I Know What You Downloaded on BitTorrent… | Hacker News Reader

I Know What You Downloaded on BitTorrent…

torrentfreak.com

214 pointsllambda86 comments

Interesting removal terms. They pretty much force you to admit that you downloaded, whatever they say you downloaded in order to have your data removed. Immediately after having confirmed your real identity via Facebook, of course. They could sell this information to MPAA and RIAA for gold.

The Details:

By submitting a request to have your download activity removed from our database, you are acknowledging that the activity was, in fact, carried out by yourself. This means that you are only submitting a request to have the details of your own personal activity deleted. Any unrecognized activity, such as files you did not download or do not remember downloading, are not — I repeat, are not to be included in your removal request. Why is this imperative? Well, we actually don’t have to explain ourselves...sorry.

The important part is that you understand these terms and conditions before hitting that beautiful button that will erase your criminal back ground, at least for now. Wait, you did remember to read these terms before making the decision to submit a removal request, right? Of course you did, everyone reads the fine print.

Other Important Things to Consider: We make no guarantees that your information will not appear on any other databases. We may have erased your bad behavior but, keep in mind that your data on this site is aggregated public domain. So, if by chance, another sadistic group of people decides to open a similar web site, we have no control over what they do with your information. Furthermore, if you continue to involve yourself in activity like this, your future download history will, without a doubt, appear in our database again and we may not be as nice about it next time.

If any part of these terms is still unclear, please visit your local elementary school and ask to repeat grades 3 through 5.

Indeed. That's pretty shady. In my mind it transforms this site from "amusing exercise in internet privacy resarch" to "borderline extortion". It's also not a contract or affidavit, though. There's legally nothing to prevent you from lying to them AFAICT.

To top that off, the company running the site is American, not Russian: XMLSHOP LLC.

A better idea is to just cycle the MAC address on your router and get new IPs

That just spreads out the data. It does nothing to erase the association of the IP that pulled the torrent with your account, which can still be subpoenaed by a copyright holder. There are much better privacy solutions.

The (new-style) minutemen of the internet, these. Though this web site may have positive effects, all signs point towards RIAA / MPAA sellout.

keep in mind that your data on this site is aggregated public domain

WTF is "aggregated public domain" supposed to mean? It's certainly not any copyright feature I've ever heard of, and I've done some reading.

Besides that, nobody asked them to "guarantee" that the info wouldn't show up anywhere else, just f-ing delete it from their database. Oh, but maybe not being able to control screen scrapers means that they don't know how to "DELETE FROM `user_activity` WHERE user_id = $foo;"

See? No preventing of screen scrapers necessary.

I think they mean that they can't stop someone who may have already scraped that info before you requested the delete.

Were they ever asked to do so?

Some people might, and this is making it clear that they can't fulfill that request.

What do you mean? I'm quoting their statement, and regardless it's irrelevant towards their ability to delete user data that they actually possess.

Just another layer to their trolling. I doubt they would get much money from MPAA/RIAA since I'd be surprised if those groups didn't have similar and more encompassing databases already. The point about making you acknowledge you downloaded the data is simply a framing of "Just because we have this IP that matches these files doesn't mean you actually downloaded them even if you currently share that IP; but we're only going to comply to take-down requests of your personal data, so if you think an arbitrary IP represents your own personal data, that's your mistake."

> 'd be surprised if those groups didn't have similar and more encompassing databases already.

Those groups don't have Facebook verified identities of people admitting of downloading specific files. Pretty hard to prove that "it wasn't me" at that point.

It might be a joke. It might be a serious attempt to screw you, disguised as a joke. It's like some movie character who tells you not to do something, then pushes you to do it anyway, either to teach you a lesson or because they are actually out to get you. I think it's just a joke, though.

> They could sell this information to MPAA and RIAA for gold.

Maybe in the US, but in many other countries they would be breaking several privacy laws. In fact, even the collecting the initial minimal information (IP's + downloads) already breaks privacy laws in most of Europe. Commercially, this information has no value.

They are an American company.

Thought the site said Russian.

The lack of seriousness on the site greatly compromises the value of the data. As a captcha they they ask you enter the entire text of the USA Constitution, and give a mailing address in Antarctica. There is no evidence that large portions of the data isn't made up, no sane company would want to touch this. The agreement above sound more like an attempt to prevent people from contacting them in the first place (probably as they have to remove data manually), than a prelude to extortion.

> The lack of seriousness on the site greatly compromises the value of the data.

I think that's the point. They want to make a point about privacy, but they don't want anyone to take the specific data seriously.

countries can definitely be forced or rather be asked to cooperate to reduce piracy - http://croak.eu/uDKQwa

Terrifying stuff, even having aliases doesn't work against this form of tyranny...

Sounds like it's time to send them a DMCA notice.

How so? You don't own any copyright over that information. In fact, being completely factual in nature, copyright doesn't apply.

It's a joke people. They claim that the scraper is real though:

"Don't take it seriously

The privacy policy, the contact us page — it’s all a joke. We came up with the idea of building a crawler like this and keeping the maintenance price under $300 a month. There was only one way to prove our theory worked — to implement it in practice. So we did. Now, we find ourselves with a big crawler. We knew what it did but we didn’t know how to use it. So we decided to make a joke out of it. That’s the beauty of jokes — you can make them out of anything.

However, if you have a better idea — don’t hesitate to contact us."

I don't use BitTorrent very often (because I have incoming connections for that torrent in my router's state table for years after I do so), but there were a few things I wanted to download today so I just spun up an EC2 instance, installed Transmission, and did it from there. A 38GiB Blu-Ray image took about two hours. The next time I want to do this, I'll have a completely new IP address.

Is this a terrible idea?

It depends what you're tying to guard yourself against. It's not like Amazon isn't keeping track of who owned that IP at that time.

I guess it would protect you against someone being able to tie all your torrent downloads to a single IP and/or person without a significant amount of effort.

In general, it only takes a lawsuit over one torrent to ruin you though.

Probably, because Amazon has a record of your EC2's instance IP address (even if you only use it for a few hours, I'm sure it's logged somewhere), and if they get a subpoena from the MPAA or similar they might be forced to give them your personal information, in which case you could receive a nastygram from their lawyers.

Brilliant idea! I will have to try this next time.

It depends. Do you ever want to be able to rely on Amazon Web Services as a piece of your business infrastructure at any point in the rest of your life? You're putting that in jeopardy by using EC2 for illegal purposes; Amazon could well ban you from the service if a copyright holder outs you.

Amazon has no reason to be lenient here, especially given how ICE (DHS) has been handling copyright infringement...

That's a lot to risk. I'd rather upset my own ISP than upset Amazon -- Amazon is potentially more valuable to me. At least pick a cloud provider you don't intend to ever use for anything else.

Presumably my business would use an account under the business name.

any ideas why, transmission on a mac is crawling with the same torrent that's lightning fast on vuze via windows? i've tried a few torrents using trasmission, and they would either crawl or not DL at all.. Vuze seems to be more and more intrusive (in fact some malware detectors continually report malicious activity coming from vuze), but somehow they figured out how to make torrents fly.. it's not uncommon for me to get 1mbps downloads..

Check you haven't got the Speed Limit on; then make sure the slow torrent is set to ignore any speed limits; then check how many peers it can share with (default is 60); then check ports are okay.

wow.. looks like people feel really strongly about transmission :)

"Hi. We have no records on you."

Just got that for the past 2 or 3 connections I've used in the past few weeks. It might not be very good, but at least it seems inclined to falsely testify for one's innocence.

I am surprised about the high quality taste other people have who share this VPN. Csikszentmihalyi, Ebook Libraries, Stephen Merchant - proud of my fellow anonymists.

proud of my fellow anonymists

Except, of course, that they didn't pay the authors for any of that high-quality content you like so much.

You can't actually know that.

I would, however, bet a beer.

And so the next step in the cat-and-mouse game is predictable: A whole bunch of forged requests.

Bonus points if the forged IPs are from RIAA sites, DHS, White House, FBI etc.

Done already. Most of the major trackers add random ips to the lists they publish.

This service is BS. I just went there and it gave me a random torrent, "Jennifer Lopez Papi" (or something like that). I wouldn't get anything of JLo's, even if they gave it to me free.

Somebody did from the IP address you seem to be using.

Either you are behind a masquerading NAT, or perhaps your ISP rotates IP addresses and somebody else was using your address the other day, or just maybe your WiFi router isn't as secure as you hoped, or...

The service neatly highlights the caveats of matching people to IP addresses.

I have a static IP, and I'm pretty sure that no-one at my home has downloaded the tv episode this service mentions. It's of course not entirely impossible that someone has hacked my wifi router, but I think that is less probable than it is for some random web service to show some made-up data.

Some trackers inject fake peers.

https://torrentfreak.com/the-pirate-bay-tricks-anti-pirates-...

No, they definitely have bugs. I have a static IP, not shared with anyone, and it has a single bogus entry for me too.

Widely used public trackers inject random ips as peers to provide plausible deniability against this sort of tracking.

It said something wrong for me too. Something about "Magneto", presumably a comic book or something. I know who lives on my street, and I doubt any of them are the hack-the-neighbor's-router types.

It also didn't mention things I have pirated off of public trackers, so, meh.

Someone can just park in your street and steal your internet. Just saying!

They claim they can track 20% of the public torrents people download, and I suspect it's a very specific 20% corresponding to certain trackers and certain torrent clients. I wonder what they are.

Probably public trackers, it didn't find anything on me.

There's no way for any torrent client to hide itself since all this site needs to do is to have a program join the swarm of all torrents it can find and log all the ip's of the peers in that swarm, it doesn't matter what torrent client you use.

However if it's a closed tracker and they do not have access they can't join the swarm and log the ip's. I'd assume that at this point they are only logging ip's on open trackers but there's no technical reason why they couldn't join a private tracker (unless they don't accept more users) and log ip's there aswell.

Private trackers are a lot more difficult. I bet it would raise some eyebrows if a user on a private tracker were to suddenly announce all torrents. On public trackers they can just use multiple IPs, on DHT they are trackers themselves and don't even need to ask others, but on private trackers their crawler will have a hard time getting many accounts to hide its activity.

As long as the connections are direct. If even a small part of Torrent users would use something like OneSwarm, it would provide enough plausible deniability to make this data automatically useless.

I download around 2-3 torrents a week normally using public trackers and this site says "Hi. We have no records on you.". Another note, I use peerblock while downloading not really because I believe in the protection but because its interesting to see the names of organizations which care what i'm doing. Perhaps its actually doing something.

Since I don't use torrents at all (unless if software uses it for updates but I am not aware of anything I currently use that does), it might not be too interesting.

However, the next time I share WiFi with someone, this may be quite useful.

The last lecture of my P2P Systems and Overlay Networks class was about Anonymity. I should probably go over the slides once again.

EDIT: This was a paper about file sharing anonymity, http://www.cs.cornell.edu/people/egs/papers/herbivore-esigop...

Either my roommate has very different music tastes than I thought he did, or They've overestimated my ISPs lease time.

No kidding. I live in a one-bedroom in a college student apartment complex and none of these listed downloads are mine. But from visiting that website, I just learned that the Walking Dead is on it's second season.

Weird, I downloaded 4-5 episodes of an unlicensed series and only one of them got tracked. I'm fairly sure all torrent were from the same source and used the same trackers, but I could be wrong.

Not to mention I use torrents extensively but they only had one torrent on my "file".

I can see this causing a lot of household problems.

Can't we get updated definitions for peerblock which will blacklist their crawling ip?

Looks fake to me:

http://www.youhavedownloaded.com/?q=0.0.0.0

http://www.youhavedownloaded.com/?q=255.255.255.255

http://www.youhavedownloaded.com/?q=192.168.1.1

http://www.youhavedownloaded.com/?q=192.168.2.1

http://www.youhavedownloaded.com/?q=192.168.5.1

[...]

Has this correctly identified anyone's downloading?

i hope this doesn't prompt more people to start using bittorrent through tor.

why?

It is widely considered to be an abuse of tor. The system wasn't built for that from a technical perspective, and from a social perspective, you are degrading the quality of the service for the people who actually need it.

because it makes it so difficult to provide exit nodes in the US for people that actually need them. DMCA complaints will quickly take down an exit node because of tor users sending bittorrent traffic out of it.

Just like DMCA complaints have shut down other internet service providers, like Comcast? Ultimately, in the US, ISPs are not responsible for their users' activity. "Common carrier" and all that. When you open an exit node, you become an ISP.

This is true, however it does put additional pressure on (volunteer) exit node operators nevertheless.

i'm aware of DMCA's safe-harbor provision and i've fought with colo providers over it. when you're not an ISP the size of comcast (or any decent-sized "real" ISP), you're always going to be subject to another company's AUP.

i've had an exit node shut down by a colo provider simply because they didn't want to deal with the overhead of processing the DMCA requests. they knew what tor was and they knew i wasn't the one downloading content, but they just didn't want to deal with it, so it was either turn the exit node into a relay or have my server shut off.

https://trac.torproject.org/projects/tor/wiki/doc/GoodBadISP...

The only thing it has for me is something called "Worms.Crazy.Golf" - something I have never downloaded. I also have a static IP.

This site seems completely bogus.

apparently some trackers have fake peers that might use your IP address. regardless of if that is or isn't the case, it lends you some deniability.

In India, most ISP's don't provide you with a static IP address. So the addresses are shared/recycled. When I opened the website I got a list of torrents that I have not downloaded.

Basically every couple of days this list for me will change and won't be accurate. I'm sure many other ISP's do the same. So this list of downloads isn't entirely accurate.

I knew this was a ruse when I read the bio's at the bottom of the page. I had a good laugh at this one:

"Suren Ter (me) I’m a producer of the site. Like a movie producer, I made the site."

Then several sentences later:

"Me? I don’t do code, I don’t do research, I don’t do design — I do sites. Drop me a message if you’d like."

They are probably not taking dynamic IPs in mind. But the idea is interesting.

I am guilty of downloading one episode of Pawn Stars after my DVR messed up the recording. My DVR re-recorded it the next day. If this is illegal, then I'll just get a VPN and cancel my satellite service.

And that's why I'm behind a VPN. Found one torrent which I assume someone else who had this VPN's temporary IP-adress downloaded earlier, though.

For those on dynamic IP the data is so mixed up. Atleast a date or timestamp of the download would make it more clear.

Anyone have any idea how they collect the data (what IP is dowloading what torrent)?

An integral part of the torrenting process is getting a list of IP addresses from the tracker so you can connect to each IP and start downloading the data. You can log those IP addresses to a database instead of downloading that data.

Also, doesn't work if your service provider provides dynamic IPs.

I have static IP and it knew exactly what i have downloaded; i guess it is using some of the most popular trackers from 'the pirate bay'.

usenet & ssl + nzbmatrix = no more problems.

Your Usenet provider certainly knows what you're downloading. The reason you don't care is because someone sued some Usenet provider in the early 90s, and Usenet providers were deemed "common carriers", not liable for the content they carry. Since downloading copyrighted content is apparently not illegal, it all works out.

Also nice because SSL doesn't tend to get preempted by traffic shaping so you usually get close to the max download rate the ISP says you're paying for.

for me it says, "Well, you are in the clear. But look what others do"...AnalTeenAngels.com - Abbie (584.32 MB)

should i check it out? must be good!

[turns out to be a gay flick, FML]

Reply on news.ycombinator.com