Silk Road forums

Quote from: BenCousins on June 26, 2012, 07:52 pm

i cant seem to get my bridges working can anyone help?
I said this a couple of days ago,but what is the weakness in connecting to SR from a clean laptop purchased with cash using a wireless prepaid USB for net purchased with cash (fake name) and booting that laptop with an OS on an external USB that is encrypted and hidden(physically hidden) when not using. This laptop/USB/wireless net would only be used for connecting to SR. surely this is overkill as a buyer but as a vendor i see this would be necessary. I fail to see how i could be traced if i did all that.

The question isn't how you would be traced, it's why you would be traced and who would trace you. Remember, everything the government does costs money, the setup you described would be hard to trace, in other words, expensive.

But the thing is the government doesn't need to target him. They target Tor in general, and he might get scooped up in that.

An anonymous tip by itself is not enough to raid someone afaik

Because his apparent lack of interest in and knowledge of properly securing himself is contradictory to the thought of him being good at doing things that require being properly self secured? 

There is not a single way in which VPNs work, there are a few different types. However, there are some general things we can say about VPNs. First of all, if they are low latency they are weak to the general anonymity attacks against all currently known low latency anonymity systems. This means that they provide anonymity from passive attackers by making it difficult for them to see where your traffic enters AND exits. If an attacker can see the entry AND exit of your traffic, they can deanonymize you regardless of the sort of VPN you are using or if the VPN nodes themselves are compromised. This deanonymization attack can also be carried out regardless of the number of intermediary nodes that you route your traffic through from entry to exit. If an attacker can not simultaneously monitor your entry and exit points, they will need to either work their way from your exit point to your entry point (if they are, for example, the website you are visiting, or someone who is monitoring it), or from your entry point the the exit point (if they are watching you and trying to determine which website you are visiting). This is speaking strictly in terms of what I would call signals intelligence, there are attacks that can identify pre-fingerprinted websites through the encryption that is provided by the *overwhelming majority* of VPN providers, and this could allow such an attacker to determine the website you are visiting even if they can not observe your actual exit traffic.

With many VPN providers they will offer a limited number of entry and exit points. An attacker going against these services is less concerned with middle nodes. For example if you use a provider with many nodes that only allows entery with a node in USA and exit with a node in Netherlands, the attacker doesn't necessarily need to get logs from the middle nodes if they can identify the provider who owns the exit you are using and determine which entry you must have used. So in these cases a true back or forward trace of logs may not be required as the attacker knows where the logs they are really interested in are stored already.

The anonymity of a VPN is largely provided by how the provider is structured. If the nodes you are using are in ten different countries but are owned by a provider in USA, a single warrant in USA is probably all that is required to compromise all ten of their hops. Some of the better VPN providers have structured themselves in such a way that a warrant is required to the operator of each hop, and this is certainly advantageous from a legal resistance perspective.

At the end of the day, a VPN can provide anonymity that is fed resistant. This can be seen by simple open source intelligence gathering, there have been numerous cases where the botnet operator could not be traced until they forgot to use VPN. Of course, one must also take into consideration the fact that misinformation could be being fed through open source channels, giving the impression that the botherder forgot to use VPN when in reality their VPN was compromised. However, at the end of the day there are no cases of people who used Tor being traced by law enfocement, and there are thousands of cases of people who used VPN providers being traced by law enforcement. It is largely a matter of time for either of these solutions, eventually you can be traced. Even with extremely anonymous solutions such as mix networks it is largely just a matter of time before a global passive attacker deanonymizes you, unless there is constant rate cover traffic. And low latency solutions provide absolutely no protection from global passive attackers.

It is really an enormously large topic and I am going to need you to ask something more specific than "how does vpn work and how is it anonymous" to give you a good answer, without typing out a very large amount of information, especially as you apparently would need a large amount of terminology explained to you before the merits of a VPN can be properly analyzed.

Yes cigarettes are pathetic.

I would not call DXM pathetic, but it's certainly a BAD drug. It has a nasty body load to it, horrible side effects, and there are plenty of drugs that are far better than it in it's category, and other categories.

I look down on people who use it the same was I look down on people who huff freon from A/C's, and people who inhale butane or duster. It's really bad. Don't do it. I'm not a snob, I'm just sensible.

Comparing DXM to huffing freon or duster is just stupid. DXM has a mechanism of action that is separate from "brain cells dying from asphyxiation".  I think DXM is a pleasant enough drug, but I do think it can cause  bad long term side effects if it is used frequently. I think ketamine and DXM are similar, but with ketamine being better in every single possible way. 

our concern for my welfare is very touching(!) but so far OZ has proven himself to be correct on every point I've asked him. I know this because believe it or not he's not my only friend on SR and I have run security related answers to questions I've asked him past others over the past few weeks.

OZ was wrong about what secure virtual memory is, he was wrong about Linux being a type of BSD, he suggested that SR have a private bridge for all of its users to directly connect to, he said not to use Truecrypt because it has backdoors, he is a fucking retard if not a fed and you are the only one I see who is supporting him as anything else.
 

The "air gap" I was referring to was between an Android Device and your home computer - I appreciate this isn't the common understanding of the phrase, how would you best describe it?

An airgap (which you probably learned about from me) is a *total* disconnecting from the internet of a device that handles security critical operations.

unless you want to ferry encrypted data back and forth on a USB stick between devices

That would break the airgap, see if you actually knew about security you would realize that ferrying encrypted data back and forth on USB entirely defeats the purpose of using an airgap. If you don't believe me just look at how stuxnet got to its target.

I already mentioned the advantages of a conventional cold boot attack not being possible as far as I can see?

The RAM of a tablet can be frozen and dumped in exactly the same way as the RAM of a laptop or desktop, it might slow the attackers process of obtaining the RAM down enough to be helpful but you can use encapsulation material to do the same things with desktop.

I also think a tablet wouldn't give off the same kind of EM emissions as a regular monitor/keyboard which could be picked up by the kind of SIGINT spying. There's also the fact it's far less susceptible to malware given that there's appreciably more viruses out there for other Operating Systems (admittedly that's changing!).

Think think think, you should talk about things you know, ask questions or shut the fuck up. You are not even right about what signals intelligence is, that is a measurement and signature intelligence attack. Tablets are not any more resistant to malware than anything else, you should learn the difference between a targeted attack and a dragnet attack. I don't know how susceptible a tablet screen is to TEMPEST attacks, I would *guess* about as much as a laptop display.

Quote from: kmfkewm on June 25, 2012, 07:31 am

/me thinks about selling a spyware infested "secure USB!" configuration and making pop ups come up on customers screen questioning why they were so stupid to trust a product they bought on SR
vlad you seem more and more sketchy to me with your assortment of plans to offer products that could be used to deanonymize people, 3G dongles from you, private tor bridges from you, USBs from you, tablets from you.....why suddenly the interest in selling such things?  Nothing like this is good for people to buy here, especially bridges tablets or dongles. I really don't think you mean any harm, but it strikes me as strange to see your sudden plans to offer such things. Also

..Do you think people should cosy up to the man who wants to legalise kiddy porn and murder police officers instead?

I've said it before and I'll say it again : I do NOT need your approval to be a vendor on here, my record speaks for itself, there's a link to it at the bottom of this message if you want to see testimonials from people who have purchased their Bitcoins safely using cash through my service.

I don't have to justify myself to you but in case anyone else was wondering I am planning on offering a way which will increase people's security through using SR not reducing it. I have been transparent about my plans and since I won't even be handling the products in question I fail to see how I could tamper with them. As I said I'm in the process of writing a guide in conjunction with another seller (who is based in the US) to show people how to access SR safely from their Android devices. I have asked OZ and two other more established members on the forum to edit the guide once the first draft is ready and you're welcome to read it yourself to verify it is simply a way to help people to secure their own device from being monitored through installing a Tor browser, enabling full device encryption and so on.

As for selling USB devices and 3G dongles, I seem to remember saying that when I first started selling on SR I suggested this as the ones already available were far too expensive but as I stated above, there's too much of a risk that the setup will not be secure which is why I did not follow through on this  - I'm not exactly sure how someone could interfere with a 3G dongle in that way but of course you know best as always.

You may not agree that my plan to sell secure Android Tablets for SR users this is a good idea - here's a newsflash for you, I don't give a damn.

I already made it clear when you advocated murdering Police Officers that I don't want to do business with you. You are a pathetic, twisted individual and frankly I think you're giving us Brits a bad name on here.

V.

Nice argumentum ad hominem, have fun carrying on like a fed. Anyone who uses USB dongles, hardware or bridges or VPNs from you or anyone else is fucking retarded, end of story.