Silk Road forums

You might want to remove some more of that info, like the city where the package is sitting and the origin country. There can't be too many packages in that facility from that country, potentially seized.

Edit: Just delete the whole thing, it's unnecessary for your question.

Didn't Rocker leave a post a couple of days ago saying that he was going to announce the winners on January 10 and now it's gone, or am I taking crazy pills?

I would like a single VPN service that I can trust without tor as there are a lot of sites that block the tor exit nodes... I would like a service that won't provide the US gov't with the information they want.

Unfortunately, this "privacy by policy" is not secure. How can you trust a VPN provider short of being given root access to their server and looking at the logs? Even then, how can you be sure they don't start logging as soon as you leave? VPN providers can see their whole network. They can see your IP address and the sites you're visiting, if they choose to look. That they don't look is just a promise.

The whole point of Tor is to send your circuits over independently operated relays, so nobody has a view of the whole network. The entry guard operator can see your IP address but doesn't know which site you're visiting. The exit node operator can see which site you're visiting, but doesn't know your IP address. In the case of a hidden service, nobody knows which site you're visiting. That's not a promise. That's privacy by design.

Furthermore, what's the point of hiding your IP address from PayPal unless you're using a stolen account?

1. You need periodically make NTP update on server where hidden service is running. Cause hidden services depend on time sync.

Every Linux distro comes at least with ntpdate by default, which updates the clock once a day. That should be sufficient, since clocks don't drift more than a second or two in a 24 hour period unless you have a really fucked up hardware clock. Alternatively you could run ntp. I don't see a security threat in allowing these services to update over clearnet. Almost every server has them running so there's nothing out of the ordinary about that. However, you would definitely want to keep the time correct, because as you said, Tor needs an accurate clock to run, but also because clock skew is a known attack on hidden services.

2. How Backup-ing data is organized ? Two keypoints for backup, it must be made quick and in safe mannner.

In the case of a multiple hidden service setup, the 3 servers would be backups to each other. If LE seized one, the others would continue operating normally, syncing to each other while getting sync errors to the third server. Also, if an intrusion detection system is configured to destroy the data on the seized server, then LE couldn't prove it was part of the hidden service. Users would observe no change, because the other 2 servers would continue publishing their descriptors and users would connect to them.

However, you probably want a dedicated backup server anyway. One benefit is that you could put it in stealth mode, like the ssh services described above. So even if someone is crawling the Tor network for hidden service descriptors, they would get an error that the hidden service is down whenever they tried to connect to it (unless they had the cookie/password). They couldn't determine what type of service was running on it, let alone that it was the backup server for hidden service X.

As for the backup procedure, there are a variety of backup tools for Linux, but a lot of them are based on rsync. Why not run rsync over ssh? You would have to configure ssh to run over Tor, which can be done with connect-proxy, among other things. So rsync -> ssh -> connect-proxy -> Tor -> backup hidden service. Set an hourly cron job for that.

Possible solution to make it harder for hack:
At some random moment of time, send signaling email to e.g. Tormail showing, that there's some open port-forwarding on gateway to ssh and there's 30-min time window to download backup files, thus service which checking Tormail downloads backup data within given time-frame.

Seems overly complicated for something that should be straight forward, and relies on a third party service that increases the attack surface.

3. Bitcoin wallet and related data must be secured even higher on another dedicated server or VM, than eShop.

I haven't given much thought to that, but yeah, you would probably want to run that on separate hardware.

i disabled the e tag's completely, but when it try to sign into tormail here or sr it just resets the login page when i click submit. i guess stuff needs to b cached?

This is what I was talking about. I haven't experimented with disabling memory cache myself, but I've seen enough people warning against it.

The Tor devs don't want to break the web browsing experience, especially for people who won't understand what's wrong or how to fix it, so allowing JavaScript and memory cache is a necessary evil.

Another thing is, the best way to deal with a correlation attack via a blocked internet connection is to run 2 or more hidden services (2 or more sets of servers as described above) in different locations. Consider 3 hidden services with the same private key and corresponding onion domain. The way that works is, whoever publishes their hidden service descriptor last gets the connections. Hidden services publish their descriptors every half hour. So if you start them 10 minutes apart, users will be connecting to a different set of servers every 10 minutes. If LE somehow identifies one of the servers (despite the protections described above) and cuts the internet connection, a few minutes later they will be able to access "the" hidden service again, creating confusion and plausible deniability.

The problem to solve is syncing the databases. For a blog that only gets updated a few times a day at most, that's easy. For a forum like this, that's a lot harder.

@mracid

I haven't used Liberte, but if you're on Linux, go to Applications -> Accessories -> Terminal

Type in:

  gpg --import

and hit enter. You'll see a flashing cursor. Paste the public key there. Hit enter again so you're on a blank line, then CTRL + D.

The much scarier version is that someone hacked the forum and is manually deleting posts/forum sliding topics.

Great. While he's at it, maybe he can delete some of the spam too.