Silk Road forums
Discussion => Silk Road discussion => Topic started by: Dread Pirate Roberts on August 05, 2013, 08:46 pm
-
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
It is becoming clear that the US Feds are behind the take down of Freedom Hosting and have access to every record of every site hosted by them. This includes the anonymous email service known as Tor Mail. I know that MANY people, vendors included, used tormail. You must think back through your tormail usage and assume everything you wrote there and didn't encrypt can be read by law enforcement at this point and take action accordingly. I personally did not use the service for anything important, and hopefully neither did any of you.
The best article I have found on the matter is by wired (clearnet warning):
http://www.wired.com/threatlevel/2013/08/freedom-hosting/
Everyone please try to keep each other informed as you are able.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (MingW32)
iQEcBAEBAgAGBQJSAA8UAAoJEAIiQjtnt/olquUIAL8q17/eSRlrspmo2Mz0DKvI
ZNOARVATXW2AdaL5GmTmal3sbWTjK9T7u5otgXYbkD3DvB+LCdWknY6GK33fRlws
rF96mV+5BgbKyNZ8cyQAxvYCUQDnY0zzBd87H7eRTdmnZfXqPAoDd5WDTIPiukRX
mxmBwaYalNF/nti+Z+phrSPytunkPXn50jMvHj9LeF2GMJUMwuIYAN7gx7eQ24oR
GHdzXF3UKIWOMQ9vHDt6lrfqs8N/AwE+Fta/EKVAX+mRZc2O+rwVxxoRjK6ViP0L
9q8QjDhhjqF0wD+1oN8k6zGwVsrk5wE3OJid1luleFYkS+pzdRnRAA6P0y1gnjs=
=5y7k
-----END PGP SIGNATURE-----
-
I used tormail as an email to buy bitcoins. Should I be worried?
-
Live and learn to encrypt.
I hope they enjoy that sex talk with that girl... At least in my mind she was a she....
Haha
Stay strong DPR....
-
Is freedom hosting any way connected to the Silkroad main page and these fourms?
-
My SR account name is the same for tormail but never use it, many ones on SR are the same. Does anyone know if a tormail account can be deleted?
-
Thank you for the solid advice DPR I appreciate everything you do for all of us!
-
yeah i saw this on 4chan.. all over the place..
people are gunna be getting fucked.. but pretty much just pedos.. and nasty dudes that like CP...
and of course anyone dumb enough to not use pgp for ANYTHING personal they do on tor..
are you worried about it DPR? not tormail but like the fact that they arrested him??
-
Do we know that the contents of Tormail emails are compromised, or do we suspect or assume it?
-
Is freedom hosting any way connected to the Silkroad main page and these fourms?
absolutely not. the only connection is that many SR users also used services hosted by FH, like tormail.
-
Thank you Dpr. Good lookin out. 8)
-
My SR account name is the same for tormail but never use it, many ones on SR are the same. Does anyone know if a tormail account can be deleted?
I think it's best to not ever login to tormail again.
-
There sending the information to an ip somewhere in Virginia, Which happens to be the home base for SOD.
-
are you worried about it DPR? not tormail but like the fact that they arrested him??
from what I've gathered so far the security vulnerabilities that led to his arrest are not present with SR and me.
"Do we know that the contents of Tormail emails are compromised, or do we suspect or assume it?"
we are not 100% sure, but at this point it is assumed VERY likely and we should act as though we are 100% sure.
-
I would assume as well.
Re-install Tor.
Make sure you completely overwrite tor when you re-install it. Delete the folder, don't decompress it back into the same folder.
-
we are not 100% sure, but at this point it is assumed VERY likely and we should act as though we are 100% sure.
Yep, as I thought and I agree.
-
I used tormail as an email to buy bitcoins. Should I be worried?
Buying bitcoins isn't illegal(yet) so I would assume not.
-
thank you for the heads up DPR i to never used it for anything important but if you have been using it for any day to day business without encryption you must move your stock asap take no chances and be ready to be raided all ways think worse case scenario and say nothing.
this is a lesson to us all and if you dont currently use pgp i suggest you start to learn it now as this can make the difference between being free or not....... stay on your toes and one step ahead,
good luck my friends stay safe.......
R
-
damn, glad i never use tormail. thanks for the heads up DPR!!
-
Since it's a hidden service, as long as nobody was stupid to mention anything that would unmask their identity, does it really matter what else anyone said in Tormail?
-
Since it's a hidden service, as long as nobody was stupid to mention anything that would unmask their identity, does it really matter what else anyone said in Tormail?
A lot of people are stupid.
-
Since it's a hidden service, as long as nobody was stupid enough to mention anything that would unmask their identity, does it really matter what else anyone said in Tormail?
A lot of people are stupid.
I guess so :)
-
Are you guys getting a 'click here for a important security announcement' message on your home page?
Is it linked to this thread?
-
Are you guys getting a 'click here for a important security announcement' message on your home page?
Is it linked to this thread?
Yes
-
thanks man. just checking.
-
Are you guys getting a 'click here for a important security announcement' message on your home page?
Is it linked to this thread?
Yup and as much as I appreciate that warning message it's got me nervous. I read the articles and I'm not exactly sure what's going on, but a red security message on SR leads me to believe this is some pretty serious stuff. Can anyone tell me in lamens terms what's happening? I am not going to be using tormail for now and perhaps forever.
-
Are you guys getting a 'click here for a important security announcement' message on your home page?
Is it linked to this thread?
Yup and as much as I appreciate that warning message it's got me nervous. I read the articles and I'm not exactly sure what's going on, but a red security message on SR leads me to believe this is some pretty serious stuff. Can anyone tell me in lamens terms what's happening? I am not going to be using tormail for now and perhaps forever.
More info here: http://dkn255hz262ypmii.onion/index.php?topic=195878.0
-
Would think the ESR17 JAVA EXPLOIT loaded when you visit a FH page should be included in the 1st post and more of an ongoing concern???
-
Well i think i might be double fucked !! Hopefully not but there is 2 riot vans of police around the corner as i type this !! i bought something from hackbb and sent a address with no encryption but it is not my place it's a good few hoursaway but someone will be upset!! plus paid him with no escrow still waiting for my item with no way to contact ;[ plus have been trying to get on tormail the last week all so hackbb whilst they were both down. might of had this injection thing????
Going back 2 nights ago... late at night i was bord and bought 150 hacking tools off SR as soon as i downloaded the link my whole computer went Fucking crazy .trogan back doors was coming up it was opening as many files as possible writing on the screen was asking if i wanted to see a naked baby and loads of jibberish and code on ramdom places on the screen!! it was typing the link in mega upload i lost control of it i never ever seen a computer act like that before ! i pulled the battery whilst it was going crazy and wiped all the files and scanned the whole computer and seems ok now but still don't trust it!!!
SO DO U THINK THIS HAPPENED COS OF THE FH OR THE HACKING TOOLS?
I really hope there too busy with all the pedo's cos all i wanna do chill and smoke some herb!!
-
Well. atleast i didnt use tormail for anything too important. and the things i did use it for were always encrypted or via privnote:)
-
^ I HOPE that privnote comment was a joke.. =-0
-
They likely would still need a specific warrant for each account to see the contents of emails just like they would with any other email provider. I believe they need less to see the headers and subject but for the actual content they need to show probable cause to a judge to get access to the content. Assuming this is in the USA or some similar country.
-
damn, glad i never use tormail. thanks for the heads up DPR!!
Yup same here, and even the couple times I have all addresses were PGP'd. Its times like these where all the infinite posts about how important encryption is finally shines through. This is the moment everyone was prepared for, of course the pawns went first in battle, but anyone of value and intellect has their armor and shield ready.
-
Well, I say live and learn, There are many people working on the actual coding of the script as we speak and figuring out exactly whatit does and how it does it. Now. Lets assume the worst because that way no matter how we act it can be in good judgement. So from now on :
.Make sure Noscript is turned off!
.Encrypt everything, And i mean everything. Any questions about drugs , because that is intent to import narcotics even if you dont buy them.
.Do NOT download any dodgy files from non trusted sellers on SR, The feds could just as easily fit exploits with backdoors into any file you download, Say hacking ebooks for instance, I have seen 3 members complain of the same problem as stated by mclovin below.
.Always ALWAYS verify the Image of tails, or whatever you use.
.Never connect to Tor from a normal browser, Obvious but people do it.
.Keep an eye out and report anything suspicious, I know it may seem very "ratty" however we are in a new age now, Where everything needs to be watched. Lets say you see something but dont post it as you dint want to be ridiculed, And then as a result 10 people get busted. They lose their jobs, Their families could be taken away from them or left hungry, And Jailtime could be a high probability, all for combating the war on drugs.
It's an anonymous forum, So your not losing any face, Fucksake if you care about that then you are in a very bad position.
.DO NOT TRUST ANYONE, I have seen to many people talking about stories that could identify them.
Anything you wish to add DPR??
-
Since it's a hidden service, as long as nobody was stupid to mention anything that would unmask their identity, does it really matter what else anyone said in Tormail?
A lot of people are stupid.
You, Sir, deserve a +1 for making me laugh so hard.
HeatFireFlame, +1 to you, my friend, for that post.
-
They likely would still need a specific warrant for each account to see the contents of emails just like they would with any other email provider. I believe they need less to see the headers and subject but for the actual content they need to show probable cause to a judge to get access to the content. Assuming this is in the USA or some similar country.
Yeah and who exactly are they going to serve these warrants on? No one is going to own up to being the owner of Tormail are they?
-
Big lesson for all the folks bitching about learning PGP
Here is the best read i found so far.
http://arstechnica.com/tech-policy/2013/08/researchers-say-tor-targeted-malware-phoned-home-to-nsa/
Looks like they left a calling card either to boast or scare deepnet enthusiasts. I would abandon trying to log in to tormail. My box will never be visited by me again but luckily I never really used it.
ALSO - Windows OS, ditch it. Linux or Mac were not affected if I have my info correct (please chime in if this is wrong) and disable Javascript when you update TOR.
Ever since I started using SR the big advice was to encrypt. I was advised to ditch hushmail and use tormail but really there is NO email or communication client that is 100% secure . Always assume mails will be read by a third party and ENCRYPT.
This mighty be the next thing to read...
http://arstechnica.com/security/2013/08/crytpo-experts-issue-a-call-to-arms-to-avert-the-cryptopocalypse/
-
Now is good time to publicly flog vendor for use BCgolder Java PGP and privnote.
They could become LE honeypot anytime and we not know. Possible privnote is made in secure way. yes. but if LE takeover they make simple change to record IP and not delete note and run for days or week or month.
-
My SR account name is the same for tormail but never use it, many ones on SR are the same. Does anyone know if a tormail account can be deleted?
I'd say a tormail account could be deleted but you'd have to log back in to do it. Not sure if it's a good idea to though. Would I be wrong in saying that a lot of people created tormail accounts for pgp purposes, I made one up that i dont use when setting up pgp.. I'm too old for this shit so to DPR or anyone who does know what this means I have a question.
.
Should we change our pgp keys now?
-
Hi guys,
I am a bit nervous i only use SR and the SR Forums but i remembered i upload my Weed photos for my buyers on Torimages so they can see it in HD should i be worried and if i Torimages is compromised what should i do?
The images where taken by camera not phone if that helps.
SAGreat
-
They likely would still need a specific warrant for each account to see the contents of emails just like they would with any other email provider. I believe they need less to see the headers and subject but for the actual content they need to show probable cause to a judge to get access to the content. Assuming this is in the USA or some similar country.
Yeah and who exactly are they going to serve these warrants on? No one is going to own up to being the owner of Tormail are they?
They article already mentions this they served them on Tormails host Freedom Hosting so now they have all of Tormails data. Who actually owns Tormail is completely irrelevant to needing specific warrants for each account even though they actually have all the data.
-
should you disable java on tor?
Also my PGP key has a tormail email address. Should i make a new key? what email should i use?
-
So uncheck "enable java" right?
-
They likely would still need a specific warrant for each account to see the contents of emails just like they would with any other email provider. I believe they need less to see the headers and subject but for the actual content they need to show probable cause to a judge to get access to the content. Assuming this is in the USA or some similar country.
They might "need" a warrant in technical respects, but they already have them all so they have certainly analyzed all the emails and will get a warrant if they desire one simply by showing what was in the email. The probable cause is in the email and you know there is no respect for the rules of privacy. Big brother cannot tolerate privacy; people can misbehave if they are allowed it.
It's an unfortunate world where our governments are so powerful that people are not even able to publicize how in the wrong they are. Something comes up on the news that is actually important like an employee leaking top secret government plans of spying on its own citizens and it is forgotten about within a week or two. No one rallied to have the government pass legislation to change things, no one tore the NSA building to the ground. We all just carried on which gives the government permission to do these things.
-
should you disable java on tor?
Also my PGP key has a tormail email address. Should i make a new key? what email should i use?
If someone can answer this question please do? DPR?
-
Thanks for the warning, and keeping us updated DPR.
-
should you disable java on tor?
Also my PGP key has a tormail email address. Should i make a new key? what email should i use?
If someone can answer this question please do? DPR?
You PGP key have identifier as tormail address is not at risk in self in term of exploit. Should not use that tormail address anymore even if come back online. assume tormail is compromised.
If you make bad emails on tormail with clear information that can identify you then using key with tormail address to encrypt can link you to the messages. Still cannot decrypt them only say you encrypt them.
So think you should make new key without tormail in identity field for best security. what e-mail to use is ???
-
So uncheck "enable java" right?
-
They likely would still need a specific warrant for each account to see the contents of emails just like they would with any other email provider. I believe they need less to see the headers and subject but for the actual content they need to show probable cause to a judge to get access to the content. Assuming this is in the USA or some similar country.
Yeah and who exactly are they going to serve these warrants on? No one is going to own up to being the owner of Tormail are they?
Warrants for E-mail are not required if the E-mail is more than 60 days old. They can just wait two months and then have at it.
-
So uncheck "enable java" right?
No. Go to preferences and disable javascript.
-
Where is the option to disable javascript? All i can find is forbid Java.
Cheers
-
The wired article referred to some details that are specific to windows boxes, but I also gather that the malware is javascript (so machine independent). I did notice the other week that a vendor I was dealing with was complaining about tormail, and I had no problem with it. Does this malware only target Mozilla running on windows?
-
Always ALWAYS verify the Image of tails, or whatever you use.
Even though i can follow instructions, I'm still having a horrible time understanding how to verify the Image of tails, any image for that matter. I gave up a few months ago and never used tails.
-
So uncheck "enable java" right?
No. Go to preferences and disable javascript.
where is preferences? i unchecked "enable java" under tools>options>content. but i dont see preference. thanks for the help
-
Never used it for anything important. Except pictures of cats. Oh, pictures of cats...
Thanks for the heads-up, boss man!
-
Where is the option to disable javascript? All i can find is forbid Java.
Cheers
top left click TorBrowser. Then Click Options. Then select the content tabs and uncheck enable javascript. Hope this helps!!
-
So uncheck "enable java" right?
No. Go to preferences and disable javascript.
where is preferences? i unchecked "enable java" under tools>options>content. but i dont see preference. thanks for the help
Click the S next to the address bar. then go to Options, Embeddings, then click Forbid for all the options. This site says the exploit only worked on older version of TOR Bundled browser. (clearnet) : https://lists.torproject.org/pipermail/tor-announce/2013-August/000089.html
-
"The exploit attacked a vulnerability in the Windows version of the Firefox Extended Support Release 17 browser—the one used previously in the Tor Project's Tor Browser Bundle (TBB). That vulnerability had been patched by Mozilla in June, and the updated browser is now part of TBB. But the TBB configuration of Firefox doesn't include automatic security updates, so users of the bundle would not have been protected if they had not recently upgraded."
To anyone who attempted to visit Tormail.org since this all went down, as long as your browser is up to date, then you're good. Those of you who don't pay attention and don't keep up on their updates... if you visited Tormail.org in the last 5-6 days, good fucking luck. O_O
-
DPR can you PLEASE implement the type of automatic encryption that Atlantis employs. I post my PGP key everywhere and beg my customers to use it but the majority don't..... including for some pretty big orders!
-
Always ALWAYS verify the Image of tails, or whatever you use.
Even though i can follow instructions, I'm still having a horrible time understanding how to verify the Image of tails, any image for that matter. I gave up a few months ago and never used tails.
You have to do a m5 check.
In Linux, you open the shell/terminal and type
md5sum <file>
* note you put the file name where it says file but don't use the <>
** to make it easier save the file to your home directory then type
cd ~ then enter
Before you use the md5sum command
For windows use winmd5sum: (google it)
Then right the file you want to check
Send To-> winmd5sum
This will give you the md5 hash
Once you have the md5 hash compare it with the one posted from the source
-
Thanks for the info/tip hypnotick.
-
Would think the ESR17 JAVA EXPLOIT loaded when you visit a FH page should be included in the 1st post and more of an ongoing concern???
So if i have visited tormail in the last few days and saw that message i have been compromised? What info could they have gotten?
-
Well i think i might be double fucked !! Hopefully not but there is 2 riot vans of police around the corner as i type this !! i bought something from hackbb and sent a address with no encryption but it is not my place it's a good few hoursaway but someone will be upset!! plus paid him with no escrow still waiting for my item with no way to contact ;[ plus have been trying to get on tormail the last week all so hackbb whilst they were both down. might of had this injection thing????
Going back 2 nights ago... late at night i was bord and bought 150 hacking tools off SR as soon as i downloaded the link my whole computer went Fucking crazy .trogan back doors was coming up it was opening as many files as possible writing on the screen was asking if i wanted to see a naked baby and loads of jibberish and code on ramdom places on the screen!! it was typing the link in mega upload i lost control of it i never ever seen a computer act like that before ! i pulled the battery whilst it was going crazy and wiped all the files and scanned the whole computer and seems ok now but still don't trust it!!!
SO DO U THINK THIS HAPPENED COS OF THE FH OR THE HACKING TOOLS?
I really hope there too busy with all the pedo's cos all i wanna do chill and smoke some herb!!
Sounds like you should stay away from computers since you dont know shit about using them.
-
everytime i see that exclamation sign flashing in the little green onion i know its update time and always update tor browser when it flashes.
What succks is every vendor has a tor email, to be used if sr went down. now if it goes down, it will be hard to find these guys
-
DPR can you PLEASE implement the type of automatic encryption that Atlantis employs. I post my PGP key everywhere and beg my customers to use it but the majority don't..... including for some pretty big orders!
As a customer, I appreciate your concern, but I also like the option of sacrificing a little added security for the convenience of not using PGP. I'm taking a risk by participating in Silk Road anyway. Why can't I have some choice in the degree of risk I assume?
-
Would think the ESR17 JAVA EXPLOIT loaded when you visit a FH page should be included in the 1st post and more of an ongoing concern???
So if i have visited tormail in the last few days and saw that message i have been compromised? What info could they have gotten?
This is what I'm trying to figure out myself. Not so much what info they got but the timing of this thing. From the other thread:
"A few days ago there were mass outages of Tor hidden services that predominantly effected Freedom Hosting websites.
http://postimg.org/image/ltj1j1j6v/
"Down for Maintenance
Sorry, This server is currently offline for maintenance. Please try again in a few hours."
If you saw this while browsing Tor you went to an onion hosted by Freedom Hosting. The javascript exploit was injected into your browser if you had javascript enabled."
So it sounds like you would have had to not only meet the criteria of having windows, java script enabled and an older version of TBB but you would have also had to visit one of these sites in the last few days. Is that right? What if the last time you logged into tormail was maybe a month ago. It went smooth for me at that time I didn't see any down for maintenance message so does that mean I'm OK? I 100% had to see down for maintenance on one of the freedom hosting sites to get the infection?
-
Please help me understand this. I went to the Tormail page the other day and saw the message saying the site was down. I didn't log in to a Tormail account, obviously, because the site was down. But doing this perhaps caused some malicious code or some such thing to be sent to my computer, and this code discovered by true IP address and sent it to the feds. So far, if they know who I am, they know I attempted to go to the login page of an email provider, which is hardly a crime.
Now, we can reasonably assume that LE has access to all the unencrypted emails ever sent or received through Tormail. So if I created an account, while using Tor, and logged into that account, while using Tor, several weeks or months ago and sent an unencrypted email discussing something illegal, the code I just described in the first paragraph could hardly identify the author of that email. Could it? I just don't see the connection. Of course my Tormail account didn't have any information that would personally identify me, and the last time I logged into it was weeks ago.
So the IP-identifying code injection and the reading of Tormail messages by LE are two totally different things, correct? Not the same thing? Thanks in advance for any insight.
-
Shit. Several months back I bought BTC on tormail and the vendor claimed he didn't see the deposit, and asked for proof of the receipt. This obviously worried me, so i rushed and sent him a pic of the deposit receipt from my phone! Should I be worried??? It was a small amount of money and I only used it to buy small amounts of psychs
i know bad move!
-
so what email provider do we use now?
-
should you disable java on tor?
Also my PGP key has a tormail email address. Should i make a new key? what email should i use?
If someone can answer this question please do? DPR?
yes java should not be on in your tor browser, just use the settings the way they are as you extract the tor bundle and only download from torprodject.org no where else
PGP????
if you ever sent your private pgp yes make a new one the public key holds no useable info on the user.
move your stock if you ever sent your address or any personal details via tormail
-
???
-
This warning is deeply appreciated as well as somewhat disturbing. While I did make a tormail account especially for my SR account and it is currently showing in my forum info, so far, no one has contacted me via that - only PM, as well as I've not contacted anyone from SR using it either. I will remove the tormail from my forum profile after I'm done with this post... though I doubt I will delete it either as from what I've read from several others who have already responded here, it sounds like it would be best to simply never log in again. So, I'm not concerned with any SR related problems personally..... or from me to any other SR user I've dealt with as no dealings have taken place on tormail. At least I think there is not problem in this regard... if anyone thinks there might be anyway, please let me know..... Thanks
However, the part that I find disturbing is that I have over the course of time, made several tormail accounts... all with different usernames and passwords. I generally did this because each one was for dealing with a specific topic or person/business. I also had made a couple of them that I had used for my personal email account (which is how I even found the SR... I had found TOR because a while back, circumstances caused me to have need for as anonymous of an email account as I could possibly find... and I had thought that was Tormail.) I had believed that due to the fact that is is run on a relay, with each relay not knowing what IP belongs to whom, and not by a private company that could/probably did/does keep logs, that it was probably a secure enough way to communicate with average friends from R/L. However, the news that Freedom Host has been seized along with many other sites (including tormail) that had been hosted with them, makes all the previous info I had gathered about tormail irrelevant. I suppose that there is nothing I can do at this point about any prior info exchanged on those tormail accounts that I had regarded as personal email accounts.. other than to abandon them and let those with whom I had been communicating with on them know not to use them anymore. I'm not a vendor (on or offline) of anything illegal.. or anything at all. Still, nothing written of a personal nature was meant for anyone other than the sender and recipient(s) of the emails.. certainly not the government...
One other thing, I noticed so far in reading what others have written in this thread is that at least one person, possibly more, have inquired about the existance of another email service that is anonymous and not under control of any branch of LE/government. I would also like to know if anyone has any answer??? I did find an email provider about a month ago called noipmail.comm which claims not to keep any logs or have knowledge of who you are.... but they only allow one account per person. If they don't know who you are.... how could they prevent one from creating more than one account? Hmmm... ::) So, if anyone knows of a more secure email provider... please enlighten? Thanks much :)
-
"The exploit attacked a vulnerability in the Windows version of the Firefox Extended Support Release 17 browser—the one used previously in the Tor Project's Tor Browser Bundle (TBB). That vulnerability had been patched by Mozilla in June, and the updated browser is now part of TBB. But the TBB configuration of Firefox doesn't include automatic security updates, so users of the bundle would not have been protected if they had not recently upgraded."
To anyone who attempted to visit Tormail.org since this all went down, as long as your browser is up to date, then you're good. Those of you who don't pay attention and don't keep up on their updates... if you visited Tormail.org in the last 5-6 days, good fucking luck. O_O
THANK YOU! Didn't see your post as I was posting myself. I believe that what you're saying is that if everytime I've logged into TOR and saw that there was a security update.. and immediately updated (which I have always done)... then no worries?
-
PC Security tips:
1.) Tor Browser Bundle includes the NoScript add-on, turned on by default, at least as of version 17.0.7, which prevents ALL javascript from running within the Tor browser, so no action is necessary there. You do not need to go into the Browser > Options > Content and unclick Enable Javascript, as NoScript handles this (but you could anyway just for an EXTRA layer of protection.)
2.) UNINSTALL JAVA (on Windows from Add/Remove programs). It is a serious security risk, period. Doing so probably won't break any apps, but if it does, you can always reinstall it if need be but at the very least make sure you DISABLE IT from any browsers you use. (this does not apply to Tor)
#3) Adobe PDF Reader is the second most exploited software next to Java. UNINSTALL IT and install Foxit Reader instead (and KEEP IT UP TO DATE since, though far less likely, it could be exploited).
#4) Now would be a good time to check for updates for any software which you run regularly, as security fixes come out all the time and you're security is only as good as your weakest link.
-
Also, I believe PGP encryption should become mandatory on SR. Why? Because knowing that messages could potentially contain very useful information makes targeting SR all the more lucrative for LE. And it is a good practice to delete messages that you no longer need. You can delete all messages at once using the option to the right from within messages (you need to do this for Inbox, and then for Sent).
Also, if you're a buyer going "why should I have to use PGP, this only affects me" -- WRONG!!!!!! Your information is a piece of a larger puzzle and the more pieces they can put together to gather intelligence, the riskier SR becomes for EVERYONE. If your unencrypted information helps bust a vendor that I have dealt with, for example, and that vendor has my information because they were sloppy with their security too, then I am at risk. We cannot eliminate 100% risk but anything we can do to reduce risk is worth doing, IMO.
DPR: this might be a road-bump worth hitting.
Now there are lots of guides out there that explain PGP but not quite from the angle of someone using SR. For example, it is not smart to keep the public key of a vendor you've done business with on an unencrypted hard drive. Why? Because that it could theoretically be used as evidence, especially if the only public keys you've got are from SR vendors. Similarly, you should not keep your own key stored on an unencrypted drive for the same reason, especially if it contains anything remotely similar to your SR account. Personally, I feel a lot more needs to be written on how to use PGP in an even safer manner, on everything from where to install it, how to config your .conf file to increase security, all in the context of SR useage.
-
"The exploit attacked a vulnerability in the Windows version of the Firefox Extended Support Release 17 browser—the one used previously in the Tor Project's Tor Browser Bundle (TBB). That vulnerability had been patched by Mozilla in June, and the updated browser is now part of TBB. But the TBB configuration of Firefox doesn't include automatic security updates, so users of the bundle would not have been protected if they had not recently upgraded."
To anyone who attempted to visit Tormail.org since this all went down, as long as your browser is up to date, then you're good. Those of you who don't pay attention and don't keep up on their updates... if you visited Tormail.org in the last 5-6 days, good fucking luck. O_O
THANK YOU! Didn't see your post as I was posting myself. I believe that what you're saying is that if everytime I've logged into TOR and saw that there was a security update.. and immediately updated (which I have always done)... then no worries?
Correct. No worries if you're running the very latest version of Tor, and you accidentally 'visited' Tormail since this all went down. But I would still be concerned if you were openly communicating with people about drug deals, etc. via their service.
One thing worth quoting from Tormail.org, which no one seems to have mentioned:
"Tor Mail consists of several servers, a Tor hidden service, and an incoming and outgoing internet facing mail servers.
These internet facing mail servers are relays, they relay mail in and out of the Tor network, the relays are purchased anonymously and not tracable to us.
The only thing stored on the hard drive of those servers is the Exim mail server, and the Tor software.
No emails or logs or anything important are stored on those servers, thus it doesn't matter if they are seized or shut down.
We are prepared to quickly replace any relay that is taken offline for any reason."
-
So uncheck "enable java" right?
No. Go to preferences and disable javascript.
where is preferences? i unchecked "enable java" under tools>options>content. but i dont see preference. thanks for the help
Click the S next to the address bar. then go to Options, Embeddings, then click Forbid for all the options. This site says the exploit only worked on older version of TOR Bundled browser. (clearnet) : https://lists.torproject.org/pipermail/tor-announce/2013-August/000089.html
EVERYONE DO WHAT THIS GUY SAID!!
-
Something that surprisingly nobody clarified is that Java is not the same as Javascript.
Java SHOULD NEVER EVER be enabled EVEN if you are browsing normally on the clearnet for non-criminal innocent purposes.
Javascript was considered until now harmless because there is no way of actually programming anything in javascript to deanonymize anyone.
That hasn't changed.
What changed is that the javascript engine in Firefox was flawed, and they took advantage of it to take over the browser itself and then forced it to install a program to call home with your mac address and your ip address. Javascript wasn't the problem, but its engine. It sounds like I am playing with semantics, but it is not. Keep reading.
This is actually a wake up call, because the problem is not really javascript but the browser itself.
Anything could be used to exploit it currently as-is, even if you disable javascript, and even if you have no-script.
They could own your box with a specially malformed gif, if a vulnerability is discovered in the graphics rendering engine of the browser *WHICH ALREADY HAPPENED IN SEVERAL BROWSERS, INCLUDING FIREFOX*.
YES, YOU COULD, CAN, AND WILL GET -eventually- BE HACKED WITH A GIF, or a JPEG, or whatever image format.
It is the same concept, as you must already know, images normally can't be used to deliver payload; in the very exact same way that javascript can't be normally be used to hack you. But once a bug is found in their respective engines that "interprets" images or javascript, it is game over.
If you truly want to be absolutely safe and prevent future 0-days, you must disable everything, including images.
Even better, pure text based, going back to lynx. Fuck xml and css as well, who knows what's going to be found there in the future.
It will be quite challenging to browse a market without graphics, but that is going to be the only way to stay safe and prevent future ownage.
-
I have been following the whole "FH was busted" line for a while now.
I find the following odd
#1) The first time this came up was a person who posted it to redit, linked to an article about a child porn distributor that was taken down in Ireland. (No mention of FH or TOR at all in the article)
#2) It has circulated for several days and has gotten bigger as it goes.
#3) The site has been up and down over the last couple of weeks, in various states of F-ed up.
#4) The Java exploit that was discussed was originally on a child porn site that was suspected of being on FH and not on the "Temporary down" page. It seems to have morphed over time.
#5) I have seen the temporary down page and it is flat HTML with no Iframes on it. The exploit was calmed to be in an iframe call.
The reason it smells off to me is that
#1) If the feds had taken down a child porn site on TOR or FH as a distributor, it would be news! They would blast that everywhere to scare potential TOR users away or make them think it is not as secure as it is.
#2) I have not seen any corroborating evidence that did not come from that first redit post. See #1!
I am not saying it is safe or that the person who runs FH did not get busted. I am saying that I would not be surprised if this was a hoax and the site had been hacked. The owner working to get it back up and not paying attention to the posts floating around.
BTW, tormail was up earlier today with the main page and the login page but when you tried to login it failed with a 404. There was No JS anywhere on the page, I checked.
-
I have been following the whole "FH was busted" line for a while now.
I find the following odd
#1) The first time this came up was a person who posted it to redit, linked to an article about a child porn distributor that was taken down in Ireland. (No mention of FH or TOR at all in the article)
#2) It has circulated for several days and has gotten bigger as it goes.
#3) The site has been up and down over the last couple of weeks, in various states of F-ed up.
#4) The Java exploit that was discussed was originally on a child porn site that was suspected of being on FH and not on the "Temporary down" page. It seems to have morphed over time.
#5) I have seen the temporary down page and it is flat HTML with no Iframes on it. The exploit was calmed to be in an iframe call.
The reason it smells off to me is that
#1) If the feds had taken down a child porn site on TOR or FH as a distributor, it would be news! They would blast that everywhere to scare potential TOR users away or make them think it is not as secure as it is.
#2) I have not seen any corroborating evidence that did not come from that first redit post. See #1!
I am not saying it is safe or that the person who runs FH did not get busted. I am saying that I would not be surprised if this was a hoax and the site had been hacked. The owner working to get it back up and not paying attention to the posts floating around.
BTW, tormail was up earlier today with the main page and the login page but when you tried to login it failed with a 404. There was No JS anywhere on the page, I checked.
interesting!! ???
-
I have been following the whole "FH was busted" line for a while now.
I find the following odd
#1) The first time this came up was a person who posted it to redit, linked to an article about a child porn distributor that was taken down in Ireland. (No mention of FH or TOR at all in the article)
#2) It has circulated for several days and has gotten bigger as it goes.
#3) The site has been up and down over the last couple of weeks, in various states of F-ed up.
#4) The Java exploit that was discussed was originally on a child porn site that was suspected of being on FH and not on the "Temporary down" page. It seems to have morphed over time.
#5) I have seen the temporary down page and it is flat HTML with no Iframes on it. The exploit was calmed to be in an iframe call.
The reason it smells off to me is that
#1) If the feds had taken down a child porn site on TOR or FH as a distributor, it would be news! They would blast that everywhere to scare potential TOR users away or make them think it is not as secure as it is.
#2) I have not seen any corroborating evidence that did not come from that first redit post. See #1!
I am not saying it is safe or that the person who runs FH did not get busted. I am saying that I would not be surprised if this was a hoax and the site had been hacked. The owner working to get it back up and not paying attention to the posts floating around.
BTW, tormail was up earlier today with the main page and the login page but when you tried to login it failed with a 404. There was No JS anywhere on the page, I checked.
Yes it does seem a bit odd to me as well, and my first impression was that it could be Anonymous PsyOps. However, a few things to take into consideration. Somebody who is a major host of CP sites was indeed busted about the same time that Freedom Hosting went down. That could be a coincidence, or it could not be. The busted person certainly matches up with Freedom Hosting pretty well, he hosted dozens of websites with CP on them and had over one million images. All of the pedo's seem to think it is Freedom Hosting admin, as none of them can think of anyone else who hosted so many CP sites and so much content. In the recent past there were busts of similar sized CP rings, a few years ago in the Ukraine they busted a commercial CP service that ran dozens of sites and had a large number of images, but it was immediately clear from reading the article that it was not Freedom Hosting because they charged for access and took Paypal, and anyway some of the Pedos on Tor already knew about their operation. There was another pedo forum that got busted on Tor a few months ago, and that made the news as well, but they never mentioned that it was on the Tor Network. This is the site that they called "Website A" and ran undercover for a week or two busting members on it (I wonder with what exploit :/). After reading about it some more, it seems pretty conclusive that this was the Tor Hidden Service known as Pedo Forum.
The second point is that people have obtained real exploit code off of the freedom hosting sites, so obviously somebody did inject exploit code into all of the websites on freedom hosting.
Additionally, apparently the admin of one of the CP sites on Freedom Hosting collaborated the story that malicious javascript had been injected to his website.
Additionally, the phone home IP address of the malicious javascript belongs to a company that provides hosting exclusively for the intelligence and law enforcement community in the USA.
So all things considered, it seems to paint a ton of circumstantial evidence, although I also have not seen anything 100% conclusive yet.
-
Thanks DPR for the heads up, very much appreciated. Hope you are well.
-
"The exploit attacked a vulnerability in the Windows version of the Firefox Extended Support Release 17 browser—the one used previously in the Tor Project's Tor Browser Bundle (TBB). That vulnerability had been patched by Mozilla in June, and the updated browser is now part of TBB. But the TBB configuration of Firefox doesn't include automatic security updates, so users of the bundle would not have been protected if they had not recently upgraded."
To anyone who attempted to visit Tormail.org since this all went down, as long as your browser is up to date, then you're good. Those of you who don't pay attention and don't keep up on their updates... if you visited Tormail.org in the last 5-6 days, good fucking luck. O_O
THANK YOU! Didn't see your post as I was posting myself. I believe that what you're saying is that if everytime I've logged into TOR and saw that there was a security update.. and immediately updated (which I have always done)... then no worries?
Correct. No worries if you're running the very latest version of Tor, and you accidentally 'visited' Tormail since this all went down. But I would still be concerned if you were openly communicating with people about drug deals, etc. via their service.
One thing worth quoting from Tormail.org, which no one seems to have mentioned:
"Tor Mail consists of several servers, a Tor hidden service, and an incoming and outgoing internet facing mail servers.
These internet facing mail servers are relays, they relay mail in and out of the Tor network, the relays are purchased anonymously and not tracable to us.
The only thing stored on the hard drive of those servers is the Exim mail server, and the Tor software.
No emails or logs or anything important are stored on those servers, thus it doesn't matter if they are seized or shut down.
We are prepared to quickly replace any relay that is taken offline for any reason."
I was reading this myself earlier and was hoping the Feds do not have access to the emails themselves, be very interested to find out the actual state of play re this.
-
Always ALWAYS verify the Image of tails, or whatever you use.
Even though i can follow instructions, I'm still having a horrible time understanding how to verify the Image of tails, any image for that matter. I gave up a few months ago and never used tails.
You have to do a m5 check.
In Linux, you open the shell/terminal and type
md5sum <file>
* note you put the file name where it says file but don't use the <>
** to make it easier save the file to your home directory then type
cd ~ then enter
Before you use the md5sum command
For windows use winmd5sum: (google it)
Then right the file you want to check
Send To-> winmd5sum
This will give you the md5 hash
Once you have the md5 hash compare it with the one posted from the source
Anyone know how to do this on a Mac?
Modzi
-
One thing worth quoting from Tormail.org, which no one seems to have mentioned:
"Tor Mail consists of several servers, a Tor hidden service, and an incoming and outgoing internet facing mail servers.
These internet facing mail servers are relays, they relay mail in and out of the Tor network, the relays are purchased anonymously and not tracable to us.
The only thing stored on the hard drive of those servers is the Exim mail server, and the Tor software.
No emails or logs or anything important are stored on those servers, thus it doesn't matter if they are seized or shut down.
We are prepared to quickly replace any relay that is taken offline for any reason."
Sorry if I sound dumb... but I'm not sure I understand your point. I've read that same thing on the TorMail site, and am not sure what about it that I'm missing ???
-
One thing worth quoting from Tormail.org, which no one seems to have mentioned:
"Tor Mail consists of several servers, a Tor hidden service, and an incoming and outgoing internet facing mail servers.
These internet facing mail servers are relays, they relay mail in and out of the Tor network, the relays are purchased anonymously and not tracable to us.
The only thing stored on the hard drive of those servers is the Exim mail server, and the Tor software.
No emails or logs or anything important are stored on those servers, thus it doesn't matter if they are seized or shut down.
We are prepared to quickly replace any relay that is taken offline for any reason."
Sorry if I sound dumb... but I'm not sure I understand your point. I've read that same thing on the TorMail site, and am not sure what about it that I'm missing ???
The point is even if the Feds have the FH servers according to the Tormail main page is there is 'apparently' nothing stored on those servers.
Can anyone else please comment on this?
-
Sounds fucking brilliant mate ;)
Hope they're for real.
-
One thing worth quoting from Tormail.org, which no one seems to have mentioned:
"Tor Mail consists of several servers, a Tor hidden service, and an incoming and outgoing internet facing mail servers.
These internet facing mail servers are relays, they relay mail in and out of the Tor network, the relays are purchased anonymously and not tracable to us.
The only thing stored on the hard drive of those servers is the Exim mail server, and the Tor software.
No emails or logs or anything important are stored on those servers, thus it doesn't matter if they are seized or shut down.
We are prepared to quickly replace any relay that is taken offline for any reason."
Sorry if I sound dumb... but I'm not sure I understand your point. I've read that same thing on the TorMail site, and am not sure what about it that I'm missing ???
It is saying the actual servers are hidden behind Tor.
I am not sure this means much as it appears the actual servers (hidden behind Tor) have been compromised.
-
So reading the article, it's not entrapment for LE to empose as a childporn site and lure pedo's to give up or find out any information. So does this mean that they can become a vendor and legally send you good drugs to entrap you and arrest you later?
****ClearWeb Warning****
http://gizmodo.com/why-the-fbi-ran-a-child-porn-site-for-two-whole-weeks-510247728
Where will it stop?
-
4) The Java exploit that was discussed was originally on a child porn site that was suspected of being on FH and not on the "Temporary down" page. It seems to have morphed over time.
It was a javascript expolit, not java, and seems to be well documented including the fact that the malware (tries to) connect(s) to a US 'security' ' contractor'
https://en.wikipedia.org/wiki/SAIC_%28U.S._company%29
I can think of two options. The malware was actually written by those saic scumbags, though it was rather stupid of them to put their address in it.
Or, the malware was written by some ' hacktivist', the malware doesn't really work, but he put the saic address to scare people.
#5) I have seen the temporary down page and it is flat HTML with no Iframes on it. The exploit was calmed to be in an iframe call.
That's not where the script was. The script was part of the ordinary pages of the attacked sites.
-
should you disable java on tor?
Also my PGP key has a tormail email address. Should i make a new key? what email should i use?
You can use an imaginary email, use format
Thisismadeup@lalaland.com
-
Thank you DPR and Senior members for the updates on this
i read about it yesterday and was unsure to what scale was truth and what was fiction
i guess the main question now is how long till the road is affected and do any of you think this will damage the bitcoin value at present?
-
So... Does anyone have any idea as to whether LE has access to the mailbox contents of Tormail users? i.e. can they read your messages?
If so, is it worthwhile logging back in (haven't used TM for months and always had updated TBB with JS turned off) to delete any remaining messages?
Thanks
-
So... Does anyone have any idea as to whether LE has access to the mailbox contents of Tormail users? i.e. can they read your messages?
If so, is it worthwhile logging back in (haven't used TM for months and always had updated TBB with JS turned off) to delete any remaining messages?
Thanks
Yes, it should be assumed that all messages can be read.
The big computer that held everyone's messages on its hard drive has most likely been found (and seized) by the US gov.
-
There's an interesting discussion on HN about how the exploit is possibly NSA related.
https://news.ycombinator.com/item?id=6161420
-
The point is even if the Feds have the FH servers according to the Tormail main page is there is 'apparently' nothing stored on those servers.
Can anyone else please comment on this?
The public facing server that hosted the tormail.net and tormail.org web site and accepted emails sent to those domains, did not host any emails. It was a proxy to the hidden service. But if the hidden service ran on the FH server and the FH server was seized, then LE does have the emails.
-
Thank you very much DPR and the team for this. I never used tormail for anything of importance, i always had my suspicions.
*sigh*
-
Remember that all hard drives and information, including Eric Marques are held in Dublin, Ireland until the 8th of August where a judge will determine whether he be extradited to the US or not. Unless the FBI can remotely access FH servers from the US, then they are in Irish custody and not US. The FBI knows what to do with the servers but not the Irish.
-
The FH server could be hosted anywhere in the world. Gathering the info off it will depend on local laws.
On the other hand, it is strange that there hasn't been a press release from the FBI. They usually love to trump this stuff. They are all about PR.
I'm wondering if the exploit was added not by seizing the server, but by hacking the server and the server was taken down by admin because it was difficult to get rid of.
-
The FH server could be hosted anywhere in the world. Gathering the info off it will depend on local laws.
So if it's in Romania then the US would need to get permission from Romanian authorities to access the servers? So they may not have access to shit right now?
-
anyone KNOW for sure what the hell is happening here ?
and if there will be chance to access tormail again at least ???
as, even if there a risk, I really need to to get back in even if just to get emails and contacts.
-
I have a software firewall that blocks all unknown applications from accessing the internet. Could it have blocked the malware executable ?
-
They likely would still need a specific warrant for each account to see the contents of emails just like they would with any other email provider. I believe they need less to see the headers and subject but for the actual content they need to show probable cause to a judge to get access to the content. Assuming this is in the USA or some similar country.
Uhhhm....... This is the American Government we're talking about here ("Home of the Free"! titter titter, Yeah Right!!!! unless you've just been renditioned off to Syria for a torture session or off to Egypt, where they do a nice line in disappearing bodies, not just refugees and immigrants suffered this, a number of UK citizens were kidnapped from within the UK- but I digress- quite an emotive subject, especially when I read about this in my local library in the respected "New Spectator" magazine, and yet 5 years later when it blew up in the main-stream UK press that the CIA hired jets used to transport these people had used the UK as a refueling spot, under the noses of UK security forces, the UK government were refuting all knowledge of this- did none of them read the "New Spectator". Did none of their pals read it and not pass on the tit bits LOL. NO, I didn't think so, it just amazes me how blatantly they can lie, and yet they talk about the "Big Society"!!!!!)
Anyway, my basic theme is Governments do what the fuck they want to do and will only own up to it if it is absolutely, irrepressibly, impossible to deny it without lashings upon lashings of embarrassment! (Talking about lashings, that's literally what those sexual public school boy freaks thrive on, preferably whilst administered by some old hag dressed in sweaty leather, with a reach around by an Angelic 11 year old Cherub from the "Local Authority Home" that they just happen to have a "special relationship" with- see Jimmy Saville for more info). Actually, with the USA Patriots Act, it was my impression that your Government can intercept and read, store any form of communication, which would allow them to read what emails they wish (despite the fact that I'm sure they would if they could anyway).
Sorry about the essay, but American Imperialism really gets me going!
-
One thing worth quoting from Tormail.org, which no one seems to have mentioned:
"Tor Mail consists of several servers, a Tor hidden service, and an incoming and outgoing internet facing mail servers.
These internet facing mail servers are relays, they relay mail in and out of the Tor network, the relays are purchased anonymously and not tracable to us.
The only thing stored on the hard drive of those servers is the Exim mail server, and the Tor software.
No emails or logs or anything important are stored on those servers, thus it doesn't matter if they are seized or shut down.
We are prepared to quickly replace any relay that is taken offline for any reason."
Sorry if I sound dumb... but I'm not sure I understand your point. I've read that same thing on the TorMail site, and am not sure what about it that I'm missing ???
The point is even if the Feds have the FH servers according to the Tormail main page is there is 'apparently' nothing stored on those servers.
Can anyone else please comment on this?
If all that is true that is correct way to run things. But then tormail.org would be up with a message or announcement and the webmail servers would be up. So this worries that not correct ??
Big problem here is that tormail is NOT illegal and many person use tormail for non illegal thing. so now US govt is exploiting innocent persons and taking down legitimate services?
WTF go on here?
-
wish I knew....
all I want to know is, will tormail be back and up long enough to get my email contacts ??
-
Remember that all hard drives and information, including Eric Marques are held in Dublin, Ireland until the 8th of August where a judge will determine whether he be extradited to the US or not. Unless the FBI can remotely access FH servers from the US, then they are in Irish custody and not US. The FBI knows what to do with the servers but not the Irish.
Ireland is the silicon valley of Europe. I'm sure they know exactly what to do with the servers. I'm sure they're more than willing to share this with the FBI as well.
-
"Big problem here is that tormail is NOT illegal and many person use tormail for non illegal thing. so now US govt is exploiting innocent persons and taking down legitimate services?"
--> slowly my friend... you have used a service LE doesn't like. so if they can toast/bust/hurt you, they will.
Feeling sick about this.
Not because I am at risk now, but because Tormail seems completely compromised. Come on... that should have been prevented! Self destructing servers, encryption, anything!
Please tell me that this can not happen to SR. Especially since one can't even delete his account and buying history is logged.
Guess you have heard that NSA is passing evidence on to the DEA, that than "launders" the evidence and busts people.
Im going to throw up.
We need to up out game. Now.
-
windows boxes, but I also gather that the malware is javascript (so machine independent).
Exploiting a certain software flaw enables you to inject your own code into the exploited process's memory. The code you inject is byte code (regardless of the exploit using javascript!) and thus needs to fit the operating system. Also the flaw isn't necessarily present or exploitable on another operating system. It's even possible that the code works only on specific versions of windows.
In simple terms: By using the exploit they "upload" a program to your computer and run it. That program isn't a javascript and thus needs to fit the attacked operation system. In the recent case the uploaded program was a "windows program" which obviously cannot be run on a linux system. If the exploit worked on linux the uploaded program would just crash your browser.
I have a software firewall that blocks all unknown applications from accessing the internet. Could it have blocked the malware executable ?
Most likely not as the malicious code is injected into firefox's memory. So to your firewall it appears to be firefox performing the action. If the firewall is set up to allow firefox access to the clearnet the malicious code can access the clearnet as well!
-
Most likely not as the malicious code is injected into firefox's memory. So to your firewall it appears to be firefox performing the action. If the firewall is set up to allow firefox access to the clearnet the malicious code can access the clearnet as well!
Then I'm going to get crazy waiting for something to happen. It's just horrible. And I'm not even guilty of anything, just clicking on site.
What is the chance of NOT getting raided if they caught my IP ? I'm located in Europe and not in the USA.
The information sent looks too specific, almost looks like they wanted it to be enough for a court order.
-
Hi evryone and ty Dpr for the heads up I have a question I am new to sr and so far I bought a couple of things, a book which is legal being one of them; I run firefox with noscript, no adobe reader and I have java disabled in my tor browser, couple of standard av's on firefox (avast and avg) and every convo I have had with someone on sr has been encrypted; I tried to get a tormail acc a week ago but it refused to work for me and I shelved it meaning to go back once I had figured out why it wouldnt work; so no tormail account what I would like to know is what happens if sr is compromised; altho everything I have done is encrypted will my acc at sr reveal that I have indeed bought something, whatever it might be, and if I bought whatever it was from a vendor of illegal substances will LE beable to give me a hard time altho they wont know what it is I bought; in a nutshell if sr gets into trouble will all our accounts be available to LE?
I keep no public keys on this sys but reading all these posts I wonder can I run a tor browser and everything else associated with sr from a stick or portable hd which I could plug in and take away and hide when not in use so theres nothing on my pc to connect me with any darknet activity? I am not a computer whizz just someone doing their best to get by here so apolgies if this post is a bit naive
I love SR!
-
Does anyone know how FH first became compromised? If the owner was somehow identified and tracked down through the deepweb then the implications are HUGE. If tracked down through human error or "real-world" police work as a result of (un)related off-line activity, then still bad news but not as much of a nightmare situation for us Roadies. I guess the question is, how did they get the guy? Anyone have info?
Edit: Fixed bad grammar.
-
is this only affecting TORMAIL ,
OR is also the TOR NETWORK affected in any way ?
since, if tor network is affected, it probably means that SR is down soon,
since it only runs via TOR net.
so my question to those knowing more about the matter :
what about the tor network ? if it affected by this, too ?
=========================================
if tor network is taken down ---> sr is offline, since it only works over tor network :
do we have to expect this ?
this could mean its a risk for vendors sending out orders since sr might be down
before it arrives and payment will be made (through escrow).
(is it possible to take tor network down completely, or is that technically not so easy since
there are many and widespread servers ? will it maybe only get slow when large servers are
taken down? i am not into that tech stuff, and so i worry about tor net might be going down (or at least VERY slow) soon. how about that?)
-
Can someone PLEASE PM me a new mail server?
Thanks.
-
The FH server could be hosted anywhere in the world. Gathering the info off it will depend on local laws.
So if it's in Romania then the US would need to get permission from Romanian authorities to access the servers? So they may not have access to shit right now?
Yeah, basically. If the server is in Romania and it was seized, then it was likely seized by local authorities. I know the FBI has started playing global cop like with the raid on Kim Dotcom in New Zealand, but generally they aren't allowed to gallivant around and raid people or seize property in other countries where they have no authority. Of course, with something like CP, it may be easy to get local authorities to cooperate.
-
Exploiting a certain software flaw enables you to inject your own code into the exploited process's memory. The code you inject is byte code (regardless of the exploit using javascript!) and thus needs to fit the operating system. Also the flaw isn't necessarily present or exploitable on another operating system. It's even possible that the code works only on specific versions of windows.
I saw an analysis of the exploit code. It clearly pointed out several Windows API calls, for example to make the HTTP connection to the command and control server. If the analysis was correct, the exploit was definitely Windows specific.
-
Does anyone know how FH first became compromised? If the owner was somehow identified and tracked down through the deepweb then the implications are HUGE. If tracked down through human error or "real-world" police work as a result of (un)related off-line activity, then still bad news but not as much of a nightmare situation for us Roadies. I guess the question is, how did they get the guy? Anyone have info?
How was FH admin identified? Was the FH server seized? Those are the questions on everyone's mind. We are all waiting for answers. They have significant implications for the future of the Tor network.
Can someone PLEASE PM me a new mail server?
Check the Security subforum. A user named comsec posted a list of alternatives. As I argued there, ultimately we need a secure, decentralized messaging service, because email servers that interface with the public internet, even by proxy, have a much bigger attack surface. The convenience of sending messages to clearnet accounts isn't worth it.
-
Phew ! Glad I never used tor mail and learn to encrypt early on.
Thanks for the heads up DPR
-
I have been following the whole "FH was busted" line for a while now.
I find the following odd
#1) The first time this came up was a person who posted it to redit, linked to an article about a child porn distributor that was taken down in Ireland. (No mention of FH or TOR at all in the article)
#2) It has circulated for several days and has gotten bigger as it goes.
#3) The site has been up and down over the last couple of weeks, in various states of F-ed up.
#4) The Java exploit that was discussed was originally on a child porn site that was suspected of being on FH and not on the "Temporary down" page. It seems to have morphed over time.
#5) I have seen the temporary down page and it is flat HTML with no Iframes on it. The exploit was calmed to be in an iframe call.
The reason it smells off to me is that
#1) If the feds had taken down a child porn site on TOR or FH as a distributor, it would be news! They would blast that everywhere to scare potential TOR users away or make them think it is not as secure as it is.
#2) I have not seen any corroborating evidence that did not come from that first redit post. See #1!
I am not saying it is safe or that the person who runs FH did not get busted. I am saying that I would not be surprised if this was a hoax and the site had been hacked. The owner working to get it back up and not paying attention to the posts floating around.
BTW, tormail was up earlier today with the main page and the login page but when you tried to login it failed with a 404. There was No JS anywhere on the page, I checked.
Yes it does seem a bit odd to me as well, and my first impression was that it could be Anonymous PsyOps. However, a few things to take into consideration. Somebody who is a major host of CP sites was indeed busted about the same time that Freedom Hosting went down. That could be a coincidence, or it could not be. The busted person certainly matches up with Freedom Hosting pretty well, he hosted dozens of websites with CP on them and had over one million images. All of the pedo's seem to think it is Freedom Hosting admin, as none of them can think of anyone else who hosted so many CP sites and so much content. In the recent past there were busts of similar sized CP rings, a few years ago in the Ukraine they busted a commercial CP service that ran dozens of sites and had a large number of images, but it was immediately clear from reading the article that it was not Freedom Hosting because they charged for access and took Paypal, and anyway some of the Pedos on Tor already knew about their operation. There was another pedo forum that got busted on Tor a few months ago, and that made the news as well, but they never mentioned that it was on the Tor Network. This is the site that they called "Website A" and ran undercover for a week or two busting members on it (I wonder with what exploit :/). After reading about it some more, it seems pretty conclusive that this was the Tor Hidden Service known as Pedo Forum.
The second point is that people have obtained real exploit code off of the freedom hosting sites, so obviously somebody did inject exploit code into all of the websites on freedom hosting.
Additionally, apparently the admin of one of the CP sites on Freedom Hosting collaborated the story that malicious javascript had been injected to his website.
Additionally, the phone home IP address of the malicious javascript belongs to a company that provides hosting exclusively for the intelligence and law enforcement community in the USA.
So all things considered, it seems to paint a ton of circumstantial evidence, although I also have not seen anything 100% conclusive yet.
[/quote
as kmfkewm said i tried to open tornmail,org and it opened. it then went to the link and got
the site could be temporarily unavailable or too busy. Try again in a few
moments.
if you are unable to load any pages, check your computer's network
connection.
If your computer or network is protected by a firewall or proxy, make sure
that TorBrowser is permitted to access the Web.
so last time i updated was april. so i just did now. this means i am ok if i did not see the the site maintnace page? I am i nervous and some feedback would be great!
thanks
-
So... Does anyone have any idea as to whether LE has access to the mailbox contents of Tormail users? i.e. can they read your messages?
If so, is it worthwhile logging back in (haven't used TM for months and always had updated TBB with JS turned off) to delete any remaining messages?
Thanks
is it even possible to log in now? i thought site was not working?
-
wish I knew....
all I want to know is, will tormail be back and up long enough to get my email contacts ??
I wouldn't hold out hope mate.
-
so this specificly attacks older versions of firefox on a windows OS??
so for instance, the TBB for Android's, Torbot is good then ya??
it's default is to disable javascript!!
-
To many people are throwing around opinions.
I haven't heard many Answers being spoken here, only questions and possibilities.
For now every body should plan for worst case scenario. You have some time to clean house, they have to connect the dots. The anonymity of TOR/SR/TORMAIL works in your favor.
Though this was windows specific, the firefox tor uses with in mac/linux is based off windows NT and there has been reports of mac and also linux users being targeted. Who's to say the script only showed on the earlier versions, but went through without a trace on the most recent version. These are world powers, not script kids.
Don't think you're safe. Plan for the worst. If you're tormail account matches your vendor ID and you have sent your address to any other vendors/suppliers unencrypted, you are screwed if the servers have been seized and the emails are still there.
-
^^^^ Why would a vendor EVER give out his address encrypted or not???? I don't even give my address out to my real life friends! Vendors send, not receive.
-
That's just a possibility. I'm not going to post multiple different what ifs and out comes but simply to answer your question, I dare say a few big vendors are trusted by smaller new vendors, who may on sell their product.
People often err on the side of error. Brief lapse in judgement, etc.
Ontopic pls, You could have asked me that question in a PM. Been a vendor for 11 days and you know the score right.
"DrMDA ranked in the top 59% of sellers with 100% positive feedback from 33 transactions."
-
CLEARNET WARNING:
Just seen a CNN broadcast talking about how DEA is using the NSA data to crack down on US citizens.:
http://www.youtube.com/watch?v=0RYMxcTkTsA
U.S. directs agents to cover up program used to investigate Americans:
http://www.reuters.com/article/2013/08/05/us-dea-sod-idUSBRE97409R20130805
-
This is on the homepage of Tormail:
"or Mail consists of several servers, a Tor hidden service, and an incoming and outgoing internet facing mail servers.
These internet facing mail servers are relays, they relay mail in and out of the Tor network, the relays are purchased anonymously and not tracable to us.
The only thing stored on the hard drive of those servers is the Exim mail server, and the Tor software.
No emails or logs or anything important are stored on those servers, thus it doesn't matter if they are seized or shut down. SHOULD THIS MAKE US FEEL ANY SAFER?
We are prepared to quickly replace any relay that is taken offline for any reason."
Does that mean they didn't have time to take the relay down? DAMNIT I WANT TO BE A SUPER GEEKAZOID! : D Maybe I should go to ITT Technical Institute ^.^
-
We are prepared to quickly replace any relay that is taken offline for any reason.
Yet, they have not been replaced.
-
so correct me if I am wrong.
IF I redownload tor completely and only use SR I should be fine correct?
I have been having issues getting tails to work however I have a set up that works fairly nicely
SR hasn't been compromised at all has it?
-
SR hasn't been compromised at all has it?
Do you actually think anyone is able to answer that?
-
No emails or logs or anything important are stored on those servers, thus it doesn't matter if they are seized or shut down. SHOULD THIS MAKE US FEEL ANY SAFER?
That's what I want to believe but....
-
SR hasn't been compromised at all has it?
Do you actually think anyone is able to answer that?
Yes actually I DO. DPR would know however he hasn't replied to any posts in a while and I was trying to get an update from him. As it was more of a general question directed at a specific Person
-
Would signing into a Tormail account be a problem? Since it's still protected by Tor, it wouldn't show them your IP- right?
-
Would signing into a Tormail account be a problem? Since it's still protected by Tor, it wouldn't show them your IP- right?
Aside from the fact that tormail is down and probably never coming back up, have you been reading the thread at all? It's a good idea to start at the first post..... The exploit affects Mozilla 17 on windows ONLY. If you visited tormail (and it was actually up) on the old TOR browser bundle on a windows machine, yes your IP address would be shown to them. As you put it.
-
Would signing into a Tormail account be a problem? Since it's still protected by Tor, it wouldn't show them your IP- right?
It wouldn't matter if you are/were using an email client to log in to tormail.
-
Hey Folks, fuck it. If we all go to the joint, we get a chance to meet other members of the SR family, we get to stop having to jump on the treadmill every day stumbling along, keeping up 'middle class' existence (including the truly oppressive 'middle-class morals'), stop listening to our spouses, stop paying 30-50% of our hard-earned $ to The Man, in short, stop fucking pretending everything is o.k.
If it was, old fucks like myself wouldn't be so happy spending so much time on SR & SR forum talking about REAL issues (politics, philosophy, literature) and looking to score drugs. If all that was readily available outside of SR and our society wasn't so fucking oppressive, well.................so just fuck it.
We take the precautions that we can, intelligently and without shortcuts; beyond that, come what may come.
-
Non tech user questions
If you logged into Tormail/other infected FH sites, on a Windows OS machine, with JavaScript enabled, on TBB version xxx, then you could have had the malware injected onto your computer. Then if you went onto the clearnet (with tor browser or simply any browser?), you IRL IP would have been recorded - up to now is that the extent of exposure or does it go further?
In which case LE would know that:
a) you access tor sites hosted by FH (therefore the tor network)
b) if they have confiscated the servers they know the content of any tormail messages that had been sent/received?
-
Also, if you're a buyer going "why should I have to use PGP, this only affects me" -- WRONG!!!!!! Your information is a piece of a larger puzzle and the more pieces they can put together to gather intelligence, the riskier SR becomes for EVERYONE. If your unencrypted information helps bust a vendor that I have dealt with, for example, and that vendor has my information because they were sloppy with their security too, then I am at risk.
What if I'm only sending my postal address to a vendor without PGP? If you're claiming that that information by itself endangers anyone but me, I don't follow your logic.
-
Since it's a hidden service, as long as nobody was stupid to mention anything that would unmask their identity, does it really matter what else anyone said in Tormail?
A lot of people are stupid.
That and I also read , if I understood correctly (I am not too computer savvy) that the feds made some kind of Trojan that will unmask your real ip that I think you get by logging into your tor mail account.
Worse part of it is. I tried to get a vendor from China I deal with to start using pgp and they could not grasp the simple concept.
So I figured tormail to be my next option.
I had no choice but to order from them through tormail. Then this happen. Luckily I had taken a break from ordering from them for a while before this happen. Once I got back and was ready to order again I had forgot my password. So I had to open a new User name, if they look back it doesnt look like I had much activity, thanks to the fresh account.
But they still had access to a few not so legal conversations, so I am a little worried. Also I logged back into my tormail account once it was back up for like a day before I found out about this big mess.
Sure enough when I ran a scan of my PC a few Trojans and a few other malicious things where on my PC.
So Now I am laying low using a different PC re downloaded tor on a new usb drive I am going to re download pgp. Change all passwords.
I tweaked the settings on my tor browser. I did not know had to be tweaked before. Such as forbid scripts and forbid iframe.
Is there any other thing I am missing?
Oh ya and I am looking into tails as well.
-
That and I also read , if I understood correctly (I am not too computer savvy) that the feds made some kind of Trojan that will unmask your real ip that I think you get by logging into your tor mail account.
It doesn't depend on you logging into your account. It runs on older versions of the Tor Browser (specifically, Firefox version 17.0 - 17.0.6) on Windows and connects to a command and control server in Virginia that is probably run by the NSA or one of its contractors. Simply visiting a site with the malicious code under those conditions would get your IP address sent to the NSA along with cookies identifying the sites you were visiting.
I'm surprised you haven't read that, because it has been explained throughout the last 10 pages of this thread and on 30 other threads in this forum.
Worse part of it is. I tried to get a vendor from China I deal with to start using pgp and they could not grasp the simple concept.
So I figured tormail to be my next option.
I had no choice but to order from them through tormail. Then this happen. Luckily I had taken a break from ordering from them for a while before this happen. Once I got back and was ready to order again I had forgot my password. So I had to open a new User name, if they look back it doesnt look like I had much activity, thanks to the fresh account.
Did you send a plaintext shipping address in the old account? Did you delete those emails more than a month ago? If not, they are still on the Tormail server or its back up server, waiting for LE to read them
Sure enough when I ran a scan of my PC a few Trojans and a few other malicious things where on my PC.
That is likely to be unrelated to the FH exploit, which doesn't persistent on your computer for more than half an hour or until you close Tor Browser. Basically your computer is fucked from other random malware.
Is there any other thing I am missing?
Oh ya and I am looking into tails as well.
Yeah, it sounds like you should stop using Windows altogether.
-
Worse part of it is. I tried to get a vendor from China I deal with to start using pgp and they could not grasp the simple concept.
If one is not able to learn PGP, then one should not be transacting on SR. To each his own, but I personally would never do business with a vendor who couldn't handle PGP, just as I'd never get in a car at night with someone who didn't know how to turn on the headlights. It's just asking for trouble.
-
Make sure Noscript is turned off!
Hold up. Why in the world would I want to DISABLE NoScript? Doesn't that prevent java scripts from running?
Because I just realized, while it came installed with the TBB, it was not set to prevent java, flash and other plugins from running as embedded objects. Fuck. Should have looked into that earlier. But now you're saying to turn it off? Why?
-
Hi guys,
I am a bit nervous i only use SR and the SR Forums but i remembered i upload my Weed photos for my buyers on Torimages so they can see it in HD should i be worried and if i Torimages is compromised what should i do?
The images where taken by camera not phone if that helps.
SAGreat
The problem is we don't know who the hosting provider for Torimages is (or was). You could be compromised if the following are true:
1) If Torimages is hosted on Freedom Hosting.
2) If you run Windows
3) If you did not run the latest (June 26, 2013) version of the Tor Browser Bundle, with Firefox 17.0.7 (or Tails 0.19, with also features Firefox 17.0.7)
4) If you enabled Javascript
Nightcrawler
4096R/BBF7433B 2012-09-22 Nightcrawler <Nightcrawler@SR>
PGP Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xB8F1D88EBBF7433B (MIT clearnet keyserver)
PGP Key: https://keys.indymedia.org/pks/lookup?op=get&search=0xB8F1D88EBBF7433B (IndyMedia https: clearnet keyserver)
PGP Key: http://qtt2yl5jocgrk7nu.onion/pks/lookup?op=get&search=0xB8F1D88EBBF7433B (IndyMedia .onion keyserver)
PGP Key: http://dkn255hz262ypmii.onion/index.php?topic=174.msg633090#msg633090 (Silk Road Forums PGP Key Link)
PGP Key Fingerprint = 83F8 CAF8 7B73 C3C7 8D07 B66B AFC8 CE71 D9AF D2F0
-
sub'd
-
Make sure Noscript is turned off!
Hold up. Why in the world would I want to DISABLE NoScript? Doesn't that prevent java scripts from running?
Yeah, he meant turned on.
-
Worse part of it is. I tried to get a vendor from China I deal with to start using pgp and they could not grasp the simple concept.
If one is not able to learn PGP, then one should not be transacting on SR.
Those Chinese chemical companies and drug suppliers are not transacting on SR. They are clearnet businesses, sometimes with clearnet web sites, and always with clearnet email addresses. They take fiat currency, not bitcoins. They probably don't know that the people they are selling to are SR vendors or buyers.
That is what makes unencrypted emails to these sources on the Tormail server such a big vulnerability, if it was indeed seized by LE. Sources up the supply chain will be compromised, as well as potentially the vendors who provided shipping addresses in plaintext that can be linked to them.
-
Make sure Noscript is turned off!
Hold up. Why in the world would I want to DISABLE NoScript? Doesn't that prevent java scripts from running?
Yeah, he meant turned on.
i'm getting confused. is it advised to enable the 's' icon in tor so forbid scripts globally is selected (eg there's a red cross through the icon)
-
sub'd
your not wanted here shiz it was probably one of your agents who wrote the malware
-
i'm getting confused. is it advised to enable the 's' icon in tor so forbid scripts globally is selected (eg there's a red cross through the icon)
It is advised to click the option that says Forbid scripts (as in JavaScript) globally. That should be pretty obvious.
And yes, then there will be a circle with a bar through, the universal symbol for "no", on top of an S, the symbol in this case used for "scripts". :)
-
i'm getting confused. is it advised to enable the 's' icon in tor so forbid scripts globally is selected (eg there's a red cross through the icon)
It is advised to click the option that says Forbid scripts (as in JavaScript) globally. That should be pretty obvious.
And yes, then there will be a circle with a bar through, the universal symbol for "no", on top of an S, the symbol in this case used for "scripts". :)
thanks,
-
What about all the Privnote's read? Anyway that can be traced back to a person? if it traced back to persone, how do you prove a transaction took place vs alot just "talk'? Curious?
-
i'm getting confused. is it advised to enable the 's' icon in tor so forbid scripts globally is selected (eg there's a red cross through the icon)
It is advised to click the option that says Forbid scripts (as in JavaScript) globally. That should be pretty obvious.
And yes, then there will be a circle with a bar through, the universal symbol for "no", on top of an S, the symbol in this case used for "scripts". :)
Are there any other precautions that need to be taken? Such as inside the "Options" tab under the No scripts menu? I see alot of stuff in there about blocking java, flash, etc (as someone else said) but i do not know if these need to be manually checked ALONG WITH the "disable scripts globally" option, or if the disabling scripts does the same thing and takes care of everything....???
-
Are there any other precautions that need to be taken?
The best thing you can do for your security is switch to Tails or Whonix. There are other ways a browser can be exploited besides JavaScript, and the next payload that LE delivers may target Linux and OS X as well, but at least with Tails, if you are not running as root, it would be more difficult to bypass Tor.
Whonix is even more secure than Tails, because bypassing Tor requires breaking out of the VM, and I haven't heard of an exploit for that in the last few years, although there have been privilege escalation exploits to gain root access on Linux (which would affect Tails). The downside is the VMs obviously exist on your hard drive so it's not a "leave no trace" solution like Tails, and the Workstation VM does not have disk encryption out of the box, so you'd have to store it in an encrypted volume yourself, or install a custom OS with full disk encryption of the virtual hard disk. So making it safer in that regard is more difficult. Tails is more of a plug-n-play solution.
-
Make sure Noscript is turned off!
Hold up. Why in the world would I want to DISABLE NoScript? Doesn't that prevent java scripts from running?
Because I just realized, while it came installed with the TBB, it was not set to prevent java, flash and other plugins from running as embedded objects. Fuck. Should have looked into that earlier. But now you're saying to turn it off? Why?
No script prevents java (and only if this is selected in options). Javascript has to be disabled separately.
-
What about all the Privnote's read? Anyway that can be traced back to a person? if it traced back to persone, how do you prove a transaction took place vs alot just "talk'? Curious?
That good sir is conspiracy
-
Ok so I have been trying to follow this thread but its just gone off in so many directions I have personally lost track of it all. So can we just clarify what we know is fact and what we need to do moving forward.
So TorMail has been compromised. If you have used TorMail to discuss anything relating to orders that contains valid names or addresses, you should no doubt be concerned. At present we know it came in from some form of browser injection that found a vulnerability in Windows and Firefox. From what I can gather that is the ONLY fact that we currently really have, or have I missed something?
My next question is what measures are people taking now to ensure additional security. Fortunately although I have a TorMail account in the same name as this user account, I am not a vendor and have never used the TorMail service for anything. I am not really concerned about what they might find in mine.
I run TOR on OSX with the TOR Browser, I PGP anything I send address wise to vendors. TOR has not said its need updating although I have heard people mention they need to, or is this just for Windows?
I know a lot of people with far more knowledge on the subject than me I have discussed SR and its security, but should we assume if they can do this to TorMail they could do it to SR, and be extra vigilant with our encryption, if a vendor does not have a PGP key then basically don't order from them??
-
hey guys,
just need a few things cleared up here,
to our knowledge it is near impossible for "viruses" to jump from one partition to the next on your hdd so keeping any programs(.exe files) that may be susceptible to downloading or installing viruses should be stored and run from a separate partition to your o/s,
does a "exploit" work in a similar manner and will only infect the partition it is run from?
this paired with encrypting all your drives and running tor from a encrypted portable hdd with nothing else on it would effectively be sandboxing and would be as safe to use for SR as a program like oracle to virtualize a operating system to sandbox in(linux) or tails, provided you keep up with tor updates and have it on the correct settings?
( both tails and linux are written in unix to our knowledge see below, we have also neglected to mention a few more security measures involving ISP that are quite hard to do with any other o/s other then windows,
as it is not mentioned on these forums this is for our own safety:).....)
"backdoors" are also written in linux using unix syntax, this the first thing a hacker will learn to do,
so why use any system written in unix as most if not all hackers are extremely well versed in how these operating systems work,their flaws and how to get around them?
-
it just seems like everyone has a false sense of security when it comes to unix based systems....
it is not that hard to make a program( virus, backdoor, expolit,keylogger) applicable to all systems, you just need to make one code to each specific operating system or use a programing language that is applicable across each o/s you wish to infect and adjust the parameters accordingly.
the US government have programers and hackers at there disposal that are more then capable of this.
-
to our knowledge it is near impossible for "viruses" to jump from one partition to the next on your hdd so keeping any programs(.exe files) that may be susceptible to downloading or installing viruses should be stored and run from a separate partition to your o/s,
does a "exploit" work in a similar manner and will only infect the partition it is run from?
That's total bullshit. Spreading to different drives and partitions is what virii have been capable of since the very beginning of virus coding. It was their only mechanism to replicate and spread as the internet didn't exist in its current form.
An exploit doesn't infect anything. It's just a way to run a program with privileges you actually don't have. What the program does is up to you. Doesn't matter if it's malware, starts the calculator or installs the latest version of minesweeper. It can do anything the exploited process can. Also replicate itself and run itself as a distinct process.
this paired with encrypting all your drives and running tor from a encrypted portable hdd with nothing else on it would effectively be sandboxing
If you run something from an encrypted hard drive doesn't make a difference because a) most encryption happens transparently and b) it will not be encrypted anyways once it's been loaded into memory.
Also do you actually know what sandboxing is and how it works?
and would be as safe to use for SR as a program like oracle to virtualize a operating system to sandbox in(linux) or tails, provided you keep up with tor updates and have it on the correct settings?
If copying something to an encrypted partition would be just as safe as using isolated virtual machines why would people put effort into developing things like tails?
( both tails and linux are written in unix
dude... really?... That's like saying "novels are written in comics"
we have also neglected to mention a few more security measures involving ISP that are quite hard to do with any other o/s other then windows,
as it is not mentioned on these forums this is for our own safety:).....)
Assuming you mean IPS:
I don't see in which way windows would make intrusion prevention easier than other operating systems.
"backdoors" are also written in linux using unix syntax, this the first thing a hacker will learn to do,
so why use any system written in unix as most if not all hackers are extremely well versed in how these operating systems work,their flaws and how to get around them?
A "backdoor" with what I assume you mean a trojan can be written in any language that is suitable for the system it's to be installed on. Again you can't write stuff "in unix".
Open source software will always be safer and most likely more frequently updated than closed source software as flaws in open source software are easier to find for everyone and thus easier to fix.
You don't know shit about what you're saying here, go to some place where you can actually hear people when they laugh at you.
-
if a vendor does not have a PGP key then basically don't order from them??
Yep. That's my approach.
-
I've just gone through my options and my white list includes sites like hotmail,google and yahoo.I have disabled java and silverlight in 'embeddings' but do I delete the obvious sites in the white list?These are there under the defult settings.
as you can tell,I haven't a clue about programming.
-
to our knowledge it is near impossible for "viruses" to jump from one partition to the next on your hdd so keeping any programs(.exe files) that may be susceptible to downloading or installing viruses should be stored and run from a separate partition to your o/s,
does a "exploit" work in a similar manner and will only infect the partition it is run from?
That's total bullshit. Spreading to different drives and partitions is what virii have been capable of since the very beginning of virus coding. It was their only mechanism to replicate and spread as the internet didn't exist in its current form.
An exploit doesn't infect anything. It's just a way to run a program with privileges you actually don't have. What the program does is up to you. Doesn't matter if it's malware, starts the calculator or installs the latest version of minesweeper. It can do anything the exploited process can. Also replicate itself and run itself as a distinct process.
this paired with encrypting all your drives and running tor from a encrypted portable hdd with nothing else on it would effectively be sandboxing
If you run something from an encrypted hard drive doesn't make a difference because a) most encryption happens transparently and b) it will not be encrypted anyways once it's been loaded into memory.
Also do you actually know what sandboxing is and how it works?
and would be as safe to use for SR as a program like oracle to virtualize a operating system to sandbox in(linux) or tails, provided you keep up with tor updates and have it on the correct settings?
If copying something to an encrypted partition would be just as safe as using isolated virtual machines why would people put effort into developing things like tails?
( both tails and linux are written in unix
dude... really?... That's like saying "novels are written in comics"
we have also neglected to mention a few more security measures involving ISP that are quite hard to do with any other o/s other then windows,
as it is not mentioned on these forums this is for our own safety:).....)
Assuming you mean IPS:
I don't see in which way windows would make intrusion prevention easier than other operating systems.
"backdoors" are also written in linux using unix syntax, this the first thing a hacker will learn to do,
so why use any system written in unix as most if not all hackers are extremely well versed in how these operating systems work,their flaws and how to get around them?
A "backdoor" with what I assume you mean a trojan can be written in any language that is suitable for the system it's to be installed on. Again you can't write stuff "in unix".
Open source software will always be safer and most likely more frequently updated than closed source software as flaws in open source software are easier to find for everyone and thus easier to fix.
You don't know shit about what you're saying here, go to some place where you can actually hear people when they laugh at you.
you have not really explained anything here and are just having a go man....
a viruses main purpose is to replicate itself yes, but it can only do this inside the partition it is infected with this is basic computing knowledge.....
saying tails is written is in unix more like saying a novel and comic are both written in English do u have any concept of syntax? and how that works? because that statement just shows how little you really know about computing....
linux and tails are both unix based systems and malicious programs are easily written with the terminal of the operating system so we would say as would anyone else with computing knowledge that u can indeed write "stuff" with unix..
we do understand what sand-boxing is it is running a program in a safe environment isolated from your operating system. hence the name sandbox, a virtual machine is just one way to do this...
operating system partition > encrypted partion with operating system(this operating system is effectively the sandbox when booted) > encrypted usb running tor.
And no i meant ISP internet service provider...... you my friend have alot less of an idea about you are talking about then us maybe should consider what you are saying before you post, our answers to half of your questions make this quite clear, we are not going to waste our energy on the rest.
-
to our knowledge it is near impossible for "viruses" to jump from one partition to the next on your hdd so keeping any programs(.exe files) that may be susceptible to downloading or installing viruses should be stored and run from a separate partition to your o/s,
does a "exploit" work in a similar manner and will only infect the partition it is run from?
That's total bullshit. Spreading to different drives and partitions is what virii have been capable of since the very beginning of virus coding. It was their only mechanism to replicate and spread as the internet didn't exist in its current form.
An exploit doesn't infect anything. It's just a way to run a program with privileges you actually don't have. What the program does is up to you. Doesn't matter if it's malware, starts the calculator or installs the latest version of minesweeper. It can do anything the exploited process can. Also replicate itself and run itself as a distinct process.
this paired with encrypting all your drives and running tor from a encrypted portable hdd with nothing else on it would effectively be sandboxing
If you run something from an encrypted hard drive doesn't make a difference because a) most encryption happens transparently and b) it will not be encrypted anyways once it's been loaded into memory.
Also do you actually know what sandboxing is and how it works?
and would be as safe to use for SR as a program like oracle to virtualize a operating system to sandbox in(linux) or tails, provided you keep up with tor updates and have it on the correct settings?
If copying something to an encrypted partition would be just as safe as using isolated virtual machines why would people put effort into developing things like tails?
( both tails and linux are written in unix
dude... really?... That's like saying "novels are written in comics"
we have also neglected to mention a few more security measures involving ISP that are quite hard to do with any other o/s other then windows,
as it is not mentioned on these forums this is for our own safety:).....)
Assuming you mean IPS:
I don't see in which way windows would make intrusion prevention easier than other operating systems.
"backdoors" are also written in linux using unix syntax, this the first thing a hacker will learn to do,
so why use any system written in unix as most if not all hackers are extremely well versed in how these operating systems work,their flaws and how to get around them?
A "backdoor" with what I assume you mean a trojan can be written in any language that is suitable for the system it's to be installed on. Again you can't write stuff "in unix".
Open source software will always be safer and most likely more frequently updated than closed source software as flaws in open source software are easier to find for everyone and thus easier to fix.
You don't know shit about what you're saying here, go to some place where you can actually hear people when they laugh at you.
you have not really explained anything here and are just having a go man....
a viruses main purpose is to replicate itself yes, but it can only do this inside the partition it is infected with this is basic computing knowledge.....
saying tails is written is in unix more like saying a novel and comic are both written in English do u have any concept of syntax? and how that works? because that statement just shows how little you really know about computing....
linux and tails are both unix based systems and malicious programs are easily written with the terminal of the operating system so we would say that u can indeed write "stuff" with unix..
And no i meant ISP internet service provider...... you my friend are a complete fuckwit maybe should consider what you are saying before you post.
You are either a troll or fucking retarded
-
how are we retarded or trolling...
every single thing we have said is fact.
go take a computer course before opening your mouth, it will do you some good.
-
to our knowledge it is near impossible for "viruses" to jump from one partition to the next on your hdd so keeping any programs(.exe files) that may be susceptible to downloading or installing viruses should be stored and run from a separate partition to your o/s,
does a "exploit" work in a similar manner and will only infect the partition it is run from?
Wrong, virus can spread to different partitions, no idea why you think otherwise. Virus can spread from one computer to another without even using the internet, via USB memory sticks etc, many old school virus spread via floppy drive. No clue where you got this totally incorrect idea from. Exploits are used to remotely make a computer execute a virus payload (usually, the other dude who apparently named himself after the captcha as well explained this in more detail).
this paired with encrypting all your drives and running tor from a encrypted portable hdd with nothing else on it would effectively be sandboxing and would be as safe to use for SR as a program like oracle to virtualize a operating system to sandbox in(linux) or tails, provided you keep up with tor updates and have it on the correct settings?
Wrong, that is not sandboxing at all, encrypted drive is mounted wont protect from this sort of attack at all but isolating in a virtual machine properly could and would in most cases, again you have no clue what you are talking about.
( both tails and linux are written in unix to our knowledge see below, we have also neglected to mention a few more security measures involving ISP that are quite hard to do with any other o/s other then windows,
as it is not mentioned on these forums this is for our own safety:).....)
Tails is based on Debian which is a Linux distro, Linux is a Unix like operating system, BSD family is actually Unix based.
"backdoors" are also written in linux using unix syntax, this the first thing a hacker will learn to do,
so why use any system written in unix as most if not all hackers are extremely well versed in how these operating systems work,their flaws and how to get around them?
Unix is not a language that you write things in, there are various linux/unix shells that have scripting languages associated with them, Unix based operating systems are actually considered to be some of the most highly secured (OpenBSD, FreeBSD), Linux operating systems are generally thought to be pretty secure to highly secure as well, almost all attack payloads like this are written in some assembly language and then put into memory and made to execute via a vulnerability in an application (like a buffer overflow in a C program) that is exploited with something like javascript.
a viruses main purpose is to replicate itself yes, but it can only do this inside the partition it is infected with this is basic computing knowledge.....
What magic property of partitioning makes it so virus cannot spread from one partition to another? There is absolutely nothing that inherently prevents a virus from going to one partition to another, you would need to have some access controls to prevent it from spreading in such a way, or you would need to have real sandboxing, or something else. Saying that a virus cannot spread from one partition to another is about as honest as saying a human cannot jump over an object, it entirely depends on the object, and in many cases a virus will have no trouble infecting files in all partitions.
saying tails is written is in unix more like saying a novel and comic are both written in English do u have any concept of syntax? and how that works? because that statement just shows how little you really know about computing....
Saying tails is written in Unix is more like saying something that is retarded, tails is based on Debian and uses the Linux Kernel and is written almost exclusively in C, and Linux is a Unix like operating system it isn't really Unix.
linux and tails are both unix based systems and malicious programs are easily written with the terminal of the operating system so we would say as would anyone else with computing knowledge that u can indeed write "stuff" with unix..
Tails IS a Linux distro, and neither of them are really Unix based they are Unix like. Look at Wikipedia: BSD = Unix https://en.wikipedia.org/wiki/Berkeley_Software_Distribution , Linux = Unix Like https://en.wikipedia.org/wiki/Linux
This exploit was probably written in Emacs or Notepad++.
-
@ Astor
Quote:
It doesn't depend on you logging into your account. It runs on older versions of the Tor Browser (specifically, Firefox version 17.0 - 17.0.6) on Windows and connects to a command and control server in Virginia that is probably run by the NSA or one of its contractors. Simply visiting a site with the malicious code under those conditions would get your IP address sent to the NSA along with cookies identifying the sites you were visiting.
I'm surprised you haven't read that, because it has been explained throughout the last 10 pages of this thread and on 30 other threads in this forum.
I actually havent had much time to thoroughly read this thread because I didnt have time I had just logged in from a different pc to change passwords and noticed the prompt in the main SR page and I read only the first post.
Today I am going to sit down and read everything I can in 8 hours.
Yes the address was in plain text. I will NEVER make that mistake again. But luckily the order I made was very small it could pass as a user ordering stuff for personal use.
And luckily the package arrived without and problem. That I know of yet. It was to a drop address I never order to my house.
As for the old emails on there I did not get a chance to delete them a full month before the indecent but luckily there was talk of only a couple transactions. They have one small transaction. And talk of a few hundred g's from a past transaction.
Now considering that what do they have on me? If anything?
What would they be able to do with that information?
-
saying tails is written is in unix more like saying a novel and comic are both written in English do u have any concept of syntax? and how that works? because that statement just shows how little you really know about computing....
Saying tails is written in Unix is more like saying something that is retarded
Dude, you really made me laugh! Thanks for making my day ;D
And no i meant ISP internet service provider...... you my friend have alot less of an idea about you are talking about then us maybe should consider what you are saying before you post, our answers to half of your questions make this quite clear, we are not going to waste our energy on the rest.
My bad, I was trying to put what you said in a context that would actually make sense...
-
what we meant by tails is written "in" unix is they use a similar kernal is all (linux's kernal being based off unix, tails from linux) so they are all written in a similar fashion using the same syntax although they might be different once one is comprised the next will be fairly quickly if not at the same time.
this is just becoming picking hairs now..
we got this totally incorrect idea from how difficult is to code a virus to specifically infect other partions what makes you think otherwise ? codeing a program to hide and replicate itself inside a partion is one thing but to make it jump partition is something else and that was un-heard of to us until you mentioned it.
-
how are we retarded or trolling...
every single thing we have said is fact.
go take a computer course before opening your mouth, it will do you some good.
Do you know who you're asking to take a computer course?? Fuck me, do some homework champ. ??? kmfkewm would have forgotten more than you'll ever know about security. He is an actual Security Expert and been around for ages. Start by reading through some of his post history before making such hysterical, inaccurate claims.
PS - it's actually "splitting hairs", not picking hairs!
-
Thank you for the advice DPR.
Long live S.R.
-
theauconnection is making me laugh so hard. ;D ;D ;D ;D ;D
-
When can this security warning on the homepage come down? I've noticed a drop off in orders and I think the very prominent warning is scaring customers away. Anyone who was using Tormail is aware by now of the issues and I'd hate to link all of this permanently to SR when it actually had nothing to do with SR. On top of that there has been a lot of irrational panic related to this considering how minor the forensics of the incident ultimately concluded. You may say better be on the safe side but regular normal people (buyers) are skittish to begin with thinking the DEA and CIA are going to send a 30 man SWAT raid on their house every time they order a gram of kush so to add to that mentality with security warnings that are not SR related I think is unnecessary even with security first always being the understandable mission.
-
When can this security warning on the homepage come down? I've noticed a drop off in orders and I think the very prominent warning is scaring customers away. Anyone who was using Tormail is aware by now of the issues and I'd hate to link all of this permanently to SR when it actually had nothing to do with SR. On top of that there has been a lot of irrational panic related to this considering how minor the forensics of the incident ultimately concluded. You may say better be on the safe side but regular normal people (buyers) are skittish to begin with thinking the DEA and CIA are going to send a 30 man SWAT raid on their house every time they order a gram of kush so to add to that mentality with security warnings that are not SR related I think is unnecessary even with security first always being the understandable mission.
I hardly think buyers are thinking "the DEA and CIA are going to send a 30 man SWAT raid on their house every time they order a gram of kush".
That's an overreaction on your part. People are a little cautious at the moment and with a host of information still being unconfirmed ( just speculation and assumptions), it's best to proceed with caution. The security warning should remain for the time being as not everyone logs on each day. I very much doubt that buyers are being scared off SR due to Tormail, a site completely unrelated to SR, now being compromised.
-
how are we retarded or trolling...
every single thing we have said is fact.
go take a computer course before opening your mouth, it will do you some good.
Do you know who you're asking to take a computer course?? Fuck me, do some homework champ. ??? kmfkewm would have forgotten more than you'll ever know about security. He is an actual Security Expert and been around for ages. Start by reading through some of his post history before making such hysterical, inaccurate claims.
PS - it's actually "splitting hairs", not picking hairs!
G,day Wadozo, you certainly haven't been around for a while. You been in prison lol?
-
When can this security warning on the homepage come down? I've noticed a drop off in orders and I think the very prominent warning is scaring customers away. Anyone who was using Tormail is aware by now of the issues and I'd hate to link all of this permanently to SR when it actually had nothing to do with SR. On top of that there has been a lot of irrational panic related to this considering how minor the forensics of the incident ultimately concluded. You may say better be on the safe side but regular normal people (buyers) are skittish to begin with thinking the DEA and CIA are going to send a 30 man SWAT raid on their house every time they order a gram of kush so to add to that mentality with security warnings that are not SR related I think is unnecessary even with security first always being the understandable mission.
I hardly think buyers are thinking "the DEA and CIA are going to send a 30 man SWAT raid on their house every time they order a gram of kush".
That's an overreaction on your part. People are a little cautious at the moment and with a host of information still being unconfirmed ( just speculation and assumptions), it's best to proceed with caution. The security warning should remain for the time being as not everyone logs on each day. I very much doubt that buyers are being scared off SR due to Tormail, a site completely unrelated to SR, now being compromised.
Tormail might be unrelated for some people but for others it may be all too related. There were those who conducted business through there in times of SR outages. There was the vendor who posted that all his buyers information was sent on a spreadsheet through there. There are those who had bitcoins sent to e-mail from bitinstant or other sites that might be nervous about their bitcoins being tracked.
-
Yes the address was in plain text. I will NEVER make that mistake again. But luckily the order I made was very small it could pass as a user ordering stuff for personal use.
And luckily the package arrived without and problem. That I know of yet. It was to a drop address I never order to my house.
As for the old emails on there I did not get a chance to delete them a full month before the indecent but luckily there was talk of only a couple transactions. They have one small transaction. And talk of a few hundred g's from a past transaction.
Now considering that what do they have on me? If anything?
What would they be able to do with that information?
We're still not 100% sure that the server is in the hands of LE. They could have injected an exploit without taking physical control of the server, but the fact that the server was offline for a couple of days before coming back online with the exploit, and this happened after the presumptive admin was arrested, is pretty good evidence that LE had physical control of the server.
For security reasons, we should operate under the assumption that they have physical control of the FH server, including the Tormail email database. That hard drive has a massive trove of data for them to sift through. Besides all the CP, there must have been tens of thousands of Tormail accounts, and potentially millions of emails. They will likely prioritize the biggest targets: major CP and drug distributors.
If I was tasked with sifting through the data, I'd go through the list of SR vendors, starting with the highest percentage rank, and see if they have Tormail addresses. Conveniently, StExo's archives are on that hard drive with all vendor profiles, so they don't have to crawl the SR server. Email addresses will be listed in the profiles or their PGP keys. About half of SR vendors had Tormail addresses, so they wouldn't be hard to find.
That may not be how LE sifts through the data, but it seems logical to me, so if I was a top SR vendor, I would be extremely cautious right now, if I had a Tormail account with unencrypted emails in it.
As for you, it could take months to years, or possibly never, before they get around to reading your emails, but to err on the side of safety, I would never use that shipping address, and probably never use that Chinese source again. Consider them both watched.
-
how are we retarded or trolling...
every single thing we have said is fact.
go take a computer course before opening your mouth, it will do you some good.
Do you know who you're asking to take a computer course?? Fuck me, do some homework champ. ??? kmfkewm would have forgotten more than you'll ever know about security. He is an actual Security Expert and been around for ages. Start by reading through some of his post history before making such hysterical, inaccurate claims.
PS - it's actually "splitting hairs", not picking hairs!
G,day Wadozo, you certainly haven't been around for a while. You been in prison lol?
Mate, I've been busy with other commitments. Haven't been to prison yet and plan on keeping it that way! (LOL) The demise of Tormail is a perfect reminder for all of us to encrypt ALL potentially incriminating communication, ALWAYS. Anyone sending plain text messages containing details of illegal activities through any mail service is crazy.
-
how are we retarded or trolling...
every single thing we have said is fact.
go take a computer course before opening your mouth, it will do you some good.
Do you know who you're asking to take a computer course?? Fuck me, do some homework champ. ??? kmfkewm would have forgotten more than you'll ever know about security. He is an actual Security Expert and been around for ages. Start by reading through some of his post history before making such hysterical, inaccurate claims.
PS - it's actually "splitting hairs", not picking hairs!
G,day Wadozo, you certainly haven't been around for a while. You been in prison lol?
Mate, I've been busy with other commitments. Haven't been to prison yet and plan on keeping it that way! (LOL) The demise of Tormail is a perfect reminder for all of us to encrypt ALL potentially incriminating communication, ALWAYS. Anyone sending plain text messages containing details of illegal activities through any mail service is crazy.
Glad to hear you're well. A lot of members have gone Awol. I agree, with recent developments, it's imperative we take are security more serious than ever.
-
There's so many unanswered questions around tormail that I'd really like answering but after looking around for a couple of hours there's just silence.
according to one source, the tormail owner is in custody too, in others the owner is the FH guy who's been arrested. I read somewhere that the tormail set up is distributed so it may not all be on fh servers and I also read somewhere that the email dbs are encrypted. If it is the FH dude then I assume he will eventually do a deal to release the key to decrypt as part of a plea deal. I also haven't been able to find out how many accounts there were on tormail.
The main thing is that I'd assume tormail access is going to be given to all interested parties
So cp first, I'd say that they'll be running jobs to find any accounts that have emails with the cp keywords, they'll then start a secondary trawl for accounts that match the characteristics of a cp email account, which would encrypted documents and encrypted emails. which means it's possible that some sr accounts will be caught up in that and if there's no indication that it's drugs rather than cp, on inspection they'll end up on the list
then of course there'll be the nsa running jobs to find guns, bombs, "terrorist" etc keywords and will be sniffing around the dissident accounts. (along with looking to see if Snowden left all his stuff on tormail)
and the DEA will be looking for all the drug related keywords.. which is possibly how some of the SR accounts will be caught. If there really are LE paying attention here then they probably will do the mapping of the vendor emails from SR and they'll also manually pick some of the more visible peeps who post, like the journos. More concerning for me is that guy who did the vendor survey a few months back. any vendor who didn't encrypt their answers and answered some of the more egregious questions about how they source their drugs are at a huge risk of a visit because I seem to remember him saying that he was going to keep everything on tormail. There's also that forum thread where people post their keys.. a quick trawl of that will give them lot's of non vendor keys for people who may be using SR to source large quantities of drugs that are not being sold on via SR. and of course the thing to remember is that even if they can't decrypt the email contents, they know the email address that it was sent to/came from and I suspect (although have never tried) that it's trivial to get the public key email address of the sender/recipient from the message to see if it's different.
and of course there's that lovely bit of software that they can feed all the data into to identify the contact networks of the email accounts. Which means no matter how many middle men have been used for deals, the trail will be highlighted.
and this is before the xkey thing is used.
It's enough to give anyone who used it nightmares.
-
I'm a bit confused, why are all you guys acting like the security of your emails are dependent upon the TorMail servers being compromised or not? If you weren't using encryption your info was compromised the second you pushed send. You do realize that many Tor exit nods exist just for the purpose of watching all the clear text data exit don't you?
-
It's enough to give anyone who used it nightmares.
Only those silly enough to not encrypt their messages.
-
I'm a bit confused, why are all you guys acting like the security of your emails are dependent upon the TorMail servers being compromised or not? If you weren't using encryption your info was compromised the second you pushed send. You do realize that many Tor exit nods exist just for the purpose of watching all the clear text data exit don't you?
A lot of those emails -- in fact, I would venture to say a majority of them -- were between Tormail accounts. People were betting on the security and privacy of Tormail, and the assumption that it would never be seized.
I think it's time for all major targets in the SR community to up their game. This is no longer about basic shit like having a strong PGP key and not giving out identifying info in your profile. If you're still doing that, you should be stripped of your vendor privileges immediately. We're on a new level now. We are being actively attacked by LE now. They won't go after all small time buyers, but if you are a vendor, mod or admin, you should be switching to a Whonix like setup, or installing PORTAL on your router, or an anonymizing middle box between your main computer and your router, and the computer you use for Tor should have no identifying info on it at all. And it should absolutely 100% not be Windows based. And it should go without saying at this point that you must encrypt EVERYTHING. Your hard drive, virtual disks, communications, etc.
The arms race is on, and you better be ready before the next exploit is served through the market or forum servers.
-
There's also a mac address spoofer than can be used, it's usually used by the basement dwellers to get around ip/mac bans.
-
and buyers need to consider whether they should post reviews with an account that can be mapped to their SR account - it confirms you made the transaction and it was for your use
also those of you who put your stats in your signature are just waving a flag to get attention if those stats are high value.
most personal use peeps will be too small for the police to care about, that topix forum where people openly sell drugs is proof of that. They're very low hanging fruit but they never seem to get done so unless those accounts are fake you can at least take comfort that it's unlikely you'll get a visit.. unless you're into cp or something else that trips a flag.
-
and buyers need to consider whether they should post reviews with an account that can be mapped to their SR account - it confirms you made the transaction and it was for your use
also those of you who put your stats in your signature are just waving a flag to get attention if those stats are high value.
most personal use peeps will be too small for the police to care about, that topix forum where people openly sell drugs is proof of that. They're very low hanging fruit but they never seem to get done so unless those accounts are fake you can at least take comfort that it's unlikely you'll get a visit.. unless you're into cp or something else that trips a flag.
I honestly don't think they care wether you're a Top vendor, at it since the start, or a new one just making ground. Of course the former may be more significant and warrant more attention, but we all will be done for conspiracy with the Feds, they don't give a fuck, you conspired you're nicked.
-
No use shutting the stable door, when the horse has bolted. Of course the feds have anticipated this ahead of time. They have already been injected. Its a sad time for S,R. We need DPR to re-assure us and keep us secure as we ride these uncharted waters.
Honestly, reassurances from DPR ain't worth shit. He could get busted without us knowing about it, and agree to work with LE to save himself from a long prison sentence. Then he would be giving out public reassurances to keep the investigation going while siphoning all vendor info to LE in the background. You are the only person who can keep you secure, and you are the only person that you should rely on to keep you secure.
And claiming that SR has already been exploited, when there is no evidence of that, is a disservice to the community, because it builds complacency. "Oh well, I'm already screwed. Might as well not do anything to improve my security." No, there's a lot that most people can still do to improve their security.
-
No use shutting the stable door, when the horse has bolted. Of course the feds have anticipated this ahead of time. They have already been injected. Its a sad time for S,R. We need DPR to re-assure us and keep us secure as we ride these uncharted waters.
Honestly, reassurances from DPR ain't worth shit. He could get busted without us knowing about it, and agree to work with LE to save himself from a long prison sentence. Then he would be giving out public reassurances to keep the investigation going while siphoning all vendor info to LE in the background. You are the only person who can keep you secure, and you are the only person that you should rely on to keep you secure.
And claiming that SR has already been exploited, when there is no evidence of that, is a disservice to the community, because it builds complacency. "Oh well, I'm already screwed. Might as well not do anything to improve my security." No, there's a lot that most people can still do to improve their security.
I agree, I shouldn't claim that without proof, I'm just assuming the worst, so people realize this is very serious now. Do you think DPR would and could do that? I think the Feds can be persuasive, look what happened with Sabu. Could DPR really be capable. Don't think so.
-
No use shutting the stable door, when the horse has bolted. Of course the feds have anticipated this ahead of time. They have already been injected. Its a sad time for S,R. We need DPR to re-assure us and keep us secure as we ride these uncharted waters.
Honestly, reassurances from DPR ain't worth shit. He could get busted without us knowing about it, and agree to work with LE to save himself from a long prison sentence. Then he would be giving out public reassurances to keep the investigation going while siphoning all vendor info to LE in the background. You are the only person who can keep you secure, and you are the only person that you should rely on to keep you secure.
And claiming that SR has already been exploited, when there is no evidence of that, is a disservice to the community, because it builds complacency. "Oh well, I'm already screwed. Might as well not do anything to improve my security." No, there's a lot that most people can still do to improve their security.
Some excellent advice astor. +1 for you. People should take heed and not rest on their laurels.
-
No use shutting the stable door, when the horse has bolted. Of course the feds have anticipated this ahead of time. They have already been injected. Its a sad time for S,R. We need DPR to re-assure us and keep us secure as we ride these uncharted waters.
Honestly, reassurances from DPR ain't worth shit. He could get busted without us knowing about it, and agree to work with LE to save himself from a long prison sentence. Then he would be giving out public reassurances to keep the investigation going while siphoning all vendor info to LE in the background. You are the only person who can keep you secure, and you are the only person that you should rely on to keep you secure.
And claiming that SR has already been exploited, when there is no evidence of that, is a disservice to the community, because it builds complacency. "Oh well, I'm already screwed. Might as well not do anything to improve my security." No, there's a lot that most people can still do to improve their security.
I agree, I shouldn't claim that without proof, I'm just assuming the worst, so people realize this is very serious now. Do you think DPR would and could do that? I think the Feds can be persuasive, look what happened with Sabu. Could DPR really be capable. Don't think so.
IMO, the only person capable of accurately answering your question is DPR himself. ;D
-
Maybe he will. ;D
-
the good thing if there is is that its made me STRONGER. i may be killed later but for now. I am stronger.
if there is a silver lining. me being stringer makes the whole community stringer.
and for GODS SAKE all this for CP!! really..
come on freaks.... just come over to our side.
get some good drugs and forget your CP tendencies.
I hope they bust the lot of them cause the best place for a CP freak is in the clink.
they will get whats coming to them 10 fold. Its the GREAT leveler.
I love prison.. just not being in it.
-
I agree, I shouldn't claim that without proof, I'm just assuming the worst, so people realize this is very serious now. Do you think DPR would and could do that? I think the Feds can be persuasive, look what happened with Sabu. Could DPR really be capable. Don't think so.
30 year prison sentences reduced to 15 years can be persuasive.
I don't know if DPR would do that, but I'm not going to base my security on the assumption that he won't.
How do we know FH admin didn't do that? He got arrested on Thursday and the site came back up with an exploit on Saturday. How do we know he didn't tell LE everything, the location of the server, the password to the full disk encryption, and the password to the administrator account, to save himself?
-
I agree, I shouldn't claim that without proof, I'm just assuming the worst, so people realize this is very serious now. Do you think DPR would and could do that? I think the Feds can be persuasive, look what happened with Sabu. Could DPR really be capable. Don't think so.
30 year prison sentences reduced to 15 years can be persuasive.
I don't know if DPR would do that, but I'm not going to base my security on the assumption that he won't.
How do we know FH admin didn't do that? He got arrested on Thursday and the site came back up with an exploit on Saturday. How do we know he didn't tell LE everything, the location of the server, the password to the full disk encryption, and the password to the administrator account, to save himself?
It's certainly food for thought. Many have advocated and reiterated time and time again, the importance of anonymity and cryptography. Including yourself, maybe more people will take heed of them words, after we have seen the repercussions if indeed there are any for us here.
-
I agree, I shouldn't claim that without proof, I'm just assuming the worst, so people realize this is very serious now. Do you think DPR would and could do that? I think the Feds can be persuasive, look what happened with Sabu. Could DPR really be capable. Don't think so.
30 year prison sentences reduced to 15 years can be persuasive.
I don't know if DPR would do that, but I'm not going to base my security on the assumption that he won't.
How do we know FH admin didn't do that? He got arrested on Thursday and the site came back up with an exploit on Saturday. How do we know he didn't tell LE everything, the location of the server, the password to the full disk encryption, and the password to the administrator account, to save himself?
He probably did considering he always said if he got busted he was going to.
-
That's true, he outright said "I'm not going to jail for you", but it turns out he is.
-
I hope they bust the lot of them cause the best place for a CP freak is in the clink.
they will get whats coming to them 10 fold. Its the GREAT leveler.
Agreed that CP freaks are disgusting. But the thought of wishing ANYONE be put in a cage by government is UNthinkable... can think of lots that could and maybe should be done to them... but not that... just my opinion.....
-
the good thing if there is is that its made me STRONGER. i may be killed later but for now. I am stronger.
if there is a silver lining. me being stringer makes the whole community stringer.
and for GODS SAKE all this for CP!! really..
come on freaks.... just come over to our side.
get some good drugs and forget your CP tendencies.
I hope they bust the lot of them cause the best place for a CP freak is in the clink.
they will get whats coming to them 10 fold. Its the GREAT leveler.
I love prison.. just not being in it.
i don't know about you guys but we'd rather not be associated or sell to anyone that has had anything to
do with cp.
a swift kick to the head will do more for their tendencies then any amount of good drugs could ever do. Pedophiles receive alot lighter sentencing in my country then traffickers!!!!
the sickos in possession of child porn wouldn't even see jail time here, at most they would receive a 6-18 month sentence and are segregated from the rest of us for their own protection.(most pedophiles will receive 18months unless they are repeat offenders...disgusting!)
and most would have the sentence suspended up until recently..
(to our knowledge suspended sentences are no longer handed out)
-
Child porn possession is legal in half of the world and probably will be legalized in the other half of the world within the next few hundred years.
-
http://www.newstalk.ie/High-Court-to-hear-extradition-request-on-child-porn-kingpin
-
Child porn possession is legal in half of the world and probably will be legalized in the other half of the world within the next few hundred years.
You can't be serious! One of the most ridiculous statements I've ever seen posted. You can do what you do kmfkewn, that's your choice, but to suggest that child pornography possession will be legalized in the remaining 50% of countries where it's currently illegal, over a period of a few hundred years, is outrageous and unconscionable. A more realistic expectation would be to suggest that CP possession is deemed illegal in most, if not all of the countries where it's currently legal. Anyone who actually believes countries such as the US, UK, Australia, etc, would ever soften their stance on CP possession, needs to have their head examined.
-
Now,without arguing about syntax or cp could someone answer my question i posted :-
I've just gone through my options and my white list includes sites like hotmail,google and yahoo.I have disabled java and silverlight in 'embeddings' but do I delete the obvious sites in the white list?These are there under the defult settings.
as you can tell,I haven't a clue about programming.
-
http://www.newstalk.ie/High-Court-to-hear-extradition-request-on-child-porn-kingpin
Looks like we won't be getting any more details about whether he is the FH admin and how they found him until next week.
-
i think its a good movement to get this pedophiles freaks to death. But you know Silk Road, will live forever. This is an attack from government, to once again tell us
"hey buy the drugs WE smuggle , Buying from Silk Road will get you behind bars eventually"
The war on drugs... With silk road we make a successful war against the war on drugs, and guess what, the only victims, are street dirty dealers getting out of business.
Let this madness be forever. For if Silk Road dies, i die too. Long Live DPR, Long Live Silk Road,
FUCK THE POLICE - fuck SR competitors, which can well be behind such attacks.
Please everyone, try to stay safe, and use only vendors that you have used and trust. most important. don't lose faith. we can change the world with bitcoin.
-
Child porn possession is legal in half of the world and probably will be legalized in the other half of the world within the next few hundred years.
You can't be serious! One of the most ridiculous statements I've ever seen posted. You can do what you do kmfkewn, that's your choice, but to suggest that child pornography possession will be legalized in the remaining 50% of countries where it's currently illegal, over a period of a few hundred years, is outrageous and unconscionable. A more realistic expectation would be to suggest that CP possession is deemed illegal in most, if not all of the countries where it's currently legal. Anyone who actually believes countries such as the US, UK, Australia, etc, would ever soften their stance on CP possession, needs to have their head examined.
Thank you. Simply, thank you.
@ kmfkewm - I respect your right to choose what you want. All I am saying is after you have a child, I hope you feel differently.
-
Question, I am running OSX and just trying spoofing my mac addresses and my internet stopped working so I had to reset it back to normal.
Anyone know why this is an issue? how to fix it?
-
Child porn possession is legal in half of the world and probably will be legalized in the other half of the world within the next few hundred years.
shut the fuck up mate. history is moving in the opposite direction. thankfully. you sound like a filthy pedo.
-
yeh but keeping addresses and threatening folk is >:( >:( >:( never mind the shite refund policy for known scam / ers check link >:(
-
I don't think this vulnerability infected most people, unless it had been running for a long time undetected. If your TBB was updated since June you couldn't get affected. Why anyone would not update their browser is beyond me.
However, I don't think these stories answer how this FH guy got caught in the first place. I doubt it was through the javascript vulnerability, they only use that to get info on the users. The stories say Irish police and FBI had been hunting him for like a year, so other unknown techniques were used to locate the server.
Silk Road is next, spend those bitcoins fast, boys!
-
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
It is becoming clear that the US Feds are behind the take down of Freedom Hosting and have access to every record of every site hosted by them. This includes the anonymous email service known as Tor Mail. I know that MANY people, vendors included, used tormail. You must think back through your tormail usage and assume everything you wrote there and didn't encrypt can be read by law enforcement at this point and take action accordingly. I personally did not use the service for anything important, and hopefully neither did any of you.
The best article I have found on the matter is by wired (clearnet warning):
http://www.wired.com/threatlevel/2013/08/freedom-hosting/
Everyone please try to keep each other informed as you are able.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (MingW32)
iQEcBAEBAgAGBQJSAA8UAAoJEAIiQjtnt/olquUIAL8q17/eSRlrspmo2Mz0DKvI
ZNOARVATXW2AdaL5GmTmal3sbWTjK9T7u5otgXYbkD3DvB+LCdWknY6GK33fRlws
rF96mV+5BgbKyNZ8cyQAxvYCUQDnY0zzBd87H7eRTdmnZfXqPAoDd5WDTIPiukRX
mxmBwaYalNF/nti+Z+phrSPytunkPXn50jMvHj9LeF2GMJUMwuIYAN7gx7eQ24oR
GHdzXF3UKIWOMQ9vHDt6lrfqs8N/AwE+Fta/EKVAX+mRZc2O+rwVxxoRjK6ViP0L
9q8QjDhhjqF0wD+1oN8k6zGwVsrk5wE3OJid1luleFYkS+pzdRnRAA6P0y1gnjs=
=5y7k
-----END PGP SIGNATURE-----
I love u man, no homo :)
-
Let's take CP discussion here so we don't derail this thread: http://dkn255hz262ypmii.onion/index.php?topic=199155.0
-
i think its a good movement to get this pedophiles freaks to death.
Some people think you should be put to death because you choose to use drugs. They're wrong, too. This species need to evolve. More killing, and the further imposition of totalitarianism is not helping. There will always be opposing factions. We need to stop thinking about controlling and murdering each other, and try to work toward harmonization; not demonization.
Please go do some hard work establishing the ability to think critically and reason before you go saying how the world should be. That's a big part of why this species is currently such a bad way in the first place.
Let's evolve already. Bring on the post-human!
;D
-
i think its a good movement to get this pedophiles freaks to death.
Some people think you should be put to death because you choose to use drugs.
its a total different thing bro. Drugs i do them cause i chose to do them. But fucking a child, even fucking a baby, Its not the choice of the child.
I do drugs because i don't like reality. I have a reason.
i wonder what causes a man to turn to being pedophile. If i had to guess, i must say that these pukes of our society, do it either for the money, or because they have tiny cock. And maybe fucking a child makes it look bigger to them.
In anyway, keep in mind, that i am a druggie, and people can see that. Or at least many people can. I dont hurt anyone else than myself. But the CP.... you dont know who it can be. It can be the sir with the suit. Or the lady with the shop.
these hypocrites, that smile to the society, while abusing their babies, i think they dont deserve to exist, and there shall be no forgiveness in my opinion.
And honestly, i dont know anyone that would wanted a junkie to die, just because is a junkie. This is no reason, it is only a fact. Most people i know, simply try to tell junkies that "drugs will kill you, and you'd better stop using them". On the other hand, i cant find one single person (other than you and the pedophile who supported openly that it should be legal to posses CP.) to disagree that pedophiles should die.
For me, for once, i would say bravo to LE for that try. Please concentrate on that, bring down the pedophiles, and when you are done with it, you can focus on Silk Road (it will be ages until then) , but i find it a hypocrisy. If you (LE) want to stop it why you cant stop TOR? it is a joke really. I mean, i would hate my life if i could not find any drugs online anymore, but on the other hand, i would (try to) sacrifice my addiction, if i knew that TOR is brought down, and the vast majority of CP is getting busted. I would really try to stop using drugs if TOR died.
-
Child porn possession is legal in half of the world and probably will be legalized in the other half of the world within the next few hundred years.
Listen, you guys are all jumping on this dude as if this statement is advocating CP, and I don't feel that it is. While it may be a fairly antagonistic statement, and a touchy one , in no way do I see any personal support for CP in these words. It looks to me to be more of a commentary on the state of the world right now, as in " things are so fucked up that I wouldn't be surprised if CP was legal everywhere soon" . I, of course, 100% disagree with the statement, but I'm not about to jump on this dude for being a pedo when he made no such insinuations. Go easy guys, he's a member here and probably doesn't deserve false accusation.
-
I wish child porn possession was legal in 100% of the world today
-
I think Child porn will never be legal in 100% world.
-
talk about getting derailed...
ANYTHING is legal for the RIGHT price..
come on people......
-
DPR's initial warning and the subsequent advice from members with solid understanding of programming to help us keep safe...these were the types of intelligent posts that make many of us proud to be members here.
The ignorant self-righteousness of the last few days' posts...not so much.
-
talk about getting derailed...
ANYTHING is legal for the RIGHT price..
come on people......
Agree. Money makes the monkey dance. Money can't buy you love.
-
I wish child porn possession was legal in 100% of the world today
May I ask for what reason?
-
Oh where is this topic going? Moderation please! I don't wish to share the room with cp loving cockroaches.
-
Another article on the matter which says 'many reckon SR will be the next target'. Its taken from the daily mail which is not the most reputable paper in the uk..
warning clearnet link - http://www.dailymail.co.uk/news/article-2388197/Eric-Eoin-Marques-NSA-cyber-attacks-took-Dark-Web-used-online-pedophiles.html
-
I wish child porn possession was legal in 100% of the world today
You just made me hate you. Well done kid.
-
Any information on this TBB update?
-
I wish child porn possession was legal in 100% of the world today
Ha, in DPR's thread, you're coming apart bro. Are you OK? Give the man some drugs quick.
-
I wish child porn possession was legal in 100% of the world today
Ha, in DPR's thread, you're coming apart bro. Are you OK? Give the man some drugs quick.
more likely that with most of the sites gone he's finding that teletubbies isn't doing it for him
-
What does "clearnet warning" imply? What should I be doing differently to access the "clearnet?"
-
What does "clearnet warning" imply? What should I be doing differently to access the "clearnet?"
Open the link with your normal browser, not TOR
-
What does "clearnet warning" imply? What should I be doing differently to access the "clearnet?"
Open the link with your normal browser, not TOR
Incorrect.
http://dkn255hz262ypmii.onion/index.php?topic=158389.15
The answer to everyone's question as to why people are so anal about the clearnet warnings is this:
It is to make sure you access any clearweb site using TOR and not on your normal browser. Let's say LE put up a site and put on link on these forums to go to it. You access that site without TOR and with your normal browser the owner of that site now has the IP addresses of all the people who visited it. If the only link they post is in these forums than every single person who visits that site did so because they were on the SR forums which would warrant further investigation. Basically it's to tell people to only access those sites over The Onion Relay. Hope that helped.
« Last Edit: May 12, 2013, 04:49 pm by DanDanTheIceCreamMan »
-
What does "clearnet warning" imply? What should I be doing differently to access the "clearnet?"
Open the link with your normal browser, not TOR
Incorrect. Don't do this. Generally you *want* to visit links from the forum only over Tor.
Edited to add:
Be careful about clicking on any user posted links on this forum. The link could be an attempt to attack you.
You must think about everything you are doing. If you are not sure then the best thing to do is to stay on trusted websites (the SR and the SR forums).
-
Fuck , guys I'm sorry. Apparently I had that all wrong and was in no position to be giving advice. Thank you for correcting me. Dam. I've been doing things........ wrong
-
I wish child porn possession was legal in 100% of the world today
Ha, in DPR's thread, you're coming apart bro. Are you OK? Give the man some drugs quick.
more likely that with most of the sites gone he's finding that teletubbies isn't doing it for him
He ain't like that Abb's, he's got a heart darlin.
-
I wish child porn possession was legal in 100% of the world today
Ha, in DPR's thread, you're coming apart bro. Are you OK? Give the man some drugs quick.
more likely that with most of the sites gone he's finding that teletubbies isn't doing it for him
He ain't like that Abb's, he's got a heart darlin.
I know, I've heard about his heart and am surprised that no one has cut it out by now. He's so full of compassion that he draws the line at directly causing harm, he just likes to watch the results because he *knows* that there's absolutely no harm done by that. A fine, upstanding human being whom anyone would want to take home to meet the family.
-
I just skimmed thru all 16 pages and cant find what i'm looking for..
Would having a VPN running help at all with this?
-
Since the SR forum seems to require a real email, and many have used tormail email addresses there, is it safe to switch in a fake, nonexistent email for now?
And what are the best alternatives to Tormail now that aren't compromised?
Anyone know if torguard . net is a good alternative? (I didn't want to post the actual link since link-posting paranoia is high at the moment) They say they're tor and PGP-based, and offshore (which technically would help against the NSA/govt access to emails older than 30 (or is it 60) days, which they consider legally "abandoned" and thus obtainable).
I looked a hushmail and i think the consensus there is that it's totally open to government access if and when they want it, so it's pretty much out. I guess encrypting every single email would help.
But I think a true hidden service email that's independent, tor-based, uses https encryption, perhaps has PGP built in, and then using PGP wrapped INSIDE that PGP would be the ideal alternative. Does such a thing exist?
If not, there's a definite hole in the market for that right now, lol!
-
I wish child porn possession was legal in 100% of the world today
Ha, in DPR's thread, you're coming apart bro. Are you OK? Give the man some drugs quick.
more likely that with most of the sites gone he's finding that teletubbies isn't doing it for him
He ain't like that Abb's, he's got a heart darlin.
I know, I've heard about his heart and am surprised that no one has cut it out by now. He's so full of compassion that he draws the line at directly causing harm, he just likes to watch the results because he *knows* that there's absolutely no harm done by that. A fine, upstanding human being whom anyone would want to take home to meet the family.
Better the devil you know....At least he is honest about it, were are on an anonymous forum after all, so who else would confess? We are all gods children sweetheart.
-
Since the SR forum seems to require a real email, and many have used tormail email addresses there, is it safe to switch in a fake, nonexistent email for now?
The forum doesn't require a real email address. Make something up. If your email address isn't visible, you can even leave your defunct Tormail address, although you might want to change it to unlink your forum identity from that address (unless it's the same username or something).
-
damn feds...
-
I wish child porn possession was legal in 100% of the world today
Ha, in DPR's thread, you're coming apart bro. Are you OK? Give the man some drugs quick.
more likely that with most of the sites gone he's finding that teletubbies isn't doing it for him
He ain't like that Abb's, he's got a heart darlin.
I know, I've heard about his heart and am surprised that no one has cut it out by now. He's so full of compassion that he draws the line at directly causing harm, he just likes to watch the results because he *knows* that there's absolutely no harm done by that. A fine, upstanding human being whom anyone would want to take home to meet the family.
At least there are some people here who draw the line at CP! Anyone who can't follow the logic of abby's post has to be drug fucked. Trying to justify why you look at and find pleasure in the sexual abuse of innocent children is ridiculous in itself, not to mention the absurd comparisons being made, especially the fixation with the Jews and the WWII Holocaust.
-
cha ching ;)
-
is it at all possible that this exploit has enabled LE to seize control of established vendor accounts and utilize them to entrap buyers?
-
is it at all possible that this exploit has enabled LE to seize control of established vendor accounts and utilize them to entrap buyers?
OMG...NOOOOOOOO!!
How did you even think up the idea that this could be possible???
-
you need to step up your sarcasm game, ace
notwithstanding your brilliance, and my naivety, i'll take that as a yes
thanks, champ :)
-
you need to step up your sarcasm game, ace
notwithstanding your brilliance, and my naivety, i'll take that as a yes
thanks, champ :)
That wasn't sarcasm. ;D
-
so you're even greener than me :D
you need to step your SR game up, boy
-
Your not green....your stupid..and there is a difference.
Good thing being stupid and asking stupid questions is allowed in these forums. You will fit in perfect. I would suggest you join the PGP club. You are exactly what they are looking for. Thank you for the advice. I will try. Good thing you told me...without your sharp insight, I may never have figured it out. Keep up the smart questions, you are clearly an asset to the community. As you seem to see stuff the rest of us missed. I do not think anyone has ever though if LE could take over a vendor account and sell drugs to entrap people... as you suggested. Good thing you got passed the 50 thread count so you can post in these forums. I just wish you would have come a couple years ago to help us all out. Oh well...at least you are here now. Please think of some more brilliant ideas and start threads. We need to hear what you think.
-
Your not green....your stupid..and there is a difference.
Good thing being stupid and asking stupid questions is allowed in these forums. You will fit in perfect. I would suggest you join the PGP club. You are exactly what they are looking for. Thank you for the advice. I will try. Good thing you told me...without your sharp insight, I may never have figured it out. Keep up the smart questions, you are clearly an asset to the community. As you seem to see stuff the rest of us missed. I do not think anyone has ever though if LE could take over a vendor account and sell drugs to entrap people... as you suggested. Good thing you got passed the 50 thread count so you can post in these forums. I just wish you would have come a couple years ago to help us all out. Oh well...at least you are here now. Please think of some more brilliant ideas and start threads. We need to hear what you think.
Your not green....your stupid..and there is a difference.
Good thing being stupid and asking stupid questions is allowed in these forums. You will fit in perfect. I would suggest you join the PGP club. You are exactly what they are looking for. Thank you for the advice. I will try. Good thing you told me...without your sharp insight, I may never have figured it out. Keep up the smart questions, you are clearly an asset to the community. As you seem to see stuff the rest of us missed. I do not think anyone has ever though if LE could take over a vendor account and sell drugs to entrap people... as you suggested. Good thing you got passed the 50 thread count so you can post in these forums. I just wish you would have come a couple years ago to help us all out. Oh well...at least you are here now. Please think of some more brilliant ideas and start threads. We need to hear what you think.
Damn King! You got called out on your sarcasm game and you didn't just "step up" your sarcasm game, you ran up the escalator!
First with a sarcastic rebuttal regarding your initial sarcasm, and then the quote above really kicked your game up a few rungs.
Unless of course maybe you are unfamiliar with sarcasm and meant all of the kind words of encouragement.... (unlikely)
-
I guess it is better then he thought...as my very first response was not sarcasm.... and my last message might have even fooled you (not likely) ;)
-
Tails. Everyone. Please. Thank You...
Okay, on a serious note; I dont really understand claws mail. Is this a viable, anon email choice? I mean, honestly, any email service could be used as long as it is accessible through tor, right? Then theres pidgen. This could also be used.
So, what do we think about claws? Oh, and if anyone else has any musings over tails vs whonix, please...Im all ears.
-
Another article on the matter which says 'many reckon SR will be the next target'. Its taken from the daily mail which is not the most reputable paper in the uk..
warning clearnet link - http://www.dailymail.co.uk/news/article-2388197/Eric-Eoin-Marques-NSA-cyber-attacks-took-Dark-Web-used-online-pedophiles.html
He can be whatever they said, but at the end, he provide to all of us a hosting service. I mean, look at his face. There were a lot of sites in that host. There is a lot of shit in the deep web, is not fair, they are flagging us like pedophiles to all of us. In my opinion there is a limit and the police is crossing it.
-
There are no secure email systems. NONE. The only secure email consists of using PGP and encrypting all messages that are sent via email.
Do not delude yourself into thinking that safe-mail or any other PROCLAIMED email is safe---it is not.
-
benzo king is like the first 5 comments priasing dpr for all his hard work. prolly the same day the fucking retard ran off with atleast 30 k in btc prolly a lil more. atleast he got banned im still LIVID about this. no rent this month lol fucking cuntttttt
-
There are no secure email systems. NONE. The only secure email consists of using PGP and encrypting all messages that are sent via email.
Do not delude yourself into thinking that safe-mail or any other PROCLAIMED email is safe---it is not.
+1. That's excellent advice. Encrypt ALL communication to prevent the possibility of any correspondence (especially if it's incriminating) you've written being able to be read by prying eyes in the event the servers should ever be compromised.
-
We can get into this security circlejerk all day and night but the reality is that p2p encryption is what will keep you safe. Your keys protecting your content. Regardless of the media on which they are stored, be it insecure email or whatever, if the content of the message has had it's encrypted integrity maintained then it should not matter. People choosing to operate their personal data on tormail servers in plaintext should have definitely known the risks of doing so. There is no excuse.
When it comes to encryption and security: Your attention to detail and how thorough you are should equal your DESIRE TO STAY OUT OF PRISON.
in other words: if you cut corners in securing yourself then you should be willing to accept those risks involved in doing so.
In the meantime:
Change your virtualbox VM's over to linux if you haven't now. Consider TAILs
Disable Javascript in tor browser.
-
Your not green....your stupid..and there is a difference.
Good thing being stupid and asking stupid questions is allowed in these forums. You will fit in perfect. I would suggest you join the PGP club. You are exactly what they are looking for. Thank you for the advice. I will try. Good thing you told me...without your sharp insight, I may never have figured it out. Keep up the smart questions, you are clearly an asset to the community. As you seem to see stuff the rest of us missed. I do not think anyone has ever though if LE could take over a vendor account and sell drugs to entrap people... as you suggested. Good thing you got passed the 50 thread count so you can post in these forums. I just wish you would have come a couple years ago to help us all out. Oh well...at least you are here now. Please think of some more brilliant ideas and start threads. We need to hear what you think.
cool story, champ
XD
-
http://www.businessinsider.com/teens-posting-photos-of-drugs-from-silk-road-2013-8
FUCK NO ! >:(
-
Maybe....just a thought from someone who knows far less on the subject of PGP than the many who are far wiser... but, the way I see it (in part) is that the longer the key, the stronger... (correct me if I'm wrong). And I've read many threads here on security and understand that currently it's being recommended that keys that are 2048 bit RSA are good and secure. Considering that the folks who are recommending this seem to be very knowledgeable on the subject, I feel way out of my leauge even posting anything like this here - probably because I am.... :-\
Guess, my only reason for even bring it up at all, is the fact that most who are doing the recommending also mention that they personally use a 4096 bit RSA key.... just after reading the latest few pages here, it does appear as if the best thing each and every one of us can do is to use the strongest security methods we can to protect ourselves... and if it's safer to use a 4096 bit RSA key... then.... shouldn't that be one recommendation made by those who truly understand? Along with other precautions of course.... just kind of wondering is all..... ???
-
Maybe....just a thought from someone who knows far less on the subject of PGP than the many who are far wiser... but, the way I see it (in part) is that the longer the key, the stronger... (correct me if I'm wrong). And I've read many threads here on security and understand that currently it's being recommended that keys that are 2048 bit RSA are good and secure. Considering that the folks who are recommending this seem to be very knowledgeable on the subject, I feel way out of my leauge even posting anything like this here - probably because I am.... :-\
Guess, my only reason for even bring it up at all, is the fact that most who are doing the recommending also mention that they personally use a 4096 bit RSA key.... just after reading the latest few pages here, it does appear as if the best thing each and every one of us can do is to use the strongest security methods we can to protect ourselves... and if it's safer to use a 4096 bit RSA key... then.... shouldn't that be one recommendation made by those who truly understand? Along with other precautions of course.... just kind of wondering is all..... ???
It's predicted that a 2048 bit RSA key will not be cracked until around 2033, approx. 20 yrs from now. It is advisable that anyone creating a new pair of keys choose a key strength of 4096 bits instead of 2048. This will allow you many extra years past the current prediction of 2033 for a 2048 bit RSA key before the need to create a new, stronger key becomes a necessity. Basically, when creating a new pair of keys, choose the strongest option available to you which is for most software, 4096 bits. Some software will allow you to create larger keys but a 4096 bit key is strong enough for the time being.
-
@Wadozo thanks for that! I wasn't implying that a 2048 bit key wasn't strong enough.... and by what you just said, it sounds plenty strong if it's not predicted to be broken for another 20 years. (I've got a 4096 though anyway.. ;D )
-
How does a PGP newbie step up to that number?
-
How does a PGP newbie step up to that number?
Depends on what PGP software you're using. Some will have a max. key size of 2048 bits or even lower. Gpg4usb is a great one to use. You can create a pair of keys, 4096 bit RSA ones at that, and is very simple to use. It will work on Windows, Mac and Linux OS and has a friendly user interface for newbies.
Download it from here - http://gpg4usb.cpunk.de/download.html
Follow astor's excellent tutorial - http://nfm5tbykjg6oijbm.onion/gpg4usb/