18 ms·

The FBI Identified a Tor User

427 points by mikece 4y ago

deleted 4y ago
[deleted]
takoid 4y ago
Original article this is referencing: https://www.vice.com/en/article/z34dx3/fbi-wont-say-hacked-dark-web-isis-site-nit https://www.vice.com/en/article/z34dx3/fbi-wont-say-hacked-d... And the relevant court document: https://www.documentcloud.org/documents/23569961-motion-to-reconsider-hsd-order https://www.documentcloud.org/documents/23569961-motion-to-r...
- flotzam 4y ago
  Direct link to the PDF (because DocumentCloud's web viewer appears to be down): https://s3.documentcloud.org/documents/23569961/motion-to-reconsider-hsd-order.pdf https://s3.documentcloud.org/documents/23569961/motion-to-re...
  - screwturner68 4y ago
    Seems like this is a case of the government saying "trust us". They noted two ways that the feds could have gotten the IP address but how about a third, they targeted the guy and got the IP address from the ISP and said "look!, we found our guy" -occams razor.
    - richbell 4y ago
      Wouldn't they need to know who he is before they could target him and acquire his IP? Unless your suggesting parallel construction?
      - screwturner68 4y ago
        I read the doc and it seems like the case is built on information gathered by the government but they won't say how. They don't want to say how because it's supposed to be a national security issue, which is understandable but not how our legal system works (or should work). They are saying that they got his IP via tor and that that IP address went to ISIS websites, but again they won't say how they have this information they are just saying "trust us". I'm saying that if they had targeted this individual, the feds thought he was up to something but had no real evidence, it would be really easy to find this guys IP address and then say he went to X website and he needs to go to jail -but we can't tell you how we found this out. Do you see where the problem is? We still have due process in this country or at least we're supposed to.
        richbell 4y ago
        > I'm saying that if they had targeted this individual, the feds thought he was up to something but had no real evidence, it would be really easy to find this guys IP address and then say he went to X website and he needs to go to jail -but we can't tell you how we found this out. Do you see where the problem is? We still have due process in this country or at least we're supposed to. Yeah, it's been a problem for a while now. I do think you're referring to Parallel Construction, a.k.a. evidence laundering. https://en.m.wikipedia.org/wiki/Parallel_construction https://en.m.wikipedia.org/wiki/Parallel_construction
        screwturner68 4y ago
        TDIL -parallel construction
- Ajedi32 4y ago
  Even leaving aside the question of whether the FBI actually compromised Tor, or just did something way more mundane like infect the defendant's PC with malware, the linked court document is really interesting. Not only does the FBI decline to say how they determined what IP address the defendant used to access the Tor hidden service, but they're also trying to hide the fact that the defendant asked to see that information by requesting the court label the defendant's court filing itself a "highly sensitive document"? And the court granted that request? Is that normal? It seems really bizarre to me, but I'm not a lawyer.
  - advisedwang 4y ago
    If becomes widely known that the government can de-cloak Tor users, that will change the behaviour of their targets and so hurt their surveillance, so it's fairly common that the government wants to hide this fact. (same with stingrays, for example). But just wanting to keep it secret is not enough. So they will claim that this has national security implications, saying some targets are terrorists. And courts defer very heavily to the government in this area, so the FBI might be successful. Because just knowing that there is a break is enough to tip someone off, the FBI can and courts likely would classify a request for details as well as the details themselves.
    - geepound 4y ago
      >If becomes widely known that the government can de-cloak Tor users, that will change the behaviour of their targets and so hurt their surveillance, so it's fairly common that the government wants to hide this fact. (same with stingrays, for example). As was discussed verbally at Defcon, a huge chunk of the exit nodes are either in the US or EU. Same for guards. (The whole GCHQ vs several EU countries trying to do intel in parallel without a shared intelligence agency thing is perpetually amusing.)
      - mr_woozy 4y ago
        [dead]
- dang 4y ago
  Ok, we've changed the URL to that from https://www.schneier.com/blog/archives/2023/01/the-fbi-identified-a-tor-user.html https://www.schneier.com/blog/archives/2023/01/the-fbi-ident.... Schneier's title seems more HN-friendly so I've kept it.
generalizations 4y ago
I wonder if this is going to be confirmation that a large fraction of Tor nodes are in fact run by the FBI.
- Buffout 4y ago
  So what if they were? Only exit node see the message (encrypted or not). And it doesn't know where it originated. I speculate this is most likely case of a ISIS server run by FBI.
  - gizmo686 4y ago
    If you control both exit and entrance nodes, you can corralate connections with a timing analysis.
    - Buffout 4y ago
      I don't think that is how timing analisis works. User can say to "entrance node" that it is also a node and that is how it can deny that it is originator. "Entrance node" doesn't know its position in a chain. Only Exit node knows its position.
      - electroly 4y ago
        I don't think that's totally true. At least, it's maybe superficially true but not in a real world sense. The entry node can see your IP by virtue of the incoming TCP connection and it's not hard to figure out if an IP is a Tor relay or not. The list of known relays is a list that you can just go and get. If it's not a relay, then it's a client, and you're the entry node.
        deleted 4y ago
        [deleted]
        Buffout 4y ago
        No, this is not the timing attack I was thinking of. Your version of timing attack comes from inside tor network and that is solved by Entry Guards. And besides you can also be Tor relay and a client. This attacks are just bugs that are fixed. The real timing attack that is not fixed and will not be (it is not in threat model), is when your ISP works with police (that has warrant) and gives them data. And police also controls server or exit node.
Mizza 4y ago
More troubling - is it a crime to visit a website which begs donations for an illegal cause?
- donkeyd 4y ago
  No, it isn't. That's not what he was charged for, it's just one piece of evidence in the case: > “From Mr. Al-Azhari’s attempt to acquire firearms through unlawful channels to his desire to provide material support to a designated foreign terrorist organization, it was clear Mr. Al-Azhari’s intention was to carry out an act of violence,” > According to the complaint, Al-Azhari was an ISIS supporter who planned and attempted to carry out an attack on behalf of that terrorist organization. Al-Azhari, who has a criminal history that includes prior terrorism charges in Saudi Arabia, attempted to purchase multiple firearms over the course of the investigation, before acquiring a Glock pistol and a silencer. He also expressed admiration for Pulse nightclub shooter Omar Mateen and spoke of his desire to carry out a similar mass casualty shooting. Additionally, Al-Azhari researched and scouted potential targets in the Tampa area, including Honeymoon Island. He also rehearsed portions of an attack and the statements that he would make during or in connection with such an attack.
  - SamoyedFurFluff 4y ago
    I’m interested what the case law is for arresting someone for intent to perform a heinous act. I’ve heard a lot from stalking victims and the like that often times police will refuse to do anything until the stalker has assaulted or murdered the victim in question, despite clear indications the stalker is actively planning to do harm.
    - chopin 4y ago
      Wait until the victim is someone powerful.
    - deleted 4y ago
      [deleted]
    - maxlybbert 4y ago
Tepix 4y ago
It could also be that they had backdoored his PC earlier, right?
- dncornholio 4y ago
  It could also be they just checked his browsing history..
- Miner49er 4y ago
  Could be a lot of things. Could be the FBI runs the site and specifically targeted him. Or they run the site and it has some sort of browser exploit. I'm guessing the first though. That they set up the site specifically to target him. The rest of the investigation involves them running eBay accounts to sell him weapons and such. Seems like the whole investigation was borderline entrapment to be able to arrest him on something.
  - closewith 4y ago
    It's not close to entrapment, unless the FBI coerced the accused.
KingLancelot 4y ago
The feds run all the entrance and exit nodes. Tor was created by the feds for spies to use, then they made it public yo hide the traffic. This is the official story that everyone has evidently forgotten.
- sweetbitter 4y ago
  Not quite. The guy who wrote Tor can be clearly seen to have been studying a lot of these things in the later 90s, and it was pretty much always public, but only developed after he got the Navy to get him an NSF grant. Hell, in one slide he had made back then, he was even well-aware of some of the fundamental vulnerabilities in the protocol, and the (still too expensive) mitigations for those flaws, so it can't even be said that anything was concealed. If we go back further to the original concept of chained anonymous remailers as envisioned by Chaum 40 years ago, it gets even harder to claim something like this.
- stuckkeys 4y ago
  Source? or you just speculating?
  - DoItToMe81 4y ago
    There is no source. It is nonsense.
- wrycoder 4y ago
  Well, not all the exit nodes by now. But many of them. Most people are probably leery of running an exit node, because its traffic is in the clear (modulo ssh) and often connects to disparate and shady servers.
  - ramesh31 4y ago
    This is what I've never understood about Tor. What possible incentive does anyone have to run an exit node? Seems like nothing but a liability for some extremely awful stuff.
DoItToMe81 4y ago
I wouldn't get so excited about this. There have been tons of javascript exploits to leak IP addresses in the past, it's more likely that than the FBI running thousands of servers.
- Ajedi32 4y ago
  Or even something way simpler, like the FBI secretly compromising the user's PC with malware prior to the arrest. Without more detail it's impossible to know whether this is even news.
  - Ajedi32 4y ago
    Out of curiosity, will we get more detail? Presumably the FBI would need to reveal to somebody how they obtained this information in order for it to be admissible as evidence ("he did this, trust us" probably won't fly in court), but is there a legal means by which they could do that without revealing their exact methods to the general public? (I don't actually know what the law says on this subject.)
    - nostrademons 4y ago
      Parallel construction. They use their real methods to identify the user, then once they know the user, specifically target them with simpler known methods to build evidence for the case. In the court filing, they present evidence that they've gained through known methods which don't work all that well unless you already have a suspect, but they actually caught the suspect using methods that are not public (and won't become so, unless there's an internal leak at the FBI).
      - Ajedi32 4y ago
        But if they were using parallel construction, surely the criminal complaint wouldn't make claims they can't prove using the non-secret chain of evidence, right? Here the court filing alleges that the FBI knows what IP address the defendant used to visit a Tor hidden service. Don't they now have to prove that claim if they want the prosecution to succeed?
causi 4y ago
I will never understand people who do illegal things over their own IP. Is it really that hard to find an open access point? Way back in the day when I torrented all my content I used a long-range wifi antenna connected to a public AP and a dedicated PC with a scrubbed drive that never connected to my home network.
- deleted 4y ago
  [deleted]
- LastTrain 4y ago
  So you did illegal things illegally. And who owned the public AP? Someone not as smart as you? You sure?
  - causi 4y ago
    So you did illegal things illegally. Yep. I said I don't understand people who do illegal things over their own connection, i.e., stupidly. And who owned the public AP? McDonald's.
    - hinata08 4y ago
      using such setup wouldn't prevent anyone from finding you if you did illegal things that really mattered, like donating to a terrorist organization you can proudly use it to download torrents (because nobody cares and the feds won't triangulate a signal for torrents), but they can definitely do it for terrorism and intelligence matters. (check out all the stories of spies who had radios, from the 1914 to SOE to cold war) As a bonus, you even post your story on HN, a site where analysts from all the governments and major companies of the planet meet to talk about tech... this guy was probably more careful than you
    - VWWHFSfQ 4y ago
      McDonald's has video cameras pointing at every inch of their property 24/7. All they need is a timestamp from the AP and they'll go find your license plate in the parking lot on the surveillance tapes.
nibbleshifter 4y ago
Sounds like his box was compromised, possibly by owning the site he visited first. The FBI has done this before - inject a browser exploit into a site they compromised to identify its users.
- DarkmSparks 4y ago
  yep, this, I ran a tor webserver for discussing geopolitics with friends on a pi for a few months before finding it had been compromised. that was shortly after intel exchange had been taken down. Tor services just arent secure in any sense imho. especially not from the people who wrote them. sigh.
  - titaniumtown 4y ago
    > for discussing geopolitics with friends on a pi for a few months before finding it had been compromised. that's very suspicious
    - DarkmSparks 4y ago
      now mostly fall back on cryptome.org dont get the more juicy military stuff, but it's much less effort.
  - Run_DOS_Run 4y ago
    >I ran a tor webserver for discussing geopolitics with friends on a pi for a few months before finding it had been compromised. Not the fault of Tor. HSDir nodes could snoop on announced v1 .onion adresses. This isn't the case anymore for Onion v2 addresses. But even if an attacker has the onion address of your webserver, he needs a way to compromise it. Either through a vuln in your website or your webserver.
    - nibbleshifter 4y ago
      A vuln in the webserver is the usual way, I used to collect and scan .onion domains for misconfiguration issues a few years ago. You would be amazed how many admins leave shit like PHPMyAdmin wide open.
0xbadcafebee 4y ago
Isn't all propaganda unofficial? It's not like there's a stamp on it ("This Propaganda was Approved by the Secretary of Media for the Islamic State"). Don't be fooled by that counterfit propaganda! Only buy the real deal!
- Freak_NL 4y ago
  Not at all. States can produce their own (and thus official) propaganda, but affiliates or supporters can do so on their own as well (unofficial). When the ambassador of some country purchases advertising space in a national newspaper in the country they are stationed in and uses that to publish a letter or pamphlet, then that is likely officially sanctioned propaganda (the Chinese ambassador did this in the Netherlands to present the official Chinese view on certain matters related to China debated in Dutch media some years ago). That particular instance literally came with the stamp of approval (or rather the ambassador's signature).
- deleted 4y ago
  [deleted]
privacywiki 4y ago
If the user's data passes through nodes owned by one entity or their partners in this case NSA, FBI, GCHQ etc, it's going to be quite easy to find the origin IP...
optimalsolver 4y ago
I keep saying this, but the inescapable fact about Tor is that its traffic patterns make you stand out prominently. Just the fact you’re using it automatically makes you interesting and worthy of a closer look. All well and good if you’re just maintaining a cookie recipe site on the dark web, but it’s rarely ever that, is it?
- xnorswap 4y ago
  Is your intention in repeating that to keep Tor usage below the critical threshold where that remains true?
  - notyourwork 4y ago
    I interpret op to be suggesting Tor isn’t as anonymous of one who conducts illicit activity would assume. That seems to be the trend time and time again.
  - likpok 4y ago
    Tor has a lot of pretty gnarly trade offs that will naturally keep usage low outside of people who really need it. The latency is nontrivial, exit nodes are congested and lots of sites don’t want to deal with Tor because so much abuse flows through it. Tor definitely has a similar problem to like voat or gab: a community with a strict no-witch-burning philosophy ends up filled with witches.
  - DougN7 4y ago
    Realistically, what would need to happen for it to not be the case? How many millions or billions of people would have to use it before the government would give up and stop looking at you if you use it?
    - noirscape 4y ago
      In order for that to happen you first need to convince people to either accept the hit in connection speed (which is terrible over TOR) or you need to significantly increase the amount of nodes on the network, the latter of which isn't going to happen because of the legal risks, which act as a chilling effect.
checkyoursudo 4y ago
A person might still use Tor because they would rather have only the Feds know what porn they look at rather than have the Feds and everyone else know what porn they look at.
adenozine 4y ago
From Bruce of all people, this is a wildly provocative, unsubstantiated claim about routine takedown behavior from the feds. I mean, nobody hates the gov side of the cryptography wars more than me, but this type of article is well below table-stakes for discussion. Especially by legendary professionals of repute like Bruce. It's very disappointing to me. The price of clicks truly deconstructs the modern man's integrity...
- monero-xmr 4y ago
  Bruce has also been hardcore anti-cryptocurrency. From a pure cryptography perspective the innovations around zero knowledge proofs are very intriguing and it’s highly unlikely they would have happened as quickly without the monetary benefit of cryptocurrency pushing such research forwards. However Bruce is an extreme statist, and if he had his way I’m sure all cryptography would be backdoored.
  - czx4f4bd 4y ago
    Really? Bruce is pro-backdoor? Where's that pro-backdoor advocacy in this essay from 2013 on evading NSA surveillance and warning about the risk of backdoored cryptography? https://www.schneier.com/essays/archives/2013/09/nsa_surveillance_a_g.html https://www.schneier.com/essays/archives/2013/09/nsa_surveil... Or this essay from 2016 arguing that backdoors sabotage security? https://www.schneier.com/essays/archives/2016/04/the_value_of_encrypt.html https://www.schneier.com/essays/archives/2016/04/the_value_o... Or this essay from 2019 decrying yet another effort to backdoor encryption? https://www.schneier.com/blog/archives/2019/12/scaring_people_.html https://www.schneier.com/blog/archives/2019/12/scaring_peopl...
    - monero-xmr 4y ago
      This is, without a doubt, the craziest thing I have ever seen pushed out by a someone who purports to know something about cryptography, law, and political advocacy: https://www.lawfareblog.com/tornado-cash-not-free-speech-its-golem https://www.lawfareblog.com/tornado-cash-not-free-speech-its... Schneier has gone off the deep end
MuffinFlavored 4y ago
can you not use nordvpn first, then tor?
- warinukraine 4y ago
  Mullvad, please. nordvpn has been acquired by some private equity that's acquiring all the vpns.
  - MuffinFlavored 4y ago
    do you agree based on your understand that if this TOR user had used Mullvad VPN services (or equivalent) he would've been fine/not detected by the FBI?
    - haakon 4y ago
      If FBI really has compromised Tor, there's no reason to believe they would be helpless against a VPN service.
  - sekai 4y ago
    Source? NordVPN was and is owned by Tesonet.
  - nick__m 4y ago
    I know that Nord Security the company that own nordvpn has acquired AtlasVPN and I also know that the VPN market is quite concentrated, 7 companies owns dozens of brands. I would like information on those acquisitions... have I missed some important news? I would like to know because NordVPN, while not as hardcore on privacy as mullvad, is still providing a useful service for protection against an untrusted wifi and geofence jumping.
xwdv 4y ago
Only whitelist Tor nodes that you have personally vetted. Always double vpn.
- stuckkeys 4y ago
  Double vpn is only going to give them an additional bump. Still detectable.
r3trohack3r 4y ago
I have second hand knowledge of lawsuits that have been dropped by the FBI during discovery because it would require them revealing zero days they have on Tor. Recently this has started getting increasing levels of press exposure[1] including in CSAM cases. The FBI has also continued to run CSAM websites after takeover to collect intel, and likely run honeypots for other content. If your adversary is a state actor, particularly the U.S., tor alone is not sufficient for anonymity. It's fairly safe to assume they have the ability to deanonymize you. Your only safety net, it seems, is the value of other targets relative to you when it comes to them burning their "golden ticket" zero day. And even then, you're at risk of parallel construction. If you're sitting in front of a computer that you're using for something the U.S. government has significant interest in prosecuting, that device should be considered compromised and adversarial - you should act accordingly. https://www.wired.com/2017/03/feds-rather-drop-child-porn-case-give-exploit/ https://www.wired.com/2017/03/feds-rather-drop-child-porn-ca... Edit, pulling up from the threads below: Tor is just a layer. You still have to take measures to separate your identity from the device, the behavior, and the location. When tor falls, the next question is "what do they see?" You have control over that.
- PartiallyTyped 4y ago
  Is there really any way to hide from a motivated state actor? Asking about it on HN is definitely not one. Relevant xkcd: 538 [1] [1] https://xkcd.com/538/ https://xkcd.com/538/
  - Jerrrry 4y ago
    No. Which is why Agora marketplace, digital lawyers, and a slew of others have simply said: "we no longer operate under any assumption of privacy regardless of measures taken, and have simple refused to operate on the internet any longer." Which is what the 3 letters want, a chilling-effect to reduce their Herculean-effort to just an Athenian one.
    - danuker 4y ago
      Physical measures might make yourself much more expensive to surveil, to the point of not being worth it. You can avoid being the "easy picking".
lofaszvanitt 4y ago
There were rumors that Tor is run by the FBI... who knows :D.
- commandlinefan 4y ago
  It was created by the U.S. Department of Defense, so there's that...
anthk 4y ago
Tor Browser by default it's useless, as it enables Javascript. Links+ with 127.0.0.1:9050 as the Socks4a proxy, enforcing everything connected into proxies (it has a setting for TOR) and not allowing cookies would be a safer option.
fIREpOK 4y ago
[dead]
anonu 4y ago
This was fascinating, 10 years old now: https://www.theguardian.com/world/interactive/2013/oct/04/tor-stinks-nsa-presentation-document https://www.theguardian.com/world/interactive/2013/oct/04/to... If you had 10 years and the resources of the US Government, I am sure Tor has been broken many times over now...
UltraViolence 4y ago
I doubt the Tor user was identified on the Tor network. Most likely his Bitcoin donations gave him away, since Bitcoin is far from anonymous. He might also have left other clues such as an email address which he accessed from clearnet. Anyway, it's pretty obvious LEA cannot identify Tor users en-masse. There have been several CP websites taken down which had hundreds of thousands of users, yet they only managed to arrest the website administrators. Only a handful of users were arrested, and mostly because of dumb mistakes.
lysergia 4y ago
I have a Glinet[0] router that has Tor functionality and 'torifies' your connection, so even if there's some JS 0day that executes trying to decloak me, the adversary just gets a Tor IP instead of my home connection IP. Note: I connect to Tor from my torified Glinet router which is doing Tor-over-Tor which is considered 'dangerous'[1] but I do it anyway. This might be overkill for most, and I'm not doing anything illegal (I mostly browse clearnet sites instead of hidden services anyways). [0] https://www.gl-inet.com/ https://www.gl-inet.com/ [1] https://tor.stackexchange.com/questions/427/is-running-tor-over-tor-dangerous https://tor.stackexchange.com/questions/427/is-running-tor-o...
- 0xCMP 4y ago
  If you read through the 10 year old presentation linked[0] you'll see they have ways to break just running over Tor. You really need to be running Tor on the machine, possibly via a VPN (like Mullvad or VPS+Wireguard/SSH), and either using Tor Browser, Whonix/Tails, or QubesOS. My (updated) understanding is that running all things via Tor is slow without as much benefit as just a normal VPN and that if anything you use throw away VMs or Tor Browser sessions to avoid any way to correlate. Also note that a well known attack is simply knowing a connection is currently happening (preferably a long-running one) and cutting off the internet in suspected areas until the connection drops. So I guess either you need to avoid long running connections (I think you could do this in the local firewall?) or have redundant network connections like Dual ISP or ISP + LTE on something like Opnsense (cause wow, is it difficult to do this on Linux. I intend to blog about it someday soon). [0]: https://www.theguardian.com/world/interactive/2013/oct/04/tor-stinks-nsa-presentation-document https://www.theguardian.com/world/interactive/2013/oct/04/to...
- meep0l 4y ago
  Out of curiosity, what is the benefit of using Tor just to browse legal clearnet sites?
  - tylersmith 4y ago
    Privacy. The con is a very annoying latency.
charcircuit 4y ago
It's very important to note that according to this document the FBI was able to both - Obtain the person's IP - Decrypt the person's traffic to see what pages they visited I honestly do not believe the second is possible so it makes me question the validity of the first. I have a feeling Tor itself wasn't the issue, but rather something else.
permo-w 4y ago
if you’re surprised that the US government can identify TOR users, then you should look up who primarily funds the TOR foundation
- HackerNCoder 4y ago
  Oh oh I know! 38% the US government, 36% individual donors (people like me), 16% private foundations, 5% other (not US) governments, 9% corporations and 1.5% "other" https://blog.torproject.org/transparency-openness-and-our-2020-and-2021-financials/ https://blog.torproject.org/transparency-openness-and-our-20...
  - permo-w 4y ago
    exactly. this isn’t to say that US agencies have backdoors written into TOR per se, but they have had TOR delay the patching of exploits in order to achieve the same end
    - HackerNCoder 4y ago
      And where is the proof of that? Just because someone gives money to the Tor Project doesn't mean they get to tell them exactly what to do.
      - permo-w 4y ago
        I'll put it like this: if parts of the US government are using exploits to de-anonymise TOR users, which is hard to dispute, and they're funding the TP, which they are and always have done, and they're the US government, which has never had any qualms about interfering with companies that aren't funded by them, never mind ones that are, why do you think they wouldn't delay patches in order to maintain an exploit? the US collective funds TOR so that they can exert control over the field of play, or even just keep it in sight. perhaps that control is relatively small and only used in extremely high-profile cases, but that's more useful than nothing at all it's a parenting paradigm: it's safer for your kids to drink at home than out at a bar or in a park somewhere, because at least at home you can keep an eye on things
googlryas 4y ago
Instead of tor, would it just be safer to vpn into a hostile nation's services and browse openly from there?
Synaesthesia 4y ago
Nobody here mentioning I2P, it's a good alternative to Tor, and it's not designed but the US Navy!
zxcvbn4038 4y ago
I think a lot of this has been covered elsewhere before: - when using tor you should disable javascript because a malicious or compromised site can use javascript to do non-tor stuff that potentially compromises your location. (can be a big pill to swallow, web without javacript is very 90s) - Run torbrowser within a secure VM or separate device using Tails to minimize your activity footprint - Use a VPN when connecting to TOR (I also put my TOR services behind their own VPN so even if the entry point is known you can't get the origin IP from it) - As an added protection I use firewall rules to ensure that only the tor client process can communicate out, any other attempt to send or receive traffic to the public internet gets dropped.
- sillystuff 4y ago
  Firefox supports proxy via unix domain socket and tor daemon supports unix sockets too, so you can setup torbrowser in a VM/container without any network access to add additional safety against leaks. The sole communication channel to the tor daemon via unix socket(s). For vm, use virtfs/9p to share between the daemon and browser, for container just bind mount it. To allow torbrowser to control the tor daemon, you can use socat as a proxy over an additional unix socket since tor's control port does not directly support using a unix socket. The whonix project has good info on the environment variables you will need to set to get the torbrowser to play nice with an external tor daemon, so you do not need to resort to tor over tor which will make your traffic stand out. https://github.com/Whonix/anon-ws-disable-stacked-tor/blob/master/usr/libexec/anon-ws-disable-stacked-tor/torbrowser.sh https://github.com/Whonix/anon-ws-disable-stacked-tor/blob/m... IMO, torbrowser, on platforms that support it, should separate daemon and browser by default, with browser in a separate network namespace with no network interfaces. But, if zero day in tordaemon, and your adversary is US gov't or other well resourced organization, it is probably still game over. Not to mention NSA scale traffic analysis that Schneier seems to be suggesting as a possibility here, which can only be defended against by only using Internet access that can never be tracked back to you. For downloading bookwares off libgen, the above mitigation is probably sufficient, though, if not a bit overkill.
  - sillystuff 4y ago
rocket_surgeron 4y ago
Running a TOR node to fight for "freedom" is like handing out plutonium to laypersons so they can fight nuclear proliferation. Everyone daydreams of activists and journalists but really they're only enabling child pornographers and methamphetamine dealers.
- 93po 4y ago
  At some point I am confident that the mainstream use of the internet will evolve into something very similar to Tor. It will protect user privacy in ways that can't be defeated without machine access/user idiocy. We will look back on the days of our ISPs logging every single action we take, into perpetuity, to be forever used against you, as the dark ages.
psychlops 4y ago
For all we know at this point the ISIS website could have been hosted by the FBI.
stuckkeys 4y ago
That is why I use a VPN provided by FBI so they think one of their own is doing research haha. Also this is how you get free security 24/7. Tor was broken a while back. Not sure why anyone would think it is a safe/private/secure. Your ISP is always rattin you out.
_0nel 4y ago
Bro probably used Tor in Brave browser…
jfthfthfthfth 4y ago
[dead]
deleted 4y ago
[deleted]
jbirer 4y ago
I always imagined that FBI / CIA was using Tor to sell the drugs they seized to fund their clandestine operations.
throwaway67743 4y ago
There are known ways to de-anomymise tor users, but the article doesn't mention these are known (probing for alternative unhandled routes like non TCP) but also js etc can be used to recover real addresses etc. Omission of facts is a bit misleading unfortunately.
fleddr 4y ago
Not related to Tor, but food for thought regarding anonymity... Quite a few people online wear multiple masks. You're that wonderful professional on linkedin with your full name on display, the ideal grandson on Facebook, but also a Twitter shitposter and toxic gamer under the disguise of anonymity. Its worthwhile to consider the anonymous version of you. I'm imagining that it won't take long before a few dots can be connected. Not by the FBI, surely they already can, but as a public service. AI reverse engineering your clicks, writing style, whatever other input. Meaning, if there's a "socially less accepted" version of you, do worry. It seems inevitable to me that they ultimately get linked back to your true identity. And to be clear, this isn't just about a burner account to let off some steam. Anonymity is also used to freely criticize employers, political ideas, the establishment in authoritarian regimes, and it's an essential defense for people/groups that are often the target of harassment. To illustrate how easily this can go wrong, recently a giant Twitter dump resurfaced. It turned out to be a cleaned up 2 year old file, but it did send a lot of people into a moral panic. Specifically, some made the mistake to link their real identifiable email address to their burner account. The bottom line is that anonymity is fragile and unlikely to last.

427 points by mikece 4y ago

deleted 4y ago

[deleted]

Original article this is referencing: https://www.vice.com/en/article/z34dx3/fbi-wont-say-hacked-dark-web-isis-site-nit https://www.vice.com/en/article/z34dx3/fbi-wont-say-hacked-d... And the relevant court document: https://www.documentcloud.org/documents/23569961-motion-to-reconsider-hsd-order https://www.documentcloud.org/documents/23569961-motion-to-r...

flotzam 4y ago
Direct link to the PDF (because DocumentCloud's web viewer appears to be down): https://s3.documentcloud.org/documents/23569961/motion-to-reconsider-hsd-order.pdf https://s3.documentcloud.org/documents/23569961/motion-to-re...
- screwturner68 4y ago
  Seems like this is a case of the government saying "trust us". They noted two ways that the feds could have gotten the IP address but how about a third, they targeted the guy and got the IP address from the ISP and said "look!, we found our guy" -occams razor.
  - richbell 4y ago
    Wouldn't they need to know who he is before they could target him and acquire his IP? Unless your suggesting parallel construction?
    - screwturner68 4y ago
      I read the doc and it seems like the case is built on information gathered by the government but they won't say how. They don't want to say how because it's supposed to be a national security issue, which is understandable but not how our legal system works (or should work). They are saying that they got his IP via tor and that that IP address went to ISIS websites, but again they won't say how they have this information they are just saying "trust us". I'm saying that if they had targeted this individual, the feds thought he was up to something but had no real evidence, it would be really easy to find this guys IP address and then say he went to X website and he needs to go to jail -but we can't tell you how we found this out. Do you see where the problem is? We still have due process in this country or at least we're supposed to.
      - richbell 4y ago
        > I'm saying that if they had targeted this individual, the feds thought he was up to something but had no real evidence, it would be really easy to find this guys IP address and then say he went to X website and he needs to go to jail -but we can't tell you how we found this out. Do you see where the problem is? We still have due process in this country or at least we're supposed to. Yeah, it's been a problem for a while now. I do think you're referring to Parallel Construction, a.k.a. evidence laundering. https://en.m.wikipedia.org/wiki/Parallel_construction https://en.m.wikipedia.org/wiki/Parallel_construction
        screwturner68 4y ago
        TDIL -parallel construction
Ajedi32 4y ago
Even leaving aside the question of whether the FBI actually compromised Tor, or just did something way more mundane like infect the defendant's PC with malware, the linked court document is really interesting. Not only does the FBI decline to say how they determined what IP address the defendant used to access the Tor hidden service, but they're also trying to hide the fact that the defendant asked to see that information by requesting the court label the defendant's court filing itself a "highly sensitive document"? And the court granted that request? Is that normal? It seems really bizarre to me, but I'm not a lawyer.
- advisedwang 4y ago
  If becomes widely known that the government can de-cloak Tor users, that will change the behaviour of their targets and so hurt their surveillance, so it's fairly common that the government wants to hide this fact. (same with stingrays, for example). But just wanting to keep it secret is not enough. So they will claim that this has national security implications, saying some targets are terrorists. And courts defer very heavily to the government in this area, so the FBI might be successful. Because just knowing that there is a break is enough to tip someone off, the FBI can and courts likely would classify a request for details as well as the details themselves.
  - geepound 4y ago
    >If becomes widely known that the government can de-cloak Tor users, that will change the behaviour of their targets and so hurt their surveillance, so it's fairly common that the government wants to hide this fact. (same with stingrays, for example). As was discussed verbally at Defcon, a huge chunk of the exit nodes are either in the US or EU. Same for guards. (The whole GCHQ vs several EU countries trying to do intel in parallel without a shared intelligence agency thing is perpetually amusing.)
    - mr_woozy 4y ago
      [dead]
dang 4y ago
Ok, we've changed the URL to that from https://www.schneier.com/blog/archives/2023/01/the-fbi-identified-a-tor-user.html https://www.schneier.com/blog/archives/2023/01/the-fbi-ident.... Schneier's title seems more HN-friendly so I've kept it.

generalizations 4y ago

I wonder if this is going to be confirmation that a large fraction of Tor nodes are in fact run by the FBI.

Buffout 4y ago
So what if they were? Only exit node see the message (encrypted or not). And it doesn't know where it originated. I speculate this is most likely case of a ISIS server run by FBI.
- gizmo686 4y ago
  If you control both exit and entrance nodes, you can corralate connections with a timing analysis.
  - Buffout 4y ago
    I don't think that is how timing analisis works. User can say to "entrance node" that it is also a node and that is how it can deny that it is originator. "Entrance node" doesn't know its position in a chain. Only Exit node knows its position.
    - electroly 4y ago
      I don't think that's totally true. At least, it's maybe superficially true but not in a real world sense. The entry node can see your IP by virtue of the incoming TCP connection and it's not hard to figure out if an IP is a Tor relay or not. The list of known relays is a list that you can just go and get. If it's not a relay, then it's a client, and you're the entry node.
      - deleted 4y ago
        [deleted]
      - Buffout 4y ago
        No, this is not the timing attack I was thinking of. Your version of timing attack comes from inside tor network and that is solved by Entry Guards. And besides you can also be Tor relay and a client. This attacks are just bugs that are fixed. The real timing attack that is not fixed and will not be (it is not in threat model), is when your ISP works with police (that has warrant) and gives them data. And police also controls server or exit node.

Mizza 4y ago

More troubling - is it a crime to visit a website which begs donations for an illegal cause?

donkeyd 4y ago
No, it isn't. That's not what he was charged for, it's just one piece of evidence in the case: > “From Mr. Al-Azhari’s attempt to acquire firearms through unlawful channels to his desire to provide material support to a designated foreign terrorist organization, it was clear Mr. Al-Azhari’s intention was to carry out an act of violence,” > According to the complaint, Al-Azhari was an ISIS supporter who planned and attempted to carry out an attack on behalf of that terrorist organization. Al-Azhari, who has a criminal history that includes prior terrorism charges in Saudi Arabia, attempted to purchase multiple firearms over the course of the investigation, before acquiring a Glock pistol and a silencer. He also expressed admiration for Pulse nightclub shooter Omar Mateen and spoke of his desire to carry out a similar mass casualty shooting. Additionally, Al-Azhari researched and scouted potential targets in the Tampa area, including Honeymoon Island. He also rehearsed portions of an attack and the statements that he would make during or in connection with such an attack.
- SamoyedFurFluff 4y ago
  I’m interested what the case law is for arresting someone for intent to perform a heinous act. I’ve heard a lot from stalking victims and the like that often times police will refuse to do anything until the stalker has assaulted or murdered the victim in question, despite clear indications the stalker is actively planning to do harm.
  - chopin 4y ago
    Wait until the victim is someone powerful.
  - deleted 4y ago
    [deleted]
  - maxlybbert 4y ago

Tepix 4y ago

It could also be that they had backdoored his PC earlier, right?

dncornholio 4y ago
It could also be they just checked his browsing history..
Miner49er 4y ago
Could be a lot of things. Could be the FBI runs the site and specifically targeted him. Or they run the site and it has some sort of browser exploit. I'm guessing the first though. That they set up the site specifically to target him. The rest of the investigation involves them running eBay accounts to sell him weapons and such. Seems like the whole investigation was borderline entrapment to be able to arrest him on something.
- closewith 4y ago
  It's not close to entrapment, unless the FBI coerced the accused.

KingLancelot 4y ago

The feds run all the entrance and exit nodes. Tor was created by the feds for spies to use, then they made it public yo hide the traffic. This is the official story that everyone has evidently forgotten.

sweetbitter 4y ago
Not quite. The guy who wrote Tor can be clearly seen to have been studying a lot of these things in the later 90s, and it was pretty much always public, but only developed after he got the Navy to get him an NSF grant. Hell, in one slide he had made back then, he was even well-aware of some of the fundamental vulnerabilities in the protocol, and the (still too expensive) mitigations for those flaws, so it can't even be said that anything was concealed. If we go back further to the original concept of chained anonymous remailers as envisioned by Chaum 40 years ago, it gets even harder to claim something like this.
stuckkeys 4y ago
Source? or you just speculating?
- DoItToMe81 4y ago
  There is no source. It is nonsense.
wrycoder 4y ago
Well, not all the exit nodes by now. But many of them. Most people are probably leery of running an exit node, because its traffic is in the clear (modulo ssh) and often connects to disparate and shady servers.
- ramesh31 4y ago
  This is what I've never understood about Tor. What possible incentive does anyone have to run an exit node? Seems like nothing but a liability for some extremely awful stuff.

DoItToMe81 4y ago

I wouldn't get so excited about this. There have been tons of javascript exploits to leak IP addresses in the past, it's more likely that than the FBI running thousands of servers.

Ajedi32 4y ago
Or even something way simpler, like the FBI secretly compromising the user's PC with malware prior to the arrest. Without more detail it's impossible to know whether this is even news.
- Ajedi32 4y ago
  Out of curiosity, will we get more detail? Presumably the FBI would need to reveal to somebody how they obtained this information in order for it to be admissible as evidence ("he did this, trust us" probably won't fly in court), but is there a legal means by which they could do that without revealing their exact methods to the general public? (I don't actually know what the law says on this subject.)
  - nostrademons 4y ago
    Parallel construction. They use their real methods to identify the user, then once they know the user, specifically target them with simpler known methods to build evidence for the case. In the court filing, they present evidence that they've gained through known methods which don't work all that well unless you already have a suspect, but they actually caught the suspect using methods that are not public (and won't become so, unless there's an internal leak at the FBI).
    - Ajedi32 4y ago
      But if they were using parallel construction, surely the criminal complaint wouldn't make claims they can't prove using the non-secret chain of evidence, right? Here the court filing alleges that the FBI knows what IP address the defendant used to visit a Tor hidden service. Don't they now have to prove that claim if they want the prosecution to succeed?

causi 4y ago

I will never understand people who do illegal things over their own IP. Is it really that hard to find an open access point? Way back in the day when I torrented all my content I used a long-range wifi antenna connected to a public AP and a dedicated PC with a scrubbed drive that never connected to my home network.

deleted 4y ago
[deleted]
LastTrain 4y ago
So you did illegal things illegally. And who owned the public AP? Someone not as smart as you? You sure?
- causi 4y ago
  So you did illegal things illegally. Yep. I said I don't understand people who do illegal things over their own connection, i.e., stupidly. And who owned the public AP? McDonald's.
  - hinata08 4y ago
    using such setup wouldn't prevent anyone from finding you if you did illegal things that really mattered, like donating to a terrorist organization you can proudly use it to download torrents (because nobody cares and the feds won't triangulate a signal for torrents), but they can definitely do it for terrorism and intelligence matters. (check out all the stories of spies who had radios, from the 1914 to SOE to cold war) As a bonus, you even post your story on HN, a site where analysts from all the governments and major companies of the planet meet to talk about tech... this guy was probably more careful than you
  - VWWHFSfQ 4y ago
    McDonald's has video cameras pointing at every inch of their property 24/7. All they need is a timestamp from the AP and they'll go find your license plate in the parking lot on the surveillance tapes.

nibbleshifter 4y ago

Sounds like his box was compromised, possibly by owning the site he visited first. The FBI has done this before - inject a browser exploit into a site they compromised to identify its users.

DarkmSparks 4y ago
yep, this, I ran a tor webserver for discussing geopolitics with friends on a pi for a few months before finding it had been compromised. that was shortly after intel exchange had been taken down. Tor services just arent secure in any sense imho. especially not from the people who wrote them. sigh.
- titaniumtown 4y ago
  > for discussing geopolitics with friends on a pi for a few months before finding it had been compromised. that's very suspicious
  - DarkmSparks 4y ago
    now mostly fall back on cryptome.org dont get the more juicy military stuff, but it's much less effort.
- Run_DOS_Run 4y ago
  >I ran a tor webserver for discussing geopolitics with friends on a pi for a few months before finding it had been compromised. Not the fault of Tor. HSDir nodes could snoop on announced v1 .onion adresses. This isn't the case anymore for Onion v2 addresses. But even if an attacker has the onion address of your webserver, he needs a way to compromise it. Either through a vuln in your website or your webserver.
  - nibbleshifter 4y ago
    A vuln in the webserver is the usual way, I used to collect and scan .onion domains for misconfiguration issues a few years ago. You would be amazed how many admins leave shit like PHPMyAdmin wide open.

0xbadcafebee 4y ago

Isn't all propaganda unofficial? It's not like there's a stamp on it ("This Propaganda was Approved by the Secretary of Media for the Islamic State"). Don't be fooled by that counterfit propaganda! Only buy the real deal!

Freak_NL 4y ago
Not at all. States can produce their own (and thus official) propaganda, but affiliates or supporters can do so on their own as well (unofficial). When the ambassador of some country purchases advertising space in a national newspaper in the country they are stationed in and uses that to publish a letter or pamphlet, then that is likely officially sanctioned propaganda (the Chinese ambassador did this in the Netherlands to present the official Chinese view on certain matters related to China debated in Dutch media some years ago). That particular instance literally came with the stamp of approval (or rather the ambassador's signature).
deleted 4y ago
[deleted]

privacywiki 4y ago

If the user's data passes through nodes owned by one entity or their partners in this case NSA, FBI, GCHQ etc, it's going to be quite easy to find the origin IP...

optimalsolver 4y ago

I keep saying this, but the inescapable fact about Tor is that its traffic patterns make you stand out prominently. Just the fact you’re using it automatically makes you interesting and worthy of a closer look. All well and good if you’re just maintaining a cookie recipe site on the dark web, but it’s rarely ever that, is it?

xnorswap 4y ago
Is your intention in repeating that to keep Tor usage below the critical threshold where that remains true?
- notyourwork 4y ago
  I interpret op to be suggesting Tor isn’t as anonymous of one who conducts illicit activity would assume. That seems to be the trend time and time again.
- likpok 4y ago
  Tor has a lot of pretty gnarly trade offs that will naturally keep usage low outside of people who really need it. The latency is nontrivial, exit nodes are congested and lots of sites don’t want to deal with Tor because so much abuse flows through it. Tor definitely has a similar problem to like voat or gab: a community with a strict no-witch-burning philosophy ends up filled with witches.
- DougN7 4y ago
  Realistically, what would need to happen for it to not be the case? How many millions or billions of people would have to use it before the government would give up and stop looking at you if you use it?
  - noirscape 4y ago
    In order for that to happen you first need to convince people to either accept the hit in connection speed (which is terrible over TOR) or you need to significantly increase the amount of nodes on the network, the latter of which isn't going to happen because of the legal risks, which act as a chilling effect.

checkyoursudo 4y ago

A person might still use Tor because they would rather have only the Feds know what porn they look at rather than have the Feds and everyone else know what porn they look at.

adenozine 4y ago

From Bruce of all people, this is a wildly provocative, unsubstantiated claim about routine takedown behavior from the feds. I mean, nobody hates the gov side of the cryptography wars more than me, but this type of article is well below table-stakes for discussion. Especially by legendary professionals of repute like Bruce. It's very disappointing to me. The price of clicks truly deconstructs the modern man's integrity...

monero-xmr 4y ago
Bruce has also been hardcore anti-cryptocurrency. From a pure cryptography perspective the innovations around zero knowledge proofs are very intriguing and it’s highly unlikely they would have happened as quickly without the monetary benefit of cryptocurrency pushing such research forwards. However Bruce is an extreme statist, and if he had his way I’m sure all cryptography would be backdoored.
- czx4f4bd 4y ago
  Really? Bruce is pro-backdoor? Where's that pro-backdoor advocacy in this essay from 2013 on evading NSA surveillance and warning about the risk of backdoored cryptography? https://www.schneier.com/essays/archives/2013/09/nsa_surveillance_a_g.html https://www.schneier.com/essays/archives/2013/09/nsa_surveil... Or this essay from 2016 arguing that backdoors sabotage security? https://www.schneier.com/essays/archives/2016/04/the_value_of_encrypt.html https://www.schneier.com/essays/archives/2016/04/the_value_o... Or this essay from 2019 decrying yet another effort to backdoor encryption? https://www.schneier.com/blog/archives/2019/12/scaring_people_.html https://www.schneier.com/blog/archives/2019/12/scaring_peopl...
  - monero-xmr 4y ago
    This is, without a doubt, the craziest thing I have ever seen pushed out by a someone who purports to know something about cryptography, law, and political advocacy: https://www.lawfareblog.com/tornado-cash-not-free-speech-its-golem https://www.lawfareblog.com/tornado-cash-not-free-speech-its... Schneier has gone off the deep end

MuffinFlavored 4y ago

can you not use nordvpn first, then tor?

warinukraine 4y ago
Mullvad, please. nordvpn has been acquired by some private equity that's acquiring all the vpns.
- MuffinFlavored 4y ago
  do you agree based on your understand that if this TOR user had used Mullvad VPN services (or equivalent) he would've been fine/not detected by the FBI?
  - haakon 4y ago
    If FBI really has compromised Tor, there's no reason to believe they would be helpless against a VPN service.
- sekai 4y ago
  Source? NordVPN was and is owned by Tesonet.
- nick__m 4y ago
  I know that Nord Security the company that own nordvpn has acquired AtlasVPN and I also know that the VPN market is quite concentrated, 7 companies owns dozens of brands. I would like information on those acquisitions... have I missed some important news? I would like to know because NordVPN, while not as hardcore on privacy as mullvad, is still providing a useful service for protection against an untrusted wifi and geofence jumping.

xwdv 4y ago

Only whitelist Tor nodes that you have personally vetted. Always double vpn.

stuckkeys 4y ago
Double vpn is only going to give them an additional bump. Still detectable.

r3trohack3r 4y ago

I have second hand knowledge of lawsuits that have been dropped by the FBI during discovery because it would require them revealing zero days they have on Tor. Recently this has started getting increasing levels of press exposure[1] including in CSAM cases. The FBI has also continued to run CSAM websites after takeover to collect intel, and likely run honeypots for other content. If your adversary is a state actor, particularly the U.S., tor alone is not sufficient for anonymity. It's fairly safe to assume they have the ability to deanonymize you. Your only safety net, it seems, is the value of other targets relative to you when it comes to them burning their "golden ticket" zero day. And even then, you're at risk of parallel construction. If you're sitting in front of a computer that you're using for something the U.S. government has significant interest in prosecuting, that device should be considered compromised and adversarial - you should act accordingly. https://www.wired.com/2017/03/feds-rather-drop-child-porn-case-give-exploit/ https://www.wired.com/2017/03/feds-rather-drop-child-porn-ca... Edit, pulling up from the threads below: Tor is just a layer. You still have to take measures to separate your identity from the device, the behavior, and the location. When tor falls, the next question is "what do they see?" You have control over that.

PartiallyTyped 4y ago
Is there really any way to hide from a motivated state actor? Asking about it on HN is definitely not one. Relevant xkcd: 538 [1] [1] https://xkcd.com/538/ https://xkcd.com/538/
- Jerrrry 4y ago
  No. Which is why Agora marketplace, digital lawyers, and a slew of others have simply said: "we no longer operate under any assumption of privacy regardless of measures taken, and have simple refused to operate on the internet any longer." Which is what the 3 letters want, a chilling-effect to reduce their Herculean-effort to just an Athenian one.
  - danuker 4y ago
    Physical measures might make yourself much more expensive to surveil, to the point of not being worth it. You can avoid being the "easy picking".

lofaszvanitt 4y ago

There were rumors that Tor is run by the FBI... who knows :D.

commandlinefan 4y ago
It was created by the U.S. Department of Defense, so there's that...

anthk 4y ago

Tor Browser by default it's useless, as it enables Javascript. Links+ with 127.0.0.1:9050 as the Socks4a proxy, enforcing everything connected into proxies (it has a setting for TOR) and not allowing cookies would be a safer option.

fIREpOK 4y ago

[dead]

anonu 4y ago

This was fascinating, 10 years old now: https://www.theguardian.com/world/interactive/2013/oct/04/tor-stinks-nsa-presentation-document https://www.theguardian.com/world/interactive/2013/oct/04/to... If you had 10 years and the resources of the US Government, I am sure Tor has been broken many times over now...

UltraViolence 4y ago

I doubt the Tor user was identified on the Tor network. Most likely his Bitcoin donations gave him away, since Bitcoin is far from anonymous. He might also have left other clues such as an email address which he accessed from clearnet. Anyway, it's pretty obvious LEA cannot identify Tor users en-masse. There have been several CP websites taken down which had hundreds of thousands of users, yet they only managed to arrest the website administrators. Only a handful of users were arrested, and mostly because of dumb mistakes.

lysergia 4y ago

I have a Glinet[0] router that has Tor functionality and 'torifies' your connection, so even if there's some JS 0day that executes trying to decloak me, the adversary just gets a Tor IP instead of my home connection IP. Note: I connect to Tor from my torified Glinet router which is doing Tor-over-Tor which is considered 'dangerous'[1] but I do it anyway. This might be overkill for most, and I'm not doing anything illegal (I mostly browse clearnet sites instead of hidden services anyways). [0] https://www.gl-inet.com/ https://www.gl-inet.com/ [1] https://tor.stackexchange.com/questions/427/is-running-tor-over-tor-dangerous https://tor.stackexchange.com/questions/427/is-running-tor-o...

0xCMP 4y ago
If you read through the 10 year old presentation linked[0] you'll see they have ways to break just running over Tor. You really need to be running Tor on the machine, possibly via a VPN (like Mullvad or VPS+Wireguard/SSH), and either using Tor Browser, Whonix/Tails, or QubesOS. My (updated) understanding is that running all things via Tor is slow without as much benefit as just a normal VPN and that if anything you use throw away VMs or Tor Browser sessions to avoid any way to correlate. Also note that a well known attack is simply knowing a connection is currently happening (preferably a long-running one) and cutting off the internet in suspected areas until the connection drops. So I guess either you need to avoid long running connections (I think you could do this in the local firewall?) or have redundant network connections like Dual ISP or ISP + LTE on something like Opnsense (cause wow, is it difficult to do this on Linux. I intend to blog about it someday soon). [0]: https://www.theguardian.com/world/interactive/2013/oct/04/tor-stinks-nsa-presentation-document https://www.theguardian.com/world/interactive/2013/oct/04/to...
meep0l 4y ago
Out of curiosity, what is the benefit of using Tor just to browse legal clearnet sites?
- tylersmith 4y ago
  Privacy. The con is a very annoying latency.

charcircuit 4y ago

It's very important to note that according to this document the FBI was able to both - Obtain the person's IP - Decrypt the person's traffic to see what pages they visited I honestly do not believe the second is possible so it makes me question the validity of the first. I have a feeling Tor itself wasn't the issue, but rather something else.

permo-w 4y ago

if you’re surprised that the US government can identify TOR users, then you should look up who primarily funds the TOR foundation

HackerNCoder 4y ago
Oh oh I know! 38% the US government, 36% individual donors (people like me), 16% private foundations, 5% other (not US) governments, 9% corporations and 1.5% "other" https://blog.torproject.org/transparency-openness-and-our-2020-and-2021-financials/ https://blog.torproject.org/transparency-openness-and-our-20...
- permo-w 4y ago
  exactly. this isn’t to say that US agencies have backdoors written into TOR per se, but they have had TOR delay the patching of exploits in order to achieve the same end
  - HackerNCoder 4y ago
    And where is the proof of that? Just because someone gives money to the Tor Project doesn't mean they get to tell them exactly what to do.
    - permo-w 4y ago
      I'll put it like this: if parts of the US government are using exploits to de-anonymise TOR users, which is hard to dispute, and they're funding the TP, which they are and always have done, and they're the US government, which has never had any qualms about interfering with companies that aren't funded by them, never mind ones that are, why do you think they wouldn't delay patches in order to maintain an exploit? the US collective funds TOR so that they can exert control over the field of play, or even just keep it in sight. perhaps that control is relatively small and only used in extremely high-profile cases, but that's more useful than nothing at all it's a parenting paradigm: it's safer for your kids to drink at home than out at a bar or in a park somewhere, because at least at home you can keep an eye on things

googlryas 4y ago

Instead of tor, would it just be safer to vpn into a hostile nation's services and browse openly from there?

Synaesthesia 4y ago

Nobody here mentioning I2P, it's a good alternative to Tor, and it's not designed but the US Navy!

zxcvbn4038 4y ago

I think a lot of this has been covered elsewhere before: - when using tor you should disable javascript because a malicious or compromised site can use javascript to do non-tor stuff that potentially compromises your location. (can be a big pill to swallow, web without javacript is very 90s) - Run torbrowser within a secure VM or separate device using Tails to minimize your activity footprint - Use a VPN when connecting to TOR (I also put my TOR services behind their own VPN so even if the entry point is known you can't get the origin IP from it) - As an added protection I use firewall rules to ensure that only the tor client process can communicate out, any other attempt to send or receive traffic to the public internet gets dropped.

sillystuff 4y ago
Firefox supports proxy via unix domain socket and tor daemon supports unix sockets too, so you can setup torbrowser in a VM/container without any network access to add additional safety against leaks. The sole communication channel to the tor daemon via unix socket(s). For vm, use virtfs/9p to share between the daemon and browser, for container just bind mount it. To allow torbrowser to control the tor daemon, you can use socat as a proxy over an additional unix socket since tor's control port does not directly support using a unix socket. The whonix project has good info on the environment variables you will need to set to get the torbrowser to play nice with an external tor daemon, so you do not need to resort to tor over tor which will make your traffic stand out. https://github.com/Whonix/anon-ws-disable-stacked-tor/blob/master/usr/libexec/anon-ws-disable-stacked-tor/torbrowser.sh https://github.com/Whonix/anon-ws-disable-stacked-tor/blob/m... IMO, torbrowser, on platforms that support it, should separate daemon and browser by default, with browser in a separate network namespace with no network interfaces. But, if zero day in tordaemon, and your adversary is US gov't or other well resourced organization, it is probably still game over. Not to mention NSA scale traffic analysis that Schneier seems to be suggesting as a possibility here, which can only be defended against by only using Internet access that can never be tracked back to you. For downloading bookwares off libgen, the above mitigation is probably sufficient, though, if not a bit overkill.
- sillystuff 4y ago

rocket_surgeron 4y ago

Running a TOR node to fight for "freedom" is like handing out plutonium to laypersons so they can fight nuclear proliferation. Everyone daydreams of activists and journalists but really they're only enabling child pornographers and methamphetamine dealers.

93po 4y ago
At some point I am confident that the mainstream use of the internet will evolve into something very similar to Tor. It will protect user privacy in ways that can't be defeated without machine access/user idiocy. We will look back on the days of our ISPs logging every single action we take, into perpetuity, to be forever used against you, as the dark ages.

psychlops 4y ago

For all we know at this point the ISIS website could have been hosted by the FBI.

stuckkeys 4y ago

That is why I use a VPN provided by FBI so they think one of their own is doing research haha. Also this is how you get free security 24/7. Tor was broken a while back. Not sure why anyone would think it is a safe/private/secure. Your ISP is always rattin you out.

_0nel 4y ago

Bro probably used Tor in Brave browser…

jfthfthfthfth 4y ago

[dead]

deleted 4y ago

[deleted]

jbirer 4y ago

I always imagined that FBI / CIA was using Tor to sell the drugs they seized to fund their clandestine operations.

throwaway67743 4y ago

There are known ways to de-anomymise tor users, but the article doesn't mention these are known (probing for alternative unhandled routes like non TCP) but also js etc can be used to recover real addresses etc. Omission of facts is a bit misleading unfortunately.

fleddr 4y ago

Not related to Tor, but food for thought regarding anonymity... Quite a few people online wear multiple masks. You're that wonderful professional on linkedin with your full name on display, the ideal grandson on Facebook, but also a Twitter shitposter and toxic gamer under the disguise of anonymity. Its worthwhile to consider the anonymous version of you. I'm imagining that it won't take long before a few dots can be connected. Not by the FBI, surely they already can, but as a public service. AI reverse engineering your clicks, writing style, whatever other input. Meaning, if there's a "socially less accepted" version of you, do worry. It seems inevitable to me that they ultimately get linked back to your true identity. And to be clear, this isn't just about a burner account to let off some steam. Anonymity is also used to freely criticize employers, political ideas, the establishment in authoritarian regimes, and it's an essential defense for people/groups that are often the target of harassment. To illustrate how easily this can go wrong, recently a giant Twitter dump resurfaced. It turned out to be a cleaned up 2 year old file, but it did send a lot of people into a moral panic. Specifically, some made the mistake to link their real identifiable email address to their burner account. The bottom line is that anonymity is fragile and unlikely to last.