(untitled)

Let's get this straight once and for all times: Is TOR safe enough for criminal activity? I know, I know. The NSA has evil exit nodes spying on your outgoing traffic and so on. But is this really a risk for the average criminal, say a scammer, a hacker, a drug vendor, or is tor still secure? After all, I know of not a single incident where someone was convicted because of tor vulnerabilities or manipulated nodes. Every caught tor user case boils down to personal stupidity or server related attacks based on webv ulnerabilities or timing association attacks. If your answer is no, what would actually be more secure? Some years ago we had this meme of vpn+tor, which from todays perspective is quite hilarious. But are there any more secure alternatives at all? Buying some shady socks proxys from forum vendors doesn't seem like a good idea, hacking e.g. wordpress servers yourself to use as a proxy leaves the question of how to access that safely in the first place. So my conclusion is that we either have to trust tor or accept that anonymity beyond darknets is dead. What do you think, lainon?

>is Tor safe enough for criminal activity? Alone, no. Police also run those evil nodes and many police agencies have the resources to do some basic traffic analysis. At the very least, you should be using a obfs bridge. I think it is reasonable to trust Tor in the sense that you don't have to assume you are de-anonymized the instant you use it. Like with modern crypto primitives, it is usually more fruitful for attackers to use side channels and good ol' fashioned sleuthing. >what would actually be more secure. buy a botnet, set all of them up as public i2p nodes, and only connect to those nodes.

Short answer: no Long answer: nothing is secure, as long as it's going out from your hiding place. You don't use your hideout as a hacker den, you use it to hide, sleep, p!ss n sh!t, eat and maybe watch pr0n. Criminal activity has to be conducted over public nodes, that have many visitors without identification, using bare metal, and preferably one-off Acc's. Having a fixed entry node is stupidity in and off itself. But hold on, if we do all this, and still get fvcked, how did they get us? Well, at this point I really want to make vidya gaem analogy: like in GTA, when you Commit crimes, and they get reported/they are observed by law enforcement, you get a wanted level. It depends on this wanted level, in how much danger you are, and how much the feds want your ass. And unlike in Vidya, you don't get a counter, you have to carefully observe and feel up the situation, judging your own actions in their danger. Staying anonymous after a crime hasn't really changed since the beginning of crime: make sure you don't leave traces, keep your hands clean, talk as few words as possible and keep your face covered. If you just want to torrent soykaf and maybe download music, map out some places for free access, free up some time, install a VPN on your device and go sit down somewhere good, do your sh!t and go home. I call it sewer seeding, cuz public WiFi is basically like a sewer, full of sh!t data, and basically non-transparent for bystanders, so good enough for seeding purposes.

>bare metal Does this phrase have some new meaning besides "not inside a VM"?

>>16768 Why do you act like you know soykaf when you clearly don't?

>>16770 why do you act like you know that i don't know sh!t, when you clearly don't know that i don't?

>>16769 i dunno about you, but i've learned this phrase as "blank machine without anything but the bare minimum of utility on it. no personal data, no unnecessary programs and other identifying sh!t. The internet is wide, we prolly lurked different boards.

>>16766 >Is Tor anonymous? >[idiot] was caught using Tor, it is unsafe! >Tor is funded by the feds. Funding must mean it's backdoored. >Tor is not a perfect solution, so don't bother protecting yourself. Tor works by using onion routing to proxy your traffic through three (or more) volunteer nodes, with one layer of encryption for each node used in a connection. Every connection uses a set of nodes (circuit) randomly chosen by the user. Tor does not: - mandate or incentivize users to act as relays - employ dummy traffic - introduce intentional latency - mix packets together to be sent out in unpredictable orders - pad the size of packets, except for aspects of hidden services - use unidrectional tunnels, or change tunnels ("circuits") unless the user wishes it Also note that Tor: - has a centralized list of routers - does not have a very diverse set of relays (many are hosted in Europe, especially Germany) Clearly, the intention of Tor, in implementing LLARP (Low Latency Anonymous Routing Protocol), is to be blazing fast while preserving user privacy, and anonymity against most adversaries. It excels at this. How can you be deanonymized when using Tor as a normal user (non-relay)? There are various methods to do so, but the most prominent are the following: - Timing attacks / traffic shape correlation attacks - Attacks on traffic exiting the network (MITM techniques) - Protocol data leakage (browser metadata, p2p such as bittorrent, etc) - OPSEC failure (humans interacting with other humans, DON'T) Operations security is easy if you have a basic level of intelligence, and you should avoid usage of anything but the Tor Browser Bundle unless you actually know what you are doing, so as to not leak metadata.

>>16773 The most powerful method at the disposal of the feds is the Timing Attack. Global adversaries such as the NSA and its allied spying agencies log every single byte that goes through the internet backbone, through almost every ISP, in the West, and stores it for years. This means that they can observe when traffic entered the network, when similarly-sized traffic exited the network, and thus infer what entities are communicating with each other, and can deanonymize you. It may take several time intervals to deanonymize you with this technique, depending on the circumstances. Minutes, or perhaps fractions of a minute, at best. A few factors can work in your favor: - High traffic to a website. If there are many connections going to, say, DuckDuckGo.com, and you do your browsing as quickly as possible, it is likely impossible to determine that you did this, because there are so many other users using it as well. - High latency. Specifically, if more nodes are used in your circuit, it must take longer to deanonymize you, mathematically speaking. - Use of hidden services. Tor employs a number of additional protections to hidden services, and needs to know the address of a service to even attempt to deanonymize it through DoS attacks. When using one, your traffic will go through at least six relays, and your traffic does not exit the Tor network, either. This makes deanonymization of the users of hidden services extremely difficult and unlikely, especially if they switch circuits often and have good practices. The server hosts are more at risk here, their true IPs are usually found within months if they are high profile enough.(Don't post infographics with irrelevant characters obnoxiously added.)

>>16774 Conclusion: While Tor can provide Anonymity some of the time, it is not sufficient to protect user metadata from the multi-billion dollar might of world intelligence agencies. All the same, why not use it? You protect your privacy, drastically reducing the power of governments and corporations to influence human behavior, and can be anonymous if you put in some effort, especially if sticking to communication within the network. There is no reason not to use Tor- perfection is the enemy of the good. If you want something better that solves almost all of the problems listed above, try I2P instead. Or better yet, in the future consider the Nym network, which includes global adversaries in its thread model, while still experimental, has received millions in funding recently, and will be a great alternative to Tor.

>>16769 It means a few things. It means you minimize the amount of hardware on your board, and use open-standard hardware only. Full disk encryption. No closed-source firmware. Absolutely minimal software, preferably audited by yourself, or created by yourself. Combined with driving miles away (physical indirection) and use a directional antennae to connect to public wifi like 700 meters away from yourself (best I've gotten was ~750), using scripts to do whatever is to be done in as small a time interval as possible, you can pull it off. In reality, a darknet like I2P combined with very minimal hardware is pretty good.

Theoretically? If the NSA can monitor enough of the Internet to deanonymize most Tor traffic, that's pretty bad for criminals. They would be able to establish criminal associations with some level of certainty especially if paired with other data like seized system logs. If the NSA collects all that Tor traffic and in 5, 10, 20 years decrypts it with quantum computers, that's very bad for everyone and criminals in particular. That's a mountain of once-secret evidence sitting out there possibly forever. Practically? The NSA has been doing bulk surveillance for a long time and the only criminal prosecutions that come of it are the Reality Winners of the world (also some extrajudicial killings). Think of all the drug deals and murders that were planned in the clear. The NSA saw 100% of everything over SMS, a lot of what was over HTTP, and a lot of what was in the systems of collaborative companies. They didn't do anything with it because they didn't care or care enough to poison the well. "My adversary doesn't care" is a supremely soykafty line of defense but it's real. And it's worth remembering when someone tries to say Tor is secure because nobody is going to jail. One new law could change that overnight. As for mitigations, as others have said, not soykafting where you eat is the number one thing. Finding your real IP address is one thing. Finding out where you actually are is another.

>>16777 NSA doesn't like to show their capabilities for mere criminal investigations. They are trying to catch Rooskies and journalists. State police like the FBI are a more realistic adversary for most criminals, and cartels also have to worry about the CIA, who are not reliable business partners.

>>16778 You're not wrong, but the point remains: people are doing soykaf over SMS and getting away with it. It doesn't mean that SMS is secure.

>>16769 That's what it means literally everywhere except for this thread. >>16773 Tor automatically switches circuits every 10 minutes.

>>16780 Buy a VPS with XMR and set up an outproxy on I2P, if you intend to connect to send packets anonymously.

>>16769 >>16772 >>16776 >>16780 "Not inside a VM" is also wrong. Bare metal is programming a chip without the layer of an OS in between. >Bare metal programming is writing firmware that directly runs on the hardware without having any underlying abstractions such as operating systems It makes me sad that people come to this board, give advice in a security thread that could be crucial to the safety of some lainons and yet don't even know the most basic stuff about computers and programming. I know that nur ne of you will do this anyways, but please lurk more, not just on lainchan but also in life. Before acting smart and knowledgeable, you should first gather some experience and learn stuff by listening, after some years you can eventually start helping others with simple things. But never act as if you knew more than you actually do.

>>16782 Oi, it's the lainon from >>16768 here. I am from a different IB background, so maybe I understand some things wrong. I'm sorry about the misuse of "bare metal" in this thread, because I didn't learn the coding-related meaning (the actually widespread one). I'm trying to give advice based on my limited knowledge, combined with actual experience (I do not want to discuss this right here right now, I hope you understand why). I'm mainly from a /k/ background, and we /k/ommandos use bare metal as a phrase for absolute paranoia-machines, built/bought exclusively for doing dangerous things that could land one in jail. I hope this clears up some things, so thank you for not being an 4sshat about it, but instead pointing out mistakes for us to correct/work on.

>>16773 >>16774 >>16775 This lain anons. I really, really hope Nym catches on. I wanted to run a node but my ISP doesn't do IPv6 yet. :'-(

The IC is basically just legalized criminals and they need to maintain the integrity of Tor to safely perform their criminal activity. It's impossible to say whether someone might've broken Tor or not but it's more reasonable to say that breaking Tor isn't worth it for the IC even to use against the most high profile terror targets. Human lives aren't as valuable as this technology.

>>16784 But anonymizer's are by an large a popularity contest. The mass, diversity and focused attention ergo the constant practical testing of the popular anonymizer will always beat any fancier technology that lacks the user & devbase.

Safety is subjective and it depends of what you're doing alongside using Tor, but I'd say so. People selling and drugs on darknet markets are all using Tor. Remember the guy that got caught using Facebook to blackmail young girls? https://www.vice.com/en/article/v7gd9b/facebook-helped-fbi-hack-child-predator-buster-hernandez Took 2 years and he was using Facebook, they had to pay a lot of money just to get a vulnerability that still wouldn't have affected him had he just not downloaded the cyberhumped video.

>something something exit nodes NSA T O R Proof that whoever talks about Tor has no actual clue about it. Pathetic LARP thread. RTFM.

>>16800 80% of lainchan is LARPers, me included, the other 20% are jannies and overly confident basementdwellers with crippling avtism. Get real my n!gga, Imageboards are inherently lower quality than forums with user registration and resulting quality control/gatekeeping.

>>16802 When every second passerby leaves a huge steaming pile of feces on the lobby carpet, no amount of janitors will save the place. Besides turning it into an insane asylum, putting tiles instead of carpet, and keeping everyone in electrocution restraining collars for the time being.

>>16766 If I were going to use Tor for anything more than posting on websites and trying to hide pony porn from my ISP, I would certainly venture out to use an IP address that can't be related to me, with TAILS, and try to be as brief as possible. I've seen good things about using email mixnets with Usenet to send encrypted messages and not get caught. >Every caught tor user case boils down to personal stupidity or server related attacks based on webv ulnerabilities or timing association attacks. That's the claim. There's no reason to believe they don't just know about how most people use Tor and merely go after high-profile cases, making up evidence to preserve the illusion.

Why does everyone keep making this thread? The general consensus is that tor is secure, but not a fool proof solution. It's another layer of anonymity and security to add to a well thought out thread model and plan. The general idea is this encrypted hard drive ->public/cracked wifi -> tor network -> c2 server/questionable server This is a decent enough for most if you include opsec and will generally keep you safe. The more times you do "questionable activities" the more chances you have to fuarrrk it up (wifi sniffing on network, forget to route over tor, end server compromise, not using https so tor exit node can see your creds. Generally speaking feds don't want to time and resources on developing a 0day in tor if they don't have too. Exploit dev is hard especially these days and people are auditing the tor code all the time. It's much easier to go for low hanging fruit such as infiltration, osint, and relying on opsec failures, and phishing. tl;dr is tor secure? Yes, but it should be treated as a layer in a security model. Tor should not be treated as a silver bullet.

>>16805 >TAILS I don't know why more people don't use Qubes+Whonix instead of TAILS. VM is a lot better than bare metal, because bare metal can reveal unique hardware details like MAC addresses and serial numbers if it gets compromised. Rare and expensive VM escape exploits are required to get similar information out of a compromised VM.

>>16809 You don't know why more people don't use the idiot proof solution that comes with a step by step guide?

>>16811 The opposite of that, I mean. Qubes is hard and not supported on all hardware. I don't know how Whonix is on Qubes but without it it's a giant pain in the ass relative to Tails.

>>16811 >>16812 I used Qubes+Whonix just to see how hard it was to use. It was stupidly easy.

>>16812 qubes isolates every program in it's own sandbox and assumes every program has a backdoor. whonix routes everything though tor as a router. There is no idiot proof solution.

>>16787 You're right, but there's a reason people use SSH instead of telnet these days. Same principle applies for overlay networks. It might not be the most popular today, but if enough people see the value then it will become the dominant tool.

>>16817 I think he just means that anonymity systems work better the more people are involved. I wish we could keep the pompous fart sniffing incomprehensible word salads to /hum/

>>16814 Before there is a preconfigured distribution of Whonix with locked-down hypervisor OS (be it Qubes or something simpler since it should be an equivalent experience to Tails), people will use Tails. It's still good enough for journalists and drug dealers, good as in compared to Tor Browser on MS Windows.

>>16830 >Before there is a preconfigured distribution of Whonix with locked-down hypervisor OS Yes, that exists, it is called Qubes +Whonix and it's as easy to install as ubuntu. >It's still good enough for journalists and drug dealers I wish people would stop acting like this is true

>>16766 >Is TOR safe enough for criminal activity? >TOR ISHYGDDT >I know of not a single incident where someone was convicted because of tor vulnerabilities or manipulated nodes. Parallel construction. On a long enough timeline, if you're an appealing enough target, you will be caught. All it takes is one 0-day. Even if there are no flaws in the tor protocol or implementation (kek), tor sits atop a mountain of buggy soykaf: millions of lines of libc, openssl, and kernel code. If you're using TBB, add a few million more lines of code for X and Firefox. Heartbleed was in the openssl code for 26 months before it was publicly disclosed. Shellshock was in Bash for *25 years* before it was publicly disclosed. Beneath this veritable Everest of soykaf software is at least a generation of fundamentally flawed hardware vulnerable to side channel attacks. But let's say you have secure hardware (kek) and secure software (kek). Then there's the human element. Are you 100% perfect 100% of the time? All it takes is one lapse in attention or judgement and you've given your adversaries the bit of information they need to start tracking you down. Of course, the glowies aren't going to invest tons of resources and burn a valuable 0-day if you're a small fry. But if you are, why bother? Go to school or learn a trade, get a job, invest in your 401(k) and IRA, retire rich.

>>16830 Tails and whonix are different things. The purpose of Tails is to avoid leaving forensic evidence on the harddrive. Whonix is just a glorified sandbox and firewall for tor browser.

>>16833 There is also a time window to be considered. Many exploits require social engineering and some amount of time to execute, things you can avoid. Consider a CPU backdoor that escalates privileges to root when a rare sequence of instructions is executed. They had to make you run some arbitrary code (javascript, malware) somehow, and you can at least heavily minimize the amount of code running on your board. Let's say you are sending out a command for your bots to propagate to each other- unless they break encryption, or just hack every relay along the way, they will not catch that quick TCP stream, especially once you walk away from whatever endpoint you used to make the connection. I would be most concerned about using a persistent identity in which social engineering vulns or large time intervals are possible. Why give them time to use 0-days for your IRC client or whatever libraries it employs, when you can just mitigate the problem by not engaging in social persistence entirely?

I've sold plenty drugs on the onions, know loads who have, it's fine. The main threat on there is the other people you interact with there and not the software.

>>16832 >it's as easy to install as ubuntu Installing an OS is difficult, more than you as a technically-inclined person with experience think. Both RMS and Linus Torvalds say installing Linux is difficult and they outsource this task to other people. Using a live distro is easier than installing an OS, if Ubuntu live came with same features as Tails, there would be no need in separate distribution.

>>16839 Linus says it was hard to install Debian (Debian and Ubuntu use similar installer sequence): /watch?v=qHGTs1NSB1s RMS says beginners should ask more experienced users with help installing: /watch?v=umQL37AC_YM

>>16839 It is literally less than 20-30 clicks probably to install Ubuntu (or Mint, or Pop OS for that matter) from downloading to installation. I refuse to accept that it requires a technically-knowledgeable person to do it. Not even a tech-savvy person myself. It's just that computing has become so dumbed down for people that even simply downloading an ISO and making a bootable flash drive are "too much" for the n0rmi robots. >>16839 Both of them said that about OSes they had attempted to install DECADES ago and ever since they just refused to do it themselves. Then again, even back in the 90s it was hardly more difficult to install Red Hat or Mandrake than installing even Windows.

>>16809 I tested Whonix without Qubes in KVM/QEMU. Way more comfy than using TAILS. But if I had to do illegal things I think I'll use TAILS.

>>16833 Damn. This place is hilarious. I come here every now and then for the comedy tbqh.

Use i2p and stop making this thread everyday. And watch this scriptboy https://youtu.be/zXmZnU2GdVk

>>16845 Why do you people keep bringing up I2P? They have different purposes.

Now I can't even pretend to larp on this chan, my knowledge of cybersecurity is pretty limited. But i've been trying to access darknet with enough obfuscation to make me sleep easy at night, so i'd appreciate if you guys could rate my basic setup? >tor browser >kali linux on oracleVM >vpn running on main OS Will this keep me out of the soykaf with any fedbois or should I worry more about the network i'm using? Also, how do I run my own 'obscure' node off of IPv6 (if that's a thing?)

>>16850 Your main OS better not be winblows. And I really hope you don't trust your VPN

>>16844 why people post vacuous posts like yours is quite intriquing. On one hand you feel like you are better than that person, like they're in the wrong, but at the same time your ego is so bloated that you feel like you're wasting your time if you correct them. SO in the end you post this kind of smug response to russle their jimmies and get them to respond to you, which in some twisted warped perception would validate your superiority? weird.

>>16860 ancient advice, my dude: Don't feed the troll.

>>16860 Why are you so mad? Do you even know why I found his post funny?

Oops… Pic related.

>>16865 Probably by remembering that the threat model never included global observers, it seems kind of obvious to me, but maybe you're tired. Incidentally, whatever are you using considering that botnets are barely any better? Note that it's implied I2P as well is vulnerable. Which is also known by the project itself as their thread model document warns against timing correlation.

>>16864 Again, as I stated earlier, this does not mean anything. Yes, no soykaf Tor circuits can be deanonymized given enough time intervals, because Tor is not meant for global adversaries in the first place. I2P on the other hand, is extremely resistant to traffic analysis by comparison- for I2P, the eclipse attack is your main tool for use. This post is ignorant FUD.

>>16864 Looks like we've taken in too many /g/ refugees.

>>16888 unironically i2p forums are total cleartext

>>16893 Which doesn't matter since it's actually E2EE. Think about it.

>>16893 Access it via i2p? What's the problem?

>>16889 >/g/ refugees >not refu/g/ees A wasted opportunity.

>>16837 This was my thinking, that someone could evade detection by using guerrilla style warfare. Working in small groups or alone, minimizing your time online, taking opportunistic targets out instead of focusing on any single target, and spacing out attack by months, maybe even years.

>>16899 Since Lainchan thinks my post was [that] due to filter, https://pastebin.com/LexbSdAf here is my response to your post

>>16905 I remember an old story about a CP ring. One of the leaders of the group would assign everyone their handle. Every once in a while all of the handles would be refreshed. The idea was you didn't want adversaries to easily link the names to each other or to previous names, or reveal anything about the individuals using the names. It's an interesting idea if you must use names, I guess.

>>16905 Can you or anyone else please post it on another pastebin service or even better as a txt file on lainchan? pastebin.com is c*ckflared and I can't properly access it with tor.

>>16925 >please post it on another pastebin It just says use random or non-unique usernames to avoid osint. I have no idea why he needed so many words just to say that. Probably a typical /hum/ poster. >I can't properly access it with tor. https://kproxy.com/

>>16850 No. Bad. https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN Also, Kali isn't hardened by any means. You'd probably be much better off using Tails and booting from USB rather than using a VM.

>>16925 Refresh the circuit, dumb nigger.

>>16850 >kali vm kali is just debian with tools. >vpn running on main os while on tor browser. if you route traffic to vpn before tor, the vpn provider can see what your doing. Tor before vpn is usually alot better. the safest bet for someone who can't /sec/ would be just use tails.

>Is TOR safe enough for criminal activity? to be honest regardless of how many people sperg out on it nobody in their right mind is going to deny it being actively and successfully used for criminal activity... But the thing is you can be successful in criminal enterprise often even without using tor. I feel that as a criminal I've mostly had to use it a lot because of it having become common practice, like the use of a messaging app called Wickr which from what I understand has purely managed to market itself to the infosec community without being really technically impressive in any way at all.

>>16957 As has been explained over and over again by Tor developers, it is a BAD IDEA to use VPNs in combination with Tor. Stop giving this advice! https://matt.traudt.xyz/posts/vpn-tor-not-mRikAa4h/ (onion version: http://tv54samlti22655ohq3oaswm64cwf7ulp6wzkjcvdla2hagqcu7uokid.onion/posts/vpn-tor-not-mRikAa4h/)

>>16964 >market itself to the infosec community You mean, market itself to 89IQ wannabe darknet druglords?

>>16966 I'm embarrassed to say I used to be a "VPN then Tor" person. This actually cleared a lot up for me. Never really sat down to read about what I was using, and how it works, which was dumb. Thank you for the read.

>>16775 >All the same, why not use it? Because then everything on the clearnet treats you like a cannibal terrorist child rapist

>>16966 TOR then VPN can be useful if you want to obfuscate the source of TOR traffic

>>16783 The fact that you think the boards you browse has any effect on what it means shows that you probably shouldn't be giving security advice.

>>16809 Use a machine with no internal NIC, or a custom BIOS such as libreboot.

>>16806 >(wifi sniffing on network Just use a long range antenna (don't sit at the place with the AP e.g. the cafe), randomize your MAC every connection and employ transport layer security (OpenVPN through the TOR to your C2).

>>16766 food for thought : https://www.esat.kuleuven.be/cosic/publications/article-2852.pdf

>>16957 > kali is just debian with tools. Those tools add attack surface. https://media.defcon.org/DEF%20CON%2023/DEF%20CON%2023%20presentations/DEF%20CON%2023%20-%20Wesley-McGrew-I-Hunt-Penetration-Testers-WP.pdf For all the VPN+Tor talk, I much prefer contributing to collaborative community documentation rather than pointing to some dude's blog. I'm surprised nobody has linked this yet: https://www.whonix.org/wiki/Tunnels/Introduction

>>17462 Woah, you're telling me that services on windows add attack surface, and the same thing happens on *nix??? /s But for real, Kali is not designed or intended to be hardened out of the box. I mean, Kali/Backtrack only within the last few years installed with a non-root user as the default login... Also, ty for whonix link. I only recently, ashamedly, read it when it was posted in a thread a few months ago. Turns out, you need to know your tools. Go figure.

>>16843 But why? Whonix has live mode and if you wanted to, you could use the grub-live package to make your host amnesic too. I really don't see the benefits of tails here.

>>17462 >For all the VPN+Tor talk, I much prefer contributing to collaborative community documentation rather than pointing to some dude's blog Matt Traudt is a paid Tor developer working for the Naval Research Lab.

>>16769 no it does literally just mean that

>>16782 >splits hairs >calls others dumb Bare metal is programming a chip without the layer of an OS in between, eh? So, if I code for a device in assembly is that bare metal? What if I'm running a driver? What if I have OpenBSD on my Pi? That's bare metal! I prefer the meaning of "not within a VM"

>>17567 The main complaint was that it's a "some dude's blog", not something hosted first-party by the one of the projects directly. Also bonus points for Whonix docs being a wiki. We can't really edit/update Matt's blog.

>>17567 Is he not paid enough to express all his valuable expert opinions on official documentation or is he just making up some street cred for future employment by bumping articles absolutely void of meaning to his blog? Your average darknet forum for dudeweeds has more valid info than all the inane soykaf he posts there or on reddit. So does the Whonix wiki, as lains noted above in the thread. If you want to know how to use Tor, go to Whonix wiki directly: http://dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion/ hurr >People consider [VPN after Tor] because they want to appear to have an IP address that doesn't change and isn't associated with Tor. durr >It ruins Tor so much, <OMG ruins so much!!!! >and you have to trust the VPN company so much, >that you might as well not even use Tor at all. <Heh, VPNtards owned!!!! That's just a fart in the puddle tier arguments, madaiadan tier. VPN = any kind of tunnel. You have all the reasons to use one if you see so convenient for situation, don't let authoritative opinions of blogshit grifters affect your decision.

>>17709 >madaiadan What is this? I only find references to some singer with a different spelling.

>>16775 >why not use TOR Because it gets blacklisted

>>16809 >Rare and expensive VM escape exploits are required to get similar information out of a compromised VM. Someone please post more information, I think we are all interested

>>17821 I2P devs explained that they don't want to turn their project into a mix network, and for some reason they don't want it to be used for outproxying by default (why? This would give it more utility, noise, attention, though it does mitigate some of the anonymity advantages of the techniques they have implemented I suppose. They seem very set on it being its own little "Invisible Internet"- go figure.)

>>16773 thanks lain this is a good explanation

>>17836 Don't bring your phone if you're going to hang out at a coffee shop you'll make suspicious communications from. Don't be stupid.

>>16782 "Not inside a VM" is also wrong. Bare metal is programming a chip without the layer of an OS in between. When you are "programming a chip without the layer of an OS in between" then the code you are writing is the OS. By your own definition an OS running without a VM is running on bare metal. When an OS is running ontop of another OS (+hypervisor) then that guest OS is not running on bare metal anymore. This is consistent with how both developers and sysadmins use the term. >>16800 Anyone who writes TOR instead of Tor probably hasn't read any actual documentation or research papers and can be safely ignored. https://support.torproject.org/about/#why-is-it-called-tor >>17836 >5. Don't forget to pay the bill if they serve before billing; With cash or giftcard. When connecting to wifi make sure you don't leak any unique identifies like probe requests, mac address, hostname and dhcp duid. Cameras can be a problem. >>17822 >I2P devs explained that they don't want to turn their project into a mix network i2p's garlic routing does group together multiple people's traffic for part of the journey to make it harder to track individuals. Everything >>17821 said about the project itself is accurate though. Good ideas are not as important as good implementation.

>>16782 >"Not inside a VM" is also wrong. Bare metal is programming a chip without the layer of an OS in between. When you are "programming a chip without the layer of an OS in between" then the code you are writing is the OS. By your own definition an OS running without a VM is running on bare metal. When an OS is running ontop of another OS (+hypervisor) then that guest OS is not running on bare metal anymore. This is consistent with how both developers and sysadmins use the term. >>16800 Anyone who writes TOR instead of Tor probably hasn't read any actual documentation or research papers and can be safely ignored. https://support.torproject.org/about/#why-is-it-called-tor >>17836 >5. Don't forget to pay the bill if they serve before billing; With cash or giftcard. When connecting to wifi make sure you don't leak any unique identifies like probe requests, mac address, hostname and dhcp duid. Cameras can be a problem. >>17822 >I2P devs explained that they don't want to turn their project into a mix network i2p's garlic routing does group together multiple people's traffic for part of the journey to make it harder to track individuals. Everything >>17821 said about the project itself is accurate though. Good ideas are not as important as good implementation.

>>17845 Directional wifi anthenna and just roam around your neighbourhood

>>17848 >hi lain, I liked your online profile, where are we going for our date? <shut up and hold this directional antenna while we drive around the neighborhood >o-ok

>>17849 I would be smitten for sure

>>17848 On a cloudy day, preferably under some concrete overpass, if you care about geostationary satellites being trained on your face.

>>17847 >Anyone who writes TOR instead of Tor probably hasn't read any actual documentation or research papers and can be safely ignored. You may say that. I'd argue that "TOR" is easier to discern in a sizeable body of text in comparison to "Tor".

>>17861 >You may say that. No, the Tor project themselves say that. https://support.torproject.org/about/#why-is-it-called-tor https://support.torproject.org/about/#why-is-it-called-tor https://support.torproject.org/about/#why-is-it-called-tor https://support.torproject.org/about/#why-is-it-called-tor

depends on what you do. to be honest.

NSA/CIA/whatever don't care about small time criminals, they care about people who are threats to the state (read: insurgents, other states). So if you're scamming people, buying drugs, hacking mom and pop stores, they don't care. That's the job of small time cops, and they don't have the resources/abilities to go after someone with actually good security and opsec. Occasionally the FBI arrests people that really screwed up their opsec to make the public think they're doing their job, but you never hear about the high-profile targets because they don't want to reveal the methods they use to catch them. Seriously, using Linux, Tor and not posting identifying information is good enough for most things. As for the NSA, remember that the internet is basically ran by the government and all ISPs are backdoored, and they have an insane amount of zero-days and budget for penetration into your computer. The problem isn't hiding what you're saying, it's hiding who you are and who you're talking to. Afaict strong encryption methods haven't been broken (yet), so public/private key encryption is still legit. But if you're talking over the internet, you need a way for it to not be linked to you.

>>19394 >NSA/CIA/whatever don't care about small time criminals, But they are paranoid as hell.

They just don't do lots of stuff, but they can. They control whatever they need to. What is organized is controlled, so what is organized is a presentation.

they have the ability to remove data from anyone's computer also this place glows what the fuarrrk do you think?

I'm posting "evidence" for circumvention of the judicial system right now, because I'm being illegally surveilled.

>>16809 Tails is for larpers. Tails is no better than torifying your connections on any linux distribution. The live feature is absolutely useless in the event of an attack, the only thing preventing disk writes are software blocks, these soft blocks can (and would) be bypassed through some exploit in the event of an attack, allowing the attacker to make a write directly to the USB. The live configuration is not hooked to physical controllers in order to prevent disk writes. Low level disk writing can already occur within soft blocked disk writing. People should just use Whonix instead, don't bother with the Whonix live mode by the way it is just as worthless as Tails. People should try to have as many possible layers of security possible. With Tails you have little more than the firewall. Tails does not have virtualization. Qubes is by far the best in regards to layered security. WiFi can also be very useful depending on the situation of the individual, the issue with WiFi is that it can allow TEMPEST to grab your encryption key. WiFi is evil, it should always be avoided at all costs unless you can compensate for the risk. https://www.schneier.com/blog/archives/2016/02/practical_tempe.html https://www.schneier.com/blog/archives/2015/06/tempest_attack.html https://www.rambus.com/blogs/tempest-side-channel-attacks-recover-aes-256-encryption-keys/ Physically disabling WiFi does not protect you from these attacks by the way, they make the attack less easy to conduct. Even having a phone near your device jeopardizes your encryption key, try to keep a 30 meter radius around your device free of smart devices.

https://www.mdpi.com/2076-3417/12/1/137/html Achieving Sender Anonymity in Tor against the Global Passive Adversary > Abstract > Tor is the de facto standard used for anonymous communication over the Internet. Despite its wide usage, Tor does not guarantee sender anonymity, even in a threat model in which the attacker passively observes the traffic at the first Tor router. In a more severe threat model, in which the adversary can perform traffic analysis on the first and last Tor routers, relationship anonymity is also broken. In this paper, we propose a new protocol extending Tor to achieve sender anonymity (and then relationship anonymity) in the most severe threat model, allowing a global passive adversary to monitor all of the traffic in the network. We compare our proposal with Tor through the lens of security in an incremental threat model. The experimental validation shows that the price we have to pay in terms of network performance is tolerable.

>>16841 I'm a smoothbrain, I can do something like install an OS but I need to go by guides online. I solve a problem using research, then forget how I did it. I've never understood how people just retain information and get good with technology, like knowing a programming language.

US intelligence tried to MiTM me and my Tor entry node >Guard REDACTED ($REDACTED ID) is failing an extremely large amount of circuits. This could indicate a route manipulation attack, extreme network overload, or a bug. I couldn't connect to the guard entry node I've been connecting to for months, it was still up and nothing wrong with my internet. Changed my IP address and it worked perfectly.

So some (the worst) fundamental open problems in low-latency anonymizing networks: > Mitigating sybil attacks WITHOUT a single trusted authority > End-to-end correlation resistance WITHOUT intolerable expenses In the interest of simplicity, reliability, and efficiency the Tor Project sucked it up, admitted that fully decentralized consensus is an open problem, and built a formidable reputation as a highly-transparent nonprofit for everyone to depend on. Only 17 entities run directory authorities, though seems like the consensus has never been manipulated. Why is consensus about which relays are legitimate difficult? This is because trust is not a problem that can be solved by technology alone, there is an inherently human element to it. If a malicious relay is entirely passive, there is no way[*] to detect whether or not the relay operator is even a real person via technical heuristics. [*] - It seems likely that the Tor developers have used some kind of side-channel to fingerprint differences between custom relay software and the official software on occasion, which has been used to remove hundreds of malicious relays. This is not reliable imo, merely a short- or medium-term band-aid. Transparency and reputation are the factors that underly trust, and trust, no matter how lightly distributed, is what underpins anonymity. For now we trust the directory authorities, but how much is that trust worth if even those authorities themselves usually cannot discern who is running the relays they add to the consensus? Sure, over 50% of exit nodes have set up some domain records that attest to who they are, and so have 10% of guards, but that is not really enough and certainly is not something that ever has to enter the mind of a Tor client. In the long-term, I think we will have to use a web-of-trust kind of system, in which the operator of a relay signs the key of another relay to vouch for their being a real person or not, and this could become another factor utilized in determining how much bandwidth should be funneled through a relay, or whether or not to use one at all. Interaction among relay operators could be highly encouraged. However it must be questioned how scalable a web of trust can really be, because of the nature of transitive trust- if A trusts B, how much stock should she put in B's judgement of C- should she even trust C at all? The more transitive trust you engage in, the less manual effort you have to give, but the more susceptible you are to deception. And it is worth questioning the nature of that trust; if Alice endorses Bob, what assumptions are we making about that decision? Does that mean Alice believes Bob is a real human being operating relays, or perhaps it means Alice copypasted the wrong key and really meant to vouch for Charlie, or Bob paid Alice $100 to increase his reputation? The criteria of peoples' judgement is incredibly variable. Perhaps we just accept that some people will have wacky judgement, and under the 'distributed trust' paradigm we roll with the idea that most people are legit most of the time. Better than trusting a faceless horde of anonymous relays run by Swiss authorities, I guess. One error-prone aspect of a web of trust is that the user must pick some points at which to 'anchor' their initial trust, as the basis for your subjective evaluation of which peers are worth routing through. So trusting the judgement of those anchors that the set of relay operators they vouch for are real people. Perhaps you would also look at how 'interwoven' these trust relationships are, who has the most vouches from operators as few hops away from anchor points as possible- so trusting the vouch of the anchors (0 hops away) more than the vouch of a node 1 or 2 hops removed from the anchor. And if you trust A, who vouches for both B and C, how strengthened is their reputation if B and C vouch for each other? Or D is vouched for by B, how do we weight the effect of D trying to vouch for someone who closer to the anchor, like B or C? How much less should they be trusted if further away? Should the weight decrease exponentially, or via some other distribution? Should the trust only flow downwards or within the same 'level' of hops, but never upwards? This would create interwoven 'clusters' and 'cliques' of relays affirming each others' existence, from which relay software will have some anchor points manually chosen. However, the average user can hardly be expected to do this themselves, so what would their trust anchors be- just picked out by the Tor Project? >Traffic correlation While it resists 'traffic analysis' attacks, the Tor Project just avoids including traffic correlation in the scope of its design, which kinda bends the knee to 'global passive adversaries' (read: governments that buy IP packet headers from Tier 1 ISPs, key IXPs, underwater cables to measure a decent % of global traffic flow). When Tor was first created the idea of such adversaries was a joke due to storage and bandwidth constraints. To their credit it was still a joke into at least 2017, but agencies have had a good number of years to cut yet more deals with tech companies and improve the actual analysis of stored data. For example they needn't burden their infrastructure with encrypted packets flowing out of PornHub, that's stupid as fuarrrk. They have probably been performing a great number of optimizations on what they bother collecting, so it is feasible that they can store any metadata that they come into contact with now, and international cyber cooperation doesn't seem to be decreasing, so their collection is likely growing a bit. So why don't they do anything about it? Well after looking at some old slides and papers, I saw that even Roger Dingledine, who wrote Tor, was aware of countermeasures against correlation attacks, but they were too expensive to defend against back in the early 2000s and/or there was not enough research. I am referring to 'link padding', the generation of fake traffic patterns between A and B. The idea is that if the bandwidth pattern from USER to RELAY A cannot be linked to the pattern between EXIT and DESTINATION, or even further if the traffic patterns of many users cannot be distinguished from each other, then you cannot establish a correlation between the USER and the DESTINATION (relationship anonymity). The more peers that a relay engages in link padding with, the more robust the anonymity, but the more resources that must be consumed. Nowadays with some papers I've read it seems like link padding between clients may very well be sufficient to guarantee 'sender anonymity' (cannot tell whether a given user is sending any data at all) which implies relationship anonymity, and it seems like some of the measures may be possible to implement. Maybe we need some kind of more-decentralized Tor that engages in dummy traffic between users and makes sybil attacks harder against the volunteer relays. Or maybe we should just do the classic "tunnel your onion routed packets over a BitTorrent swarm" :)

>>19743 I also got one of these today.

>>19746 >Well after looking at some old slides and papers, I saw that even Roger Dingledine, who wrote Tor, was aware of countermeasures against correlation attacks, but they were too expensive to defend against back in the early 2000s and/or there was not enough research. I am referring to 'link padding', the generation of fake traffic patterns between A and B. The idea is that if the bandwidth pattern from USER to RELAY A cannot be linked to the pattern between EXIT and DESTINATION, or even further if the traffic patterns of many users cannot be distinguished from each other, then you cannot establish a correlation between the USER and the DESTINATION (relationship anonymity). In an interview a few months ago, Nick Mathewson, one of the other Tor founders, mentioned they were looking back into implementing padding. I think the timeline was having it implemented by the end of the year or next year, but I'm not positive on that.

>>19748 >In an interview a few months ago, Nick Mathewson, one of the other Tor founders, mentioned they were looking back into implementing padding. I think the timeline was having it implemented by the end of the year or next year, but I'm not positive on that. I have not seen this myself, but if such an established project considers widening their scope to include more powerful adversaries, I'll be pretty excited, cuz then it won't just be people like me with no resources who intend to develop for these tactics, and the anonymity set would be much larger. Because of increased bandwidth available since the 90s, and the increasing threat of very-real semi-global adversaries (really, these ad agencies, CDNs, and T1s are on almost equal footing in terms of IP packet headers as intelligence agencies!), they will be forced to defend eventually. The real exciting thing is that it seems like some flavors of padding can be accomplished without intolerable performance/resource loss (i posted a link to one paper on this a few posts up), so we could very well have real powerful tools to work with soon. The cost/effort of hiding your traffic against these types of attackers will go down, that is for sure.

If the TOR protocol actually posed a roadblock to bioluminiscent agents doing their job, it would have been outlawed by now.

>>19842 Not necessarily true, they used to depend on it themselves and still may, and it would cause reputational damage and a speed-up of the anonimity side of this arms race, given how established the project is.

Is the darknet secure? ha ha no I got ripped off again just recently trying to score something. The entire site was cloned with the same log in and account details but with different wallet, the old switchero. Must've been an inside job, its a scam that's been happening all over.

>>19845 do your market not provide its public key and a signed text with the current url and timestamp?

>>19842 >If the TOR protocol actually posed a roadblock to bioluminiscent agents doing their job, it would have been outlawed by now. What convinces to "reason" about the world in this manner? If this were the way the world worked, open source software would be outlawed, cryptography research would be outlawed, even the sale of mere pen and paper would be outlawed. Education would be outlawed. Tor is quite secure within the constraints of the scope of its design. Everyone knows that if you want to deal with attackers who have enough money to copy most internet traffic, you have to create noise traffic and engage in defense-in-depth techniques rather than relying on any given tool, to avoid having a single point of failure. Pro tip for western anons: Write a program that sends a bunch of useless bandwidth to a tunnel hosted in a country that doesn't cooperate with your own, 'bury' your true traffic within the false traffic pattern, connect to a (private?) Tor relay also running in that country, and then fire away. Your entry stream looks completely different from the exit stream :) now you just make sure it's running for a good while rather than just starting at the same time as the circuit. If you are worried about crypto being broken someday, also consider not using your home connection to do anything sensitive :) Also due to the 'base rate fallacy' it is likely that even your ordinary browsing traffic through Tor cannot always be perfectly correlated, due to the network's size. I still view the tech as a great $$$ barrier to the vast majority of adversaries wanting to attack you, like advertisement agencies.

>>16766 I can't believe this thread is still up. Then again, it's a topic worth investigating. Personally, I would use more layers of protection "under" TOR, if you will. The thing running TOR would just be a Pi on a Timer on some kind of open WiFi. The data would then be streamed over a custom VPN and maybe a proxy chain. It would look like normal data. >people using TOR have been caught though It's been proven a hacker team can pwn a target which is using TOR. It costs a lot of money though. Millions.

>>19850 you don't need to write a program to send useless traffic, you can just torrent files through the same network as the rest of your Tor traffic

>>16766 There is one answer to this question and it's not up for debate. it's common sense: tor is a tool and when used properly it can help protect you. tor is NOT a get out of jail free card and is not some glowie proof magic program. YOU STILL NEED GOOD OPSEC. its really that simple. I dont understand why there is even a discussion in this thread. If you're seriously debating this garbage you're misinformed and you can start by reading the tor website. /thread

>>>19852 >It's been proven a hacker team can pwn a target which is using TOR. It costs a lot of money though. Millions. Pwn someone under what context? Are you talking about a pseudonymous person (long-lived identity), or an anonymous action (no persistent identity)? The former can be targeted for hacking or have its future actions predicted but the latter cannot. What software are you even referring to? In the case of a pseudonym, you could do recon to figure out what software/hardware setup someone uses and use that to target them, but this cannot be done for an anonymous actor, because they have already disappeared and will not show themselves again. Again, who let the reddit privacy enthusiasts onto lainchan? This is not the proper way to reason about technical topics. You need to be more precise in the way you think about things.

>>19852 >TOR It's Tor. >Personally, I would use more layers of protection "under" TOR, if you will. The thing running TOR would just be a Pi on a Timer on some kind of open WiFi. Using a pi as a router to send all of your traffic over Tor is a naive idea that makes you more vulnerable to attacks. When you run the Tor daemon as a local service and use software written for use with Tor, like the Tor Browser Bundle, it automatically uses different circuits for different sites. If you just set up a router that routes everything through Tor, all of your traffic goes through the same circuit, which makes identity correlation attacks much easier. >It's been proven a hacker team can pwn a target which is using TOR. It costs a lot of money though. Millions. There are attacks that can work given certain circumstances, but it is still inaccurate to say that any target using Tor can be pwned.

it really depends on how much the feds want your ass selling anything via tor is probably a bad idea(weapons by far is the worst thing you can sell, you are going to get caught and fuarrrked by the atf hard), running a site is also a worse idea cause they can concentrate their activity on you. but if you are doing something small scale or the like, its not hard to stay under the radar because there are hundreds of others like youi and the feds simply dont have enough time to track everyone. the feds arent a monolyth really, they have limited manpower, really you should think about this, not if you can get caught, but do the feds care about investing the time and resources into denanoymizing you specifically. if you'd get less than 5-15 years you probably are fine, there's bigger fish to fry

>>19867 Read the last, like, 20ish posts of the thread. Even if one intends to do something high-profile, one can raise the bar such that the stars must align perfectly against them to bring them down. You're right that running infrastructure makes you targetable, but to expand on that I would say that using any pseudonym for a long period of time is similar in risk. If you can manage it, drop the name- ego is worthless. You talk of 'staying under the radar', but when you go anonymous instead of pseudonymous you can be under the radar almost 100% of the time, no matter what it is you do. All you have to do is refrain from touching literally anything remotely related to your soykaf at any time other than when you are employing maximum security measures. You don't sit there brewing soykaf on twitter, forums, IRC or whatever with your nym (lmfao) from your home connection (LOL). Anonymity is anti-social. A bonus of this is that even if someone does 100 actions, getting caught once doesn't burn them for the other 99.

>>16778 >State police like the FBI >State >FBI lainon, i... you do know what the F stands for, right?

>>16827 Im very retarded, what does the last bit of the image supposed to mean?

>>19912 While it may be true that someone who sees that license plate would not be able to recall the correct license plate number, the description of "all 1's or something" is enough to identify him because that format is still very unique and it's a suspicious format, so it's more likely to be under scrutiny. So it doesn't provide him any anonymity. In the context of that post, I believe lain is using it to draw a parallel to the need for anonymity networks to have a large number of users. If thousands of people in the area had license plates of a similar format (ignoring, for the sake of example, that license plates are either 6 or 7 chars which results in an upper bound of 192 people), then "all 1s or something" wouldn't be enough to identify him. A real world example could be that Harvard student who got arrested for sending in hoax bomb threats to delay exams. He used an temporary email service and Tor to send the threats, but he did this from Harvard's network. So once Harvard figured out the threat was from a Tor user, they checked their logs and found he was the only person on the Harvard network using Tor at the time the threats were sent.

> 16768 schizo confirmed, god speed

>Is TOR safe enough for criminal activity? No, end of discussion. You will be caught one way or another.

>>16850 This is fuarrrking stupid, kali has soykafsecurity running everything as root,

>>16778 I'm a journalist that's planning on doxxing a lot of members of the cabal. How fuarrrked am I?

>>20550 Here's a cautionary tale: https://www.youtube.com/watch?v=85h_fTGyufs

>>20550 Let's put it this way: the fact that you posted this on a public forum is a sign that you're pretty fuarrrked. Might as well post everything you have right now.

>>20499 >you do realize there is a thing called beacon absorbers around? >there's no guarantee your phone or laptop doesn't just announce the mac address for a millisecond by any chance Laptop wifi/bluetooth modules are PCIe cards you can just pull them out. Plug in a USB wifi dongle when you get to your destination. Leave your phone at home. >this is futile as most coffee shops still have captive portals and require you to get OTP code from your mobile number (which is registered to your name) Your country is not the only country in the world. I have never heard of this. >>20550 If you're bragging about it to strangers then you're clearly in it for the virtue signalling and not actually making a difference.

>>20558 No... Who would do such a thing?

>>20565 Even if they don't own the nodes, they can still see your connection to the entrance and the exit's connection to the site?

>>20571 how? They would need access to the server and even if they had access to the server your connection is encrypted via previous nodes. Your ISP can see you are connected to TOR and that's pretty much it.

>>20572 I think they're referring to a case where a large scale adversarial entity such as an ISP or similar entity such as a state actor with access to ISPs) both provides you with internet and provides the website you're visiting or the exit node your using (or two ISPs are coordinating to share this information). In such a case, they don't have access to any of the tor nodes or the server involved, but they'll still see that you connected to a tor node at the same time an exit node connected to the website and be able to do some timing and traffic analysis. Such a global adversary was thought to be too costly to operate when Tor was designed, but now there is reasonable concern that such a global adversary may be feasible in certain cases - for example, if you live in a country where the government fully controls the internet and you use tor to access a site hosted within your country. However there are plans to (or maybe its already happened) add padding and some other mechanisms that would make even attacks like that no longer practical. Bridges can also mitigate this as long as the adversary is unaware of the bridge and cannot detect the bridge retroactively.

>>20573 No even your isp doesn't have access to the exit node you are connected too because all of the traffic between the entrance and exit node are encrypted and using a bridge, as you said, can mitigate weather your ISP knows you are connected to tor or not and if they can see what entrance node you are going in. Also, all of these issues can be solved by simply not using exit nodes and only using hidden networks. But they cannot see your activity from the point of the exit node, no.

>>20574 >No even your isp doesn't have access to the exit node you are connected too because all of the traffic between the entrance and exit node are encrypted I think you missed the condition at the start of my post: >a large scale adversarial entity... both provides you with internet and provides the website you're visiting or the exit node your using A better and more general way to have phrased this may have been "a large adversary who has access to network traffic for you or your entry node, AND network traffic fof your exit node or your actual destination. I'm not saying any given ISP can correlate any of their users' Tor traffic, but rather that someone with access to enough of your ISP's data and your destination's ISP's data (or your entry node and exit node) can attempt some attacks. This is more feasible in some cases, such as if you're connecting to a destination that also uses your ISP, or if your ISP coordinates with other ISPs to deanonymize users. Or, more practically, a state actor (or coordinating state actors) aggregates data from ISPs and does the attacks. I should also clarify that performing timing and correlation attacks does not necessarily equal deanonymization because such attacks are not fully reliable. And I should clarify that I dont want this to come across as one of the fearmongering "zomg tor is br0ken!!11" morons. This is a theoretical attack (known since the beginning) that historically is infeasible but may be (or become) practical for deanonymizing a subset of tor users given a large enough adversary - not something most Tor users need to be concerned with. The main point of my post is that the claim by >>20565 that >Traffic analysis cannot happen unless the feds magically control both the entrance and exit node is inaccurate as traffic analysis doesn't need to control the nodes. It only need access to the nodes' network traffic which can be collected without owning the nodes.

>>20574 Your ISP and the NSA are one in the same. Consider your ISP to be the NSA. Ok, so the NSA can see you are entering the Tor network unless you use bridges, in that case they may be able to see you are entering the network, they may not. This also considers the bridge you are using is not compromised. The entry nodes are monitored, and some are compromised, this is the same for exit nodes. Traffic entering and exiting the network is monitored and recorded. So these individuals have the means of performing correlation attacks. They aren't capable of performing them reliably all of the time but that does not mean they are not capable of performing these attacks. Just be overly cautious, there is much debate and attention given to the security of the Tor network and less around other measures of security which are more likely to be exploited against you. >>19620 nobody gives a fuarrrk about TEMPEST unfortunately, people should safeguard against TEMPEST to the best of their ability and READ as much material on the subject as they possibly can.

what if i use tor for tunneling nmap and other pentest activity on my target websites?

>>20628 that is gotta be so "sus". u gotta make sure that trafficis looking pretty normal + scanning will take ages.

I would have thought using tails on public wifi would have been a pretty good approach, but whenever i use certain linux live distros there's no option for wifi, and I have to connect to the Internet by connecting my phone and making a hotspot. In fact, the only distro's I've ever used that just work out the box are Mint and Ubuntu in this regard. From what I understand, this is due to certain distro not coming with certain drivers, which many people find preferable. But as a tech smoothbrain, it's kind of an obstacle. Given the fact Tails makes it necessary for me to connect to the Internet via a hotspot, I feel it detracts from its security. I'd use it a LOT more if I could just boot up from USB and connect to any wifi. I also don't like how any discussion of anonymity online has to imply some kind of nefarious or illegal activity. Big tech is evil and I feel our aspiring towards better security is entirely reasonable.

>>20798 Get a different wireless adapter that is supported. ALFA cards are generally a good choice but you'll want to check to make sure it supported on whatever distro you're trying to use.

>>20798 Using Tails on public wifi isn't a great idea in my opinion. People really should try their best to avoid using wifi in general. I don't want to go on a long autistic rambling, but I will say that Tails alongside any live distro is not a good choice for "anonymity" or "security" because as far as I know, none of them can reliably prevent disk writing due to the fact that disk writing is disabled with soft blocks these systems don't hook to disk controllers and physically prevent your hardware from making a write to a disk. So in that disk writes cannot be prevented to a certainty. Alongside that the restrictions can be bypassed through exploits. Tails does provide a torifying firewall which is nice but can be configured on your base system by yourself. Tails does not feature virtualization, once your Tails install is compromised an attacker has access to your base system and can easily deanonymize you and alter your firmware. Whonix is superior to Tails in all aspects, it even features a useless live mode :D there is no reason for using Tails. You shouldn't be using your phone for internet, in fact you shouldn't have your phone anywhere near your device. All devices, wireless or not emit electromagnetic radiation, the frequencies emitted contain information about the processes the device is conducting, and can be intercepted by any wireless device, meaning all wireless devices are a liability. The information is highly sensitive, you should research TEMPEST attacks, attackers have produced encryption keys and decrypted encrypted messages as they are relayed in real time and such. Smart devices could theoretically autonomously (without human activity) intercept these frequencies and reconstruct the information present upon them, reading the information. Wireless systems are especially bad as they emit far more emf than wired systems, using wifi you are literally broadcasting to the world your internet activity although the data within should be inaccessible to most, but not to a passive observer like the NSA. The NSA does not permit any wireless devices within 15 meters of their sensitive systems, be they radios or phones, nothing. TEMPEST is not well understood by normal people like us as the information regarding TEMPEST is closely guarded, one time a security contractor of some sort was going to give a lecture on TEMPEST, days before they were to give the lecture the entire lecture was classified and shut down by the NSA. The scarce information available is enough to determine it is a massive threat, yet nobody seems to care about it. That being said I would stick to wired connections, remove wireless modules from your device, don't bother with placebo soft blocks like RFKill. If you do not fully understand what you're up against you should exercise "extreme" caution.

>>20808 Is there any reliable source for how prevalent such malicious exit nodes are? I remember a few years ago, researchers checked for exit nodes that were attempting mitm attacks, I think by checking for injected content and ssl stripping on non-ssl pages, redirection to non-ssl sites, and cert errors caused by ssl mitm attacks, but as I recall, there were very few of these nodes. >javascript sniffing global keystrokes Source? I've seen javascript that can monitor on-page keystrokes obviously, but am unaware of any that gets global keystroke monitoring (without being chained to an exploit to break the sandbox).

>>20813 No external source, no. And there's no direct route from standard JavaScript to all keystates of the X server, Mozilla and/or Google fuarrrkery notwithstanding. However, DSOs can link to xlib symbols, so it's just a matter of sneaking a compromised media codec into the browser session, causing the browser to load it and call into it, and synthesizing an useful Display structure or capturing one from elsewhere (e.g. the media codec API). What I'm saying here is, don't go on Twitter with Firefox even if you're running OpenBSD. (Don't go on Twitter with Chromium, either, just to be safe -- the OpenBSD version of chromium is multiple bumps out of date.)

>>20808 LMAO imagine using Tor with javascript enabled and sending your real user agent. Chump behavior.

>>16766 Because you're asking this you're already incriminating yourself. Correlation is no joke

Is it worth worrying about whether or not my ISP can see that I'm using Tor? I configured obfs4 bridges in my Tor settings, but I've read that obfuscating bridges only camouflage you and there's no way to ensure your ISP can't detect you using Tor

>>21659 Depends on your threat model, but generally no, it does not matter for most people's threat models.

>>17727 It's the Whonix dev iirc

>>19893 do you think everyone else in this thread is european or did no one want to explain to you that state means more than "glorified district" outside of america?