6 ms·

I wouldn't get so excited about this. There have been tons of javascript exploits to leak IP addresses in the past, it's more likely that than the FBI running t

I wouldn't get so excited about this. There have been tons of javascript exploits to leak IP addresses in the past, it's more likely that than the FBI running thousands of servers.

Ajedi32 4y ago
Or even something way simpler, like the FBI secretly compromising the user's PC with malware prior to the arrest. Without more detail it's impossible to know whether this is even news.
- Ajedi32 4y ago
  Out of curiosity, will we get more detail? Presumably the FBI would need to reveal to somebody how they obtained this information in order for it to be admissible as evidence ("he did this, trust us" probably won't fly in court), but is there a legal means by which they could do that without revealing their exact methods to the general public? (I don't actually know what the law says on this subject.)
  - nostrademons 4y ago
    Parallel construction. They use their real methods to identify the user, then once they know the user, specifically target them with simpler known methods to build evidence for the case. In the court filing, they present evidence that they've gained through known methods which don't work all that well unless you already have a suspect, but they actually caught the suspect using methods that are not public (and won't become so, unless there's an internal leak at the FBI).
    - Ajedi32 4y ago
      But if they were using parallel construction, surely the criminal complaint wouldn't make claims they can't prove using the non-secret chain of evidence, right? Here the court filing alleges that the FBI knows what IP address the defendant used to visit a Tor hidden service. Don't they now have to prove that claim if they want the prosecution to succeed?
      - CommitSyn 4y ago
        They also know what specific pages on the offending websites they accessed. I'm wondering if the classified document wasn't about tor, but about the 'implants' aka malware that were leaked in the same set of Snowden documents. I think as much as tor being broken in some fixable way, they'd like it known even less that the FBI installs malware on the devices of persons of interest who haven't been convicted of anything. If they truly can't break Tor and they deem the person of interest important enough for "national security" then I don't think anyone who has studied history, American or otherwise, believes that they are going to throw their hands up and say "welp, that's it."
        sidewndr46 4y ago
        Or in the case of Ross Ulbricht, just makes up a story about how he was trying to kill someone by suggesting the idea to him. Then uses that to justify an investigation that just happens to be a dead-end but conveniently gathers a bunch of other evidence that is relevant to another case.
    - edgyquant 4y ago
      Is there proof of anything like this or is it just a conspiracy theory you’re peddling?
      - mwint 4y ago
        Parallel construction is very real and common
      - moe091 4y ago
        I think it's commonly known, maybe not proven, but also it's a case of can they? yes. Would they? yes. As long as you agree with those two premises it's pretty likely
      - sidewndr46 4y ago
        Parallel construction is not a theory in any way in the US. It is a "decades old, a bedrock concept" according to the DEA. Outside the US, I have no idea.
        WarOnPrivacy 4y ago
        > Outside the US, I have no idea. Genealogists use parallel construction to build out their families. Data from a large variety of sources gets used to indicate and corroborate individuals.
      - pessimizer 4y ago
        Exclusive: U.S. directs agents to cover up program used to investigate Americans [2013] https://www.reuters.com/article/us-dea-sod-idUSBRE97409R20130805 https://www.reuters.com/article/us-dea-sod-idUSBRE97409R2013...
      - ThunderSizzle 4y ago
        It's rather annoying that the initial knee jerk reaction to any negative take on authoritarian government action is labeled as a conspiracy theory to try to discredit it. The CIA did a great job getting that word out there. It's sad it's used to dismiss credible and logical conclusions so readily.
- dmatech 4y ago
  Perhaps, but the only references I saw to 2019 in the criminal complaint[1] were with respect to Tor and his phone. I don't know if he was actually under surveillance that early or if this is just stuff they later found. While there are plenty of ways this guy could have attracted the attention of California, Florida, or federal law enforcement, it's entirely possible that seeing a US residential IP address is what started this case. I can't really tell without seeing dated search warrant applications. The latest PDF[2] states: In discovery, the Government has declined to provide any information related to its TOR operation. The Defense therefore researched and drafted a motion to compel such discovery. In the course of this research, the Defense discovered an exhibit filed on the public docket in at least two federal cases with similar issues (“Exhibit 2”). The document is partially redacted, purports to be the work of a U.S. government agency, and is marked “Top Secret.” Outside of these public docket filings, Exhibit 2 is widely available on public internet sources. A Google search for Exhibit 2’s title yields 102,000 results. All of the top results apparently provide the document itself, and most of these date back to 2013. That would likely be a reference to something leaked by Edward Snowden given the year mentioned. 1. https://www.justice.gov/opa/press-release/file/1279441/download https://www.justice.gov/opa/press-release/file/1279441/downl... 2. https://www.documentcloud.org/documents/23569961-motion-to-reconsider-hsd-order https://www.documentcloud.org/documents/23569961-motion-to-r...
  - flutas 4y ago
    > Perhaps, but the only references I saw to 2019 in the criminal complaint[1] were with respect to Tor and his phone. I don't know if he was actually under surveillance that early or if this is just stuff they later found. From a doc I found[0] he was under aerial surveillance (aka, the FBI Cesnas {related [1]}) since June 2018. Also some of the facts in the case are...well this is from doc [0]. > Some of the surveillance footage is itself incriminating. (See Doc. 5, pp. 50-51) (asserting that Mr. Alazhari’s travel on certain days in May 2020 shows that he was “scouting targets fora potential mass shooting attack.”). [0]: https://www.documentcloud.org/documents/21052490-motion-to-suppress-aerial-surveillance-evidence-in-us-vs-muhammed-momtaz-alazhari https://www.documentcloud.org/documents/21052490-motion-to-s... [1]: https://news.ycombinator.com/item?id=34109507 https://news.ycombinator.com/item?id=34109507
archontes 4y ago
Doesn't the tor browser disable javascript entirely?
- checkyoursudo 4y ago
  The user can enable javascript.
- DoItToMe81 4y ago
  It does not. Noscript is set by default to allow scripts.
  - deleted 4y ago
    [deleted]
- deleted 4y ago
  [deleted]
- jwilk 4y ago
  https://support.torproject.org/tbb/tbb-34/ https://support.torproject.org/tbb/tbb-34/ > We configure NoScript to allow JavaScript by default in Tor Browser because many websites will not work with JavaScript disabled. Most users would give up on Tor entirely if we disabled JavaScript by default because it would cause so many problems for them.
  - johnisgood 4y ago
    That said, popular websites on/for Tor are free of JavaScript and they have implemented everything (such as captchas, or the "JavaScript is enabled" warning, and so forth) using pure HTML and CSS. They do use OpenResty[1], too, which is NGINX + Lua. Good stuff. [1] https://openresty.org/ https://openresty.org/, https://github.com/openresty/lua-nginx-module https://github.com/openresty/lua-nginx-module
    - Scoundreller 4y ago
      What I despise is clearnet sites that refuse to open if you don’t execute JavaScript even when I perfectly well known the page doesn’t depend on it. (Fuck you imgur)
UltraViolence 4y ago
But then you'd need to entice Tor users to turn on Javascript since it's turned off by default.
- 93po 4y ago
  This is not actually the case, at least not with the most recent versions of the browser
nomel 4y ago
> it's more likely that than the FBI running thousands of servers. Why? What's the hurdle for running a bunch of servers? How much does a server cost?
teawrecks 4y ago
I thought we already had docs showing that the govt runs a ton of tor nodes.
phil21 4y ago
> it's more likely that than the FBI running thousands of servers. Why not both? From my experience over the years doing datacenter/transit/fiber/etc. type of infrastructure - just assume a government agency of some sort either outright operates an exit node, or has a wiretap on it. You can be the most trustworthy person in the world operating in the name of freedom - outright working for a say a colo provider. Unless you are the CEO, legal team, or the individual engineer responsible for it - you will have no idea you are also operating an exit node under surveillance. I'd put money on well over 50% of the world's exit nodes being packet captured 24x7.
- hinkley 4y ago
  In WWII the Allies didn't want the Axis to know they had cracked Enigma. They used what today might be called Parallel Construction in order to make the intel look like bad luck and/or spies. They had to let some attacks happen because there was no way they could have known about them without decrypting communications. The FBI running hundreds of servers is fairly likely, and could give enough data to suggest that all of their information is just grunt detective work.

I wouldn't get so excited about this. There have been tons of javascript exploits to leak IP addresses in the past, it's more likely that than the FBI running thousands of servers.

Ajedi32 4y ago

Or even something way simpler, like the FBI secretly compromising the user's PC with malware prior to the arrest. Without more detail it's impossible to know whether this is even news.

Ajedi32 4y ago
Out of curiosity, will we get more detail? Presumably the FBI would need to reveal to somebody how they obtained this information in order for it to be admissible as evidence ("he did this, trust us" probably won't fly in court), but is there a legal means by which they could do that without revealing their exact methods to the general public? (I don't actually know what the law says on this subject.)
- nostrademons 4y ago
  Parallel construction. They use their real methods to identify the user, then once they know the user, specifically target them with simpler known methods to build evidence for the case. In the court filing, they present evidence that they've gained through known methods which don't work all that well unless you already have a suspect, but they actually caught the suspect using methods that are not public (and won't become so, unless there's an internal leak at the FBI).
  - Ajedi32 4y ago
    But if they were using parallel construction, surely the criminal complaint wouldn't make claims they can't prove using the non-secret chain of evidence, right? Here the court filing alleges that the FBI knows what IP address the defendant used to visit a Tor hidden service. Don't they now have to prove that claim if they want the prosecution to succeed?
    - CommitSyn 4y ago
      They also know what specific pages on the offending websites they accessed. I'm wondering if the classified document wasn't about tor, but about the 'implants' aka malware that were leaked in the same set of Snowden documents. I think as much as tor being broken in some fixable way, they'd like it known even less that the FBI installs malware on the devices of persons of interest who haven't been convicted of anything. If they truly can't break Tor and they deem the person of interest important enough for "national security" then I don't think anyone who has studied history, American or otherwise, believes that they are going to throw their hands up and say "welp, that's it."
      - sidewndr46 4y ago
        Or in the case of Ross Ulbricht, just makes up a story about how he was trying to kill someone by suggesting the idea to him. Then uses that to justify an investigation that just happens to be a dead-end but conveniently gathers a bunch of other evidence that is relevant to another case.
  - edgyquant 4y ago
    Is there proof of anything like this or is it just a conspiracy theory you’re peddling?
    - mwint 4y ago
      Parallel construction is very real and common
    - moe091 4y ago
      I think it's commonly known, maybe not proven, but also it's a case of can they? yes. Would they? yes. As long as you agree with those two premises it's pretty likely
    - sidewndr46 4y ago
      Parallel construction is not a theory in any way in the US. It is a "decades old, a bedrock concept" according to the DEA. Outside the US, I have no idea.
      - WarOnPrivacy 4y ago
        > Outside the US, I have no idea. Genealogists use parallel construction to build out their families. Data from a large variety of sources gets used to indicate and corroborate individuals.
    - pessimizer 4y ago
      Exclusive: U.S. directs agents to cover up program used to investigate Americans [2013] https://www.reuters.com/article/us-dea-sod-idUSBRE97409R20130805 https://www.reuters.com/article/us-dea-sod-idUSBRE97409R2013...
    - ThunderSizzle 4y ago
      It's rather annoying that the initial knee jerk reaction to any negative take on authoritarian government action is labeled as a conspiracy theory to try to discredit it. The CIA did a great job getting that word out there. It's sad it's used to dismiss credible and logical conclusions so readily.
dmatech 4y ago
Perhaps, but the only references I saw to 2019 in the criminal complaint[1] were with respect to Tor and his phone. I don't know if he was actually under surveillance that early or if this is just stuff they later found. While there are plenty of ways this guy could have attracted the attention of California, Florida, or federal law enforcement, it's entirely possible that seeing a US residential IP address is what started this case. I can't really tell without seeing dated search warrant applications. The latest PDF[2] states: In discovery, the Government has declined to provide any information related to its TOR operation. The Defense therefore researched and drafted a motion to compel such discovery. In the course of this research, the Defense discovered an exhibit filed on the public docket in at least two federal cases with similar issues (“Exhibit 2”). The document is partially redacted, purports to be the work of a U.S. government agency, and is marked “Top Secret.” Outside of these public docket filings, Exhibit 2 is widely available on public internet sources. A Google search for Exhibit 2’s title yields 102,000 results. All of the top results apparently provide the document itself, and most of these date back to 2013. That would likely be a reference to something leaked by Edward Snowden given the year mentioned. 1. https://www.justice.gov/opa/press-release/file/1279441/download https://www.justice.gov/opa/press-release/file/1279441/downl... 2. https://www.documentcloud.org/documents/23569961-motion-to-reconsider-hsd-order https://www.documentcloud.org/documents/23569961-motion-to-r...
- flutas 4y ago
  > Perhaps, but the only references I saw to 2019 in the criminal complaint[1] were with respect to Tor and his phone. I don't know if he was actually under surveillance that early or if this is just stuff they later found. From a doc I found[0] he was under aerial surveillance (aka, the FBI Cesnas {related [1]}) since June 2018. Also some of the facts in the case are...well this is from doc [0]. > Some of the surveillance footage is itself incriminating. (See Doc. 5, pp. 50-51) (asserting that Mr. Alazhari’s travel on certain days in May 2020 shows that he was “scouting targets fora potential mass shooting attack.”). [0]: https://www.documentcloud.org/documents/21052490-motion-to-suppress-aerial-surveillance-evidence-in-us-vs-muhammed-momtaz-alazhari https://www.documentcloud.org/documents/21052490-motion-to-s... [1]: https://news.ycombinator.com/item?id=34109507 https://news.ycombinator.com/item?id=34109507

archontes 4y ago

Doesn't the tor browser disable javascript entirely?

checkyoursudo 4y ago
The user can enable javascript.
DoItToMe81 4y ago
It does not. Noscript is set by default to allow scripts.
- deleted 4y ago
  [deleted]
deleted 4y ago
[deleted]
jwilk 4y ago
https://support.torproject.org/tbb/tbb-34/ https://support.torproject.org/tbb/tbb-34/ > We configure NoScript to allow JavaScript by default in Tor Browser because many websites will not work with JavaScript disabled. Most users would give up on Tor entirely if we disabled JavaScript by default because it would cause so many problems for them.
- johnisgood 4y ago
  That said, popular websites on/for Tor are free of JavaScript and they have implemented everything (such as captchas, or the "JavaScript is enabled" warning, and so forth) using pure HTML and CSS. They do use OpenResty[1], too, which is NGINX + Lua. Good stuff. [1] https://openresty.org/ https://openresty.org/, https://github.com/openresty/lua-nginx-module https://github.com/openresty/lua-nginx-module
  - Scoundreller 4y ago
    What I despise is clearnet sites that refuse to open if you don’t execute JavaScript even when I perfectly well known the page doesn’t depend on it. (Fuck you imgur)

UltraViolence 4y ago

But then you'd need to entice Tor users to turn on Javascript since it's turned off by default.

93po 4y ago
This is not actually the case, at least not with the most recent versions of the browser

nomel 4y ago

> it's more likely that than the FBI running thousands of servers. Why? What's the hurdle for running a bunch of servers? How much does a server cost?

teawrecks 4y ago

I thought we already had docs showing that the govt runs a ton of tor nodes.

phil21 4y ago

> it's more likely that than the FBI running thousands of servers. Why not both? From my experience over the years doing datacenter/transit/fiber/etc. type of infrastructure - just assume a government agency of some sort either outright operates an exit node, or has a wiretap on it. You can be the most trustworthy person in the world operating in the name of freedom - outright working for a say a colo provider. Unless you are the CEO, legal team, or the individual engineer responsible for it - you will have no idea you are also operating an exit node under surveillance. I'd put money on well over 50% of the world's exit nodes being packet captured 24x7.

hinkley 4y ago
In WWII the Allies didn't want the Axis to know they had cracked Enigma. They used what today might be called Parallel Construction in order to make the intel look like bad luck and/or spies. They had to let some attacks happen because there was no way they could have known about them without decrypting communications. The FBI running hundreds of servers is fairly likely, and could give enough data to suggest that all of their information is just grunt detective work.