3 ms·

I'm trying to understand how this was overreaching. They legally had access to the server that this website was hosted on, then they simply logged the real ip a

I'm trying to understand how this was overreaching. They legally had access to the server that this website was hosted on, then they simply logged the real ip addresses that visited the website once they had access to the server. By accessing the content on the server the FBI possess aren't they voluntarily giving up their IP. Even if it's inadvertent? I don't see how they are unjustly violating someone's privacy in this situation.

hollerith 11y ago
>they simply logged the real ip addresses that visited the website once they had access to the server. Not so: one of the primary purposes of TOR is to hide the user's IP address.
- bcook 11y ago
  IIRC, with the Freedom Hosting bust the FBI compromised the Hidden Services server, then used a browser javascript exploit to leak the real IPs of those who connected. So, your quoted text is very plausible. Tor is intended to be anonymous, but not absolutely.
  - hollerith 11y ago
    We're talking past each other. The way I interpreted the text I quoted, if the FBI needed to make use of a javascript exploit, then they're doing more than "simply logging". Context is important when interpreting text. The context of the quoted text included the question of whether the judge knew, when he or she issued the warrant, that the FBI would try to break into all the computers being used to sign into the site.
belorn 11y ago
The article describes how they had acquired a security vulnerability for Firefox, which they then exploited to create malware that infected computers that accessed the site.
- Buge 11y ago
  No it doesn't. The article says in 2013 they used a firefox vulnerability. It says we don't know how they did it this time (in 2015).
jacquesm 11y ago
One simple way in which I could create a ton of instant criminals is to embed a url with a page with illegal content into the frameset of a site that shows normal content but in such a way that you can't really see it. It wouldn't take much either (reocities.com) to put this terrible plan into action, it wouldn't take much for a hacker either to pull this stunt on unsuspecting visitors of a compromised site. Neither of those should have any implications for the visitors of the original site. Web joe-jobs are super easy to put into play.

hollerith 11y ago

>they simply logged the real ip addresses that visited the website once they had access to the server. Not so: one of the primary purposes of TOR is to hide the user's IP address.

bcook 11y ago
IIRC, with the Freedom Hosting bust the FBI compromised the Hidden Services server, then used a browser javascript exploit to leak the real IPs of those who connected. So, your quoted text is very plausible. Tor is intended to be anonymous, but not absolutely.
- hollerith 11y ago
  We're talking past each other. The way I interpreted the text I quoted, if the FBI needed to make use of a javascript exploit, then they're doing more than "simply logging". Context is important when interpreting text. The context of the quoted text included the question of whether the judge knew, when he or she issued the warrant, that the FBI would try to break into all the computers being used to sign into the site.

belorn 11y ago

The article describes how they had acquired a security vulnerability for Firefox, which they then exploited to create malware that infected computers that accessed the site.

Buge 11y ago
No it doesn't. The article says in 2013 they used a firefox vulnerability. It says we don't know how they did it this time (in 2015).

jacquesm 11y ago

One simple way in which I could create a ton of instant criminals is to embed a url with a page with illegal content into the frameset of a site that shows normal content but in such a way that you can't really see it. It wouldn't take much either (reocities.com) to put this terrible plan into action, it wouldn't take much for a hacker either to pull this stunt on unsuspecting visitors of a compromised site. Neither of those should have any implications for the visitors of the original site. Web joe-jobs are super easy to put into play.