also, I do not quite see the intelligence benefits of trying to hide something that is mentioned in the TOR faq, this is not a secret weakness, but something that has been a known weakness since the project's inception.

The only secret revealed here is that the security services have been busy tapping lots of stuff, but that cat has been firmly out of the bag for a while and has since had kittens.

It just doesn't seem right for media sites to "partner" with FBI/the government for a story like this, and give them a platform to spread its propaganda.

For the record I'm one of the people who believe what the FBI did here is wrong. I imagine if they had know what it is and what it can do early on, they would've shut down Bittorrent Inc, too, for "facilitating piracy", "conspiracy to create piracy", "money laundering" (by making money as a company that creates torrent technology), and some other CFAA charges, for good measure - all of them bullshit.