- cypherpunks - lists.cpunks.org

Re: [tor-talk] How secure is a hidden service?
by grarpamp 23 Feb '20

23 Feb '20

Tor Project sometimes censor and manage speech on its mailing lists from some various facts, alternative points of view, free and open convo, news journalist articles, inquiry, critique of Tor Project itself, etc... perhaps some of the links below may be of interest or merit, or even be nothing but utter nonsense indeed... decide as desired. Busts often have press releases, case docs, and community threads that can be read for info on, and suspicious gaps in stories of, how onions were found. Also look for cases that got dismissed, things can appear strange in them too. http://dreadditevelidot.onion/post/f7f0b5bc445630301df6 https://www.gwern.net/docs/sr/2020-flugsvamp-docs-FUP_B_13010-18.tar.xz Some of the public research and exploit whitepapers against hidden services are listed here... https://www.freehaven.net/anonbib/ Here are some articles, blogs, threads, links to links, and so forth that may have other papers and info of interest... https://restoreprivacy.com/tor/ http://darknetq7skv7hgo.onion/ https://old.reddit.com/r/TOR/comments/7lt954/ddos_related_deanonymization_t… https://www.hackerfactor.com/blog/index.php?/categories/19-Tor https://trac.torproject.org/projects/tor/ticket/19794 https://old.reddit.com/r/onions+tor/ https://lists.cpunks.org/pipermail/cypherpunks/2020-February/079289.html https://lists.cpunks.org/pipermail/cypherpunks/2019-November/077834.html https://www.gwern.net/DNM-arrests https://www.gwern.net/DNM-survival https://surveillancevalley.com/blog/fact-checking-the-tor-projects-governme… These two messages were replied directly to the Tor Project mailing lists, both were censored by the Tor Project and thus never appeared there for users to consider and or talk about... https://lists.cpunks.org/pipermail/cypherpunks/2020-February/079419.html https://lists.cpunks.org/pipermail/cypherpunks/2020-February/079417.html How hidden are the hidden services of any of today's overlay networks? One answer is as old as humanity... Perhaps that depends on how badly they want to find you. On 2/22/20, Robin Lee <robinlee(a)mailbox.org> wrote: > On Fri, 2020-02-21 at 05:41 -0500, Roger Dingledine wrote: >> On Thu, Feb 20, 2020 at 07:25:32AM +0100, Robin Lee wrote: >> > I'm wondering how hidden a hidden service actually is? Because last >> > week charges were brought against Flugsvamp, a Swedish darknet drug >> > shop. In the documents made public for the court case the police >> > states >> > that is was able to trace the actual ip-addresses of the onion- >> > addresses. Flugsvamp had two onion-addresses and the the police >> > gave >> > different probabilities that a certain ip-address was behind each. >> > >> > Is it just a function of time and amount of traffic, i.e. the >> > longer >> > you are online and the more traffic you generate, the more probable >> > it >> > is to discover the true ip-address? >> >> It's complicated. >> >> I should start out with saying I'd never heard of Flugsvamp until >> your >> email, and I have no notion of whether they used Tor or what. That >> said: >> >> Services on the internet are inherently harder to make safe than >> clients, >> (a) because they stay at the same place for long periods of time, and >> (b) because the attacker can induce them to generate or receive >> traffic, >> in a way that's harder to reliably do to clients. >> >> Most identification problems with Tor users, and with onion services, >> have turned out to be opsec mistakes, or flaws in the application >> software at one end or the other. That is, nothing to do with the Tor >> protocol at all. But of course in the "layers of conspiracy" world we >> live in nowadays, you can never be quite sure, because maybe "they" >> used a complex attack on Tor and then covered it up by pointing to an >> opsec flaw. One hopefully productive way forward is to point out that >> even if we don't know how every successful attack really started, we >> know that opsec flaws are sufficient to explain most of them. >> >> When I'm doing talks about Tor these days, I list these four areas >> of concern, ordered by how useful or usable they are to attackers in >> practice: (1) Opsec mistakes, (2) Browser metadata fingerprints / >> proxy >> bypass bugs, (3) Browser / webserver exploits, and (4) Traffic >> analysis. >> >> See e.g. the original story about Farmer's Market: >> https://blog.torproject.org/trip-report-october-fbi-conference >> where at first people worried about a vulnerability in Tor, but then >> it >> turned out that the operators had been identified and located far >> before >> they even switched to using Tor. >> >> To make this thread more productive and more concrete: can you point >> us >> to these "documents made public for the court case"? Even if they're >> in >> Svenska, they would still be useful to look at. The ones talking >> about >> probabilities of IP address I mean. > > These documents are available at > https://minfil.com/bbu3q0Y4ne/FUP_B_13010-18_zip > > Page 103 in the file 'Stockholms TR B 13010-18 Aktbil 202.pdf' contains > a short PM about the tracing. > > It is a vast set of documents, but as far I've been able to tell > identifying the VPS-servers behind the onion-addresses was the first > step. > > > > -- > tor-talk mailing list - tor-talk(a)lists.torproject.org > To unsubscribe or change other settings go to > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk >

1 0

Cloudflare Tor Mozilla via StopMITMInternational
by grarpamp 23 Feb '20

23 Feb '20

Convo on Cloudflare Tor Mozilla via StopMITMInternational https://github.com/mozilla-mobile/focus-android/issues/1743

1 0

Russia poised to (literally) invade "irresistible prize" Ireland - Center for Security Policy (DC think w^Ctank)
by Zig the N.g 22 Feb '20

22 Feb '20

Literally. Invade. Ireland. Russia. Invade Ireland. I guess it's a prize country in war - potatoes for ya food lines. "Bloody Russkies INVADING Ireland!- man the hatches and 20,000 fathoms IMMEDIATELY ya skurvy dogs!" [link to Yandex image search for "scurvy russian sailor meme" DEFINITELY not included :D -- ye olde election meddling search engine appears to have replaced "scurvy" with "curvy"] Russia isn’t just mapping Ireland’s internet cables – it’s planning to INVADE, foams Cold-War-revivalist DC think tank https://www.rt.com/op-ed/481326-russia-invading-ireland-internet-communicat… https://www.centerforsecuritypolicy.org/2020/02/20/russia-ireland-nato/ Russia is poised to invade Ireland and seize control of global communications, according to a crew of Cold War relics and professional Russophobes who’ve taken an already absurd James Bond-esque story and doubled down on it. Ireland’s status as “a vital telecommunications and logistics hub linking North America and Europe” has made it an irresistible prize to “the Putin regime,” according to a bizarre paper published on Wednesday by the Center for Security Policy, a right-wing think tank. Russia isn’t just lusting after Ireland’s burgeoning crop of tech firms, or its forest of undersea communications cables, the group argues – it’s actively plotting to invade the Emerald Isle. Can’t emphasize how ludicrous and insane this is. And it’s all inspired by sensationalist disinformation pushed by British newspaper ‘The Sunday Times’ last weekend. I debunked that bullsh*t story here. https://t.co/ZH7JEcyIVC — Bryan MacDonald (@27khv) February 20, 2020 The unhinged plot apparently derives from a story published last weekend in the Irish Times, which warned – citing the usual anonymous sources in the Garda and the military – that Russian spies were observed last year mapping out the precise location of the transatlantic ocean-bed cables that form the backbone of global communications in preparation for “future tapping or even damage.” While that gripping saga could be deflated with a quick look at one of Ireland’s own government websites, which posts the exact latitude and longitude of those cables for all to see, it clearly lit a fire under the senescent Cold War hawks at the CSP. ...

1 0

Re: [tor-talk] How secure is a hidden service?
by grarpamp 21 Feb '20

21 Feb '20

On 2/20/20, Robin Lee <robinlee(a)mailbox.org> wrote: > I'm wondering how hidden a hidden service actually is? > ... > Is it just a function of time and amount of traffic, i.e. the longer > you are online and the more traffic you generate, the more probable it > is to discover the true ip-address? Time and traffic are elements of some known research exploits. One form of general answer might also be... Given the number of proven research exploits against such services in the public literature, and the presumed attention to high security that at least some of the fallen services must have given, it's probably worth assuming that... - Public research exploits are being used in the wild. - Private research exploits do exist and are being used in the wild. - Adversaries using such public exploits, and most assuredly such private ones, are unwilling to let those respective facts of advantage become known, particularly when parallel construction and various [il]legal processes around the world effectively allow those trump cards to remain secret, thus not triggering defensive moves and arms races to their disadvantage. This isn't specific to tor, it's the nature of the entire netsec game, the history of such games showing that many such preposterous ideas not always as far fetched as their prior critiques presumed. While searching the web for the exploit papers is easy, the difficulty comes in showing the actual usage of any exploit. There's probably a wide range of honorary awards and nice paychecks available to whoever breaks any big news or research regarding the topic. And certainly many thanks from rights workers, journalists, etc whose very lives and work depend on it.

1 0

DrugRoutes, DarkWeb, DropGangs and other fun research
by grarpamp 21 Feb '20

21 Feb '20

http://4h635ssto4t7ryhqyb4z4kax57f7iheoz7gg62ufp7dp6w3j67bjdhyd.onion/ https://twitter.com/RasmusMunks https://twitter.com/search?q=dropgangs

1 0

Re: [tor-relays] Would you place your secrets or in worst case make your life
by grarpamp 21 Feb '20

21 Feb '20

>> On 13 Feb 2020, at 22:05, zwiebeln <zwiebeln(a)online.de> wrote: >> Would you place your secrets or in worst case make your life >> depended on a network that is 21 percent controlled by a single person >> that you don't know? >> >> https://nusenu.github.io/OrNetStats/allexitfamilies >> >> I think we should start an open debate on that fact, best ending up with >> giving some recommendations. I am sure that question is relevant to >> torproject.org as well. On 2/16/20, teor <teor(a)riseup.net> wrote: > A quick reminder to everyone on this list: this list is moderated. > Please keep your replies helpful and on topic. > So please ask questions in a way that assumes good faith: > https://en.wikipedia.org/wiki/Good_faith > You'll be more likely to get a helpful answer. > Again, please keep your replies helpful and on topic. Does the world need unnecessary prior restraint threatchill politically correct rewording school over potentially alternate nongroupthink and or counter data analysis or viewpoint freespeech necessary to an open debate as requested by OP. Unfortunately many entities in the world trend such control when incorporated, $50-100+k salaries start being depended upon, YouTube channels censored to keep tidy public message, bury evidences, etc. Cigarettes were hide to cause cancer for decades, what if people knew those facts? Tor is increasingly analyzed by analysts over years due its mass, others care for its users too, etc. Resulting in growing public knowledge of effective adversarial research and exploit of its design and operations limitations, assumptions, oversights, etc. That is reasonable, good process, and occurs with all apps throughout their lifetime. Let all networks not shy from fact and supposition, as they can be good to know, and lead to good improvement in all networks. Perhaps even collate them into known adversarial research list, and a frequent list leaving no side out. > So it's not really helpful to single out a particular operator or network. OP was not accusing anything, merely questioning one such weakness, one that is quite easy to observe, and reasonable to hope see addressed in tor or whatever other network. On 2/17/20, zwiebeln <zwiebeln(a)online.de> wrote: > There is only a small path between moderation and censorship – to get my > message released after four days is close to… > > Your answer Theo is rather technical and doesn't apply really on the > underlying question: > > „Would you place your secrets or in worst case make your life depended on a > network that is 21 percent controlled by a single person that you don't > know?“ > > Your assumption: „But ultimately, if we doubled tor's exit bandwidth, this > issue would go away. That's the best solution to this problem.“ - is wrong. > The Exit only > https://metrics.torproject.org/bandwidth-flags.html?start=2017-11-19&end=20… > has more than doubled in the last two years – while the exit probability of > this single person decupled. > > „Perhaps you could run more relays?“ - I am with the project now for more > than three years an do run a exit probability somewhere close to 2 percent, > that i don't like to increase, because i think it is a more than healthy > fraction for a singe person – so why do you insinuate, my question is not in > a „good faith“? > > I hope more people do come on board of this discussion now! [Dropped at tor-talk as general note]

1 0

Fw: horrific murder suicide - Warriors rugby league player Rowan Baxter
by Zig the N.g 21 Feb '20

21 Feb '20

Now here's some food for thought. Just remember, the only thing to think here is that women never do no wrong, and the things they do can never contribute to outcomes like this - it is the men who are (equally) purely and (equitably) only responsible for such situations since men are more equal than women and therefore evil. Even with presumption of guilt against the man, unjust family "law" courts and presumptive "protection from violence orders", men simply have no right to see their own children if the woman decides - and she can move away, move in with anyone, and rightfully deny her children their right to see their father, irrespective of all court orders and any justice or rights of anyone other than the woman. This is the most important foundation of democracy - women are irreproachable. The N.g ----- Forwarded message ----- Date: Fri, 21 Feb 2020 18:41:36 +1100 Subject: Re: horrific murder suicide - Warriors rugby league player Rowan Baxter Follow up: http://dstormer6em3i4km.onion/oz-cop-taken-off-family-murder-suicide-case-f… On Fri, Feb 21, 2020 at 06:32:07PM +1100, Zenaan Harkness wrote: > Insanity indeed... > > http://dstormer6em3i4km.onion/absolute-legend-australian-rugby-player-sets-… ----- End forwarded message -----

1 0

Officially Approved Terrorism
by Ryan Carboni 20 Feb '20

20 Feb '20

You will know when terrorism is officially approved when the media reports on it. Naturally I am suspicious of the lack of reporting on the Georgia Guidestones, very bold statement, global depopulation? All news is very limited and misleading nowadays. Things just happen. Our reference points of causality is being undermined. The free press emphasizes cliquish arguments against the other side. I think Rathjen was radicalized by Soros' Extinction Rebellion. https://www.thenational.ae/world/europe/germany-shootings-mass-killer-infec… Just days before the killings Rathjen had posted a video on YouTube containing conspiracy theories. Prosecutors say there were "signs of a xenophobic motive" after videos and a 24-page manifesto was found at his home. The manifesto suggested that people from more than two dozen countries should be "destroyed".

1 0

Machiavelli was right
by Ryan Carboni 20 Feb '20

20 Feb '20

Machiavelli was right, it is better to be feared than to be loved. But those who rule by fear often only live for pleasure, and do not share the emotions of those they rule over. The 1934 Business Plot was interesting, a lot of speculation, no convictions. Mobsters say they are concerned, or that this is a problem. A lot of enthusiasm. It is good to have enthusiastic supporters, they have those. All the power to them. I've been grievously harmed by a small number of culpable individuals, tied to other people who would engage in those acts themselves, protected by a larger number of less culpable individuals, protected by an even larger array of institutions. Rest assured, no one is obligated to touch my genitalia and I won't be forcing my way into any your orgies, I don't care for orgies, but you can keep them. In terms of the ongoing Gambit Roulette ( https://tvtropes.org/pmwiki/pmwiki.php/Main/GambitRoulette ), there will be no outcome desirable to me, but things can go many ways.

1 0

Plato missed two government types
by Ryan Carboni 20 Feb '20

20 Feb '20

1. Satyrocracy: governance by orgy 2. apomimarchy: governance by psyop I think two centuries of scholarship on governance and new observations should cause some form of reassessment of the US constitution...

4 3