Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The FBI Identified a Tor User

vice.com

Post reply on HN
Print view View original

121–130 of 367 posts

Re: The FBI Identified a Tor User

#121

Post by dvngnt_ »

Scoundreller wrote: post #102
johnisgood wrote: post #77

Earlier quoted context omitted.

That said, popular websites on/for Tor are free of JavaScript and they have implemented everything (such as captchas, or the "JavaScript is enabled" warning, and so forth) using pure HTML and CSS. They do use OpenResty[1], too, which is NGINX + Lua. Good stuff. [1] https://openresty.org/ , https://github.com/openresty/lua-nginx-module

What I despise is clearnet sites that refuse to open if you don’t execute JavaScript even when I perfectly well known the page doesn’t depend on it. (Fuck you imgur)

if I build a site using react, is there a way to fallback to plain HTML?

Re: The FBI Identified a Tor User

#122

Post by vorpalhex »

PartiallyTyped wrote: post #99
r3trohack3r wrote: post #95

I have second hand knowledge of lawsuits that have been dropped by the FBI during discovery because it would require them revealing zero days they have on Tor. Recently this has started getting increasing levels of press exposure[1] including in CSAM cases. The FBI has also continued to run CSAM websites after takeover to collect intel, and likely run honeypots for other content. If your adversary is a state actor, p…

Is there really any way to hide from a motivated state actor? Asking about it on HN is definitely not one. Relevant xkcd: 538 [1] [1] https://xkcd.com/538/

Just as there is no perfect boat or perfect date, there is no perfect security or privacy.

You can make things more and more difficult for your adversary (and usually for yourself too) but if they are dedicated enough they can basically outspend you.

Therefore you need to minimize the apparent cost of your actions and their duration. You can afford to be a passing pain in their butt but you can't afford to be the focus of their eye.

Re: The FBI Identified a Tor User

#123

Post by Run_DOS_Run »

michaelt wrote: post #34
Scoundreller wrote: post #5

Earlier quoted context omitted.

> The FBI also found what specific pages Al-Azhari visited, including a section on donating Bitcoin; another focused on military operations conducted by ISIS fighters in Iraq, Syria, and Nigeria; and another page that provided links to material from ISIS’s media arm Based on what little I know of SSL, this suggests the server was compromised too? Or does tor do a bad job of certificate pinning? Edit: Or the clients a…

> Based on what little I know of SSL, this suggests the server was compromised too? Not necessarily. If a passive snooper knows I used Tor Browser to make an SSL request to en.wikipedia.org and received 987,654 bytes then immediately made a SSL request to upload.wikimedia.org and received 1,234,567 bytes that might be enough information to work out I visited https://en.wikipedia.org/wiki/National_Security_Agency .

That's why Tor is communicating mostly over fixed-size cells with a fixed size of 514 bytes (or 512 if tor version There is also random padding added to cells, so that the cell content is unpredictable.

Re: The FBI Identified a Tor User

#125

Post by Buffout »

electroly wrote: post #19
Buffout wrote: post #13

Earlier quoted context omitted.

I don't think that is how timing analisis works. User can say to "entrance node" that it is also a node and that is how it can deny that it is originator. "Entrance node" doesn't know its position in a chain. Only Exit node knows its position.

I don't think that's totally true. At least, it's maybe superficially true but not in a real world sense. The entry node can see your IP by virtue of the incoming TCP connection and it's not hard to figure out if an IP is a Tor relay or not. The list of known relays is a list that you can just go and get. If it's not a relay, then it's a client, and you're the entry node.

No, this is not the timing attack I was thinking of. Your version of timing attack comes from inside tor network and that is solved by Entry Guards. And besides you can also be Tor relay and a client. This attacks are just bugs that are fixed.

The real timing attack that is not fixed and will not be (it is not in threat model), is when your ISP works with police (that has warrant) and gives them data. And police also controls server or exit node.

Re: The FBI Identified a Tor User

#126

Post by r3trohack3r »

Fnoord wrote: post #110
r3trohack3r wrote: post #95

I have second hand knowledge of lawsuits that have been dropped by the FBI during discovery because it would require them revealing zero days they have on Tor. Recently this has started getting increasing levels of press exposure[1] including in CSAM cases. The FBI has also continued to run CSAM websites after takeover to collect intel, and likely run honeypots for other content. If your adversary is a state actor, p…

> If you're sitting in front of a computer that you're using for something the U.S. government has significant interest in prosecuting, that device should be considered compromised and adversarial - you should act accordingly. Yep: stop breaking the law. The vast majority the US government has significant interest in prosecuting, the general public is OK with.

> Yep: stop breaking the law

That's certainly one takeaway. I wouldn't say that's "the" takeaway.

Re: The FBI Identified a Tor User

#127

Post by electroly »

Buffout wrote: post #125
electroly wrote: post #19

Earlier quoted context omitted.

I don't think that's totally true. At least, it's maybe superficially true but not in a real world sense. The entry node can see your IP by virtue of the incoming TCP connection and it's not hard to figure out if an IP is a Tor relay or not. The list of known relays is a list that you can just go and get. If it's not a relay, then it's a client, and you're the entry node.

No, this is not the timing attack I was thinking of. Your version of timing attack comes from inside tor network and that is solved by Entry Guards. And besides you can also be Tor relay and a client. This attacks are just bugs that are fixed. The real timing attack that is not fixed and will not be (it is not in threat model), is when your ISP works with police (that has warrant) and gives them data. And police also…

Possibly you replied to the wrong post; I don't know anything about timing attacks. My post was about whether the entry node knows that it's the entry node.

Re: The FBI Identified a Tor User

#128

Post by kevin_thibedeau »

cheese_van wrote: post #111
kibwen wrote: post #78

Earlier quoted context omitted.

Tor was developed by the US Navy. The military understands how crucial encrypted messaging is, and doesn't particularly care whether or not it's a dagger through the heart of other TLAs. In a bureaucratic battle between the military and domestic intelligence agencies, the military wins.

And additionally funded by the US State Department to provide anonymity for users seeking political expression in countries where that expression may be dangerous.

The State dept happily encouraged the use of broken cryptography machines in the past. They don't have a clean record on transparency.

Re: The FBI Identified a Tor User

#129

Post by actualwitch »

dvngnt_ wrote: post #121
Scoundreller wrote: post #102

Earlier quoted context omitted.

What I despise is clearnet sites that refuse to open if you don’t execute JavaScript even when I perfectly well known the page doesn’t depend on it. (Fuck you imgur)

if I build a site using react, is there a way to fallback to plain HTML?

It's called SSR, but unless you invest a ton of effort into architecture, it won't fallback to the point where buttons and links still work without js, it will just render.

Re: The FBI Identified a Tor User

#130

Post by soiler »

dvngnt_ wrote: post #121
Scoundreller wrote: post #102

Earlier quoted context omitted.

What I despise is clearnet sites that refuse to open if you don’t execute JavaScript even when I perfectly well known the page doesn’t depend on it. (Fuck you imgur)

if I build a site using react, is there a way to fallback to plain HTML?

if it's statically generated, yes. you can write an entire site in React using eg GatsbyJS, and it will be built ahead of time, and pages will be available as static HTML.
Post reply on HN