5 ms·

How does a rubber hose work when the people are talking via Tox or via .onion sites?

by kefka 10y ago

stinkytaco 10y ago
Rarely does encryption exist in a complete vacuum. Just as we cannot necessarily listen to every one on one conversation, those conversations become important when related to something occurring withing the "physical" world. I think we've seen that Tor does not protect you from someone who's determined to find you (see: Silk Road).
- kefka 10y ago
  Indeed, at least with Tox, all I need is a separate key exchange, somewhere. In person works wonders. So does random email, or instant message, or you name it. At least for communications that need that layer of security and anonymity, it's certainly there. And as I implied, rubber hoses won't work on anonymous and encrypted digital identities "somewhere else". At least regarding Silk Road, that's because he made amateur mistakes by posting his real name and then changing it on StackExchange, about making a e-commerce .onion website. And that was the beginning of his fuckups, with the final one by paying for an assassination attempt.
  - stinkytaco 10y ago
    > And that was the beginning of his fuckups, with the final one by paying for an assassination attempt. That's my point. At some point he needed to leave the digital world and live in the real world. There is no perfect false identity, not one that does anyone any good. Whether you are looking to overthrow a regime, sell drugs, or just keep your recent pregnancy on the down low, at some point that leaves the digital space and enters meat space. It's at that point that powerful actors can get what they want from you. Encryption might help you evade detection, but it is not a guarantee of privacy, even for a regular person. Believe it or not, I expect we agree in the end. The existence of encryption is precisely why dragnetting doesn't work for catching actual bad guys. What brought down Silk Road was old fashioned police work. Get people on the inside, record some chats, get some warrants and so on. They seized him after he had decrypted his laptop, even. It's also precisely why I think political solutions are going to be the most effective in the end. The expectation of privacy we have established outside the digital space (say, no wiretapping, no illegal searches or arrests) still gives tools for protecting the public. Perhaps we need to somewhat tweak those tools for the digital world, but that doesn't mean we need to give the government the keys to our house.
djsumdog 10y ago
I think OP was talking about torture in order to obtain keys.
- marcosdumay 10y ago
  And the GP is asking who will be tortured if you can't get the identity of the interlocutors. You can even hide that a conversation took place.
posterboy 10y ago
They might own a significant share of Tor relays and exit points, likewise for Bitcoin.
- kefka 10y ago
  I've also worked on quite a few methods of using Tor and Hidden Services, where my whole network is in .onion . I can send data to .onion addresses natively via DNS ( https://trac.torproject.org/projects/tor/wiki/doc/LinuxDNSresolverForOnions https://trac.torproject.org/projects/tor/wiki/doc/LinuxDNSre... ). I can also receive data from Onions as well. Right now, I have Node-Red communicating data from my IoT infrastructure, publishing data to my MQTT broker elsewhere (my server onion). I have my 3d printers in another place, and part of the MQTT data is pictures and GCode readouts from them. It sounds complicated, but Hidden Services allows me to treat a network of disjointed machines (all behind NATs) to be thought of as being on one huge ethernet hub. And I can code against an [hash].onion and know that my data will reach that machine, no matter the IP.

How does a rubber hose work when the people are talking via Tox or via .onion sites?

by kefka 10y ago

How does a rubber hose work when the people are talking via Tox or via .onion sites?

Rarely does encryption exist in a complete vacuum. Just as we cannot necessarily listen to every one on one conversation, those conversations become important when related to something occurring withing the "physical" world. I think we've seen that Tor does not protect you from someone who's determined to find you (see: Silk Road).

kefka 10y ago
Indeed, at least with Tox, all I need is a separate key exchange, somewhere. In person works wonders. So does random email, or instant message, or you name it. At least for communications that need that layer of security and anonymity, it's certainly there. And as I implied, rubber hoses won't work on anonymous and encrypted digital identities "somewhere else". At least regarding Silk Road, that's because he made amateur mistakes by posting his real name and then changing it on StackExchange, about making a e-commerce .onion website. And that was the beginning of his fuckups, with the final one by paying for an assassination attempt.
- stinkytaco 10y ago
  > And that was the beginning of his fuckups, with the final one by paying for an assassination attempt. That's my point. At some point he needed to leave the digital world and live in the real world. There is no perfect false identity, not one that does anyone any good. Whether you are looking to overthrow a regime, sell drugs, or just keep your recent pregnancy on the down low, at some point that leaves the digital space and enters meat space. It's at that point that powerful actors can get what they want from you. Encryption might help you evade detection, but it is not a guarantee of privacy, even for a regular person. Believe it or not, I expect we agree in the end. The existence of encryption is precisely why dragnetting doesn't work for catching actual bad guys. What brought down Silk Road was old fashioned police work. Get people on the inside, record some chats, get some warrants and so on. They seized him after he had decrypted his laptop, even. It's also precisely why I think political solutions are going to be the most effective in the end. The expectation of privacy we have established outside the digital space (say, no wiretapping, no illegal searches or arrests) still gives tools for protecting the public. Perhaps we need to somewhat tweak those tools for the digital world, but that doesn't mean we need to give the government the keys to our house.

djsumdog 10y ago

I think OP was talking about torture in order to obtain keys.

marcosdumay 10y ago
And the GP is asking who will be tortured if you can't get the identity of the interlocutors. You can even hide that a conversation took place.

posterboy 10y ago

They might own a significant share of Tor relays and exit points, likewise for Bitcoin.

kefka 10y ago
I've also worked on quite a few methods of using Tor and Hidden Services, where my whole network is in .onion . I can send data to .onion addresses natively via DNS ( https://trac.torproject.org/projects/tor/wiki/doc/LinuxDNSresolverForOnions https://trac.torproject.org/projects/tor/wiki/doc/LinuxDNSre... ). I can also receive data from Onions as well. Right now, I have Node-Red communicating data from my IoT infrastructure, publishing data to my MQTT broker elsewhere (my server onion). I have my 3d printers in another place, and part of the MQTT data is pictures and GCode readouts from them. It sounds complicated, but Hidden Services allows me to treat a network of disjointed machines (all behind NATs) to be thought of as being on one huge ethernet hub. And I can code against an [hash].onion and know that my data will reach that machine, no matter the IP.