4 ms·

You're missing the "nation state level adversary" component. I personally, do not know your mobile phone number or the last cell tower that it associated with.

by grugq 13y ago

You're missing the "nation state level adversary" component. I personally, do not know your mobile phone number or the last cell tower that it associated with. But I am not your adversary. A nation state level adversary ipso facto has access to that information. I suggest that you read the links I have posted and the articles I've written, both on http://grugq.tumblr.com http://grugq.tumblr.com and http://grugq.github.io http://grugq.github.io ... there is a lot of information there about how to operate clandestinely.

EGreg 13y ago
I took a look at the links you provided. There's some interesting stuff in there. I note, however, that the downfall of guys like Ulbricht involved things like: 1) Single point of failure. This is also related to increased susceptibility to network analysis. Even if the CIA "can't deanonymize everyone all the time" they can deanonymize a given host of a given network, by analyzing traffic patterns, placing proxies in the way or backdooring the nodes in the network, etc. 2) Recording. As you say, he got serious about his security "too late". In an age where tons of stuff you do online can be recorded and found when needed, you have to protect your anonymity from day 1. What I am claiming is that it's possible to BEGIN an alternate identity by leveraging techniques #1 and #2. #1 is what you can do with freenet or perfectdark - basically, distributed DHTs which DO NOT record the originator of a file. While it's true that a given freenode network can be compromised by backdooring enough nodes, that is much harder to do than with Tor. And #2 is what you can do with services like pastie and others who simply DO NOT have the capability in place to record who posted a message. As governments go after people, they will attempt to intimidate #2 type services. Either way there can be databases listing the confidence that a given system does NOT record a particular identifier such as an IP address. The ones that score high can be used directly. The ones that score low must unfortunately be used via commandeered accounts and the steganography would proceed that way. If there were truly no networks that the agents could trust, the agents could have aggressively employed steganography - they should have basically commandeered some email addresses in the country (http://xkcd.com/792/ http://xkcd.com/792/) and then tunneled messages through a number of different channels, including the text, the timing of the messages, the order of the messages, etc. There's tons of ways to do this without falling prey to being doxed. However, once even the smallest bit is revealed (e.g. your literary writing style is identified) the whole thing can unravel IN THEORY.

by grugq 13y ago

EGreg 13y ago

I took a look at the links you provided. There's some interesting stuff in there. I note, however, that the downfall of guys like Ulbricht involved things like: 1) Single point of failure. This is also related to increased susceptibility to network analysis. Even if the CIA "can't deanonymize everyone all the time" they can deanonymize a given host of a given network, by analyzing traffic patterns, placing proxies in the way or backdooring the nodes in the network, etc. 2) Recording. As you say, he got serious about his security "too late". In an age where tons of stuff you do online can be recorded and found when needed, you have to protect your anonymity from day 1. What I am claiming is that it's possible to BEGIN an alternate identity by leveraging techniques #1 and #2. #1 is what you can do with freenet or perfectdark - basically, distributed DHTs which DO NOT record the originator of a file. While it's true that a given freenode network can be compromised by backdooring enough nodes, that is much harder to do than with Tor. And #2 is what you can do with services like pastie and others who simply DO NOT have the capability in place to record who posted a message. As governments go after people, they will attempt to intimidate #2 type services. Either way there can be databases listing the confidence that a given system does NOT record a particular identifier such as an IP address. The ones that score high can be used directly. The ones that score low must unfortunately be used via commandeered accounts and the steganography would proceed that way. If there were truly no networks that the agents could trust, the agents could have aggressively employed steganography - they should have basically commandeered some email addresses in the country (http://xkcd.com/792/ http://xkcd.com/792/) and then tunneled messages through a number of different channels, including the text, the timing of the messages, the order of the messages, etc. There's tons of ways to do this without falling prey to being doxed. However, once even the smallest bit is revealed (e.g. your literary writing style is identified) the whole thing can unravel IN THEORY.