4 ms·

> The FBI also found what specific pages Al-Azhari visited, including a section on donating Bitcoin; another focused on military operations conducted by ISIS fi

> The FBI also found what specific pages Al-Azhari visited, including a section on donating Bitcoin; another focused on military operations conducted by ISIS fighters in Iraq, Syria, and Nigeria; and another page that provided links to material from ISIS’s media arm Based on what little I know of SSL, this suggests the server was compromised too? Or does tor do a bad job of certificate pinning? Edit: Or the clients are/were compromised. Or the suspect’s computer was compromised. Or they can somehow decrypt traffic between client and server.

donkeyd 4y ago
Unless I'm missing some info, I don't see anything that points at them finding all this info through Tor or the server. They identified the user AND 'also found what specific pages Al-Azhari visited'. That could've happened from his PC after they arrested him. Language like this is always ambiguous in order to give out as little information as possible while still providing some.
- Scoundreller 4y ago
  > That could've happened from his PC after they arrested him. Tor client wouldn’t save any of that.
  - deleted 4y ago
    [deleted]
  - thefreeman 4y ago
    he may not have been using the tor browser
michaelt 4y ago
> Based on what little I know of SSL, this suggests the server was compromised too? Not necessarily. If a passive snooper knows I used Tor Browser to make an SSL request to en.wikipedia.org and received 987,654 bytes then immediately made a SSL request to upload.wikimedia.org and received 1,234,567 bytes that might be enough information to work out I visited https://en.wikipedia.org/wiki/National_Security_Agency https://en.wikipedia.org/wiki/National_Security_Agency.
- Scoundreller 4y ago
  BRB, padding all of my webpages to be exactly 650mb each.
  - deleted 4y ago
    [deleted]
  - kylehotchkiss 4y ago
    npm install electron react-native-web
- Jerrrry 4y ago
  That size-inference side channel leak has been patched for years, random padding is added between hops to mitigate this. It is large files / DDoS going over the network that is still hard to obfuscate. Which is why TOR is intentionally slow, especially when requesting larger files. If it wasn't, you could watch the lump of data traverse across the pipe. source: n/a
  - HackerNCoder 4y ago
    source: padding spec, https://gitweb.torproject.org/torspec.git/tree/padding-spec.txt https://gitweb.torproject.org/torspec.git/tree/padding-spec....
    - Jerrrry 4y ago
      Thank you. My brain is very damp but knew it was somewhere.
- Run_DOS_Run 4y ago
  That's why Tor is communicating mostly over fixed-size cells with a fixed size of 514 bytes (or 512 if tor version < 4). There is also random padding added to cells, so that the cell content is unpredictable.

donkeyd 4y ago

Unless I'm missing some info, I don't see anything that points at them finding all this info through Tor or the server. They identified the user AND 'also found what specific pages Al-Azhari visited'. That could've happened from his PC after they arrested him. Language like this is always ambiguous in order to give out as little information as possible while still providing some.

Scoundreller 4y ago
> That could've happened from his PC after they arrested him. Tor client wouldn’t save any of that.
- deleted 4y ago
  [deleted]
- thefreeman 4y ago
  he may not have been using the tor browser

michaelt 4y ago

> Based on what little I know of SSL, this suggests the server was compromised too? Not necessarily. If a passive snooper knows I used Tor Browser to make an SSL request to en.wikipedia.org and received 987,654 bytes then immediately made a SSL request to upload.wikimedia.org and received 1,234,567 bytes that might be enough information to work out I visited https://en.wikipedia.org/wiki/National_Security_Agency https://en.wikipedia.org/wiki/National_Security_Agency.

Scoundreller 4y ago
BRB, padding all of my webpages to be exactly 650mb each.
- deleted 4y ago
  [deleted]
- kylehotchkiss 4y ago
  npm install electron react-native-web
Jerrrry 4y ago
That size-inference side channel leak has been patched for years, random padding is added between hops to mitigate this. It is large files / DDoS going over the network that is still hard to obfuscate. Which is why TOR is intentionally slow, especially when requesting larger files. If it wasn't, you could watch the lump of data traverse across the pipe. source: n/a
- HackerNCoder 4y ago
  source: padding spec, https://gitweb.torproject.org/torspec.git/tree/padding-spec.txt https://gitweb.torproject.org/torspec.git/tree/padding-spec....
  - Jerrrry 4y ago
    Thank you. My brain is very damp but knew it was somewhere.
Run_DOS_Run 4y ago
That's why Tor is communicating mostly over fixed-size cells with a fixed size of 514 bytes (or 512 if tor version < 4). There is also random padding added to cells, so that the cell content is unpredictable.