Hacker News Reader

Comment by de_nied | Hacker News Reader

>"Whoops I forgot to turn my VPN on"

Why would someone be using a VPN if they're using tor for the market? Why would a VPN offer any protection at all? If you're using a VPN and "SSH into one of the servers that they are already watching", then a VPN isn't going to provide anonymity.

View on HN

The model would be something like

    User --> VPN --> Tor --> Market

Assuming the VPN is trustworthy and you don't connect to Tor without it, the VPN would cover up the fact that you used Tor at all.

If you normally use the VPN, but forget it one time, you are now exposed.

If they are able to do a deanonymization attack on the 3 hop Tor circuit why should a VPN protect you? They can just mount a similar attack on the one hop VPN.

Thus the requirement for the VPN to be trustworthy.

What that means changes on the threat model, but for this scenario we'll say a hypothetical VPN provider in a different jurisdiction that takes Monero and has good OpSec.

The reason they can do the deanonymization attack on the Tor circuit is that they have basically unlimited resources to set up nodes, and Tor is built on the assumption that the nodes are all unrelated.

If a Tor session looks like:

    User -> VPN -> Tor( A -> B -> C ) -> Market

then the government could have the advantage of owning both A and B, or any other combination. That is difficult (though not impossible) to do to a VPN that they do not have jurisdiction over.

Anyone can set up a Tor node, but it's not possible to just randomly add nodes to a VPN's network, so they shouldn't be vulnerable to that (barring insecurity in other forms).

Check my other reply. I don't think you understand how deanonymization attacks work. It's not by governments "owning nodes." They might sometimes run the exit node, but that's for detecting certain activity, not finding people.

Plus, you can restrict what nodes are used. It's not like the public nodes are the only ones that exist.

Thanks, I appreciate it.

Clearly I've got gaps in my understanding, any good resources you could point me towards to study up?

I'd check out Wikipedia categories for general pointers. I think it's important to highlight that internet privacy and internet anonymity are two very different things. Also take care on how the word anonymous is used. Some use the word "pseudo-anonymous" which isn't the same thing.

It'd also be helpful to first learn how routing works. Then check out different types of applications(Tor, AnoNet, ZeroNet, etc) and read up on how they implement their networks.

Also read up on how the people who ran the markets got caught (read up articles in addition to Wikipedia).

Be aware Wikipedia shouldn't be used as actual fact. Check the sources. Many editors misinterpret them, or don't even read them at all.

https://en.wikipedia.org/wiki/Category:Internet_privacy

https://en.wikipedia.org/wiki/Category:Anonymity_networks

https://en.wikipedia.org/wiki/Routing

Some keywords/concepts that may help:

I2P/Peer-to-peer/Friend-to-friend/

Onion routing

Garlic routing

Digital fingerprinting

https://en.wikipedia.org/wiki/Mix_network

https://en.wikipedia.org/wiki/Crowds_(anonymity_network)

https://en.wikipedia.org/wiki/ZeroNet

https://en.wikipedia.org/wiki/Anonymous_P2P

Tails/Whonix/QubeOS for system protection.

Amazing, thank you.

The common misconception is that you have to run the nodes to do a traffic correlation attack. It's enough to see the traffic of the nodes e.g. on a IXP or as the ISP. [0] Even if the VPN is trustworthy and adversary that is able to break Tor could most likely still sees the traffic and can do a similar attack like he did for Tor.

I'm not saying that this happened only that if you think that there is a global adversary that can break the Tor anonymity a VPN won't protect you.

[0] https://www.ohmygodel.com/publications/usersrouted-ccs13.pdf

A VPN would not cover up the fact that you used Tor at all. Assuming you're actually utilizing SSH through sock proxies and using a VPN, you can still be fingerprinted and tracked. There are already existing databases that have established profiles for various sites. Your ISP can easily see if you're connecting to one of those sites based on the type of data you're sending. Regardless if it's encrypted.

On the other hand, if you normally do this but forget to one time, it doesn't mean you're automatically exposed. It simply means that if anyone is currently attempting to find you and have an exploit that will actually work on you, then they will be getting you directly instead of your VPN. However, even if you had a VPN, if it's a government agency then generally speaking they will be able to find you anyways. A VPN doesn't "hide" you. It's not meant to.

If you want to stay anonymous, there are several methods that can be utilized. The most obvious one is not connecting to the internet from your own home. Use the Starbucks WiFi. A more clever method would be buying slave bots and using poorly secured wifi netowrks around them to hop over one. Assume VPN connections are from companies based in countries not on friendly terms with yours. Like China/U.S.

  User -> RandomWifi -> VPN/SSH -> Slave -> SecondSlave/WifiHop -> VPN/SSH 2.0 -> Tor -> Market

This is a very basic set up. I would personally add more to it with other stuff, but it all depends on your threat model.

Small note. This assumes you're actually setting up your VPNs, not buying some "VPN service." I saw you wrote about being careful with VPNs and how "trustworthy" they are. I'm not sure why you would ever use a VPN service.

>I'm not sure why you would ever use a VPN service.

Geolocking. That seems to be the only 'accepted' technical answer.

> User -> RandomWifi -> VPN/SSH -> Slave -> SecondSlave/WifiHop -> VPN/SSH 2.0 -> Tor -> Market

One thing I would add to the RandomWifi at starbucks is to make sure not to bring your phone as they could detect you went there if they get to find your RandomWifi starbucks location. Also make sure to change starbucks/RandomWifi location every time and for extra-paranoid reasons, maybe wear some toupee and fake moustache in case they try to get camera recording from the starbucks. I would also do most of the work from home, just run all the db/code updates from home and then sync/push the update at RandomWifi so you just need to stay there a few seconds. You don't even need to get in, just stay outside walking and click the push button from your laptop quickly. Never do it on the same hours either.

Reply on news.ycombinator.com