The FBI Identified a Tor User • Hacker News Board

Re: The FBI Identified a Tor User

#361

Post by 93po » Thu, Jan 19, 2023, 9:59 PM UTC

rocket_surgeron wrote: post #234

Running a TOR node to fight for "freedom" is like handing out plutonium to laypersons so they can fight nuclear proliferation. Everyone daydreams of activists and journalists but really they're only enabling child pornographers and methamphetamine dealers.

At some point I am confident that the mainstream use of the internet will evolve into something very similar to Tor. It will protect user privacy in ways that can't be defeated without machine access/user idiocy. We will look back on the days of our ISPs logging every single action we take, into perpetuity, to be forever used against you, as the dark ages.

Re: The FBI Identified a Tor User

#362

Post by sweetbitter » Thu, Jan 19, 2023, 10:02 PM UTC

KingLancelot wrote: post #17

The feds run all the entrance and exit nodes. Tor was created by the feds for spies to use, then they made it public yo hide the traffic. This is the official story that everyone has evidently forgotten.

Not quite. The guy who wrote Tor can be clearly seen to have been studying a lot of these things in the later 90s, and it was pretty much always public, but only developed after he got the Navy to get him an NSF grant. Hell, in one slide he had made back then, he was even well-aware of some of the fundamental vulnerabilities in the protocol, and the (still too expensive) mitigations for those flaws, so it can't even be said that anything was concealed.

If we go back further to the original concept of chained anonymous remailers as envisioned by Chaum 40 years ago, it gets even harder to claim something like this.

Re: The FBI Identified a Tor User

#363

Post by archduck » Fri, Jan 20, 2023, 3:16 AM UTC

Semaphor wrote: post #106

2OEH8eoCRo0 wrote: post #65

Earlier quoted context omitted.

Your strategy might be safer but it also shows criminal intent. Also- the secret about torrents is that nobody really gives a shit. They're more worried about pedos and terrorists.

> Also- the secret about torrents is that nobody really gives a shit. That’s not true in some places like Germany. Just a few seconds of uploading a somewhat popular movie or porn without a VPN will get you a C&D + fees letter.

Can confirm. I slipped up for a few seconds once while torrenting. My cease-and-desist letter from Sony was personally delivered to my door by the Hausmeister.

Re: The FBI Identified a Tor User

#364

Post by zxcvbn4038 » Fri, Jan 20, 2023, 9:49 PM UTC

rz2k wrote: post #299

Seattle3503 wrote: post #254

Earlier quoted context omitted.

> - Use a VPN when connecting to TOR (I also put my TOR services behind their own VPN so even if the entry point is known you can't get the origin IP from it) Has this advice been studied? If everyone uses a VPN you could be reducing network diversity. A single compromised provider could make correlation attacks easier across the entire network. I'm not saying that's certain, but I'm generally skeptical of "hone reme…

… ROT13 is known to be a very insecure method of encryption, therefore you should run it twice on your messages to keep adversaries from reading your secrets. Unless you’re completely certain it’s impossible for the VPN providers to coordinate, that sounds like a way to short circuit the entire tor infrastructure.

And the Oscar goes to rz2k for saying that with a straight face ;)

Re: The FBI Identified a Tor User

#365

Post by sidewndr46 » Thu, Jan 26, 2023, 6:50 PM UTC

CommitSyn wrote: post #101

Ajedi32 wrote: post #82

Earlier quoted context omitted.

But if they were using parallel construction, surely the criminal complaint wouldn't make claims they can't prove using the non-secret chain of evidence, right? Here the court filing alleges that the FBI knows what IP address the defendant used to visit a Tor hidden service. Don't they now have to prove that claim if they want the prosecution to succeed?

They also know what specific pages on the offending websites they accessed. I'm wondering if the classified document wasn't about tor, but about the 'implants' aka malware that were leaked in the same set of Snowden documents. I think as much as tor being broken in some fixable way, they'd like it known even less that the FBI installs malware on the devices of persons of interest who haven't been convicted of anythin…

Or in the case of Ross Ulbricht, just makes up a story about how he was trying to kill someone by suggesting the idea to him. Then uses that to justify an investigation that just happens to be a dead-end but conveniently gathers a bunch of other evidence that is relevant to another case.

Re: The FBI Identified a Tor User

#366

Post by derangedHorse » Fri, Jan 27, 2023, 1:37 PM UTC

autoexec wrote: post #334

oceanplexian wrote: post #293

Earlier quoted context omitted.

If I were hiding from a state actor I'd use a high-bandwidth communications medium like video. In another life I worked for a large live streaming service, the infrastructure required to process terabits of video is mind-boggling in size, extremely technically challenging, and usually involves custom built ASICs and hardware that's expensive and in short supply. Even with the NSA's budget and infrastructure, I don't…

> Even with the NSA's budget and infrastructure, I don't think it's technologically feasible for them to decrypt and then semantically process or store that much content. I have little doubt that they can store terabits of video content. They let us know about their utah data center ( https://en.wikipedia.org/wiki/Utah_Data_Center ) which was estimated to have as much as 12 exabytes in 2013 and who knows what data ce…

OP said he doesn't "think it's technologically feasible for them to decrypt and then semantically process or store that much content" meaning it's more about just storing the raw data. Assuming they could store it perfectly fine (which is a big 'if' considering Cisco estimated 7.7 Exabytes of data would be generated per day by 2021), they'd still have to decrypt all the videos, semantically analyze each video (subtitles, object detection, face recognition, etc), find a way to index that information to make it queryable, and run analytics on that data regularly.

Ideally they wouldn't have to search everything when needed and could keep a running file on everyone (because lazily parsing data could be expensive and probably a waste on their existing current resources). That's not to say they can't do it, given that they probably have a huge budget, but it's also not a sure thing they can do it effectively for those who are trying to stay hidden.

Re: The FBI Identified a Tor User

#367

Post by sillystuff » Sat, Jan 28, 2023, 3:27 PM UTC

sillystuff wrote: post #232

zxcvbn4038 wrote: post #209

I think a lot of this has been covered elsewhere before: - when using tor you should disable javascript because a malicious or compromised site can use javascript to do non-tor stuff that potentially compromises your location. (can be a big pill to swallow, web without javacript is very 90s) - Run torbrowser within a secure VM or separate device using Tails to minimize your activity footprint - Use a VPN when connect…

Firefox supports proxy via unix domain socket and tor daemon supports unix sockets too, so you can setup torbrowser in a VM/container without any network access to add additional safety against leaks. The sole communication channel to the tor daemon via unix socket(s). For vm, use virtfs/9p to share between the daemon and browser, for container just bind mount it. To allow torbrowser to control the tor daemon, you ca…

> since tor's control port does not directly support using a unix socket

Note, this part is incorrect, the tor control port works over a unix socket natively. I just spent some quality time with the torrc manpage and am in the process of fixing my setup.