Silk Road forums

Drugs are only hurting myself if anybody.

Child porn oftentimes ruins the lives of individuals depicted within them. Note that I define CP as being pornographic images of actual children (Perhaps around 14 and under), not of teenagers who have the capacity to understand the consequences of capturing themselves in pixels and face the same risks adults do in regards to pornographic images of themselves. Those akin to Amanda Todd deserve no sympathy for their poor life-choices. Meanwhile, a close friend of mine who was raped numerous times in his single digits by a guy who was never charged, and grew up to become a pedophile himself, deserves sympathy.

Preferably we'd have a TOR with no child porn, and no individuals who had a sexual compulsion to touch children. However, I cannot think of a practical way to create such a TOR; it's likely impossible.

Pictures don't molest kids, people do. Also I find it amazing that you don't sympathize with Amanda Todd considering she was extorted for sex pictures by some dude on the internet she sent a picture of her flashing to (after he manipulated her into doing so), and when she refused to send more pictures he spammed her shit all over the internet and then she got picked on so much at school that she killed herself. So your policy is no looking at pictures of naked people below the age of 14, but it is okay to extort people older than that for sexual pictures and then spam them all over the place until they kill themselves? That is so weird because my belief is about the exact opposite, that it is okay to *look* at whatever you want, but it is not okay to manipulate kids into sending you sexual pictures and then blackmailing them with them. 

Manipulating kids into sending you sexual pictures and then blackmailing them for more = bad
Looking at pictures of kids who were manipulated into sending sexual pictures that were posted on the internet = morally neutral
Getting pictures of kids who who posted sexual pictures on the internet and then blackmailing them for more = bad
Looking at pictures of kids who posted sexual pictures on the internet = morally neutral

Note that in the cases I labeled as bad that a victim is inherently created, and that in the cases I labeled as morally neutral that there is not an inherent ability for the previously created victim to become aware of the fact. By the time somebody views such an image on the internet, any potential victim was already created, and barring some quantum entanglement like phenomenon, no further victimization is inherently taking place. Also make note of the fact that it is illegal to extort anybody regardless of their age.

Quote from: kmfkewm on June 19, 2013, 10:42 am

Quote

MOSCOW, June 18 (RAPSI) - Sergei Zhuk, the leader of the Bounty Hunters, a group that aims to combat pedophilia through the detection of child pornography, has asked Russia's Interior Ministry and communications agency Roskomnadzor, to restrict access to the anonymity network known as Tor, Izvestia reports on Tuesday.

The Tor software enables online anonymity by directing traffic through a worldwide volunteer network which makes it more difficult to trace Internet activity. This technology, developed by the US Naval Research Laboratory for its own purposes, was declassified in 2002 and handed over to civilian programmers for further development.

According to Zhuk, Tor is primarily used by people creating illegal websites, which cannot operate in the legal framework. In his letter, he provided examples of online anonymity being used for mala fide purposes, adding that the .onion domain zone already contains multiple websites for pedophiles.

The activist believes that Russians consume a large portion of the content.

In the closing part of his letter, Zhuk give his recommendations on how to block Tor in Russia.

Roskomnadzor has confirmed that they have received Zhuk's letter and they are currently considering the information. The Interior Ministry's press office said they have not yet received such a letter.

Bounty Hunters is a public association which detects child pornography on the web. The group became well known in September 2012 when it criticized Russia's largest social networking website, VKontakte, claiming that it hosted a large amount of child pornography.

I wonder if he knows that it isn't illegal to view or possess child porn in Russia.

Is that for REAL? Wow... gross.

It isn't illegal to view or possess child porn in about half of the world.

en.wikipedia.org/wiki/Laws_regarding_child_pornography

That map is somewhat misleading as well, there are some places where it is legal to view child porn if you don't intentionally save it to persistent memory. So viewing and possessing are differentiated in some areas, with viewing legal but not possessing. Also, in some parts of the world where possession and viewing are both illegal, simple possession or viewing are citation/warning/ticket level offenses.

Quote from: tree on June 21, 2013, 10:48 pm

128 characters is a lot to remember! Is a 15 character truly random password strong enough? I thought anything over 13 random characters was considered strong. I've heard of using 5 or more words and then 8 random characters at the end to make a strong password.

Yes currently anything over 13 characters will most likely be sufficient as long as it isn't just lowercase letters.
A lowercase 13 characters password could be guessed on average in less than an hour at 350 billion tries per second.
Once you throw in a few uppercase letters it will take on average more than 1.5 years to guess.
I got the 350 billion tries per second figure from here:

http://arstechnica.com/security/2012/12/25-gpu-cluster-cracks-every-standard-windows-password-in-6-hours/

Quote

A password-cracking expert has unveiled a computer cluster that can cycle through as many as 350 billion guesses per second. It's an almost unprecedented speed that can try every possible Windows passcode in the typical enterprise in less than six hours.

That xkcd is good advice though since sentences are easy to remember but hard to guess so they make great passwords.

According to Wikipedia each ASCII printiable character has 6.570 bits of entropy, so if your password is truly randomly generated, thirteen characters is only equal to 85.41 bits of entropy. That is not a horrible password, for a long time the minimum entropy of a secure password was considered to be 80 bits, but today estimates are closer to 128 bits. 80 bit passwords are no longer considered to be secure, 85 bit passwords are significantly better but you really should aim for at least 128 bits, which is about 20 random ASCII characters or 128 characters of English text.

A definitive guide on how to make weak passwords?

You could change the Tor source code to keep entry guards longer, for 6 months or even a year, but then you would stand out more, reducing your anonymity in a different way.

This is the standard dogma of the Tor camp, however I fail to see it. If you keep the same set of entry guards for a year, only the entry guards, their ISP's and your ISP are capable of determining this. If your ISP, your entry guard, or your entry guard's ISP's are malicious, then you are at great risk of falling victim to a timing attack or a fingerprinting attack. It definitely makes you stick out (to your ISP, entry guards and entry guards ISP) if you use persistent entry guards, but I don't think it really reduces your anonymity in any appreciable way. The people who know that you are using those guard nodes already know who you are, and they already cannot tell where you are going unless they get you with a timing or a fingerprinting attack, and if they want to get you with a timing or a fingerprinting attack they are already capable of doing so. I have never gotten a satisfactory answer as to how exactly using persistent entry guards reduces your anonymity.

You can also reduce your anonymity by making your circuit behavior on the network more noticeable. Some people feel the need to exclude nodes in whole countries. For example, someone living in the United States may not want to connect to relays in the United States. If an attacker operates one of his entry guards, he might notice that this person never connects to relays in his own country, meaning he's trying to get extra protection, making him a subject on interest. If the attacker were LE, he might start investigating that Tor user.

That is the most acceptable answer I have ever heard regarding this subject. However, I would point out that if the attacker operates one of your entry guards they are able to attempt timing and fingerprinting attacks against you regardless of if you stick out or not. I can see a possibility that if you stick out by using the entry guard in a persistent way, that the attacker may decide to do non-traffic analysis based surveillance on you. That is the only way I can see using a persistent set of guards as possibly being detrimental. Although if everybody on SR starts using persistent entry guards, then using persistent entry guards will become a behavior associated with SR. But if only you use persistent entry guards, out of all of the people here, and you never tell anybody that you do, it seems like a bit of a stretch to me that this hurts anonymity (although this is what the Tor people claim, so I am not finding fault with your description at all).

There are theoretical non-technical attacks on SR users that involved Tor. For example, a lot of vendors check buyer addresses on Google Maps and similar sites to see if they are valid (to avoid issues with products not arriving and having to go into resolution). They make these searches over Tor. If LE wanted to go on a fishing expedition, they could ask Google for all searches over Tor and hand those addresses to local LE for increased surveillance and inspection of incoming packages.

I would be absolutely furious to learn that a vendor looked up my address on Google Maps over Tor. I would also be furious to learn that a vendor looked up the tracking number on my package over Tor. Although it is probably common behavior, thankfully none of the vendors I work with would ever do such things though.

No legitimate doctor is going to prescribe that people smoke a cancerous substance, or consume orally a drug with unknown dosage, when they can instead take a pill that is accurately dosed, does the same thing and doesn't cause cancer.

The people putting their trust in the SR server side encryption obviously don't understand the difference between types of encryption. There is absolutely no way that the SR server side encryption is adequate to protect from 99% of attacks. Chances are extremely high that it consists of having things stored on a mounted symmetrically encrypted partition or container. That means that everything is in an unencrypted state while it is in RAM, which will be almost 100% of the time. If hackers pwn the servers, they can get all of the plaintexts. If the server is seized, unless the feds tremendously fuck up how they go about it, they will be able to get the plaintexts.

Completely zeroing out your computer is actually nearly impossible. You can run software a few times that claims to 0 out everything, but the fact that you have to do it a few times means that it isn't always 100%.

The best way to do it, and keep the HDD is an expensive piece of equipment called a degausser.

If you aren't worried about losing everything, just buy a new HD.

You don't *have* to do it a few times though.