Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ZeroNet – Uncensorable websites using Bitcoin crypto and BitTorrent network

zeronet.io

Post reply on HN
Print view View original

91–100 of 171 posts

Re: ZeroNet – Uncensorable websites using Bitcoin crypto and BitTorrent network

#91

Post by zeveb »

eeZah7Ux wrote: post #13

The project looks very promising but relies on running a lot of javascript from untraceable sources in the browser. Given the long history of vulnerabilities in the the browsers, trusting js from a well-known website might be OK, trusting js from zeronet is unreasonable. If ZeroNet could run with js code generated only by the local daemon or without js it would be brilliant.

This is why native clients (real native clients, not browsers-in-cans) are so important: they enable one to be more secure against targeted attacks, and they enable many eyes to review code and hence make one more secure against untargeted attacks.

Frankly, given much of the history of successful Internet tools & protocols, I'd love to see some text-UI clients for ZeroNet.

Re: ZeroNet – Uncensorable websites using Bitcoin crypto and BitTorrent network

#92

Post by mirimir »

shakna wrote: post #84
mirimir wrote: post #79

Earlier quoted context omitted.

Tor Project doesn't like people pushing HD video through its relays, because that degrades performance for other users. Torrent clients are very good at saturating links. This project is about hosting generally. But if it were used for HD video streaming, Tor Project would be just as unhappy.

The linked article refers to three ways bittorrent can deanonymise you behind Tor. That's a privacy concern, not a load problem.

Yeah, but you can deal with that, if you know what you're doing. If you use Whonix, or roll your own Tor gateway, leaks around Tor aren't an issue. UDP is the hardest thing to deal with. I mean, with proper Tor/userland isolation, leaks don't happen. So all UDP just gets dropped. If you want UDP, you need to use OnionCat or tunnel a VPN through Tor.

Re: ZeroNet – Uncensorable websites using Bitcoin crypto and BitTorrent network

#93

Post by djsumdog »

shakna wrote: post #23

Has the code quality improved since I was told to screw off for bringing up security? * 2 years out of date gevent-websocket * Year old Python-RSA, which included some worrying security bugs in that time. [0](Vulnerable to side-channel attacks on decryption and signing.) * PyElliptic is both out of date, and actually an unmaintained library. But it's okay, it's just the OpenSSL library! * 2 years out of date Pybitcoi…

That's a pretty deep and well thought out security audit. Are they at least making progress? For a lot of open source projects that are labours of love, it's all about getting the time and funding to work on them.

Re: ZeroNet – Uncensorable websites using Bitcoin crypto and BitTorrent network

#94

Post by roansh »

We need more projects like these. Whether this project solves the question of a truly distributed Internet* is out of question. What we need is a movement, a big cognitive investment towards solving the Big Brother problem.

*I am referring to concentrated power of the big players here, country-wide firewalls, and bureaucracy towards how/what we use.

Re: ZeroNet – Uncensorable websites using Bitcoin crypto and BitTorrent network

#95

Post by djsumdog »

emucontusionswe wrote: post #34

I would recommend use of Freenet over ZeroNet. More or less the same concept/functionality however with 15 years more experience. Freenet: https://freenetproject.org/

They have different goals. FreeNet is about total anonymity. In the FreeNet world, everyone helps server small pieces of all the data, yet no one person knows what data is on the portion of their local drives. Things like Javascript are also disabled on FreeNet.

ZeroNet uses the torrent protocol and serves up the content you've chosen to view. You know what you're serving.

Re: ZeroNet – Uncensorable websites using Bitcoin crypto and BitTorrent network

#96

Post by djsumdog »

mirimir wrote: post #77
j_s wrote: post #69

Earlier quoted context omitted.

Even Tor isn't a magic bullet, specifically because of other technologies used in combination, such as a web browser. https://www.eff.org/pages/playpen-cases-frequently-asked-que...

Yes, the FBI exploited a Firefox vulnerability to drop NIT malware on Playpen users. And said malware phoned home to FBI servers, bypassing Tor. However, any Whonix users would not have been affected, for two reasons. One, this was Windows malware, and Whonix is based on Debian. Two, Whonix comprises a pair of Debian VMs, a Tor-gateway VM and a workstation VM. Even if the malware had pwned the workstation VM, there i…

Wait, did they reveal how their exploit worked? I thought they had already dropped two cases rather than reveal the internals of the NIT? Like Tor Browser could still be unpatched for this?

Re: ZeroNet – Uncensorable websites using Bitcoin crypto and BitTorrent network

#97

Post by djsumdog »

mirimir wrote: post #43
ballenf wrote: post #20

Earlier quoted context omitted.

Neither argument has been tested, but the defense would that you were acting as an ISP with dumb pipes. Which logically leads to an unrelated question -- if ISPs are doing DPI on every packet, they at least theoretically 'know' whether you're transmitting 'illegal' content. If I were a rights holder, I'd be making that argument against ISPs. I don't know how I'd sleep at night, maybe, but I wouldn't let ISPs have the…

It's been tested for Freenet. LEA adversaries can participate, and identify peers. Judges issue subpoenas. Many defendants have accepted plea bargains. Plausible deniability doesn't work. What works is using Tor.

Do you have a source for those cases? I did some searches but can't seem to find anything.

Re: ZeroNet – Uncensorable websites using Bitcoin crypto and BitTorrent network

#98

Post by glenneroo »

hollander wrote: post #71

Several years ago I had Tor running on a server at home. It was a regular Tor node, not an exit node. Later I was put on a blacklist because of this. What is the risk of using this?

I ran a relay for years and never noticed any strange behaviour. Where and how were you blacklisted?

Re: ZeroNet – Uncensorable websites using Bitcoin crypto and BitTorrent network

#99

Post by mirimir »

houst0n_ wrote: post #90
mirimir wrote: post #77

Earlier quoted context omitted.

Yes, the FBI exploited a Firefox vulnerability to drop NIT malware on Playpen users. And said malware phoned home to FBI servers, bypassing Tor. However, any Whonix users would not have been affected, for two reasons. One, this was Windows malware, and Whonix is based on Debian. Two, Whonix comprises a pair of Debian VMs, a Tor-gateway VM and a workstation VM. Even if the malware had pwned the workstation VM, there i…

If the workstation vm is pwned what stops it from hitting the usual home router internal network address and/or changing the route? Is there some network isolation going on which prevents that?

The workstation VM has no route to the home router except through the Tor gateway VM. With Whonix, the gateway VM isn't even a NAT router. Plus there are iptables rules that block everything except Tor. The gateway VM only exposes Tor SocksPorts to the workstation VM. You'd need to break the network stack in the gateway VM in order to bypass Tor.

Re: ZeroNet – Uncensorable websites using Bitcoin crypto and BitTorrent network

#100

Post by dillon »

There's also GNUNet: https://gnunet.org/ As others have mentioned there's also FreeNet: https://freenetproject.org/

I haven't looked deep into any of these projects, but I do think they are neat and hoping at least one of them gains a lot of traction.

Post reply on HN