Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Messages - astor

Pages: 1 ... 125 126 [127] 128 129 ... 208
1891
Security / Re: Tor video chat, audio chat, or text chat?
« on: March 20, 2013, 12:57 am »
What makes TorChat so dangerous?

It turns you into a hidden service, opening you up to attacks that regular Tor users are not susceptible to, such as

http://freehaven.net/anonbib/date.html#hs-attack06


1892
Security / Re: Tor video chat, audio chat, or text chat?
« on: March 20, 2013, 12:48 am »
anonymous networks are high latency therefore realtime communication is impossible (and not very safe as timing attacks are easily done).

It's more difficult, but not impossible. Audio in particular seems to work, with the obvious 1-2 second delay.

High quality video is too high bandwidth, but low quality video might work. The biggest problem would be frequent disconnects, especially if both parties are hidden services.

Here's the Tails project research on the subject: https://tails.boum.org/todo/VoIP_support/

1893
With bitcoin prices jumping again today, I thought it was time to address this. :)


The mining hashrate has no effect on the price of bitcoins.

I know it looks like it does, but it doesn't.

If you think it does, answer a simple question: How?

How does a cluster of computers repeatedly running SHA-256 hashes on blocks of data influence the price that people pay for bitcoins at the exchanges, or anywhere else?

Trace the direct causal link between the two.

There is none.

So what determines the price?

Quite simply, the standing buy and sell orders at the exchanges, and the algorithms that execute trades between them. The "price of a bitcoin" at any moment is literally the last trade at an exchange, and since MtGox handles 65% of trades, for practical purposes, the "price of a bitcoin" is the last trade at MtGox.

If I sold you a bitcoin for $10 right now, the effective price of a bitcoin for us would be $10. It's just that nobody else would know about it. Your favorite bitcoin charts get their data from the exchanges, and the "price of a bitcoin" that they show is the last_local, the last trade in a local currency, which is USD for most of us.

The standing buy and sell orders at the exchanges are determined by supply and demand, and since the supply is fixed (well, it changes but at a known, fixed rate), it is effectively determined by demand for bitcoins. So there's nothing magical happening here. It's simple economics. If more people want to buy than sell, buyers will have to compete for bitcoins, and the the price will go up.

If more people want to sell than buy, sellers will have to compete to get rid of their surplus bitcoins (relative to dollars), and the price will go down.

So why does the hashrate seem to track the bitcoin price so well?

https://blockchain.info/charts/hash-rate?timespan=1year
https://blockchain.info/charts/market-price?timespan=1year

You're confusing correlation with causation. Two factors can correlation without causally influencing each other, because a *third factor* causally influences both of them.

When the sun shines more directly in the summer, more people get sunburns, and more people wear shorts. If you plotted number of people wearing shorts with number of people getting sunburns, they would track each pretty well. They would increase and decrease together, but obviously wearing shorts doesn't cause sunburns or vice versa. A third factor, the sun, is influencing both.


In the bitcoin world, the third factor is the number of people interested in bitcoin.

As the number of people wanting to get bitcoins increases, more people buy bitcoins, increasing the price, and more people mine, increasing the hashrate. That is why hashrate and price correlate.

If a new technology comes out that drastically increases the hashrate, but the number of people interested in bitcoins remains the same, then the bitcoin price will be unaffected.

The introduction of ASICS could influence people's confidence in bitcoin, which would change the price. Ah, now we've identified a causal factor! But lots of things could influence people's confidence in bitcoin. The *math* behind mining doesn't influence the price of bitcoin at all, no matter how much of it is being executed in CPUs at a given time, which is what most people seem to think.



PS, if you want to know what caused today's spike, look here: https://bitcointalk.org/index.php?topic=154672.0

1894
Security / Re: I need to improve my security!! Help needed!
« on: March 19, 2013, 01:10 am »
But.. all this security stuff that's freeware.  I mean, last week, my TorChat and my GPG4win went down at the same time.

Fuck GPG4Win. Use GPG4USB. Check the tutorial in my signature.

So, I have truecrypt, and I have a ton of really good shit on an encrypted volume, but I do worry that one day that shit's just not going to work for whatever reason, and all my data, hours and hours of work, just gone (oh, that's why we have backups, right?  well, how do we protect them?). 

With TrueCrypt. The chances of both encrypted volumes getting corrupted at the same time are slim. By your logic, why make backups at all? All hard drives fail at some point (so it may not even be your encryption that fucks you), but the only solution is backups. And if one backup doesn't make you feel safe, make two.


I just worry that the "free" part of freeware isn't necessarily a good thing for the end user.  I have seriously fucking considered buying Norton PGP.

The problem with proprietary software is that you can't be sure it doesn't have a backdoor. With open source software, you can.

Anyway, I have come across many people who have had problems with GPG4Win, but I haven't heard of a high(er than proprietary software) failure rate for TrueCrypt. I have used full disk encryption on an internal and external hard drive for a couple of years without any problems.


1895
Security / Re: SILK ROAD CRACKDOWN , VENDORS NEED TO READ!
« on: March 18, 2013, 08:16 pm »
Is it bad going on clear net site on tor, I do all the time?

No, the opposite is bad. You should not visit links posted on this forum with a regular browser.

But also, you should not log into any sites over Tor if they are linked to your identity. Don't log into your email account or Facebook over Tor.

Keep your real identity and your Tor activity separate.

(Ideally on separate physical machines, or real ID on host OS and Tor activity in VM, or real ID on hard drive and Tor activity on bootable distro, etc., but at a minimum, don't do anything linked to your real identity over Tor)

1896
Security / Re: LE manuals?
« on: March 18, 2013, 06:45 pm »
You can find all kinds of stuff on Google. Here's a fun search:

BEGIN PGP PRIVATE KEY BLOCK filetype:asc


1897
Yes, it's important to get tested often. :)

np

1898
Hey, so I got it to work. Had to install libgtk2.0-dev, libxml2-dev and libxslt1-dev before running make.

export PATH=$HOME/.gem/ruby/1.9.1/bin:$PATH

Then it complained that ~/.metasilk/config didn't exist, so mkdir ~/.metasilk; touch ~/.metasilk/config, and done.

1899
You don't need to modify the installation script. If torsocks is on the system, start the MetaSilk installation with

torsocks make

On a Debian based distro, torsocks will be installed with the vanilla Tor client.

Depends: libc6 (>= 2.14), libevent-2.0-5 (>= 2.0.10-stable), libssl1.0.0 (>= 1.0.1), zlib1g (>= 1:1.1.4), adduser, lsb-base
Recommends: logrotate, tor-geoipdb, torsocks


Anyone who wants to run MetaSilk should have the vanilla client anyway. Running a persistent application through TBB's Tor is hackish. Plus, the one of the main selling points of a desktop app like MetaSilk is that you don't need to have a browser open all the time.

So, in the README you could include one line that if you want to install over Tor, run torsocks make. Also point out that if installing in Tails (which is quite popular around here), they don't have to do that because all connections are torified already.

1900
I didn't notice they were bundled with it. That's why it said "installing" for the first batch and "fetching" for the second. Makes sense.

Yeah, I see your point. I don't know how common these gems are to download, alone or in combination, but it might be fair to at least tell people about the option to download over Tor in the README.

1901
Security / Re: SILK ROAD CRACKDOWN , VENDORS NEED TO READ!
« on: March 18, 2013, 04:07 am »
You can order scented packages like that on SR, if you don't have a contact far away to do it for you.

I worry that it would put me on a list, even if the package was clean.

1902
Security / Re: SILK ROAD CRACKDOWN , VENDORS NEED TO READ!
« on: March 18, 2013, 03:43 am »
Some people don't realize that you should only visit clearnet links posted on this forum over Tor.

So, it's a warning and reminder that clearnet links are dangerous.



1903
SS, I'm still concerned about a fingerprinting attack on this software. It tries to install the following gems from rubygems.org:

awesome_print
gtk2
mechanize
nokogiri
socksify
vrlib

I also see it fetching these:

pkg-config
glib2
atk
cairo
net-http-digest_auth
net-http-persistent
mime-types
ntlm-http
webrobots
unf_ext
unf
domain_name
require_all


If this is the only software in the world that downloads this specific combo of gems, then an attacker with access to the rubygems.org server logs can enumerate the users of this software. Installation on Tails should be fine, because all connections are transparently proxied over Tor. On other Linux distros, you could include instructions to run the make command with torsocks, which should be installed if the headless Tor client is installed. On Windows, I'm not sure what to do. Is there a Windows version of torsocks that can be bundled with it?

Edit: I found these, but haven't tried them...

http://www.freehaven.net/~aphex/torcap/
https://github.com/cpatulea/TorCap2

1904
Off topic / Re: OVDB?
« on: March 18, 2013, 01:29 am »
No, I had a couple of differently named accounts there, like I've used a few different accounts here. :P

But I can describe specific things about that forum that (I don't believe) have ever been discussed here, to prove it.

For example, somebody was posting PGP messages that, when you opened them, would deflate and fuck up the recipient's computer. There were a bunch of reports of that.

Maybe kmf remembers.

1905
Off topic / Re: OVDB?
« on: March 18, 2013, 01:15 am »
Fair enough. I don't pay much attention to it, but yeah I was on OVDB back in the day.

Pages: 1 ... 125 126 [127] 128 129 ... 208