Silk Road forums

Discussion => Silk Road discussion => Topic started by: boysen on February 10, 2013, 05:00 pm

Title: Google address contacted when refreshing SR forums?
Post by: boysen on February 10, 2013, 05:00 pm

So I was refreshing the SR forums earlier and I noticed for about a second that it said either 'Connecting to' or 'Connected to' and then lh3.ggpht.com which seems to be an address related to Picasa, definitely owned by Google. This happened two or three times, getting a screenshot of it those times never crossed my mind and when I refreshed again to take a screenshot it no longer appeared. I was in the 'Silk Road discussion' sub-forum when it happened. Still not able to recreate it but it definitely seems a bit sketchy, anyone else seen this or know what it is?

Title: Re: Google address contacted when refreshing SR forums?
Post by: boysen on February 15, 2013, 03:41 pm

No replies here but I am bumping this since it happened again. Got a screenshot of it this time.
http://xqz3u5drneuzhaeo.onion/users/qicpic/x.php?x=wk2.jpg
Happened on two refreshes and since then I can no longer reproduce it. Not on the page where it happened (shown in the screenshot) or anywhere else.

Title: Re: Google address contacted when refreshing SR forums?
Post by: Grizzly421 on February 15, 2013, 07:57 pm

Strange stuff, don't really know what it would imply.

Maybe SR is run by a Google subsidiary, It would explain why it hasn't been taken down by the govt yet. I really think if they wanted to they could stop SilkRoad.

But don't listen to my conspiracy theories, it can be dangerous for your sanity. 

GrizZ

Title: Re: Google address contacted when refreshing SR forums?
Post by: SelfSovereignty on February 15, 2013, 08:22 pm

I'm guessing that it's because either you have some random addon installed, or one of the images that loaded in the page is stored on that server.

Or the css file is from there (cascading style sheet).  Or some XML referenced a namespace there.  Or an embedded object in the post was stored there.  Etc., etc., etc..  There's a lot that goes on in a full-fledged web browser: the point is that unless it's an unknown exploit, Tor should protect your identity all the same.  If it doesn't, it's a serious bug that could get people in oppressive government nations killed -- as in it isn't just drug users they're trying to protect (i.e. they have real motivation to keep us safe).

If you're in Linux, open a terminal window and the next time you see it flash by, type this:

Code: [Select]

netstat -peanut

... and look for the matching IP address and executable name.  It may be firefox or it may be plugin-container or something else.  You can also hit CTRL+I to view the page info, and click on the "media' button.  See if there are any images listed from that address.  Other than that... forget it happened, I guess.

Title: Re: Google address contacted when refreshing SR forums?
Post by: wpwl on February 15, 2013, 08:27 pm

I have noticed this too.  I have no explanation.

Title: Re: Google address contacted when refreshing SR forums?
Post by: SelfSovereignty on February 15, 2013, 08:29 pm

I have websockets disabled.  For no real reason, just because I have no reason to use them and don't need them.  It's possible there's some javascript websocket action going on, which would explain why I've never seen such a thing but others have.

I also just realized you can enable debug-level logging in Vidalia and save the log to a file if you really want to dig into this further.

Title: Re: Google address contacted when refreshing SR forums?
Post by: SorryMario on February 16, 2013, 01:25 am

Just to make sure - are you using the Tor Browser Bundle from torproject.org?

Click on the "Help" menu - does it show "TorBrowser Help" or does it say "Firefox" (or something else)?

Click on the "View" menu,  Toolbars and select "Add-on Bar". Does it show any active add-ons, or is it empty?

Title: Re: Google address contacted when refreshing SR forums?
Post by: Shroomeister on February 16, 2013, 01:58 am

I have never seen this, and I (like most others I assume) watch the connection like a hawk....
 
 You do not happen to have Google tool bar install on the browser you use to connect to SR do you?!
 
 

Title: Re: Google address contacted when refreshing SR forums?
Post by: SelfSovereignty on February 16, 2013, 03:25 am

Oh -- I bet you're accessing the forums through the onion.to website, huh?

Do not do that.  It's extremely unsafe.  Just bookmark the forum address and SR address and only go to them directly.

Code: [Select]

SR Market   http://silkroadvb5piz3r.onion
Forums      http://dkn255hz262ypmii.onion


Title: Re: Google address contacted when refreshing SR forums?
Post by: boysen on February 17, 2013, 12:17 am

I'm definitely not the best on security on this site but I'm not stupid. :p

Using Tor Browser Bundle, private browsing, no addons installed beyond the three that come with the bundle, no google toolbar. Not going through onion.to.

I'd assume it's loaded from something as well but strange that it only happens rarely, two times in a row and then stops completely again. If I get it on my Linux machine I'll run that command.

Title: Re: Google address contacted when refreshing SR forums?
Post by: eddiethegun on February 17, 2013, 01:53 am

I believe there are certain server-side SMF add-ons that pull content like that from google.
Which ought to be disabled if so. Though frankly the danger in that situation would be to SR or whoever is hosting the forums if it's not DPR himself.

They did upgrade the SMF installation recently, no? Maybe Inigo knows...

Title: Re: Google address contacted when refreshing SR forums?
Post by: SelfSovereignty on February 17, 2013, 02:25 am

LOL!  "Silk Road busted because admin left Google Analytics enabled.  Story at 11."