log☇︎
1184 entries in 1.099s
asciilifeform: (as classic nsa clearly does not, if the 3rd tor 'leak' is to be believed.)
imsaguy: probably a tor exit node or something
ozbot: The Daily Dot - Tor and the rise of anonymity networks
pankkake: http://www.dailydot.com/technology/tor-freenet-i2p-anonymous-network/
nanotube: gecko_x2: yea, but one could avoid using the on-cpu rng. as to tor: would be even better if we had more nodes. there are only a total of 4k-ish.
gecko_x2: timing the packets that leave your client to the packets that exit an tor exit node
gecko_x2: another piece of good news is that they are not able to break TOR
pankkake: it's a live cd, which forces everything to go through tor
mircea_popescu: "The advice I shared included using Tor" for the record, that particular tidbit has most people involved in compsec scratching their heads at schneier.
BingoBoingo: mircea_popescu: I've also started and aborted a tor study.
blastbob1: faster than any web on tor atleast
pankkake: I like it - tor or not
blastbob1: i was dreaming about a irc based exchange on the tor network
asciilifeform: refer to the 'dumb users' section of the latest TOR dirt leak (even if you believe that the 'leak' is disinfo, the section applies to most users.)
asciilifeform: anyone who even thinks of 'browser' when thinking about TOR, etc. is already in a state of damnation.
pankkake: unless you forbid any non-tor traffic, like Tails does
pankkake: the tor project explicitely says you should not trust exit nodes
ozbot: Tor Researcher Who Exposed Embassy E-mail Passwords Gets Raided by Swedish FBI and CIA | Threat Leve
asciilifeform: the TOR source is a good source even for those who don't care for TOR
pankkake: anyway, the tor list of isps is a good source even if you don't care for TOR
mircea_popescu: Arvixe (hosting) Openly and respectfully state that while they dont permit a TOR exit on shared hosting accounts, you are very welcome to run one on a VPS account.
pankkake: https://trac.torproject.org/projects/tor/wiki/doc/GoodBadISPs
asciilifeform: there is no shortage of damning. TOR's authors really love it when you run it on VPS hosts, saves them some $ on running their own diddled nodes.
pankkake: some others that automatically shut you down (I know one who monitors for both TOR and Freenet)
pankkake: there are many other providers who explicitely say TOR is OK
asciilifeform: and if you diddle traffic in an easily detected way, TOR foundation will add your node to its blacklist.
asciilifeform: last i checked tor exits were explicitly permitted in their TOS
asciilifeform: they Officially love TOR.
asciilifeform: speaking of Azerbaijan, has anyone here done the TOR exercise suggested in MP's comments?
BingoBoingo: I mean how wide does the "tor foundation" advertise their exit bandwidth being? There is not way I get all of the fringe cases exiting and nothing else if this shit ain't random. I'm probably burning some logs and just advertising Tor as more compromised than imagined.
BingoBoingo: mircea_popescu: It apparently seems that Tor exits have to be honeypots. I've been running on for half of a week and been getting nothing but boring througn MITM attacks. No matter what bandwidth I offer Tor exits, the tor seems to adapt n a way that either recognizes me attacking its exits or suggests it is sucking some NSA dick.
BingoBoingo: Like Tor I imagine it wasn't all of it, but enough of it to clear two or three people.
nubbins`: then i was thinking i could set up a tor node on a raspi and run the wifi through that
mircea_popescu: he didn't plan on tor being a surveillance tool.
Kleeck__: Why are you using TOR?
gecko_x2: got my remaining btc transferred off btct in the last min.. over TOR
ThickAsThieves: heh, btct.co won't load so I tried Tor,
gecko_x2: works through tor for me
gribble: ThickAsThieves was last seen in #bitcoin-assets 3 hours, 2 minutes, and 4 seconds ago: <ThickAsThieves> a tor detector detector
mircea_popescu: it would still not be anyonymous, which is in general a much harder problem than cryptography. which is why bitcoin is secure but not anonymous, and why tor fails to deliver on anonymity etc.
mircea_popescu: so you know that someone on tor isn't using tor
mircea_popescu: so you can have within tor this plaintext protocol which nobody can identify
mircea_popescu: so like, everyone's on tor right ?
mircea_popescu: maybe they could make a tor tor
ThickAsThieves: a tor detector detector
ThickAsThieves: yeah have them donate it to Tor
blastbob1: we can put them into more tor open source development
b0n1: http://www.theguardian.com/world/interactive/2013/oct/04/tor-stinks-nsa-presentation-document
asciilifeform: not that many people have tor running on a hosted box
asciilifeform: the fellow running the port scan will see that the machine runs tor, and that's it
asciilifeform: even the lowest luser knows, i imagine, that you set up the service (e.g. http) on a local port, and expose only the tor port.
asciilifeform: if you configure the damn thing right, the only external port is TOR's standard one
asciilifeform: pg. 16: "In our time in the lab, we found that running an nmap on a node that isoffering a hidden service will turn up the port that the hidden service is using to deal with incoming connections. It can then be directly connected to, outside of Tor."
mircea_popescu: it's possible, but not likely. what happened is that one set of bureaucrats made tor at great expense, and another set used it in a disaster-of-commons way
asciilifeform: so it is even possible that one set of bureaucrats commissioned TOR and another, 'anti-' TOR
mircea_popescu: basically every contact in the "press" is being herded to defend this holy grail of "tor is actually safe"
ozbot: NSA report on the Tor encrypted network - The Washington Post
asciilifeform: http://apps.washingtonpost.com/g/page/world/nsa-research-report-on-the-tor-encryption-program/501/
ozbot: Attacking Tor: how the NSA targets users' online anonymity | World news | theguardian.com
dexX7: http://www.theguardian.com/world/2013/oct/04/tor-attacks-nsa-users-online-anonymity << i recommend this one, very rich of information
pankkake: http://www.theguardian.com/world/interactive/2013/oct/04/egotistical-giraffe-nsa-tor-document
jurov: hence ended the inquiry to add gpg to tor bundle.
ozbot: [tor-talk] Tor Browser Bundle: PGP encryption built-in?
jurov: https://lists.torproject.org/pipermail/tor-talk/2011-October/021770.html
jurov: just have a tor bundle include gpg proper
ozbot: Attacking Tor: how the NSA targets users' online anonymity | World news | theguardian.com
mircea_popescu: http://www.theguardian.com/world/2013/oct/04/tor-attacks-nsa-users-online-anonymity
asciilifeform: mircea_popescu: interestingly, the 'tor foundation' is a lot like the 'bitcoin foundation' but more so. they have a list of 'authority' nodes that every client prefers by default.
mircea_popescu: i'm with asciilifeform's suggestion : that pps is prima facie evidence that the nsa is in fact currently decoding ALL traffic passing through all tor nodes, linking it to originating ips and storing this mess. ☟︎
pizzaman1337: Schneier: http://www.theguardian.com/world/2013/oct/04/tor-attacks-nsa-users-online-anonymity
pizzaman1337: hey look, NSA has been targeting tor: http://rt.com/usa/nsa-target-tor-network-739/
pankkake: I wonder if combining tor and i2p is doable
mjoiii: would this be the first occurrence of a tor site being taken down?
taub: Ulbricht posted on Stack Overflow using his real name, asking .How can I connect to a Tor hidden service using curl in php?.. One minute later he changed his username to .frosty., but a subpoena shows the original name. ☟︎
mircea_popescu: course internet ppls were bitching at me about tor coupla months back or w/e.
pizzaman1337: look at paragraph 22, they talk about how they "located a number of computer servers, ... associated with the operation of Silk Road". So, Tor = owned
mircea_popescu: this would be nice if it didn't use the exact same verbiage as used to describe tor, the honeypot network.
Apocalyptic: like Biggy said, FBI runs all the tor nodes
TAT_Investments: businesses need to be able to raise money and tor would limit that too much
TAT_Investments: forget tor
nubbins`: and i think that businesses directly involved with btc wouldn't see the move to tor as much of a jump
TAT_Investments: businesses worth listing wouldnt list on tor
TAT_Investments: i think a tor market could be done in some way
nubbins`: anyway, tor-based exchange. arguments against?
nubbins`: yeah, i'm kind of surprised there are no major exchanges hosted on tor
pankkake: and not hidden behind tor anyway
the20year1: No reason for a TOR exchange
pankkake: maybe the next step is a TOR exchange, where everything is allowed
asciilifeform: mircea_popescu: perhaps 'complimentary' means TOR
ozbot: [tor-relays] Reimbursement of Exit Operators
benkay: https://lists.torproject.org/pipermail/tor-relays/2013-September/002824.html
mircea_popescu: donate to the nsa-tor-bitcoin foundation ?
ozbot: Bitcoin, Tor and Gates Foundation join task force to prevent child exploitation (Wired UK)
jurov: if they combined namecoin with tor, that makes more sense
gribble: Currently authenticated from hostmask random_cat!~random_ca@gateway/tor-sasl/randomcat/x-49498005. Trust relationship from user jurov to user random_cat: Level 1: 0, Level 2: 3 via 1 connections. Graph: http://b-otc.com/stg?source=jurov&dest=random_cat | WoT data: http://b-otc.com/vrd?nick=random_cat
pankkake: by the way, TOR is a step ahead, I found out there is a "revenge porn" website there
mircea_popescu: anyway, in all the aggitation about tor im surprised nobody mentioned tails.
asciilifeform: if the pwners of TOR were ready to ditch the deniability of their operation, they could have fed the same exploit to every chump connected to every exit node.
mircea_popescu: compare the gestapo's action in btc (the turning of gavin) with the gestapo's exact same action in tor.
Kleeck_: Sure, you can conspiracy theory a lot of scary scenarios, but as we understand TOR it is a very well thought out network. It's the methods of connectivity that are vulnerable, and a few other points of injection/observation, that don't involve the TOR network at all.