Hacker News Reader

Comment by DoItToMe81 | Hacker News Reader

I wouldn't get so excited about this. There have been tons of javascript exploits to leak IP addresses in the past, it's more likely that than the FBI running thousands of servers.

View on HN

Or even something way simpler, like the FBI secretly compromising the user's PC with malware prior to the arrest. Without more detail it's impossible to know whether this is even news.

Out of curiosity, will we get more detail? Presumably the FBI would need to reveal to somebody how they obtained this information in order for it to be admissible as evidence ("he did this, trust us" probably won't fly in court), but is there a legal means by which they could do that without revealing their exact methods to the general public? (I don't actually know what the law says on this subject.)

Parallel construction. They use their real methods to identify the user, then once they know the user, specifically target them with simpler known methods to build evidence for the case. In the court filing, they present evidence that they've gained through known methods which don't work all that well unless you already have a suspect, but they actually caught the suspect using methods that are not public (and won't become so, unless there's an internal leak at the FBI).

But if they were using parallel construction, surely the criminal complaint wouldn't make claims they can't prove using the non-secret chain of evidence, right? Here the court filing alleges that the FBI knows what IP address the defendant used to visit a Tor hidden service. Don't they now have to prove that claim if they want the prosecution to succeed?

They also know what specific pages on the offending websites they accessed.

I'm wondering if the classified document wasn't about tor, but about the 'implants' aka malware that were leaked in the same set of Snowden documents.

I think as much as tor being broken in some fixable way, they'd like it known even less that the FBI installs malware on the devices of persons of interest who haven't been convicted of anything.

If they truly can't break Tor and they deem the person of interest important enough for "national security" then I don't think anyone who has studied history, American or otherwise, believes that they are going to throw their hands up and say "welp, that's it."

Or in the case of Ross Ulbricht, just makes up a story about how he was trying to kill someone by suggesting the idea to him. Then uses that to justify an investigation that just happens to be a dead-end but conveniently gathers a bunch of other evidence that is relevant to another case.

Is there proof of anything like this or is it just a conspiracy theory you’re peddling?

Parallel construction is very real and common

I think it's commonly known, maybe not proven, but also it's a case of can they? yes. Would they? yes. As long as you agree with those two premises it's pretty likely

Parallel construction is not a theory in any way in the US. It is a "decades old, a bedrock concept" according to the DEA.

Outside the US, I have no idea.

> Outside the US, I have no idea.

Genealogists use parallel construction to build out their families. Data from a large variety of sources gets used to indicate and corroborate individuals.

Exclusive: U.S. directs agents to cover up program used to investigate Americans [2013]

https://www.reuters.com/article/us-dea-sod-idUSBRE97409R2013...

It's rather annoying that the initial knee jerk reaction to any negative take on authoritarian government action is labeled as a conspiracy theory to try to discredit it.

The CIA did a great job getting that word out there. It's sad it's used to dismiss credible and logical conclusions so readily.

Perhaps, but the only references I saw to 2019 in the criminal complaint[1] were with respect to Tor and his phone. I don't know if he was actually under surveillance that early or if this is just stuff they later found. While there are plenty of ways this guy could have attracted the attention of California, Florida, or federal law enforcement, it's entirely possible that seeing a US residential IP address is what started this case. I can't really tell without seeing dated search warrant applications.

The latest PDF[2] states:

    In discovery, the Government has declined to provide any information related
    to its TOR operation. The Defense therefore researched and drafted a motion to
    compel such discovery. In the course of this research, the Defense discovered an
    exhibit filed on the public docket in at least two federal cases with similar issues
    (“Exhibit 2”). The document is partially redacted, purports to be the work of a U.S.
    government agency, and is marked “Top Secret.” Outside of these public docket
    filings, Exhibit 2 is widely available on public internet sources. A Google search for
    Exhibit 2’s title yields 102,000 results. All of the top results apparently provide the
    document itself, and most of these date back to 2013.

That would likely be a reference to something leaked by Edward Snowden given the year mentioned.

1. https://www.justice.gov/opa/press-release/file/1279441/downl...

2. https://www.documentcloud.org/documents/23569961-motion-to-r...

> Perhaps, but the only references I saw to 2019 in the criminal complaint[1] were with respect to Tor and his phone. I don't know if he was actually under surveillance that early or if this is just stuff they later found.

From a doc I found[0] he was under aerial surveillance (aka, the FBI Cesnas {related [1]}) since June 2018.

Also some of the facts in the case are...well this is from doc [0].

> Some of the surveillance footage is itself incriminating. (See Doc. 5, pp. 50-51) (asserting that Mr. Alazhari’s travel on certain days in May 2020 shows that he was “scouting targets fora potential mass shooting attack.”).

[0]: https://www.documentcloud.org/documents/21052490-motion-to-s...

[1]: https://news.ycombinator.com/item?id=34109507

> it's more likely that than the FBI running thousands of servers.

Why not both?

From my experience over the years doing datacenter/transit/fiber/etc. type of infrastructure - just assume a government agency of some sort either outright operates an exit node, or has a wiretap on it. You can be the most trustworthy person in the world operating in the name of freedom - outright working for a say a colo provider. Unless you are the CEO, legal team, or the individual engineer responsible for it - you will have no idea you are also operating an exit node under surveillance.

I'd put money on well over 50% of the world's exit nodes being packet captured 24x7.

In WWII the Allies didn't want the Axis to know they had cracked Enigma. They used what today might be called Parallel Construction in order to make the intel look like bad luck and/or spies. They had to let some attacks happen because there was no way they could have known about them without decrypting communications.

The FBI running hundreds of servers is fairly likely, and could give enough data to suggest that all of their information is just grunt detective work.

> it's more likely that than the FBI running thousands of servers.

Why? What's the hurdle for running a bunch of servers? How much does a server cost?

I thought we already had docs showing that the govt runs a ton of tor nodes.

But then you'd need to entice Tor users to turn on Javascript since it's turned off by default.

This is not actually the case, at least not with the most recent versions of the browser

Doesn't the tor browser disable javascript entirely?

The user can enable javascript.

It does not. Noscript is set by default to allow scripts.

https://support.torproject.org/tbb/tbb-34/

> We configure NoScript to allow JavaScript by default in Tor Browser because many websites will not work with JavaScript disabled. Most users would give up on Tor entirely if we disabled JavaScript by default because it would cause so many problems for them.

That said, popular websites on/for Tor are free of JavaScript and they have implemented everything (such as captchas, or the "JavaScript is enabled" warning, and so forth) using pure HTML and CSS. They do use OpenResty[1], too, which is NGINX + Lua. Good stuff.

[1] https://openresty.org/, https://github.com/openresty/lua-nginx-module

What I despise is clearnet sites that refuse to open if you don’t execute JavaScript even when I perfectly well known the page doesn’t depend on it.

(Fuck you imgur)

if I build a site using react, is there a way to fallback to plain HTML?

It's called SSR, but unless you invest a ton of effort into architecture, it won't fallback to the point where buttons and links still work without js, it will just render.

if it's statically generated, yes. you can write an entire site in React using eg GatsbyJS, and it will be built ahead of time, and pages will be available as static HTML.

LibRedirect (https://libredirect.github.io/) can proxy Imgur, Fandom, Medium, and other links to no-JS alternative proxies, though some of the proxies are down or have broken Fandom images, and you have to disable the specific websites so you won't be redirected again.

Yikes. I thought the point of Tor was uncompromising security? This is going to bite some less-experienced people in the ass.

It has.

The NoScript approach is dumb because it easily supports temporary and permanent white-listing of sites, which is agreeable to many (but still problematic depending on what your risk profile).

With NoScript’s current approach, you get ruined when your JavaScript-free-optimized starts sending you nasty JavaScript.

JavaScript used to be disabled by default but too many users were complaining about pages not working. It's not very useful if you're a CFO trying to leak financial documents to a journalist but the website won't work.

Tech-literate people use JavaScript.enabled=false in about:config.

You don't even need to use about:config, it is as simple as setting Security level to "Highest" using the button on the toolbar

Reply on news.ycombinator.com