Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Messages - kmfkewm

Pages: 1 ... 199 200 [201] 202 203 ... 249
3001
Security / Re: Start a thread for Tor bridges or relays to avoid?!
« on: April 21, 2012, 04:38 pm »
they are mostly interested in the header

also they only need to log unique payload data, and they can ignore encrypted stuff unless they think they will ever be able to break it. Most traffic is non-unique. It would be a total waste to keep a copy of the traffic flow of a thousand different people downloading a movie when they could just keep one copy of the movie the first (unique) time they see it, and then use a reference to it all other times.

almost every security pro I have heard talk on this matter fall into one of two camps in their opinion on this. Camp A thinks that NSA logs all traffic into and out of the country but not all the traffic that stays within the country. I have found some evidence to corroborate this but it was nothing solid, some legal analysis of anonymity on the internet that referenced the NSA as monitoring all traffic into and out of the USA but it was written by lawyers not security people. Camp B thinks NSA logs roughly one out of every ten thousand packets through IXs, which would include a substantial number of international packets (but not entire flows) and substantially less intranational traffic since a lot of that doesn't go through IXes but stays within the AS. This would be called sampling, and it is still enough to do a lot of signals intelligence analysis with. I can't find anything solid on this, but there are several papers in anonymity literature that describe attackers with such capability, and many of them probably think NSA is such an attacker.

also of interest:

https://www.eff.org/issues/nsa-spying

Quote
The evidence also shows that the government did not act alone. EFF has obtained whistleblower evidence [PDF] from former AT&T technician Mark Klein showing that AT&T is cooperating with the illegal surveillance. The undisputed documents show that AT&T installed a fiberoptic splitter at its facility at 611 Folsom Street in San Francisco that makes copies of all emails web browsing and other Internet traffic to and from AT&T customers and provides those copies to the NSA. This copying includes both domestic and international Internet activities of AT&T customers. As one expert observed “this isn’t a wiretap it’s a country-tap.”

this paper also has interesting information in it, at least some of which is true, despite having at least one less than reputable author (I hear he had little to do with it actually)

http://www.blackhat.com/presentations/bh-usa-09/TOPLETZ/BHUSA09-Topletz-GlobalSpying-PAPER.pdf

this paper talks about sampling traffic and has very credible authors :

http://freehaven.net/anonbib/cache/murdoch-pet2007.pdf

Every security person whose opinion I respect thinks that NSA logs more traffic that enters or leaves USA than they log traffic that stays withing the USA, they just differ on if they log all international traffic from/to USA or only sample it (which would still be enough to do a lot with)

3002
Security / Re: Start a thread for Tor bridges or relays to avoid?!
« on: April 21, 2012, 01:49 pm »
Quote from: eeee on April 21, 2012, 01:00 pm
No, you do not want to let tor pick the relays/bridges for you.  Misinformation on here is rampant from idiots who are clearly not clear-headed.  Avoid any USA node.

Well for one the Tor developers say to let Tor pick your nodes for you, so I think they probably know what they are talking about. For two if you pick your own nodes you will stick out from the crowd since the vast majority of people don't pick their own Tor nodes. And for three, USA has less strict data retention laws than almost all of EU and also NSA logs ALL traffic into or out of the USA but log much less intra-USA traffic (since they carry out their logging at IX's and not AS's). What is the logic behind avoiding USA nodes? You know the feds are not limited to running Tor nodes in USA right? Please explain your logic so I can give a more thorough explanation of why you are wrong, but I already am quite certain that you will not convince me that I am wrong :).

3003
Security / Re: Start a thread for Tor bridges or relays to avoid?!
« on: April 21, 2012, 06:10 am »
You want to let Tor pick nodes for you. They already filter off bad ones as best as can be done at the directory authority servers.

3004
Off topic / Re: Drain LEs resources....
« on: April 20, 2012, 03:47 pm »
Plus it is a pretty good deterrent if all of your coworkers start dying

the more time that passes the more people I know facing life sentences for this shit and the less a fuck I give about what it will take to defeat these evil fuckers. They deserve absolutely no mercy and should be entirely wiped off the face of the world. THEY ARE WILLING AND EAGER TO TAKE YOUR LIFE, NOTHING ELSE SHOULD BE TAKEN INTO CONSIDERATION WHEN YOU DECIDE HOW THEY SHOULD BE DEALT WITH.

Anyone who disagrees is just an apologist and probably would have felt so sorry for the Nazi executioners who were just regular guys doing their job to support their families that they would be apologists for them too. Some people are not just doing a job, some people are not just misguided, and even if these things are true it isn't your job to enlighten the rabid dogs coming after you it's your job to put them down. People who use a lot of psychedelics have way too much empathy and respect for life, to the point that they are almost masochistic in their unwillingness to accept that there are enemies in this world who need to be dealt with by whatever means required.

Do you really think society is going to suddenly feel so bad for what they do to us that they are going to even try to help? Fucking joke, those brainwashed zombie human-like-creatures would have woken up decades ago if they were ever going to. They do what they are told by people who convince them that they are authorities, and the only thing they understand is fear just like all of the other simple animals (which is why their 'leaders' keep them perpetually terrified of all the boogie men).

Just as bad is this mentality that we need to just prove to them how responsible we are even though we are drug users, we don't owe them a fucking thing for one and for two they don't give a shit! You live in delusions if you think that these monsters really give a fuck if you are a serious criminal or a responsible drug user they are human predators and you are their prey.

3005
Rumor mill / Re: Euphoric Knowledge - RIP
« on: April 20, 2012, 02:07 pm »
Looks like the feds are finally starting to shut down all of the low hanging fruit forums

3006
Off topic / Re: Some lessons from The Farmers Market
« on: April 20, 2012, 04:54 am »
I would not buy bitcoins in any way that requires me to show a legitimate ID or otherwise seriously compromise my anonymity. Bitcoins are roughly as anonymous as the method used to obtain them, just keep that in mind at all times. The cash out is about as anonymous as the method used to cash them out. Mixes are really good for making it so the feds can't follow the money back to a vendor, but they will make you susceptible to money laundering charges, so my advice is to mix bitcoins and cash in and out in ways that don't require legitimate identification.

3007
Off topic / Re: Some lessons from The Farmers Market
« on: April 20, 2012, 02:52 am »
Quote from: mdmamail on April 20, 2012, 01:53 am
There are no seekrit Tor exploits, and the downfall of the TFM was not due to Tor whatever the media claims. Hushmail + Paypal.

Actually there almost certainly are secret Tor exploits, but they are not intentionally introduced by the Tor developers and they were not used against TFM. Tor has had several remote code execution vulnerabilities discovered in it in the past, and if attackers discovered them prior to Tor developers or non-malicious security researchers who cooperate with them, they would essentially be secret Tor exploits.

3008
Off topic / Re: Farmer's Market Take Down - this is important.
« on: April 20, 2012, 02:50 am »
Quote from: Marcus_Cam on April 19, 2012, 03:35 pm
I've been holding off posting this until I had the opportunity to chase down a couple of folks and confirm some points. Therefore, I won't bore you with speculation - these are the facts.

a) LE have implied, as have the media, that FM was taken down by tracking down Paypal and WU transactions. This is false.
b) TOR (specifically Roger Dingledine) have been working with the FBI for some time. Apparently, he wasn't given much say in the matter.
c) Code was introduced into Tor several 'security updates' ago (and subsequently removed within days) that contained functionality useful to LE.

I will know more soon but I hope the implications of the above are not lost on anyone.

I doubt he cooperates with FBI. Sign one that you don't know anything about Tor is the fact that you call it TOR instead of Tor, which means you probably learned about it from the media and not from academic papers. Doesn't mean your opinion is worthless, but it is a good indication that you are a noob. Second, Tor is open source software and anyone is free to check the source code. I stay in contact with multiple people who regularly follow Tor development and they would notice a backdoor if one was added. I doubt they all will cooperate. Tor has 15 developers and they live in a variety of different countries and audit each others code, compromising Arma will not be enough to compromise Tor in the way you say. Anyway if the code was added and then removed days later only the people and hidden services and relays that upgraded in that time window would have been compromised. Relays and hidden services in particular are usually some versions behind, but even users don't stay as up to date as they should.

Quote from: CaliTrees on April 19, 2012, 04:09 pm
My intel led me to believe the FBI were setting up a large amount of TOR exit nodes and using correlation attacks.

I don't understand the preoccupation that noobs have with exit nodes. It is probably because they know that exit nodes can log traffic that exits the network. In reality I am far more concerned about entry guards, if Tor has an Achilles heel it is in the guard nodes not the exit nodes. To do correlation attacks against SR users LE will need to be able to monitor the entry guards of the clients connecting to it as well as silk road server itself (possibly via owning its entry guards), "exit nodes" have little to do with correlation attacks against hidden services and when it comes to Tor to the normal internet the entry guard is still the most vulnerable part not the exit (as far as correlation attacks go).

FM fell because of a combination of using hushmail and insecure payment techniques. The  most important security lesson for people on SR to learn is that you are as anonymous as your least anonymized network overlay. The Tor network overlay is a lot better than the paypal or mail systems (for receiving). The most important thing to do is start obtaining your bitcoins anonymously and cashing them out anonymously if you are not already, and understanding that Bitcoin is no better than Paypal unless you take steps to anonymize it yourself with your cash in and out technique, preferably using mixes in addition to this (using mixes by themselves is great for unlinkability but you will still risk money laundering charges).

3009
Off topic / Re: They took the farmers market
« on: April 20, 2012, 02:35 am »
Quote from: SarahWalker on April 19, 2012, 10:18 am
Quote from: friendlyoutlaw on April 19, 2012, 10:11 am
Right, we should trust that you're not LE and use your private bridges.

Point. I have been a member of this community for a very long time, just under another name. Besides, a bridge operator will only see that someone is using the bridge to connect to the rest of the Tor network, but it won't know who that someone is or where the traffic is really originating. Happy to help you set up your own bridge, if that's what you want.

Hi fed, bridge operators actually know where that someone is and where the traffic is really originating, nice try though

ps: hope to see you charged with crimes against humanity and sentenced to death by firing squad

3010
Security / Re: Very troubling turn of events...
« on: April 20, 2012, 02:33 am »
Quote from: mdmamail on April 20, 2012, 01:49 am
Quote from: greatgreatgrandpa on April 20, 2012, 01:46 am
If they have indeed managed to compromise TOR, I can assure you they wouldn't tip their hand. They can't expect everyone they would arrest to plea out, one case will make it in front of the magistrate. Then TOR would be publicly revealed as compromised.... They won't do that. This seems to be good old fashioned gum shoe police work by the Natl bobbies.
Sorry about your mate

Actually there's an interview with one of the lead Tor developers in Wisconsin talking about how he'd never compromise his own software. The US government also relies on Tor to talk to dissidents in China, Russia, Syria and other places. It's in their best interest not to compromise it... I'm sure the NSA could give 2 flying fucks about this site. They would never assist the DEA in destroying their bulletproof anonymity network for spies and dissidents just to take down petty drug dealing.

Yup. NSA can already pwn Tor, but for once it is true to say that they don't give a fuck about us.

3011
Off topic / Re: WHO WOULD WIN AT WAR? U.K OR U.S.A?
« on: April 20, 2012, 02:22 am »
U.S.A could wipe out life on Earth if it wanted to

I doubt any country that isn't highly convinced of their God(s) will use nuclear weapons against other countries that have them in significant amounts, simply because it will be mutually assured destruction. Having a lot of nuclear weapons pretty much protects you from being attacked with them. The thought of people who care more about the afterlife than reality having nuclear bombs is scary though, they don't care about mutually assured destruction because they are convinced of their fairy tales.

3012
Off topic / Re: If you could go back in time and kill one person, who would it be?
« on: April 20, 2012, 02:18 am »
Ronald Reagan

3013
Off topic / Re: Some lessons from The Farmers Market
« on: April 19, 2012, 06:40 am »
Quote from: n0n00dz4u on April 19, 2012, 12:54 am
Amen to that.

PGP seems a little extreme no?

The reality remains the government cannot upload tor clients onto their machines because of the security risk and because of this the likelihood of them building a case on tor network based communications is little to nil. They would need the documents directly saved on a hard disk via notepad or word document in order to make it viable evidence.

Imagine some body walking into langley with a torchain and uploading devil robber.

Ludicrous

PGP isn't an extreme measure it should be seen as a requirement the rest of your post does not parse

3014
Off topic / Re: Some lessons from The Farmers Market
« on: April 19, 2012, 06:38 am »
Quote
After all do cops hang out on child porn sites?

Yes quite frequently actually

Quote
Do they study Arabic to understand the tens of thousands of angst ridden chaps shouting about blowing up this and that. And the other!

Yes, being able to translate Arabic to English will get you a very high paying job with FBI or CIA

3015
Security / Re: Just how safe is TOR?
« on: April 19, 2012, 06:22 am »
Quote from: Ammy2Argen on April 19, 2012, 04:14 am
If i were the government the first thing id want to do is disable tor. then i would seek to intercept those downloading pgp software, i would want to add something else that would allow me to no have to break encrpytion but just read it when you write it , pre encrpyption stage

The US government is not only currently the largest funder of Tor, but also are the people who originally invented the concept, and one of the implementers of the current version of the product was fresh out of the NSA when he implemented it. The US government likes Tor because it is used by dissidents in countries like China, Iran, Libya and many others to circumvent their government censorship of Western information sources and ideologies. They also probably use it to some extent for covert communications with assets in enemy territory and for hiding their own field agents communications back to them (this was what it was originally intended for when the United States military designed it). It is also an invaluable source of OSINT as they spy on exit traffic. They probably also use it to avoid attribution when engaging in cyber warfare and espionage, and of course to protect communication patterns between politically important people, definitely many embassy workers are required to use Tor to protect from spies (although this has backfired on them since they don't all understand that exit traffic isn't encrypted!).  Also, many large corporations use Tor to protect from corporate espionage, law enforcement and military use Tor to gather information online without using IP addresses that can be tied back to government or military agencies, etc. Indeed Tor has many uses for them, enough that they spend millions of dollars a year in donations to the project. They however suffer from cognitive dissonance in that they see quite clearly that Tor protects dissidents in hostile governments, without recognizing that the people using SR and other hidden service sites, are equally dissidents protecting ourselves from a hostile government.

Also the vast majority of Tor traffic is lawful in the United States. It's primary use is apparently downloading legal pornography (there are at least two studies backing this), a big secondary use seems to be getting  around firewalls (for example maybe your university blocks traffic on a certain port when you use their network, so you can't access IRC on standard ports, but they don't block Tor or if they do they don't block bridges).

Pages: 1 ... 199 200 [201] 202 203 ... 249