4 ms·

Never say never. The one thing the history of online networks teaches all of us is that some attack surfaces are very hard to imagine--until someone imagines th

Never say never. The one thing the history of online networks teaches all of us is that some attack surfaces are very hard to imagine--until someone imagines the attack surface and uses it to interfere with the network. There is plenty of interest on the part of law enforcement authorities in figuring out ways of enforcing the law on networks like the proposed (not yet implemented) network described in the article kindly submitted here. The article begins by saying, "The Silk Road . . . still offered its enemies a single point of failure," referring to Silk Road being hosted on a single server. Well, that is the KNOWN point of failure for keeping Silk Road impervious to law enforcement, but there may have been other points of failure in Silk Road's design. About the proposed DarkMarket, the article writes, "DarkMarket, Taaki and its other developers admit, is still just an experimental demonstration. They have yet to integrate anonymity protections like Tor into the software; currently every user’s IP address is listed for every other user to see." The proposal needs a lot more work to become a practical proposal for attempting to evade law enforcement scrutiny. Whether or not DarkMarket is ever implemented, and whether or not it will work as expected if it is implemented, are still open questions. The biggest open question is whether or not there will be ways for law enforcement efforts to reach into the DarkMarket even if it works in practice as the proposals suggests it is meant to work.

andrewljohnson 13y ago
To summarize your comment: * attacks are hard to predict * law enforcement is interested in attacking * being hosted on a single server is just one way to make something attackable * the proposal needs more work * whether this actually works is an open question * the real question is whether law enforcement will be able to attack In a nutshell, this is circular logic that ends where it begins, and makes no journeys elsewhere. It makes no technical criticism of DarkMarket, references no historical or similar examples, and offers no extra information from other sources (such as the source code). So, I down-voted, and wonder why all the up-votes.
- michaelt 13y ago
  I think the summary is: It's premature to call this 'a Silk Road the FBI Can Never Seize' until it has withstood a few years of determined attacks. If you look at a lot of the best practices documentation for Tor it makes everything sound like a huge hassle [1] so I can believe making a system secure against the concerted efforts of law enforcement is complicated. [1] http://lifehacker.com/how-can-i-stay-anonymous-with-tor-1498876762 http://lifehacker.com/how-can-i-stay-anonymous-with-tor-1498...
  - mathetic 13y ago
    I don't think you are getting the point of the article or the comment above. This is a p2p system meaning that by definition you cannot take the market down by arresting a single person. It doesn't say it is secure against everything. It just says that as long as the source code/binary is somehow available, it will not be possible to completely shutdown. The beauty is security vulnerabilities come and go (as in gets patched) so those are not the main concerns here. Even if they decide to tap every communication to identify the transactions and manage to decrypt it, it is going to help for a single raid and then it will get patched.
    - michaelt 13y ago
      Sure, maybe you can make entry nodes discoverable by users without them being discoverable by the feds. And maybe new users can get the software without going to a central location. And maybe you can distribute bug fixes securely without a central server, and without the people with the keys to sign the bug fixes getting compromised. And maybe you can deal with 90% of the peers being created and controlled by the feds. And maybe you're secure against any and all types of DOS. Maybe you're undetectable by deep packet inspection if every ISP was forced to perform it. And maybe there's no way to grief or spam the network into being useless. And maybe you can tolerate coordinated police operations, where a single bug in the software gets a hundred of your best sellers carted off to jail. And maybe the market will still be going strong after that's happened 5 or 6 times. But I'm going to reserve judgement until I've seen it working.
- dmk23 13y ago
  The most effective attack is the easiest to predict. It is human intelligence or infiltration by actors with a hidden loyalty. This has worked since the time immemorial for all sorts of security systems. For FBI to bring it down they'll just need to repeat what they've done with Silk Road - pose as a straw buyers, get everyone they touch on record and use them to identify/arrest the users. Put out a request for a contract killing and arrest all responders. Bonus for putting a bounty on members turning in other members. Even if this won't "shut down" the system itself, it would make it impossible to use safely.
leorocky 13y ago
> Never say never. It's wired.com. They aggrandize words in their title to get you to click. Everything they publish is apparently amazing, ever, never, finally, extreme, and "why this thing we wont name in the title is X (because we want you to click before you realize it's just the inane bullshit you thought it would be)" and the same kind of upworthy nonsense you see everywhere these days. In my opinion Wired is killing their brand with their current editorial policy, at least for discerning minds. Maybe they just want a stupid, incredulous semi-literate mob to click. I guess advertisers don't give a shit, because maybe the people that click ads are the people who click titles like that. It may just be the direction ad supported sites have to go.

andrewljohnson 13y ago

To summarize your comment: * attacks are hard to predict * law enforcement is interested in attacking * being hosted on a single server is just one way to make something attackable * the proposal needs more work * whether this actually works is an open question * the real question is whether law enforcement will be able to attack In a nutshell, this is circular logic that ends where it begins, and makes no journeys elsewhere. It makes no technical criticism of DarkMarket, references no historical or similar examples, and offers no extra information from other sources (such as the source code). So, I down-voted, and wonder why all the up-votes.

michaelt 13y ago
I think the summary is: It's premature to call this 'a Silk Road the FBI Can Never Seize' until it has withstood a few years of determined attacks. If you look at a lot of the best practices documentation for Tor it makes everything sound like a huge hassle [1] so I can believe making a system secure against the concerted efforts of law enforcement is complicated. [1] http://lifehacker.com/how-can-i-stay-anonymous-with-tor-1498876762 http://lifehacker.com/how-can-i-stay-anonymous-with-tor-1498...
- mathetic 13y ago
  I don't think you are getting the point of the article or the comment above. This is a p2p system meaning that by definition you cannot take the market down by arresting a single person. It doesn't say it is secure against everything. It just says that as long as the source code/binary is somehow available, it will not be possible to completely shutdown. The beauty is security vulnerabilities come and go (as in gets patched) so those are not the main concerns here. Even if they decide to tap every communication to identify the transactions and manage to decrypt it, it is going to help for a single raid and then it will get patched.
  - michaelt 13y ago
    Sure, maybe you can make entry nodes discoverable by users without them being discoverable by the feds. And maybe new users can get the software without going to a central location. And maybe you can distribute bug fixes securely without a central server, and without the people with the keys to sign the bug fixes getting compromised. And maybe you can deal with 90% of the peers being created and controlled by the feds. And maybe you're secure against any and all types of DOS. Maybe you're undetectable by deep packet inspection if every ISP was forced to perform it. And maybe there's no way to grief or spam the network into being useless. And maybe you can tolerate coordinated police operations, where a single bug in the software gets a hundred of your best sellers carted off to jail. And maybe the market will still be going strong after that's happened 5 or 6 times. But I'm going to reserve judgement until I've seen it working.
dmk23 13y ago
The most effective attack is the easiest to predict. It is human intelligence or infiltration by actors with a hidden loyalty. This has worked since the time immemorial for all sorts of security systems. For FBI to bring it down they'll just need to repeat what they've done with Silk Road - pose as a straw buyers, get everyone they touch on record and use them to identify/arrest the users. Put out a request for a contract killing and arrest all responders. Bonus for putting a bounty on members turning in other members. Even if this won't "shut down" the system itself, it would make it impossible to use safely.

leorocky 13y ago

> Never say never. It's wired.com. They aggrandize words in their title to get you to click. Everything they publish is apparently amazing, ever, never, finally, extreme, and "why this thing we wont name in the title is X (because we want you to click before you realize it's just the inane bullshit you thought it would be)" and the same kind of upworthy nonsense you see everywhere these days. In my opinion Wired is killing their brand with their current editorial policy, at least for discerning minds. Maybe they just want a stupid, incredulous semi-literate mob to click. I guess advertisers don't give a shit, because maybe the people that click ads are the people who click titles like that. It may just be the direction ad supported sites have to go.