3 ms·

But that's not an exit node. Yes, any .onion address that you don't personally verify[1] could be something other than it seems. In fact, with sufficient res

by reeses 13y ago

But that's not an exit node. Yes, any .onion address that you don't personally verify[1] could be something other than it seems. In fact, with sufficient resources, that onion link could be rewritten in transit once it hits the backbone or your last mile provider. How would we know if it's arsta8rst87ars.onion[2] vs. dndspjsnbshsdrsts.onion? [1] And even then... [2] Yes, Colemak

ricardobeat 13y ago
Apparently it can't be rewritten, the address itself is a hash to a server key. That's why it's gibberish and not newyorkerdrop.onion
- reeses 13y ago
  That's not what I mean. On that page (http://www.newyorker.com/strongbox/ http://www.newyorker.com/strongbox/, no SSL, no hashing, etc.) is an onion link. I see it as http://tnysbtbxsf356hiy.onion http://tnysbtbxsf356hiy.onion. An adversary with sufficient access (whether to the server, or to the network between the New Yorker site and your browser) can rewrite that link without your ever knowing. Then you are legitimately directing your browser, once on Tor, to a spoofed site.
  - sneak 13y ago
    True, but you can bookmark it, and compare it against the one used by others. They're also short - you can write them down and communicate them offline. To compare, ssh uses no PKI, but is relatively resistant to MITM as it stores public key fingerprints for a given service on first access.
    - reeses 13y ago
      bookmark...others...offline. Be more paranoid.
      - deleted 13y ago
        [deleted]
      - jlgreco 13y ago
        Yes, what if someone MiTM's your offline communication... /s If the Feds (or whoever) were swapping out this address at a large scale, then the NYTs would notice and communicate to the public that this was happening. If the NYT was muzzled and every computer that you or anyone you know has it's connection being tampered with, then you are basically fucked anyway and this is the least of your concerns. At this level of paranoia you shouldn't be trusting the NYT anyway... If they are not MiTM'ing this at a large scale, then quick verifications on other networks with other peoples' computers will work just fine.
        reeses 13y ago
        Let's take a simple example. A soldier deployed overseas sees this link, sets up Tor, and sends some confidential information that includes evidence that the US government is up to some shenanigans. After Manning and some other fun, the military is not really a fan of this happening, but realizes that it would provide an excellent way to identify seditious elements who don't have other channels to work out their moral dilemmas (or just their annoyance at being an expendable cog in the bureaucracy). MilInTheMiddle proxy rewrites the page, replaces just that link with one that is under their control, then waits. People outside the military see the normal link, but a kid in Iraqistan sees the honeypot. When s/he sends secrets to the New Yorker (it's not even the NYT), the operator has a lead not only on what information may be flowing to the media, but is able to stop it and investigate the sender. The same case could be made for financial institutions, government agencies, people in foreign countries with national firewalls, etc. The only reason I'm not particularly concerned about this is that I strongly suspect that a) the organizations don't really have their sh*t together enough to do this in a fashion that wouldn't create immense blowback when (not if) discovered, and b) there are easier methods to get similar information already in place.
        jlgreco 13y ago
        That scenario is what "offline" is for. That soldier could call up his mum and ask her to read off the link over the phone. There is no way that anything but an utterly game-changing surveillance and censorship system is going to MiTM that in time. Or he could give some local kid a candy bar to look it up at an internet cafe, or hold onto the data until more alternative communication channels open up for him. If this soldier's communication is blacked out to the point that he cannot ask anyone else to verify the link using an internet connection other than his own, then it probably isn't safe for him to be attempting whatever it is that he is doing in the first place.

by reeses 13y ago

ricardobeat 13y ago

Apparently it can't be rewritten, the address itself is a hash to a server key. That's why it's gibberish and not newyorkerdrop.onion

reeses 13y ago
That's not what I mean. On that page (http://www.newyorker.com/strongbox/ http://www.newyorker.com/strongbox/, no SSL, no hashing, etc.) is an onion link. I see it as http://tnysbtbxsf356hiy.onion http://tnysbtbxsf356hiy.onion. An adversary with sufficient access (whether to the server, or to the network between the New Yorker site and your browser) can rewrite that link without your ever knowing. Then you are legitimately directing your browser, once on Tor, to a spoofed site.
- sneak 13y ago
  True, but you can bookmark it, and compare it against the one used by others. They're also short - you can write them down and communicate them offline. To compare, ssh uses no PKI, but is relatively resistant to MITM as it stores public key fingerprints for a given service on first access.
  - reeses 13y ago
    bookmark...others...offline. Be more paranoid.
    - deleted 13y ago
      [deleted]
    - jlgreco 13y ago
      Yes, what if someone MiTM's your offline communication... /s If the Feds (or whoever) were swapping out this address at a large scale, then the NYTs would notice and communicate to the public that this was happening. If the NYT was muzzled and every computer that you or anyone you know has it's connection being tampered with, then you are basically fucked anyway and this is the least of your concerns. At this level of paranoia you shouldn't be trusting the NYT anyway... If they are not MiTM'ing this at a large scale, then quick verifications on other networks with other peoples' computers will work just fine.
      - reeses 13y ago
        Let's take a simple example. A soldier deployed overseas sees this link, sets up Tor, and sends some confidential information that includes evidence that the US government is up to some shenanigans. After Manning and some other fun, the military is not really a fan of this happening, but realizes that it would provide an excellent way to identify seditious elements who don't have other channels to work out their moral dilemmas (or just their annoyance at being an expendable cog in the bureaucracy). MilInTheMiddle proxy rewrites the page, replaces just that link with one that is under their control, then waits. People outside the military see the normal link, but a kid in Iraqistan sees the honeypot. When s/he sends secrets to the New Yorker (it's not even the NYT), the operator has a lead not only on what information may be flowing to the media, but is able to stop it and investigate the sender. The same case could be made for financial institutions, government agencies, people in foreign countries with national firewalls, etc. The only reason I'm not particularly concerned about this is that I strongly suspect that a) the organizations don't really have their sh*t together enough to do this in a fashion that wouldn't create immense blowback when (not if) discovered, and b) there are easier methods to get similar information already in place.
        jlgreco 13y ago
        That scenario is what "offline" is for. That soldier could call up his mum and ask her to read off the link over the phone. There is no way that anything but an utterly game-changing surveillance and censorship system is going to MiTM that in time. Or he could give some local kid a candy bar to look it up at an internet cafe, or hold onto the data until more alternative communication channels open up for him. If this soldier's communication is blacked out to the point that he cannot ask anyone else to verify the link using an internet connection other than his own, then it probably isn't safe for him to be attempting whatever it is that he is doing in the first place.