Hacker News Reader

Comment by Scoundreller | Hacker News Reader

> The FBI also found what specific pages Al-Azhari visited, including a section on donating Bitcoin; another focused on military operations conducted by ISIS fighters in Iraq, Syria, and Nigeria; and another page that provided links to material from ISIS’s media arm

Based on what little I know of SSL, this suggests the server was compromised too? Or does tor do a bad job of certificate pinning?

Edit: Or the clients are/were compromised. Or the suspect’s computer was compromised. Or they can somehow decrypt traffic between client and server.

View on HN

> Based on what little I know of SSL, this suggests the server was compromised too?

Not necessarily.

If a passive snooper knows I used Tor Browser to make an SSL request to en.wikipedia.org and received 987,654 bytes then immediately made a SSL request to upload.wikimedia.org and received 1,234,567 bytes that might be enough information to work out I visited https://en.wikipedia.org/wiki/National_Security_Agency.

That size-inference side channel leak has been patched for years, random padding is added between hops to mitigate this.

It is large files / DDoS going over the network that is still hard to obfuscate.

Which is why TOR is intentionally slow, especially when requesting larger files. If it wasn't, you could watch the lump of data traverse across the pipe.

source: n/a

source: padding spec, https://gitweb.torproject.org/torspec.git/tree/padding-spec....

Thank you. My brain is very damp but knew it was somewhere.

That's why Tor is communicating mostly over fixed-size cells with a fixed size of 514 bytes (or 512 if tor version < 4).

There is also random padding added to cells, so that the cell content is unpredictable.

BRB, padding all of my webpages to be exactly 650mb each.

npm install electron react-native-web

Unless I'm missing some info, I don't see anything that points at them finding all this info through Tor or the server. They identified the user AND 'also found what specific pages Al-Azhari visited'. That could've happened from his PC after they arrested him. Language like this is always ambiguous in order to give out as little information as possible while still providing some.

> That could've happened from his PC after they arrested him.

Tor client wouldn’t save any of that.

he may not have been using the tor browser

Reply on news.ycombinator.com