4 ms·

How did the feds locate freedom hosting? How did the feds take down silk road? The "tor stinks" slide was over a year old when these events occurred. A lot ca

by cowbell 12y ago

How did the feds locate freedom hosting? How did the feds take down silk road? The "tor stinks" slide was over a year old when these events occurred. A lot can change in a year.

AJ007 12y ago
No matter what pipe communication comes through, a machine is not immune to security vulnerabilities and exploits.
stephen_g 12y ago
Didn't the feds take down Silk Road because the owner paid a cop posing as a hitman to kill someone? Also, there is a problem where hidden services can be enumerated by scanning IPs. With IPv4, it is practical for a well connected entity to scan the entire internet and search for hidden services, making it possible to match to IPs. This is only an issue for people running hidden services, not Tor users.
- quasque 12y ago
  Hidden services can't be located in that manner unless the owner has badly misconfigured the service so it's reachable by IP address. A typical configuration would have the service listening on 127.0.0.1 or a private (RFC 1918) network address only, and have Tor connect to that.
- deleted 12y ago
  [deleted]
cooperq 12y ago
I specifically addressed this in the article. The feds located freedom hosting by using an exploit in Firefox which was able to deanonymize users. I don't know enough about the silk road case, but it seems probable that traffic correlation was used in that case. I agree that things can change in a year, but the essential point that Tor is not cryptographically broken is still true, IMO.
- hendersoon 12y ago
  Tor is not cryptographically broken, I agree. But see my post above about the number of nodes-- it is trivial for any nation-state to spend a small bit of money to completely compromise Tor.
- cowbell 12y ago
  >The feds located freedom hosting by using an exploit in Firefox That doesn't even make sense. Firefox is client software. How would I locate a hidden service, a server, via an exploit in Firefox? Servers don't generate websites with Firefox.

by cowbell 12y ago

How did the feds locate freedom hosting? How did the feds take down silk road? The "tor stinks" slide was over a year old when these events occurred. A lot can change in a year.

AJ007 12y ago

No matter what pipe communication comes through, a machine is not immune to security vulnerabilities and exploits.

stephen_g 12y ago

Didn't the feds take down Silk Road because the owner paid a cop posing as a hitman to kill someone? Also, there is a problem where hidden services can be enumerated by scanning IPs. With IPv4, it is practical for a well connected entity to scan the entire internet and search for hidden services, making it possible to match to IPs. This is only an issue for people running hidden services, not Tor users.

quasque 12y ago
Hidden services can't be located in that manner unless the owner has badly misconfigured the service so it's reachable by IP address. A typical configuration would have the service listening on 127.0.0.1 or a private (RFC 1918) network address only, and have Tor connect to that.
deleted 12y ago
[deleted]

cooperq 12y ago

I specifically addressed this in the article. The feds located freedom hosting by using an exploit in Firefox which was able to deanonymize users. I don't know enough about the silk road case, but it seems probable that traffic correlation was used in that case. I agree that things can change in a year, but the essential point that Tor is not cryptographically broken is still true, IMO.

hendersoon 12y ago
Tor is not cryptographically broken, I agree. But see my post above about the number of nodes-- it is trivial for any nation-state to spend a small bit of money to completely compromise Tor.
cowbell 12y ago
>The feds located freedom hosting by using an exploit in Firefox That doesn't even make sense. Firefox is client software. How would I locate a hidden service, a server, via an exploit in Firefox? Servers don't generate websites with Firefox.