21 ms·
Darknetlive Sold to Incognito Market
- kosasbest 3y agoI regularly go to Dark.fail[0] to get the latest .onions some sites are using, like the BBC: https://www.bbcnewsd73hkzno2ini43t4gblxvycyac5aw4gnv7t2rccijh7745uqd.onion Just be careful out there. All I have to do is alter one letter for the BBC .onion and I can get phished/scammed/duped. For example, this is an altered .onion for BBC: https://www.bbcnewsd73hkzno2ini43t4gblxvycyac5aw4gnv7t2rccijh7746uqd.onion Can you spot the alteration? [0] https://dark.fail/ https://dark.fail/ > Accurate URLs verified by PGP. No direct linking in order to protect against DNS leaks from accidental clicking in a clearnet browser. How does the PGP verif work? I'm not used to it. There exists a tool here[1] but how does it all work? [1] https://dark.fail/pgp https://dark.fail/pgp
- Retr0id 3y agoHow the heck does this work? I thought .onions were essentially a hash of a public key, making finding collisions (or even 1-char near collisions like your example) infeasible. Do both of your example links resolve? If so, how? I have no doubt that you can find one with similar prefix and/or suffix, but not to the degree of similarity of your example.
- michaelt 3y ago> How the heck does this work? It doesn't. But you could use brute force to produce something like https://www.bbcnewsd7xlp77nkq76byazcldy2hlmovfu2egnv7t2rccijhnu45uqd.onion https://www.bbcnewsd7xlp77nkq76byazcldy2hlmovfu2egnv7t2rccij... and at least some people will be inattentive enough to fall for it.
- deleted 3y ago[deleted]
- LeoPanthera 3y agoThis is spectacularly misleading. That second address isn't real, and doesn't work. It is computationally infeasible to generate an onion address similar to an existing one. Yes you could make another one that starts with "bbcnews", but all/most of the other characters would be different. Additionally, since the BBC is using https, the cert would be different, or missing. This is scaremongering.
- schoen 3y agoIf I'm following my intuitions about the math in the right direction, the probability of getting a single-character-or-less edit distance from a given target hash is (56×32)/32⁵⁶ per attempt. The expected number of attempts to get one success at this would then be about 2²⁶⁹. Even so, a typosquatting victim would be very unlikely to make the exact right typo for the attack to work! I think my reasoning is wrong somehow because I think there are only 2²⁵⁶ different onionsite public keys, so it doesn't quite make sense that you would have to do 2¹³ more work than trying all of them. But I'm still pretty convinced that it's going to be infeasible without a strong break of the hash function. In terms of attacks that merely try to generate onion addresses that are merely somewhat visually similar to target ones (e.g. by matching at the very beginning and very end?), these are possible, and it would be interesting to see research about how likely people are to fall for various attacks like that. Maybe that research has already been done?
- Jerrrry 3y ago>If I'm following my intuitions about the math in the right direction you are, except our theoretical familiarity with math and the antecedent nature of life can easily lead us to intuitions that mature to fallacies quickly. https://en.wikipedia.org/wiki/Birthday_problem https://en.wikipedia.org/wiki/Birthday_problem >e.g. by matching at the very beginning and very end?) Thankfully those smarter than us have solved this problem too - the "hashing" algorithm is so fundamentally lossy (but not too lossy to fall into the pidgen-hole paradox) 1-way, that it is mathematically impossible to have any knowledge of the end of the hash before you get it. You can "brute-force" it backwards, sure (for some old hashes obviously) - give me a string that's MD5 starts with "Jerry" and ends with "loves math", and I will congratulate you on your waste of computational resources.
- Tenoke 3y agoI haven't done it recently but I prefer to go to dreddit for finding the currently respected markets and links. dark.fail has been comrpomised in the past https://www.reddit.com/r/onions/comments/n1byhj/has_darkfail_been_compromised/ https://www.reddit.com/r/onions/comments/n1byhj/has_darkfail... https://www.reddit.com/r/onions/comments/12axsiz/is_darkfail_down_or_am_i_having_issues/ https://www.reddit.com/r/onions/comments/12axsiz/is_darkfail...
- verisimi 3y ago> Can you spot the alteration? yes! 5uqd.onion vs 6uqd.onion
- Jerrrry 3y agoBlatantly incorrect, and nearly dis-intelligently so....unless you know something we don't? .onion domain address are like cryptographic collisions - you must try trillons of nonces (random numbers, ya nasty brits) to even approach the chance of a collision that is recognizable in a literary sense. Now, RAT's waiting patiently for you to copy/paste transferred funds have plenty of time - especially when they know (and so do many wallets noawadays) that most people check the first and last characters.
- yieldcrv 3y agoI use daunt.link now dark.fail has been full of fail for about 3 years straight now. you would think tor is basically dead if you use dark.fail
- SuperGlueDoctor 3y ago>How does the PGP verif work? I'm not used to it. I will try to give a simplified explanation as best I can. PGP verification is a vital process to learn. Once learned it is easy to verify yourself. You need to know PGP if you are visiting .onion sites, it is not optional if you want any certainty. The information in a PGP signed message is encrypted using a password (the private key) in such a way that only a different password (the public key) could unlock it. Once you have a trustworthy public key from a site/individual, you can check to see if a message was signed using the correct password in the matching private key. If truly kept private, you can trust it is a message from the same person who gave you the the public key to begin with. That is how we know .onion urls are from the owners of the sites. If the address ever needs to change, they will sign a new message that you can know for certain came from someone in possession of the SAME private key as the first time. Same if there is a new key pair, they sign it with the old one too, so you can trust the new one equally as the old. Well, you can trust it as much as you trust the owner to not have shared it or been hacked, bribed, or arrested. Dark.fail tries to be someone you can trust. If you did trust them, you could trust all the addresses on their site, and thereby the public keys listed on those sites to be trustworthy as well. Dark.fail gives their seal of approval that everything belongs to whom it should on their site. Their tool is just checking to make sure the keys match up correctly. You cannot trust Dark.fail's seal of approval. They have proven you cannot trust them. Do not visit their site anymore. You always need to verify for yourself. Learn how.
- aborsy 3y agoWhere do you get the public keys? Also, depends how the owner of the site protects their public key, and monitors the website. I wonder if a significant of the links (if not most) are scam or honeypots.
- ClassyJacket 3y agoHow on earth did anyone have the computing power to generate the altered address? Wouldn't that have taken trillions of years? Isn't that the whole point of these long random addresses?
- cqqxo4zV46cp 3y agoI’m sorry (kind of), but this comment rubs me completely the wrong way. This is at best highly ignorant and at worst misleading. I’m willing to bet the former given how trendy it is now for people that know barely anything about a subject to turn around and teach others about it. You’ve just taken “lookalike domain name phishing exists”, explained it to an audience that almost certainly knows it, but also applied it to .onion domains, which are about the only context in which it’s wayyyy closer to impossible to actually pull this off.
- michaelt 3y ago> The USA seized the only reputable news site covering darknet safety and removed its content from the open internet. I mean - isn't that kinda normal war-on-drugs policy? The cops aren't interested in helping you test your drugs for adulterants. They'd much rather arrest you, for having drugs. We may not like it, but it's normal for cops.
- mrguyorama 3y agoA lot of cops would explicitly and openly rather you just die from bad drugs. There are many that openly refuse to carry Narcan, because a human life second(or twentieth) chance is apparently not worth $25 to them. The official policy of the united states government during prohibition for example was to poison thousands of US citizens for daring to consume a prohibited substance. People died because of it. I don't understand that level of complete lack of empathy.
- yieldcrv 3y ago[flagged]
- __MatrixMan__ 3y agoWhere I live we're on a "meh, decriminalize posession" kick (most recently: psilocybin & dmt) so that's probably biasing my view, but the cops I know are too lazy to care about busting people for possession. If you can synthesize/extract it without creating a public health hazard, and if you're not part of something violent, or selling to kids, then you're probably not worth their time. Maybe I'd feel differently if I were in a different demographic.
- cqqxo4zV46cp 3y agoYou certainly would.
- loeg 3y agoI think that's very true where I live, too, even if we haven't literally decriminalized the more esoteric drugs. That said, if you're breaking another crime and also have drugs on you, I doubt those same cops would think twice about adding it on as an extra charge. Don't make trouble or "do crimes while you're doing crimes" and it's probably not a big issue.
- Cody-99 3y ago>The USA seized the only reputable news site covering darknet safety and removed its content from the open internet. If they were 'reputable' they wouldn't have received kickbacks for linking to drug and cyber crime markets. >>According to the Department of Justice, while DeepDotWeb was in operation a total of 23.6 percent of all orders completed on AlphaBay involved DeepDotWeb Real reputable lol.
- arsome 3y agoI'm not so sure that detracts from their reputability, does Rtings seem less reputable because affiliate revenue is part of their income?
- cheeze 3y agoA bit, yes. Rtings has a vested interest to not cover a product that is sold, say, direct to consumer rather than via Amazon affiliate. I still trust Rtings and love the website, but yeah it's totally possible that at some point they leave out a product because no revenue. I think the hit to their rep would be too big so they wouldn't, but it's always possible.
- RockRobotRock 3y agoYes, 100%.
- brookst 3y agoTo a degree, yes. And if the products they were covering were illegal, it would not be at all surprising to see them busted for reviews and affiliate links. I think you’re truing to split hairs on what “reputable” means maybe?
- ijhuygft776 3y agoIs Google reputable? Some ads even contain malware...
- marcinzm 3y agoHave you seen the comments people make about Google search quality?
- deleted 3y ago[deleted]
- CobrastanJorji 3y agoKind of tangential, but I wonder how sales like that take place. Presumably, none of these parties want to be identified, even to each other, since the one's a criminal enterprise, and the other's being purchased by a criminal enterprise. But acquisitions usually involve enforceable business contracts with clauses like, for example, the purchasee's owners not immediately launching a new news site called "Darknetlive2" or something. Do you just ignore the business contractual bits, set up some sort of crypto escrow service, and go forward that way?
- yieldcrv 3y agomanual trusted escrow, more autonomous multisignature address with the trusted escrow being a signer or you just take a chance, send funds and move on
- zitterbewegung 3y agoI cite this defcon 30 talk a lot now. This is how sales are done. https://youtu.be/01oeaBb85Xc?si=iWXFwwfHIl1LMwOW https://youtu.be/01oeaBb85Xc?si=iWXFwwfHIl1LMwOW
- immibis 3y agoClickable link without tracking code: https://youtu.be/01oeaBb85Xc https://youtu.be/01oeaBb85Xc
- xx__yy 3y agoThanks - interesting talk
- selestify 3y agoSorry, but do you have a time stamp for when they discuss selling entire dark net websites to each other?
- zitterbewegung 3y ago
- ptek 3y agoThanks for this site, I will visit this weekly along with torrentfreak to get some news on different scenes. Need TOR to help stop corruption.
- bjord 3y agoI'm just disappointed they don't have an RSS feed.
- nickthegreek 3y ago> RSS They do. https://darkdot.com/index.xml https://darkdot.com/index.xml
- bjord 3y agothanks!
- thomastjeffery 3y agoThe problem with anonymity is moderation. Every community needs a source of trust to back attestations. In an anonymous forum, that trust is established with user reputation. The problem is that every user of every forum must build that reputation from scratch. Every time an anonymous forum fails, the cycle repeats. What we need is decentralized moderation.
- immibis 3y agoUsers can endorse other users (and sites).
- staplers 3y agoWhat we need is decentralized moderation. Democracy comes to mind, but that doesn't solve the 1 human: 1 vote issue. The best solution (utilizing a blockchain) we've found so far favors either electricity producers (pow) or the richest stakeholders (pos). Ensuring 1:1 human:vote ratio is near impossible without centralization.
- Exoristos 3y agoOnly the Borg desire 1:1 human:x.
- PicassoCTs 3y agoThe perfect anonymized platform- is a ablative platform. Hosted by bot-netted pcs world, managed by dao-contracts, this lucrative platform for illegal trades and services never comes into contact with you once its launched - except to dead-drop money and transaction-requests to you. Now as a standardized easily configurable container + virus. It even can buy its own ready-made zero-days and prolong its life - thanks to chat-gpt programing integration. Finance your golden years - with a swarm of dark net glider guns! If one of them fails- who cares, they can spawn more of themselves as a service. Man what a utopian dystopian nightmare..
- alcover 3y ago> Finance your golden years - with a swarm of dark net glider guns! Hearing this in the zeppelin ads speakers in Blade Runner. I would gladly read your literary production.
- PicassoCTs 3y agoWell, i did not write them down, i ordered a recording on fiver and mixed them. Enjoy: https://github.com/PicassoCT/MOSAIC/tree/master/sounds/advertising https://github.com/PicassoCT/MOSAIC/tree/master/sounds/adver...
- batch12 3y agoMaybe it's time for me to shut down my onion catalog that's been going since 2018. Seems not worth the hassle.