7 ms·

For the false names thing, are you by chance doing whois lookups on IP addresses? If so then that's just the messy nature of the beast. One issue is that WHOIS

For the false names thing, are you by chance doing whois lookups on IP addresses? If so then that's just the messy nature of the beast. One issue is that WHOIS records don't get updated sometimes, but what you're seeing is most likely the legitimate owner of the IP. So, someone else (coge t in your example) may own the IP, but if they purchase transit from that IP owner, the IP will be delegated to them but still owned by Cogent. As for the rest of your concerns. First, I would like to see some empirical data on your research. Second,what is your security model? VPNs are not that great at anonymity. You're not trying to hide from a global adversary (like nsa,gru,gchq,etc..) Using VPNs right...because even slapping Tor on that won't help you there. My theory is that they're cheap enough as a resellerand they target VPN providers as customers because there is a lot less support cost with them. The thing about suspicions and conspiracies is that they mean little without independently corroborating evidence. Try to collect facts that prove your suspicion.

wolco 7y ago
Do you think the nsa, gru, gchq have broken tor?
- cjbprime 7y ago
  The Snowden leaks suggested that they had not broken Tor, at the time of the leaks. There are "global passive adversary" timing correlation attacks which have had papers written about them and could conceivably be performed by some large intelligence agencies, especially if they cooperated with each other to do so, by using their power to observe country-scale network traffic.
  - badrabbit 7y ago
    Too lazy to look up the source but part of the leaks (and a separate leak too I believe?) Was how they have been working on what you said along with basically running a lot of the relay's and combinig that with their existing internet traffic visibility. I don't so much think they've broken it,more like they can de-anonymize who is visiting hidden sites or going out of exits with good enough accuracy. Oh,and after the raid in so many dark web markets,people now pretty much presume this is the case, they deanonymize and inform law enforcement so they can back track the evidence trail (parallel reconstruction). A lot of dark web trading has just moved to places like telegram
    - cjbprime 7y ago
      That doesn't sound right. I don't think they had much success. The presentation seemed largely resigned. Every dark web arrest I've seen has been caused by terrible operational security (e.g. having a Gmail account traceable to the admin of the dark web site) rather than a break of Tor.
      - badrabbit 7y ago
        The snowden slides are from 2008 mostly right? I think the article I read was describing how around this time gchq started collaborating with the NSA and CIA because the Tor problem was growing bigger and bigger. Their current capabilities are unknown, but their last known public plan was to control more Tor nodes and retroactively deanonymize Tor flows iirc. For the dark web stuff, the opsec failure is supposedly parallel reconstruction.
- badrabbit 7y ago
  Yes, they have (before the snowden leaks),but that isn't what I meant. The Tor project's faqs clearly state Tor can't protect against a global adversary, it is out of the scope of their threat model. If someone can see almost all internet traffic, Tor is useless against them.

wolco 7y ago

Do you think the nsa, gru, gchq have broken tor?

cjbprime 7y ago
The Snowden leaks suggested that they had not broken Tor, at the time of the leaks. There are "global passive adversary" timing correlation attacks which have had papers written about them and could conceivably be performed by some large intelligence agencies, especially if they cooperated with each other to do so, by using their power to observe country-scale network traffic.
- badrabbit 7y ago
  Too lazy to look up the source but part of the leaks (and a separate leak too I believe?) Was how they have been working on what you said along with basically running a lot of the relay's and combinig that with their existing internet traffic visibility. I don't so much think they've broken it,more like they can de-anonymize who is visiting hidden sites or going out of exits with good enough accuracy. Oh,and after the raid in so many dark web markets,people now pretty much presume this is the case, they deanonymize and inform law enforcement so they can back track the evidence trail (parallel reconstruction). A lot of dark web trading has just moved to places like telegram
  - cjbprime 7y ago
    That doesn't sound right. I don't think they had much success. The presentation seemed largely resigned. Every dark web arrest I've seen has been caused by terrible operational security (e.g. having a Gmail account traceable to the admin of the dark web site) rather than a break of Tor.
    - badrabbit 7y ago
      The snowden slides are from 2008 mostly right? I think the article I read was describing how around this time gchq started collaborating with the NSA and CIA because the Tor problem was growing bigger and bigger. Their current capabilities are unknown, but their last known public plan was to control more Tor nodes and retroactively deanonymize Tor flows iirc. For the dark web stuff, the opsec failure is supposedly parallel reconstruction.
badrabbit 7y ago
Yes, they have (before the snowden leaks),but that isn't what I meant. The Tor project's faqs clearly state Tor can't protect against a global adversary, it is out of the scope of their threat model. If someone can see almost all internet traffic, Tor is useless against them.