Silk Road forums
Discussion => Security => Topic started by: Nemesis0914 on July 25, 2013, 02:41 pm
-
So I have my home network setup and was wondering if i Should make and purchases use tor on my home network? or should i exclusively use tor using wifi spots that are not my own?
-
ISP's can see you using tor. they can't see what you're doing on tor. it's your call. i reckon at least 50% of buyers here do it at home
-
ISP's can see you using tor. they can't see what you're doing on tor. it's your call. i reckon at least 50% of buyers here do it at home
More than 60% of buyers don't even use PGP so I would estimate more like 95% or more of buyers using their home connection.
-
You can always add a VPN into the picture, one that "says it does not keep logs" (shot of tequila to that one).
With the VPN the ISP will just see the VPN traffic which is encrypted and the VPN service will see TOR traffic which is also encrypted
-
You can always add a VPN into the picture, one that "says it does not keep logs" (shot of tequila to that one).
With the VPN the ISP will just see the VPN traffic which is encrypted and the VPN service will see TOR traffic which is also encrypted
Any Idea How i do this? or shall I just google it? BTW im using windows iswell, i heard using Linux is better, but why? Also the PGP thing is new to me.
SO my ISP can see me using tor. However its not like i have to use my home network to do a transaction right. I can use any computer with tor.
-
Look into VPN service from Private Internet Access. Only $40 a year and it's so worth it. Especially in light of PRISM and all the other mass surveillance happening. We gotta protect ourselves from these fascist cocks: https://www.privateinternetaccess.com/
-
Bridges are unpublished entry guards. While it's possible for someone to query the BridgeDB many ways and try to enumerate all the bridges, it is unlikely anyone has done it for the almost 2000 bridges, other than China. So practically speaking you can hide your Tor use by using bridges, and they are free. Check out bridges.torproject.org
-
You can always add a VPN into the picture, one that "says it does not keep logs" (shot of tequila to that one).
With the VPN the ISP will just see the VPN traffic which is encrypted and the VPN service will see TOR traffic which is also encrypted
Any Idea How i do this? or shall I just google it? BTW im using windows iswell, i heard using Linux is better, but why? Also the PGP thing is new to me.
SO my ISP can see me using tor. However its not like i have to use my home network to do a transaction right. I can use any computer with tor.
Look its always going to be up to you to stay safe, no system is perfect. I just think that a VPN is a must but it also comes with its disadvantages. Google is your friend unless your signed into a google service an on your home internet haha
Bridges are unpublished entry guards. While it's possible for someone to query the BridgeDB many ways and try to enumerate all the bridges, it is unlikely anyone has done it for the almost 2000 bridges, other than China. So practically speaking you can hide your Tor use by using bridges, and they are free. Check out bridges.torproject.org
^
what he said, thats a extra layer with TOR.
To me as long as you use a decent size bit pgp key, a very good password, change things up an never make it easy then you'll be fine. Comfort<security
-
I'm using a 3G modem (bought with cash money) with a prepaid SIM. I switch SIMs to different ISP:s from time to time. And every time I'm expecting a shipment, the modem, my other computer and the USB containing my SR related shit are out of the house. I live in a very densely packed area in my city.
I've figured this is pretty safe, and my own ISP has no clue I'm using TOR. This way I don't need to encrypt anything that stays in the house when there's a risk of a CD, and I don't have to hide my personal computer (which might look suspicious these days) as there's nothing suspicious there.
Comments?
I don't live in the US btw.
-
the more people in your area that is using TOR then the better it is. It's harder for them to pin point who is doing what so if you and all your neighbors are using TOR then it's better
Be careful who you turn onto certain websites. There's a lot of sites on the TOR network that include many different interest. You don't have to turn them onto SR and be self aware
-
I'm using a 3G modem (bought with cash money) with a prepaid SIM. I switch SIMs to different ISP:s from time to time. And every time I'm expecting a shipment, the modem, my other computer and the USB containing my SR related shit are out of the house. I live in a very densely packed area in my city.
I've figured this is pretty safe, and my own ISP has no clue I'm using TOR. This way I don't need to encrypt anything that stays in the house when there's a risk of a CD, and I don't have to hide my personal computer (which might look suspicious these days) as there's nothing suspicious there.
Comments?
I don't live in the US btw.
-
Bridges are unpublished entry guards. While it's possible for someone to query the BridgeDB many ways and try to enumerate all the bridges, it is unlikely anyone has done it for the almost 2000 bridges, other than China. So practically speaking you can hide your Tor use by using bridges, and they are free. Check out bridges.torproject.org
This is good shit. Damn Astor. No ceiling to all the things you know.
Thanks for this. :)
-
SO my ISP can see me using tor. However its not like i have to use my home network to do a transaction right. I can use any computer with tor.
I'd be very, very cautious about using "any computer with Tor." God only knows what's been put on a public computer you'd be typing your information in on.
-
If you use a bootable system, such as TAILS from the TorProject, then not only does all of that crap come pre-loaded and pre-configured (Tor, PGP, etc.), but you also have the security of Linux and nothing of your activities will ever appear on your computer. It can be burnt to DVD, or you can boot from a USB flash drive, which will allow you the option to save your settings and additional files in an encrypted persistence volume, install Electrum BitCoin Wallet, even enable using Bridges when you boot up, as Astor suggests.
Check it out at torproject.org.
-
You can always add a VPN into the picture, one that "says it does not keep logs" (shot of tequila to that one).
With the VPN the ISP will just see the VPN traffic which is encrypted and the VPN service will see TOR traffic which is also encrypted
Any Idea How i do this? or shall I just google it? BTW im using windows iswell, i heard using Linux is better, but why? Also the PGP thing is new to me.
SO my ISP can see me using tor. However its not like i have to use my home network to do a transaction right. I can use any computer with tor.
Look its always going to be up to you to stay safe, no system is perfect. I just think that a VPN is a must but it also comes with its disadvantages. Google is your friend unless your signed into a google service an on your home internet haha
Bridges are unpublished entry guards. While it's possible for someone to query the BridgeDB many ways and try to enumerate all the bridges, it is unlikely anyone has done it for the almost 2000 bridges, other than China. So practically speaking you can hide your Tor use by using bridges, and they are free. Check out bridges.torproject.org
^
what he said, thats a extra layer with TOR.
To me as long as you use a decent size bit pgp key, a very good password, change things up an never make it easy then you'll be fine. Comfort<security
What disadvantages do VPN's, such as PIA..come with?
-
You can always add a VPN into the picture, one that "says it does not keep logs" (shot of tequila to that one).
With the VPN the ISP will just see the VPN traffic which is encrypted and the VPN service will see TOR traffic which is also encrypted
Any Idea How i do this? or shall I just google it? BTW im using windows iswell, i heard using Linux is better, but why? Also the PGP thing is new to me.
SO my ISP can see me using tor. However its not like i have to use my home network to do a transaction right. I can use any computer with tor.
Look its always going to be up to you to stay safe, no system is perfect. I just think that a VPN is a must but it also comes with its disadvantages. Google is your friend unless your signed into a google service an on your home internet haha
Bridges are unpublished entry guards. While it's possible for someone to query the BridgeDB many ways and try to enumerate all the bridges, it is unlikely anyone has done it for the almost 2000 bridges, other than China. So practically speaking you can hide your Tor use by using bridges, and they are free. Check out bridges.torproject.org
^
what he said, thats a extra layer with TOR.
To me as long as you use a decent size bit pgp key, a very good password, change things up an never make it easy then you'll be fine. Comfort<security
What disadvantages do VPN's, such as PIA..come with?
LOGS, you have to trust that VPNS do not log
-
Even if a VPN logs, if you're using TOR, they're only logging as much as your ISP would, which is that you're using TOR but not what you're doing on it.
The disadvantage is only in thinking that you're completely safe by protecting your network layer. If your OS is compromised with malware for example, it doesn't matter.
VPNs are cheap and definitely worth the few bucks a month they cost.
-
OK ok. So i'm Starting to get a picture of the fragility of using a home network. one question. what the hell is TAILS?? :o
-
TAILS stands for The Amnesic Incognito Live System. Search engines don't bite :)
It is a Linux based OS that focuses on security. There is a heavy hype about it at the moment and most people (including myself) think that it is the most secure way to stay anonymous if it is used in a proper way. I also agree that TAILS does not offer full protection but it is atm the best basis to start securing your computer as you don't install it on your harddrive.
TAILS is very complex and there is a lot to it, still it is very easy to use. No need to learn Linux lingo if you're just looking for basic protection.
This might help you: http://dkn255hz262ypmii.onion/index.php?topic=114141.0
-
ISP's can see you using tor. they can't see what you're doing on tor. it's your call. i reckon at least 50% of buyers here do it at home
More than 60% of buyers don't even use PGP so I would estimate more like 95% or more of buyers using their home connection.
I don't see the problem with buying at home.
As long as you wipe all the evidence of you actually buying the item there should not be a problem. All you have to say is you didn't order that if shit hits the fan.
It would be the same as if you ordered using public wifi.
-
Buying from home is probably fairly safe. The biggest disadvantage is that if you do not use a bridge or something, your ISP can tell that you are using Tor. That could be a problem for vendors, especially vendors in less densely populated areas. Short of that, working from home is possible to do securely, but if you are hacked or your Tor circuit is compromised the feds will identify you, whereas if you are working from random WiFi they will only identify the location you connected from. So it is definitely safer to not use your own internet connection, but it will only matter if Tor / Tor Browser have a security failure, or you are otherwise infected with malware somehow. I would argue that it is even somewhat safer to use a neighbors WiFi than your own internet, although this is only for two specific reasons. The feds can trace live WiFi but if they don't trace a connection while it is live there is a good chance that they will never be able to determine that you were using the open WiFi for the session they are interested in, if you spoof your MAC address then it is even less likely. So if you live in apartments or move around a lot having only used other peoples WiFi can actually give you great unlinkability after you move, if you have not been traced yet there is a very low chance that you will be traced in the future, even if there are logs leading up to the WiFi access point and LE eventually work their way to it. The other situation where it can help is if you screw up somehow and realize that you screwed up, perhaps you accidentally didn't use Tor for something sensitive or something. If you realize that this has happened on someone elses WiFi you can immediately stop using it and still have pretty decent security so long as you take some countermeasures, if this happens while you are on your own internet you are much more likely to be fucked. It is worth noting that if you are rooted even if you are using WiFi there is a good chance you will be fucked, I am not sure the accuracy of WiFi Positioning Systems these days but I imagine if the feds can gain remote control of your WiFi card that they can remotely geoposition you accurately enough to determine who you are, though in apartments that share walls they might not be able to differentiate between you and your neighbors.
-
I would argue that it is even somewhat safer to use a neighbors WiFi than your own internet, although this is only for two specific reasons. The feds can trace live WiFi but if they don't trace a connection while it is live there is a good chance that they will never be able to determine that you were using the open WiFi for the session they are interested in, if you spoof your MAC address then it is even less likely.
...
It is worth noting that if you are rooted even if you are using WiFi there is a good chance you will be fucked, I am not sure the accuracy of WiFi Positioning Systems these days but I imagine if the feds can gain remote control of your WiFi card that they can remotely geoposition you accurately enough to determine who you are, though in apartments that share walls they might not be able to differentiate between you and your neighbors.
I'm not sure what you mean by this; are you coming from the perspective of an active hunt for a person when they're actually in the area? If so then I can see what you're saying, but if you just mean when they aren't even within range of the WiFi signal to begin with, I have no clue how it could be harder for them to identify you after the fact -- none whatsoever. Have a reference handy or something?
I'm not saying you're full of it, mind you, I just have no clue how it could make a difference and would like to.
-
I would argue that it is even somewhat safer to use a neighbors WiFi than your own internet, although this is only for two specific reasons. The feds can trace live WiFi but if they don't trace a connection while it is live there is a good chance that they will never be able to determine that you were using the open WiFi for the session they are interested in, if you spoof your MAC address then it is even less likely.
...
It is worth noting that if you are rooted even if you are using WiFi there is a good chance you will be fucked, I am not sure the accuracy of WiFi Positioning Systems these days but I imagine if the feds can gain remote control of your WiFi card that they can remotely geoposition you accurately enough to determine who you are, though in apartments that share walls they might not be able to differentiate between you and your neighbors.
I'm not sure what you mean by this; are you coming from the perspective of an active hunt for a person when they're actually in the area? If so then I can see what you're saying, but if you just mean when they aren't even within range of the WiFi signal to begin with, I have no clue how it could be harder for them to identify you after the fact -- none whatsoever. Have a reference handy or something?
I'm not saying you're full of it, mind you, I just have no clue how it could make a difference and would like to.
I don't know what you are asking really. If I use a neighbors open wireless router and then I move, and two weeks later the police show up at my neighbors house, there is very little chance that they will be able to determine I am the one who was using my neighbors WiFi. So it adds potential unlinkability in some cases, although for the best additional security you would need to be moving around using random WiFi access points. If you are in a static location using open wireless networks you are not giving yourself a huge benefit, if the police show up before you get out of the habit of using a particular network they will be able to do a live wireless trace back to you. It is even possible for the police to determine who is using wireless networks without doing a live trace if they can determine multiple locations that were used by the same target (This is how they got that general Petraus his mistress, she used WiFi from hotels over time and although the FBI never got her with a live WiFi trace they did an intersection attack on the names registered at the Hotels during the multiple sessions, and her name was the one that was uniquely in all of the crowds). So WiFi is not a magic bullet, but it can definitely add to your unlinkability and untraceability, even if you are using WiFi from a static location such as a neighbors house. Using it from a static location is not going to greatly increase your anonymity, but I like to know that when I move to new locations my previous sessions are much less likely to be linked to me, whereas if I use my own internet and move to a new location it is still possible that the police could end up tracing back to me via a prior session. That is the benefit of WiFi, even if all of the Tor nodes on my circuit keep logs and the police take half a year to get court orders to follow them back to me, if I used WiFi of a neighbor and moved to a new location in the mean time, by the time they get back all the way to my neighbor there is not a log for them to follow to me anymore, and I am no longer in the habit of using that WiFi location so there cannot be a live trace. It doesn't mean they can not use other methods to deduce it was me, and if they do multiple trace backs to multiple locations that were near me they could do an intersection attack and various other things, but I would argue that it is still definitely better than them tracing back all the way to an IP address that was registered to an account under my name. At the very least it provides some plausible deniability for court, a jury will be less happy with "We followed this signal back to here and then it went dead, but we are pretty sure this person a few houses away was the originator of the signal".
Maybe if you clarify your question I can answer it better I really am not sure what you are asking. If it is in regards to WiFi Positioning Systems what I mean is that if somebody roots your computer and can see the wireless access points around you and their signal strengths, they can geoposition you with this information, and it could let them tell which house or apartment the signal is originating from.
-
Although I suppose it is possible they could suspect you and find your new location and monitor you from there. I just think it is less likely that the police will trace to a dead end at open WiFi and then try to determine everybody who lived around the area at the time the session of interest was identified, put them all under surveillance, etc. For all they know it could have been somebody war driving. In cases where the police trace criminal activity to a open WiFi hotspot these days they do analyze the wireless spectrum around the hotspot trying to see who all is using the open wireless network and trying to continue their trace of the suspect they are trying to identify, but I think in most cases where this fails they close the case as there are too many possibilities of what could have happened. It could be a neighbor who still lives in the area who no longer engages in the pattern of criminal activity, it could be somebody who went war driving, it could be somebody who moved away after the last session was identified, etc. In many cases that significantly increases the complexity of continuing the investigation, especially if it is in an area with many apartments where people come and go regularly. Now over time and multiple trace backs to the same location they can start to do more interesting things, and over multiple trace backs to multiple locations they can do even more interesting things (in either case intersection attacks are the first thing that comes to mind), and we have seen the FBI do this in at least one high profile case (with the WiFi being used at hotels), but in the end it still adds complexity to their investigation and in some cases it may make it impossible for them to identify their suspect, so it is definitely better than using your own internet I would say.
I wouldn't put all of my eggs in the WiFi basket, it makes it technical trace more difficult but there are all kinds of intersection attack possibilities over time. Somebody who war drives may never be traced back with a live trace, but if they live in a city with license plate scanners and they have two sessions traced back to the hotspot they used an intersection attack of license plate numbers scanned in a radius around the access points in the time around when the sessions were identified would probably be enough to identify their car, for example. And if you use WiFi at hotels, even if they do not get you with a live trace they can do intersection of people who were registered at those hotels during the times the sessions were identified. But in either case it is still arguably better than having them trace directly to your IP address, and in some cases it could bring you from being traceable to untraceable.
-
I think it's a bad idea. For a while I was going to use Tor 100% of the time just for privacy's sake, regardless of whether I was doing anything "wrong". Then I realized that Tor is a big red flag in itself.
With all the NSA bullshit it would be great if more people used it along with PGP, etc. Safety in numbers and all that.
-
Mixing a VPN and tor is moronic unless it's a VPN which you payed for in bitcoins and have ONLY connected to via tor. (waste of money)
Let me explain why, if you go Home connection>VPN>Tor then you're entrusting the VPN with all of your unencrypted activities then after it leaves the VPN's servers it is encrypted via tor and if you're using a non-onion service you're also entrusting the exit node and the service itself.
If you go Home connection>Tor>VPN then you are trusting an exit node with all of your information and the VPN, and the destination server. THis is completely useless unless you are trying to access a site which blocks tor exit nodes.
I did not even mention using hidden services through a VPN because anyone who does is a fucking idiot.
There is a reason why Tails blocks VPNs by default and it is because they open inherent security holes while being functionally useless. Like I said unless you buy a "Tor Only" VPN using anonymous bitcoins.
If you want to hide Tor use from ISPs/other third parties then your best option is to use obfs3 bridges only.
-
Let me explain why, if you go Home connection>VPN>Tor then you're entrusting the VPN with all of your unencrypted activities then after it leaves the VPN's servers it is encrypted via tor and if you're using a non-onion service you're also entrusting the exit node and the service itself.
Your activities are encrypted end-to-end when using TOR. Using/not using a VPN doesnt change that. The only thing the VPN server can tell is that you;re using TOR, they cant decrypt your activities.
-
If you use a bootable system, such as TAILS from the TorProject, then not only does all of that crap come pre-loaded and pre-configured (Tor, PGP, etc.), but you also have the security of Linux and nothing of your activities will ever appear on your computer. It can be burnt to DVD, or you can boot from a USB flash drive, which will allow you the option to save your settings and additional files in an encrypted persistence volume, install Electrum BitCoin Wallet, even enable using Bridges when you boot up, as Astor suggests.
Check it out at torproject.org.
I use Liberte with default settings. Do you know if it masks TOR from ISP's automatically?
-
I wouldn't go so far as to say that VPN's are useless, but they certainly are much less beneficial than a naive user would think (most such users think adding more hops always means more anonymity, hence the 'good luck I am behind 7 proxies meme'). If you are monitored by your ISP, using a VPN can hide that you are using Tor, but your ISP is still able to do one half of a timing attack against you. The biggest advantage of using a VPN is that it hides that you use Tor from your ISP. It also gives you a static entry node in most cases, so if you happen to form a compromised Tor circuit the Tor internal attacker is only capable of tracing you back to your last VPN node. Of course if your VPN entry node is malicious the attacker can still do a timing attack against you (and your ISP always can). Using a VPN prior to Tor is not really insecure per-se, the primary effect it has is changing it from trusting your Tor entry guard the most to trusting your VPN provider the most. I think that this can be beneficial, I don't think many people trying to attack Tor would run VPN services taking into consideration that some Tor users might enter through a VPN first, but I don't put it past the feds to be running several commercial VPN providers (and they definitely have operated VPN's in the past for criminal stings, but usually advertised on criminal forums, which is why you *NEVER* use a VPN that you first heard about on a criminal forum). On the other hand, if your entry node of Tor is bad, and your Tor circuit falls to a timing attack, the VPN is the only thing keeping you safe, which is better than nothing but historically most VPN's are broken by the feds after enough time in court. VPN's tend to buy time at best, tho I have heard of a few cases where the feds failed to trace targets through VPN's, in the majority of the cases the VPN only slows them down though and after enough months they will be able to trace you, and most people keep using the same VPN indefinitely so.
-
It is worth noting that if you are rooted even if you are using WiFi there is a good chance you will be fucked
This is the main reason why getting people off Windows is the most effective security step they can take, and Tails is one of the easiest ways to do that (along with providing a lot of security and anonymity features out of the box), so overall I consider it an improvement in security, despite that lack of persistent entry points (which can be handled manually for now). Linux is far less vulnerable than Windows, although that may change if it becomes more popular, especially among "criminals".
-
ISP's can see you using tor. they can't see what you're doing on tor. it's your call. i reckon at least 50% of buyers here do it at home
Use a bridge or VPN if you don't want your ISP knowing you use Tor.
-
Can somone please explain what the hell tails is??
-
Can somone please explain what the hell tails is??
The fox from sonic, you know the one that flies around by spinning her tails like a helicopter propeller?
Or its this
Tails is a live operating system, that you can start on almost any computer from a DVD or a USB stick. It aims at preserving your privacy and anonymity, and helps you to:
use the Internet anonymously and circumvent censorship;
all connections to the Internet are forced to go through the Tor network;
leave no trace on the computer you are using unless you ask it explicitly;
use state-of-the-art cryptographic tools to encrypt your files, emails and instant messaging.
But im going to stick with that foxxy bitch from sonic!
-
i look at it like like they are always watching..
that being said there is not shit they can do when you are using tor. yeah they can tell you are using it
but do u really think your that special? that they would just be looking at you to bust you buying a oz of weed?
they cant prosecute you based on you using tor..
and vpns? its the same thing as tor pretty much you are just using an extra layer
do what you guys want vpn tor.. it really doesnt matter i dont use my home network tho
the internet isnt even in my name.. shit the lease to the place isnt even in my name.. im pretty much a ghost.. try to be like me.. be like water lol