Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Messages - kmfkewm

Pages: 1 ... 130 131 [132] 133 134 ... 249
1966
Security / Re: Persistant entry guards across reboot
« on: October 08, 2012, 08:51 am »
Cool.

Got any links for the new Tor dev direction towards this issue ? Or entry guard discussion on general.

http://freehaven.net/~arma/cogs-wpes.pdf

1967
Security / Re: VSentry - New virtualization idea/software
« on: October 07, 2012, 09:27 am »
It sounds a lot like Qubes, which also uses Xen and seems to do the same thing, but is free. You can certainly use isolation techniques to your advantage. Qubes even has secure copy paste between virtual machines, so you could implement a virtualization based 'air gap' with it by running GPG in one VM and firefox in another. Then you could copy ciphertexts from the GPG vm to the firefox VM. That way if firefox is pwnt the attacker will have more trouble to get to your plaintexts. It is also the easiest way to get x level isolation between apps, the lack of which is a truly enormous attack vector that all current window managers have. You could have it automatically open .pdf files in virtual machines that don't have access to the internet, so you would worry less about opening pdfs or docs or anything that phones home. You could make temporary sandboxes to run applications in pretty quickly. You could have Tor running in a different vm than firefox or pidgin, so even if those applications are pwnt the attacker can not easily deanonymize you. You can also isolate an attackers ability to spread through your system, if you do sensitive things in pidgin and firefox the compromise of one will not essentially ensure the compromise of the other. Virtualization based security has its own andvantages and disadvantages, it seems that paravirtualization solutions like xen offer the best ratioed trade off between security of applications/environments and isolation between applications/environments, but they are not without some serious drawbacks. For example currently xen does not support ASLR so you lose that security advantage, it also is not as secure to use virtual machines as it is to run directly on hardware so it could additionally hurt your security some here. Virtualization is from the isolation school of computer security, and isolation is widely recognized as a legitimate way of obtaining security, although some people like it a lot more than others and it isn't without its critics. 

1968
Security / Re: Persistant entry guards across reboot
« on: October 07, 2012, 09:12 am »
persistent entry guards are extremely important for anonymity. The Tor devs are actually in the process of revamping the entry guard selection algorithm to pick less guards and use them longer, and possibly layering guards for hidden services. I personally strongly suggest configuring your hidden services with a client instance of Tor to be used as a socks proxy for the hidden service instance of Tor. It hurts hidden service load times, but it offers a much much higher degree of anonymity than a vanilla Tor hidden service configuration. Also if you don't  have non-encrypted sensitive data on the hidden service, there is no real disadvantage to running the web server in a virtual machine with Tor running on the host and host only networking or similar, this can offer a much higher degree of protection from attackers who try to deanonymize your hidden service by hacking it. The disadvantage of using a virtual machine isolated hidden service  is that the web servers operating environment is easier to compromise than it would be if the web server was running on non-virtualized hardware. The advantage to using virtual machines in this way is that an attacker can't get to the external IP address from inside the VM so you can make it much harder for hackers to gain unauthorized access to the external IP address.

Short of implementing a hardware isolation solution to sandbox the web server from external IP address, the best bet for a highly anonymously configured hidden service is currently to take both of these steps (virtualization based isolation + Tor over Tor).

1969
Off topic / Re: If you had a time machine....
« on: October 06, 2012, 06:48 am »
I would definitely go six or seven hundred years into the future. For one I would get a history of lottery drawing numbers and make sure to hit a big jackpot when I got back, so I would be very rich if I returned. It might be hard to track down this information quickly, but if there is still an internet it shouldn't be too hard to look up within such a timespan. Actually I would first put someone here in charge of maintaining a website that keeps track of lottery numbers, and then since when I get back I will be a billionare after winning two massive jackpots, I could use some of the interest from that to create a foundation that archives lottery numbers and other tidbits of information that I may find advantageous to know, so that I can record them in the future and bring them back with me.  Additionally, it is probable that in six or seven hundred years the state of medicine and technology in general will be extraordinarily advanced, if pseudo immortality has been achieved I would probably stay. At least I would bring back as much information with me as I could in an attempt to advance the present day to futuristic standards. 

1970
Off topic / Re: Abu Hamzar getting extradited to the us, finally.
« on: October 06, 2012, 12:16 am »
Ah I see he had more recent charges that are actually warranting of being called crimes. His previous charges were for things that would not be illegal in the USA though (hate speech, having terrorist propaganda, etc).

1971
Off topic / Re: Abu Hamzar getting extradited to the us, finally.
« on: October 06, 2012, 12:14 am »
I just glanced over who he is. It seems like the vast majority of his crimes are not illegal under USA law. We have freedom of speech and freedom of press. What exactly is he being extradited for?

1972
Philosophy, Economics and Justice / Re: ***DPR's Book Club***
« on: October 04, 2012, 11:37 am »
We have that!  It's called the Rumor Mill :)

DPR, do you think any SR competitors will come on the scene anytime soon?

Google must be the main source of newcomers to SR, if you type in: "how to buy drugs online" that gawker article pops up at #1 on the SERPs

I'm curious as to how word spread initially though, was it just a word of mouth type thing, because obviously you can't really market a website like SR very easily.

DPR deserves an award for best marketer of the century lol.

1973
Shipping / Re: Packaging methods tested with actual trained dog
« on: October 04, 2012, 08:26 am »
for once oscar is actually not full of bs http://www.barksar.org/K-9_Detection_Capabilities.pdf
I agree, dogs can smell molecules so no matter how many times you vacuum seal a single molecule will leak out and the dog will detect it which is why if you ship international you should come up with better packaging methods.

Vacuum sealing is important and of course it creates a window of time in which the contents can not be smelled. You wash with alcohol or similar to clean any traces off the layers of the vacuum bag. A vacuum seal holds molecules in, so it keeps them away from the dogs nose. Over time scent can permeate the vacuum seal bag. Some vacuum seal bags are made with less porous materials than others and thus hold the scent away from the dog longer. I would be hesitant about using metal foil in packages, but would look into less porous plastic bags.

1974
Security / Re: Be Careful
« on: October 04, 2012, 01:34 am »
Buying bitcoin is not illegal.

Transferring bitcoin to SR is -suspicious- but not illegal.

You can buy books, cigarettes, there's legal stuff on this site available.  You can buy bitcoins on this site too. 

There's paranoia troll threads like this every week.

You need a crash course in the difference between intelligence and evidence. Here is a hint, one leads to the other.

1975
who gives a fuck if it is a cop it isn't like you ship with your real return address is it? That doesn't even strike me as suspicious at all. Jesus christ reading this post just makes me think that you should not get high on your own supply.

1976
Silk Road discussion / Re: What OS Do You Prefer to Access "The Road"
« on: October 03, 2012, 11:52 am »
why the fuck do people still use windows xp lol

1977
International mail to Australia gets seized much more regularly than mail to other countries. No package is immune from being seized. I have heard of people in USA who had letters without drugs in them opened and inspected by customs, so in all cases there is a probability that your package will be randomly inspected. The best you can possibly hope to do is try to keep the chance of thorough inspection equal to random chance selection. Australia thoroughly inspects more international mail than most countries do, and according to all the documentation available they do two stage screening on 100% of international mail.

Wtf are you on about asdf345 is an Aussie vendor. This was a domestic bust. And if you're still here, delete this thread, OP. You've just told the cops that these kids still have access to various Silkroad accounts. Not cool mate.

Oh, well in that case it seems likely that they probably ran their mouthes to friends and got snitched on. Domestic mail almost never gets intercepted anywhere, unless it is a huge pack or packaged like shit.

1978
Security / Re: Be Careful
« on: October 03, 2012, 11:24 am »
^ But its still hard to understand how police can make a prosecution with just records of bitcoin transactions linked to a person? From the cops end they would have a person linked to one or more bitcoin transactions, maybe then they could prove that these transactions went into Silk Road but then what?

I'm guessing they are using accumulated seizures then trying to link the people who were meant to receive these transactions to bitcoin transactions. Although this is kind of unnecessary as they could already charge the person anyway.

It is just the opposite of what you already guessed, they see you getting bitcoins in suspicious amounts or linked to SR somehow and then they monitor your incoming mail and pwn you for drug trafficking.

1979
Security / Re: Be Careful
« on: October 03, 2012, 10:34 am »
It's not illegal to buy bitcoins so how can they arrest people for that?  Also how come nothing like this has gone down in the US, where the DEA is operating with much more resources than any UK agency?  There are also still clearnet sites that sell illegal drugs, how come many of those haven't been cracked down on and the customers arrested?  Furthermore I've received customs letters in the past and nothing ever came of it, I just lost money.  For these reasons I'm going to call bullshit and I hope I'm not wrong.

I am so sick of hearing people parroting "OMFG IT IS NOT ILLEGAL TO BUY BITCOIN SO IT DOESN'T NEED TO BE DONE SECURELY". That makes about as much sense as thinking you won't be tried for murder if you have a butcher knife covered in blood of a murder victim who was stabbed to death found under your bed, because hey owning bloody butcher knifes isn't illegal!!!!

1980
International mail to Australia gets seized much more regularly than mail to other countries. No package is immune from being seized. I have heard of people in USA who had letters without drugs in them opened and inspected by customs, so in all cases there is a probability that your package will be randomly inspected. The best you can possibly hope to do is try to keep the chance of thorough inspection equal to random chance selection. Australia thoroughly inspects more international mail than most countries do, and according to all the documentation available they do two stage screening on 100% of international mail.

Pages: 1 ... 130 131 [132] 133 134 ... 249