4 ms·

It’s not straightforward to distribute via Bittorrent anonymously.

by deno 14y ago

dfc 14y ago
What hurdles/risks are present in bittorrent that are not incurred when uploading to a free file hosting service? I do not think bittorrent and/or free file services provide any serious level of anonymity against a group with pockets as deep as the CoS. Let's not forget these are the people that brought down anon.penet.fi... N.B.: I also updated my post to include using a tor hidden service. I thought I had included it originally. From the responses I have read it seems that I should have been more clear that I was also taking censorship resistance into consideration.
- deno 14y ago
  Just use Tor bundle and that’s it. The only way you can shoot yourself in foot is if you use flash uploader and that bypasses Tor (fortunately plugins are disabled in Tor bundle AFAIK). Seeding via Tor? You need to configure Torrent client to use Tor, make sure it doesn’t leak anything (DNS lookups, publishing to DHT or tracker, some stuff on the protocol level was a problem as well). There’s nothing that comes working out of the box. Of course it’s not rocket science, it’s just a bit more work. Hosting just via hidden service is actually worse than uploading to random locations on clearnet: 1) Still no way to do load balancing with hidden services 2) It’s usually slower anyway 3) If your server gets compromised you’re toasted, unless you use hacked servers, or buy your servers with Bitcoins or stolen CCs. The best network for publishing that kind of leaks would be Freenet or I2P + Tahoe. But those are not nearly as popular (and secure) as Tor.
  - dfc 14y ago
    I was assuming someone from anonymous could handle figuring out how to setup tor to seed. More importantly hosting via hidden service is not worse than uploading to depositfiles. Hidden services protects both the uploader's and the downloader's anonymity and it is much, much, much more resistant to censorship. I am not sure what "hosting gets breached" has to do with the discussion.
    - deno 14y ago
      I guess it’s not a major issue when just hosting some static content, but still if someone gets access to your server sitting behind Tor, you better make sure you don’t have any activity that can tie you to that server. This is how some people running CP sites via Tor were caught.
      - dfc 14y ago
        In order to get access to your server they need to circumvent the anonymity that tor provides. Hopefully if you go through the trouble to publish via hidden descriptors you know not to include your name/SSN/gps/cell-number in your apache headers;) This is completely tangential, but can you point me to the Tor investigations? The interaction of tor/law-enforcement is something I am extremely interested in.
        deleted 14y ago
        [deleted]
        deno 14y ago
        > In order to get access to your server they need to circumvent the anonymity that tor provides. Not necessarily, the CP sites were hacked using PHP vulnerabilities or something similar, not to mention your hosting provider could just get interested in your network activity for whatever reason. > This is completely tangential, but can you point me to the Tor investigations? Nothing I have bookmarked, sorry.
        dfc 14y ago
        Thanks for checking. Sadly the bookmarks always go missing...
  - far-I 14y ago
    what about Anomos? Is that safe enough?
  - Karunamon 14y ago
    Another thing is that you shouldn't really do BT over Tor. The network is not set up for it and you consume a great deal of resources.
- tjoff 14y ago
  Because uploading it to a free file hosting service can easily be done via a compromised machine and/or tor (don't know how well uploading large files over tor works though) - maybe even a library/public computer, making it quite hard to trace (though when using a public computer you need to take other precautions, like avoiding surveillance cameras). Also since nothing is made public instantly you have time to erase any traces. With bittorrent you need at least one seeder that is available long enough to feed the swarm (in decent time), during that time a lot of things can go wrong (if anything goes wrong when uploading to a free hosting service you just start over, nothing lost).
  - dfc 14y ago
    And when the hosting service receives the inevitable take down notice from CoS? CoS lawyers brought down anon.penet.fi I am sure they can convince depositfiles that they do not want to go to court.
    - tjoff 14y ago
      By that time everyone that wants it has it ;)
    - lordlicorice 14y ago
      There's nothing stopping people from uploading the files to bittorrent. It's only the hackers' anonymity that matters.
  - stock_toaster 14y ago
    > With bittorrent you need at least one seeder that is available long enough to feed the swarm (in decent time), during that time a lot of things can go wrong (if anything goes wrong when uploading to a free hosting service you just start over, nothing lost). Don't most clients support web seeding[1] these days? [1]: https://en.wikipedia.org/wiki/BitTorrent_(protocol)#Web_seeding https://en.wikipedia.org/wiki/BitTorrent_(protocol)#Web_seed...
    - tjoff 14y ago

It’s not straightforward to distribute via Bittorrent anonymously.

by deno 14y ago

It’s not straightforward to distribute via Bittorrent anonymously.

dfc 14y ago

What hurdles/risks are present in bittorrent that are not incurred when uploading to a free file hosting service? I do not think bittorrent and/or free file services provide any serious level of anonymity against a group with pockets as deep as the CoS. Let's not forget these are the people that brought down anon.penet.fi... N.B.: I also updated my post to include using a tor hidden service. I thought I had included it originally. From the responses I have read it seems that I should have been more clear that I was also taking censorship resistance into consideration.

deno 14y ago
Just use Tor bundle and that’s it. The only way you can shoot yourself in foot is if you use flash uploader and that bypasses Tor (fortunately plugins are disabled in Tor bundle AFAIK). Seeding via Tor? You need to configure Torrent client to use Tor, make sure it doesn’t leak anything (DNS lookups, publishing to DHT or tracker, some stuff on the protocol level was a problem as well). There’s nothing that comes working out of the box. Of course it’s not rocket science, it’s just a bit more work. Hosting just via hidden service is actually worse than uploading to random locations on clearnet: 1) Still no way to do load balancing with hidden services 2) It’s usually slower anyway 3) If your server gets compromised you’re toasted, unless you use hacked servers, or buy your servers with Bitcoins or stolen CCs. The best network for publishing that kind of leaks would be Freenet or I2P + Tahoe. But those are not nearly as popular (and secure) as Tor.
- dfc 14y ago
  I was assuming someone from anonymous could handle figuring out how to setup tor to seed. More importantly hosting via hidden service is not worse than uploading to depositfiles. Hidden services protects both the uploader's and the downloader's anonymity and it is much, much, much more resistant to censorship. I am not sure what "hosting gets breached" has to do with the discussion.
  - deno 14y ago
    I guess it’s not a major issue when just hosting some static content, but still if someone gets access to your server sitting behind Tor, you better make sure you don’t have any activity that can tie you to that server. This is how some people running CP sites via Tor were caught.
    - dfc 14y ago
      In order to get access to your server they need to circumvent the anonymity that tor provides. Hopefully if you go through the trouble to publish via hidden descriptors you know not to include your name/SSN/gps/cell-number in your apache headers;) This is completely tangential, but can you point me to the Tor investigations? The interaction of tor/law-enforcement is something I am extremely interested in.
      - deleted 14y ago
        [deleted]
      - deno 14y ago
        > In order to get access to your server they need to circumvent the anonymity that tor provides. Not necessarily, the CP sites were hacked using PHP vulnerabilities or something similar, not to mention your hosting provider could just get interested in your network activity for whatever reason. > This is completely tangential, but can you point me to the Tor investigations? Nothing I have bookmarked, sorry.
        dfc 14y ago
        Thanks for checking. Sadly the bookmarks always go missing...
- far-I 14y ago
  what about Anomos? Is that safe enough?
- Karunamon 14y ago
  Another thing is that you shouldn't really do BT over Tor. The network is not set up for it and you consume a great deal of resources.
tjoff 14y ago
Because uploading it to a free file hosting service can easily be done via a compromised machine and/or tor (don't know how well uploading large files over tor works though) - maybe even a library/public computer, making it quite hard to trace (though when using a public computer you need to take other precautions, like avoiding surveillance cameras). Also since nothing is made public instantly you have time to erase any traces. With bittorrent you need at least one seeder that is available long enough to feed the swarm (in decent time), during that time a lot of things can go wrong (if anything goes wrong when uploading to a free hosting service you just start over, nothing lost).
- dfc 14y ago
  And when the hosting service receives the inevitable take down notice from CoS? CoS lawyers brought down anon.penet.fi I am sure they can convince depositfiles that they do not want to go to court.
  - tjoff 14y ago
    By that time everyone that wants it has it ;)
  - lordlicorice 14y ago
    There's nothing stopping people from uploading the files to bittorrent. It's only the hackers' anonymity that matters.
- stock_toaster 14y ago
  > With bittorrent you need at least one seeder that is available long enough to feed the swarm (in decent time), during that time a lot of things can go wrong (if anything goes wrong when uploading to a free hosting service you just start over, nothing lost). Don't most clients support web seeding[1] these days? [1]: https://en.wikipedia.org/wiki/BitTorrent_(protocol)#Web_seeding https://en.wikipedia.org/wiki/BitTorrent_(protocol)#Web_seed...
  - tjoff 14y ago