5 ms·

> And upon visiting that IP address, the site forces https encryption. This isn't true if there is a MITM attacker. When you visit an HTTP website, the website

> And upon visiting that IP address, the site forces https encryption. This isn't true if there is a MITM attacker. When you visit an HTTP website, the website doesn't get to redirect you to HTTPS or anything else, because the game is already lost. When you visit a website over HTTP the attacker goes first. The legit response never made it to the client, because it was replaced in transit with a redirect to the attacker's scam/phishing/malware website.

dudehere 5y ago
How do you get a wrong IP from the blockchain in the first place? The legit software suggested to use reads out the blockchain record and forwards you to the only IP. Unclear to me where you can pick crabs on the way.
- stavros 5y ago
  Someone is sitting between you and the legit software.
  - dudehere 5y ago
    Use antivirus ))
- brenns10 5y ago
  A MITM attack requires an attacker is able to intercept and inject messages between you and the other side of your connection. So when you connect via HTTP to the IP, the attacker just masquerades as the intended target and either doesn't redirect to HTTPS or does so with their own self signed certificate.
  - dudehere 5y ago
    Ok, true. I think realistically, just use a community approved (and actually the only) software from the company who risks its huge business, if they become a MITM.
    - cmeacham98 5y ago
      Tons of people have an opportunity to MITM you and there's nothing any community approval can do about it because it's not their end of the connection. The random on the coffee shop wifi. Or the hacker on your apartment/university's poorly configured network. Or your shady ISP. Or your own government (especially likely in authoritarian countries decentralized solutions are supposed to help). I see elsewhere you mentioned certificates on the blockchain. That could work, but someone has to actually create a standard and write the code to validate the certificate and get other people to use it, which hasn't happened yet.
      - dudehere 5y ago
        I am aware of SSL on blockchain domains, but this is pain in the ass. As I mention somewhere in this thread, if random downloaders lose the same concerns about privacy as serial killers and child traffickers, I think it's better to buy a book, than to actually satisfy such demands. It can be a good joke for stand-up, though, but since there have been only a few individuals caught in the entire mankind history for making or hosting such libraries, it's not more than a joke which should not detail the world from using high tech. No need to be afraid as an academic exercise. In reality nobody needs users. At all. A few owners vs a billion users... No, bro, no. We are wasting time discussing how a book without any private data is "defaced". It is possible, if to stick a dynamite up the ass, but likely without real exposure or, let alone, the interest of all those 12 lawyers in the world fighting with piracy. Have a glass of wine and relax. There is a long line of people to catch before you get on the list.
        cmeacham98 5y ago
        I'm not worried about getting "caught" for piracy, I'm worried about some asshole in the middle hijacking my connection. Story time: back when I was in college a few years ago, the university network had some weird configuration where everybody in my dorm was on a single large local network. Somebody thought it would be funny if they ARP poisoned the network and redirected all HTTP traffic to shock websites. This would last 2-3 weeks until either they decided to stop or University IT finally caught them. Regardless, I'm glad we moved the goalposts to "you don't need privacy" and conceded that my original comment pointing out how insecure this was is correct.
  - dudehere 5y ago
    The problem with SSL certification on blockchain domains is that certificates from authorities cannot be made eternal. Either unmanned, or from CA. No real alternative.
- dudehere 5y ago
  Okay, I agree that if the intermediate network is not trusted, there can be MITM. The good thing is that the original LG offers and will keep offering multiple verification ways. 1. Affiliated sites listed by bookwarrior, the Founder of LG: https://libgen.life/viewtopic.php?f=26&t=7896 https://libgen.life/viewtopic.php?f=26&t=7896 2. Blockchain records viewable via blockchain explorers and similar public tools. E.g., you may check the libgen.lib record on https://peername.com/ https://peername.com/, press Whois button after the search. The Peername extension simply can't handle SSL, and EmerDNS domains such as .lib aren't yet supported on IPFS by browsers. It's being worked on, though. For now only IP address forwarding works, but you can choose another way as per below. libgen.crypto record is googlable and can be seen on OpenSea. I'm not finding the IPFS CID, though, but .crypto does support HTTPS, and so do IPFS gateways, after which the CID takes you to the correct location. You may use https://libgen.crypto/ https://libgen.crypto/ However, in this case there can probably still be MITM with legit SSL certificates. I'm not sure. Concluding, if you once learn a legit blockchain domain name, you can trust it's record since the record cannot be modified without direct owner's intervention. It's cryptographically strong. It's not the case with conventional Web domains which are fundamentally rented.

dudehere 5y ago

How do you get a wrong IP from the blockchain in the first place? The legit software suggested to use reads out the blockchain record and forwards you to the only IP. Unclear to me where you can pick crabs on the way.

stavros 5y ago
Someone is sitting between you and the legit software.
- dudehere 5y ago
  Use antivirus ))
brenns10 5y ago
A MITM attack requires an attacker is able to intercept and inject messages between you and the other side of your connection. So when you connect via HTTP to the IP, the attacker just masquerades as the intended target and either doesn't redirect to HTTPS or does so with their own self signed certificate.
- dudehere 5y ago
  Ok, true. I think realistically, just use a community approved (and actually the only) software from the company who risks its huge business, if they become a MITM.
  - cmeacham98 5y ago
    Tons of people have an opportunity to MITM you and there's nothing any community approval can do about it because it's not their end of the connection. The random on the coffee shop wifi. Or the hacker on your apartment/university's poorly configured network. Or your shady ISP. Or your own government (especially likely in authoritarian countries decentralized solutions are supposed to help). I see elsewhere you mentioned certificates on the blockchain. That could work, but someone has to actually create a standard and write the code to validate the certificate and get other people to use it, which hasn't happened yet.
    - dudehere 5y ago
      I am aware of SSL on blockchain domains, but this is pain in the ass. As I mention somewhere in this thread, if random downloaders lose the same concerns about privacy as serial killers and child traffickers, I think it's better to buy a book, than to actually satisfy such demands. It can be a good joke for stand-up, though, but since there have been only a few individuals caught in the entire mankind history for making or hosting such libraries, it's not more than a joke which should not detail the world from using high tech. No need to be afraid as an academic exercise. In reality nobody needs users. At all. A few owners vs a billion users... No, bro, no. We are wasting time discussing how a book without any private data is "defaced". It is possible, if to stick a dynamite up the ass, but likely without real exposure or, let alone, the interest of all those 12 lawyers in the world fighting with piracy. Have a glass of wine and relax. There is a long line of people to catch before you get on the list.
      - cmeacham98 5y ago
        I'm not worried about getting "caught" for piracy, I'm worried about some asshole in the middle hijacking my connection. Story time: back when I was in college a few years ago, the university network had some weird configuration where everybody in my dorm was on a single large local network. Somebody thought it would be funny if they ARP poisoned the network and redirected all HTTP traffic to shock websites. This would last 2-3 weeks until either they decided to stop or University IT finally caught them. Regardless, I'm glad we moved the goalposts to "you don't need privacy" and conceded that my original comment pointing out how insecure this was is correct.
- dudehere 5y ago
  The problem with SSL certification on blockchain domains is that certificates from authorities cannot be made eternal. Either unmanned, or from CA. No real alternative.
dudehere 5y ago
Okay, I agree that if the intermediate network is not trusted, there can be MITM. The good thing is that the original LG offers and will keep offering multiple verification ways. 1. Affiliated sites listed by bookwarrior, the Founder of LG: https://libgen.life/viewtopic.php?f=26&t=7896 https://libgen.life/viewtopic.php?f=26&t=7896 2. Blockchain records viewable via blockchain explorers and similar public tools. E.g., you may check the libgen.lib record on https://peername.com/ https://peername.com/, press Whois button after the search. The Peername extension simply can't handle SSL, and EmerDNS domains such as .lib aren't yet supported on IPFS by browsers. It's being worked on, though. For now only IP address forwarding works, but you can choose another way as per below. libgen.crypto record is googlable and can be seen on OpenSea. I'm not finding the IPFS CID, though, but .crypto does support HTTPS, and so do IPFS gateways, after which the CID takes you to the correct location. You may use https://libgen.crypto/ https://libgen.crypto/ However, in this case there can probably still be MITM with legit SSL certificates. I'm not sure. Concluding, if you once learn a legit blockchain domain name, you can trust it's record since the record cannot be modified without direct owner's intervention. It's cryptographically strong. It's not the case with conventional Web domains which are fundamentally rented.