5 ms·

>"Whoops I forgot to turn my VPN on" Why would someone be using a VPN if they're using tor for the market? Why would a VPN offer any protection at all? If you'

>"Whoops I forgot to turn my VPN on" Why would someone be using a VPN if they're using tor for the market? Why would a VPN offer any protection at all? If you're using a VPN and "SSH into one of the servers that they are already watching", then a VPN isn't going to provide anonymity.

Shared404 6y ago
The model would be something like User --> VPN --> Tor --> Market Assuming the VPN is trustworthy and you don't connect to Tor without it, the VPN would cover up the fact that you used Tor at all. If you normally use the VPN, but forget it one time, you are now exposed.
- bauruine 6y ago
  If they are able to do a deanonymization attack on the 3 hop Tor circuit why should a VPN protect you? They can just mount a similar attack on the one hop VPN.
  - Shared404 6y ago
    Thus the requirement for the VPN to be trustworthy. What that means changes on the threat model, but for this scenario we'll say a hypothetical VPN provider in a different jurisdiction that takes Monero and has good OpSec. The reason they can do the deanonymization attack on the Tor circuit is that they have basically unlimited resources to set up nodes, and Tor is built on the assumption that the nodes are all unrelated. If a Tor session looks like: User -> VPN -> Tor( A -> B -> C ) -> Market then the government could have the advantage of owning both A and B, or any other combination. That is difficult (though not impossible) to do to a VPN that they do not have jurisdiction over. Anyone can set up a Tor node, but it's not possible to just randomly add nodes to a VPN's network, so they shouldn't be vulnerable to that (barring insecurity in other forms).
    - de_nied 6y ago
      Check my other reply. I don't think you understand how deanonymization attacks work. It's not by governments "owning nodes." They might sometimes run the exit node, but that's for detecting certain activity, not finding people. Plus, you can restrict what nodes are used. It's not like the public nodes are the only ones that exist.
      - Shared404 6y ago
        Thanks, I appreciate it. Clearly I've got gaps in my understanding, any good resources you could point me towards to study up?
        de_nied 6y ago
        I'd check out Wikipedia categories for general pointers. I think it's important to highlight that internet privacy and internet anonymity are two very different things. Also take care on how the word anonymous is used. Some use the word "pseudo-anonymous" which isn't the same thing. It'd also be helpful to first learn how routing works. Then check out different types of applications(Tor, AnoNet, ZeroNet, etc) and read up on how they implement their networks. Also read up on how the people who ran the markets got caught (read up articles in addition to Wikipedia). Be aware Wikipedia shouldn't be used as actual fact. Check the sources. Many editors misinterpret them, or don't even read them at all. https://en.wikipedia.org/wiki/Category:Internet_privacy https://en.wikipedia.org/wiki/Category:Internet_privacy https://en.wikipedia.org/wiki/Category:Anonymity_networks https://en.wikipedia.org/wiki/Category:Anonymity_networks https://en.wikipedia.org/wiki/Routing https://en.wikipedia.org/wiki/Routing Some keywords/concepts that may help: I2P/Peer-to-peer/Friend-to-friend/ Onion routing Garlic routing Digital fingerprinting https://en.wikipedia.org/wiki/Mix_network https://en.wikipedia.org/wiki/Mix_network https://en.wikipedia.org/wiki/Crowds_(anonymity_network) https://en.wikipedia.org/wiki/Crowds_(anonymity_network) https://en.wikipedia.org/wiki/ZeroNet https://en.wikipedia.org/wiki/ZeroNet https://en.wikipedia.org/wiki/Anonymous_P2P https://en.wikipedia.org/wiki/Anonymous_P2P Tails/Whonix/QubeOS for system protection.
        6y ago
- de_nied 6y ago
  A VPN would not cover up the fact that you used Tor at all. Assuming you're actually utilizing SSH through sock proxies and using a VPN, you can still be fingerprinted and tracked. There are already existing databases that have established profiles for various sites. Your ISP can easily see if you're connecting to one of those sites based on the type of data you're sending. Regardless if it's encrypted. On the other hand, if you normally do this but forget to one time, it doesn't mean you're automatically exposed. It simply means that if anyone is currently attempting to find you and have an exploit that will actually work on you, then they will be getting you directly instead of your VPN. However, even if you had a VPN, if it's a government agency then generally speaking they will be able to find you anyways. A VPN doesn't "hide" you. It's not meant to. If you want to stay anonymous, there are several methods that can be utilized. The most obvious one is not connecting to the internet from your own home. Use the Starbucks WiFi. A more clever method would be buying slave bots and using poorly secured wifi netowrks around them to hop over one. Assume VPN connections are from companies based in countries not on friendly terms with yours. Like China/U.S. User -> RandomWifi -> VPN/SSH -> Slave -> SecondSlave/WifiHop -> VPN/SSH 2.0 -> Tor -> Market This is a very basic set up. I would personally add more to it with other stuff, but it all depends on your threat model. Small note. This assumes you're actually setting up your VPNs, not buying some "VPN service." I saw you wrote about being careful with VPNs and how "trustworthy" they are. I'm not sure why you would ever use a VPN service.
  - grenoire 6y ago
    >I'm not sure why you would ever use a VPN service. Geolocking. That seems to be the only 'accepted' technical answer.
  - patrickaljord 6y ago
    > User -> RandomWifi -> VPN/SSH -> Slave -> SecondSlave/WifiHop -> VPN/SSH 2.0 -> Tor -> Market One thing I would add to the RandomWifi at starbucks is to make sure not to bring your phone as they could detect you went there if they get to find your RandomWifi starbucks location. Also make sure to change starbucks/RandomWifi location every time and for extra-paranoid reasons, maybe wear some toupee and fake moustache in case they try to get camera recording from the starbucks. I would also do most of the work from home, just run all the db/code updates from home and then sync/push the update at RandomWifi so you just need to stay there a few seconds. You don't even need to get in, just stay outside walking and click the push button from your laptop quickly. Never do it on the same hours either.

Shared404 6y ago

The model would be something like User --> VPN --> Tor --> Market Assuming the VPN is trustworthy and you don't connect to Tor without it, the VPN would cover up the fact that you used Tor at all. If you normally use the VPN, but forget it one time, you are now exposed.

bauruine 6y ago
If they are able to do a deanonymization attack on the 3 hop Tor circuit why should a VPN protect you? They can just mount a similar attack on the one hop VPN.
- Shared404 6y ago
  Thus the requirement for the VPN to be trustworthy. What that means changes on the threat model, but for this scenario we'll say a hypothetical VPN provider in a different jurisdiction that takes Monero and has good OpSec. The reason they can do the deanonymization attack on the Tor circuit is that they have basically unlimited resources to set up nodes, and Tor is built on the assumption that the nodes are all unrelated. If a Tor session looks like: User -> VPN -> Tor( A -> B -> C ) -> Market then the government could have the advantage of owning both A and B, or any other combination. That is difficult (though not impossible) to do to a VPN that they do not have jurisdiction over. Anyone can set up a Tor node, but it's not possible to just randomly add nodes to a VPN's network, so they shouldn't be vulnerable to that (barring insecurity in other forms).
  - de_nied 6y ago
    Check my other reply. I don't think you understand how deanonymization attacks work. It's not by governments "owning nodes." They might sometimes run the exit node, but that's for detecting certain activity, not finding people. Plus, you can restrict what nodes are used. It's not like the public nodes are the only ones that exist.
    - Shared404 6y ago
      Thanks, I appreciate it. Clearly I've got gaps in my understanding, any good resources you could point me towards to study up?
      - de_nied 6y ago
        I'd check out Wikipedia categories for general pointers. I think it's important to highlight that internet privacy and internet anonymity are two very different things. Also take care on how the word anonymous is used. Some use the word "pseudo-anonymous" which isn't the same thing. It'd also be helpful to first learn how routing works. Then check out different types of applications(Tor, AnoNet, ZeroNet, etc) and read up on how they implement their networks. Also read up on how the people who ran the markets got caught (read up articles in addition to Wikipedia). Be aware Wikipedia shouldn't be used as actual fact. Check the sources. Many editors misinterpret them, or don't even read them at all. https://en.wikipedia.org/wiki/Category:Internet_privacy https://en.wikipedia.org/wiki/Category:Internet_privacy https://en.wikipedia.org/wiki/Category:Anonymity_networks https://en.wikipedia.org/wiki/Category:Anonymity_networks https://en.wikipedia.org/wiki/Routing https://en.wikipedia.org/wiki/Routing Some keywords/concepts that may help: I2P/Peer-to-peer/Friend-to-friend/ Onion routing Garlic routing Digital fingerprinting https://en.wikipedia.org/wiki/Mix_network https://en.wikipedia.org/wiki/Mix_network https://en.wikipedia.org/wiki/Crowds_(anonymity_network) https://en.wikipedia.org/wiki/Crowds_(anonymity_network) https://en.wikipedia.org/wiki/ZeroNet https://en.wikipedia.org/wiki/ZeroNet https://en.wikipedia.org/wiki/Anonymous_P2P https://en.wikipedia.org/wiki/Anonymous_P2P Tails/Whonix/QubeOS for system protection.
        6y ago
de_nied 6y ago
A VPN would not cover up the fact that you used Tor at all. Assuming you're actually utilizing SSH through sock proxies and using a VPN, you can still be fingerprinted and tracked. There are already existing databases that have established profiles for various sites. Your ISP can easily see if you're connecting to one of those sites based on the type of data you're sending. Regardless if it's encrypted. On the other hand, if you normally do this but forget to one time, it doesn't mean you're automatically exposed. It simply means that if anyone is currently attempting to find you and have an exploit that will actually work on you, then they will be getting you directly instead of your VPN. However, even if you had a VPN, if it's a government agency then generally speaking they will be able to find you anyways. A VPN doesn't "hide" you. It's not meant to. If you want to stay anonymous, there are several methods that can be utilized. The most obvious one is not connecting to the internet from your own home. Use the Starbucks WiFi. A more clever method would be buying slave bots and using poorly secured wifi netowrks around them to hop over one. Assume VPN connections are from companies based in countries not on friendly terms with yours. Like China/U.S. User -> RandomWifi -> VPN/SSH -> Slave -> SecondSlave/WifiHop -> VPN/SSH 2.0 -> Tor -> Market This is a very basic set up. I would personally add more to it with other stuff, but it all depends on your threat model. Small note. This assumes you're actually setting up your VPNs, not buying some "VPN service." I saw you wrote about being careful with VPNs and how "trustworthy" they are. I'm not sure why you would ever use a VPN service.
- grenoire 6y ago
  >I'm not sure why you would ever use a VPN service. Geolocking. That seems to be the only 'accepted' technical answer.
- patrickaljord 6y ago
  > User -> RandomWifi -> VPN/SSH -> Slave -> SecondSlave/WifiHop -> VPN/SSH 2.0 -> Tor -> Market One thing I would add to the RandomWifi at starbucks is to make sure not to bring your phone as they could detect you went there if they get to find your RandomWifi starbucks location. Also make sure to change starbucks/RandomWifi location every time and for extra-paranoid reasons, maybe wear some toupee and fake moustache in case they try to get camera recording from the starbucks. I would also do most of the work from home, just run all the db/code updates from home and then sync/push the update at RandomWifi so you just need to stay there a few seconds. You don't even need to get in, just stay outside walking and click the push button from your laptop quickly. Never do it on the same hours either.