376
Security / Re: Let's talk about security
« on: August 19, 2013, 09:58 pm »Here's another thought.
Why not use tor to connect to a remote shell sponsored by PRQ (clearnet: http://en.wikipedia.org/wiki/PRQ (http://en.wikipedia.org/wiki/PRQ) )
Then connect to your drug dealing site. You can subscribe to PRQ anonymously and pay with bitcoin...
I don't think the DEA or the FBI could get access to their logs and the Swedish courts have more important things to worry about.
One of the Tor developers draws the distinction between "privacy by design" and "privacy by policy". Tor gives you privacy by design. It's difficult for someone to know who you are and what you are doing, because of the design of the network. VPN provides offer privacy by policy. They "promise" not to log what you are doing. You have no way to verify their claim, they could change their minds, or they could be compelled by their authorities to start logging.
What you seem to be promoting is privacy by red tape.
Julian Assange is not confident in the Swedish government's ability to resist the US government's demands, so I don't know if I would base my safety on that.
If the VPN is in Sweden we already know all traffic to it from outside of Sweden and all traffic that exits it to outside of Sweden is being logged by Swedish signals intelligence.
Quote
I agree... but you have to have the hidden service (if the attack is for "all SR users", they have to have SR) side before owning the entry guard tells you more than "Sparky from Omaha is using Tor." Otherwise you still don't know who's using SR.
You don't need to have the hidden service if you have all of its HSDIR nodes, you can do timing attack from the targets entry guard to the HSDIR node request for the hidden service. Although then to actually tie users to their accounts on SR would require a bit more handy work, although once you are pretty certain the user is surfing SR fingerprinting attacks could be used to tie them to specific accounts with little hassle, if they make posts or send messages the attacker can view.
Quote
I was always working under the assumption that all HSDir nodes had access to all hidden service descriptors (telling them who the Introduction Points for the HS were). I know there was a new feature added in the past year or so to allow the use of a key to only allow clients where knowing the key the ability to find the IP for the service.. but that's a non-starter for "public" hidden sites, since all users have to know the key.
Cookie to access hidden services (and tell if they are up without owning their HSDIR node) is pretty old feature.
Quote
Firstly, you say a hard drive can be COMPLETELY encrypted. Does this literally mean if my computer is seized by law enforcement, NO info at all with be able to be seen be them? Can this be done with TrueCrypt as from what I hear, it can, and not even the FBI can crack it....I would REALLY appreciate a step by step guide on totally encrypting my harddrive and not even have to worry if my computer ended up in the wrong hands....
How much info they can see depends on the implementation and the way you use it but in the majority of cases FDE is not actually FDE. At least the boot sector is usually on the drive without being encrypted, often other things are not encrypted as well. This was news to me (other than boot sector which obviously cannot be encrypted) as I thought FDE meant that the entire drive looked like randomness, but in most cases there are still non encrypted areas, just no areas that you would normally have anything incriminating on or write to at all for that matter. You can put the boot sector on a USB stick and boot from that, but there will still be some non encrypted areas on the drive in most cases.