sweetbitter

Joined 5 years ago

Karma
192
Submissions
168
Member since
Sep 6
Anonymity is a treasure.
View on Hacker News

Recent submissions

Comment · 3 years ago
You could just use onion services to to hide the server, and store some backup onion services (whose private keys are kept offline) within the application or its files. When the server goes down due to seizure, you spin up a new one under the backup service's pubkey, and sign a list of new backup keys which will also be kept offline until the next seizure.

You could also combine encryption with steganography, if you strip non-random 'protocol information' from your encrypted bits. Doing that, it would not be easy to prove that you are sending encrypted messages at all without having obtained your keys.

Comment · 3 years ago
Comment · 3 years ago
Comment · 3 years ago
> It helps to think of it this way, if it touches your phone or the internet in any way, it's part of the public record. No matter what app you were using. So be cognizant of that, it can come back to bite you 10 years later in ways you never would have imagined.

Meh. If that's the case, why bother caring at all? Bring it on!

Comment · 3 years ago
If you're serious about it, check out this article: https://www.vice.com/en/article/nepxbz/i-gave-a-bounty-hunte...

What you need to do is pick an entity that has the information you desire, and recursively enumerate the graph of all business deals which involve the sale of that information (their downstreams, effectively). After that, you do OSINT to map out all of the employees of every organization that has access to these databases. After you have mapped out these tens of thousands of individuals and their likely social graphs, all you have to do is pay one of them a relatively small sum to do a query on your behalf.

Comment · 3 years ago
Not quite. The guy who wrote Tor can be clearly seen to have been studying a lot of these things in the later 90s, and it was pretty much always public, but only developed after he got the Navy to get him an NSF grant. Hell, in one slide he had made back then, he was even well-aware of some of the fundamental vulnerabilities in the protocol, and the (still too expensive) mitigations for those flaws, so it can't even be said that anything was concealed.

If we go back further to the original concept of chained anonymous remailers as envisioned by Chaum 40 years ago, it gets even harder to claim something like this.

Comment · 3 years ago
> If someone wants you compromised, you will get compromised, it only matters how many resources they are willing to throw at you.

Wants who compromised? What are they going to do against people who use no pseudonym and never originate from the same machine or the same physical location?

Comment · 3 years ago
For very obvious reasons you don't need to run any nodes, craft any malware, or scrutinize a target's layer 3+ OPSEC, in order to break Tor. You simply go to tier 1 ISPs and buy up IP datagram headers going to/from entry nodes and you win. The only solution is a constant rate of fake traffic to the guard node.
Comment · 3 years ago
> can just wait for you to make a mistake.

Anyhow, if one slip-up is enough, you're doing it wrong. Imagine you were a mad scientist testing out a jetpack- you are confident yes? But I imagine you would feel more confident with a bunch of nets, and a trampoline underneath that, and a lightning rod in case of a storm, and a requirement that you hold down multiple buttons at once to play with the controls, etc.

That is, if you are serious you will put in multiple safety nets at every layer of the stack so that "one slip" is not enough.

You like to talk to people, but you know that a long-term pseudonym is the gravest danger of them all.

You like virtualization, but you keep some crucial data and keys(treams) on a un-networked machine.

You like anonymizing networks, but you know the caveats of traffic tunneling and didn't connect from your home router.

You connect to a randomly-chosen wireless AP, but you know that just in case your MAC-spoofing fails or you get pwned or something, you are glad that you bought the device with cash and never tied its characteristics to your identity.

You are glad that the only transceiver connected to the device is an external wireless dongle so that when you are done, you don't accidentally connect with your device from home.

You are glad you waited for an overcast day so that you could thwart spy satellites that use visible/infrared light, and that you connected to the AP from afar to thwart cameras.

The list goes on. The guy whose face you see plastered in the news? Yeah, that guy thought his experimental jetpack was the shit. And it was- until it wasn't.

Comment · 4 years ago
Well, what about Monero? That has low fees and is pretty reliable and private.
Comment · 4 years ago
Thanks for the advice. I use synchronous media like chat protocols much more often, and was blind to this- and yep, it does seem like the primary objection to that argument was born out of a flawed understanding of the analogy.
Comment · 4 years ago
Runtime checker as in the guys who are eager to correct the terminology? Hahahaha
Comment · 4 years ago
> Cryptocurrencies are a qualitatively new thing humanity has never had to deal with ever, no matter how insistent are cryptocurrency aficionados’ in calling it merely “a digital version of cash”. This serves their wallets, by suspending deserved wariness and encouraging unsophisticated people to invest into a financial pyramid, but not truthful description of reality.

Holding no cryptocurrency myself (I don't need to buy anything with it atm :D) I would hardly call myself an 'aficionado'. But you must understand that to compare does not mean to equate. All I was saying is that cryptographic currencies have some of the properties that cash has, but that they also have the ease of transport and storage afforded to us by credit.

I don't see the issue with being able to transport cash across the 'net. Governments can still regulate businesses, banks, so if you go and buy a car and your government wants to know to tax it, the business selling you the car can just report this income. If a bank held your asset for you, they could just be subject to similar regulations as when they hold other assets for you. Once you stop treating it like credit or like some amorphous blob that cannot be regulated, this stuff gets pretty simple to understand.

Comment · 4 years ago
> Kinda sorta. Wasn't that back when people assumed cryptocurrency provided the same kind of privacy that cryptography does, which was (in retrospect), pretty dumb?

Well, there are currencies that do provide strong anonymity, so no?

But yeah agreed that cryptocurrency doesn't have that many use cases, just as cash has a declining number of them. I hope someone makes an Amazon-like platform for it.

Comment · 4 years ago
> The entire purpose of cryptocurrencies are to avoid those things, so while you technically could have them with a cryptocurrency, you would end up with no good reason to have a cryptocurrency at all.

I will substitute a word from your post that will help you understand this easier:

"The entire purpose of cash is to avoid those things, so while you technically could have them with cash, you would end up with no good reason to have cash at all."

Cryptocurrency is not antithetical to banks just like cash and gold are not. It is a digital version of cash, not credit.

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton