Hacker News Reader

Comment by skriticos2 | Hacker News Reader

>> Reality check: if your credit card details are visible to a third party - you're not anonymous.

I totally agree. Luckily more and more VPN providers accept Bitcoin payment, so that problem is solved (if you don't connect your wallet to your ID, that is) [1]. I think the more challenging part is not sending personally identifiable information through your VPN or encrypt it properly. Much of the Web is architected to identify you based on the most mundane technical information, like your browser string, cookies, the way you type or those little data leeks that happen here and there.

[1] http://www.bestvpnservice.com/blog/vpn-providers-with-bitcoi...

ps. No, I don't use a VPN. But I like to stay informed.

View on HN

>> (if you don't connect your wallet to your ID, that is)

Which is not easy.

Either you have to mine your bitcoins or you have to trust a third party to exchange your bitcoins in order to disconnect the transaction history from you. But you do have to trust that third party.

Those are the only solutions that I know of.

Well, you could just by them on the street with paper money [1]. Or you could use one of the shuffling services around [2].

[1] https://localbitcoins.com/ [2] https://www.google.com/#hl=en&q=bitcoin+laundry

Both requiring you to trust a third party.

Almost everything in modern society, especially most things related to technology, requires trusting a 3rd party at one point or another.

Yes, but the general perception of bitcoin is that it is completely anonymous. Where it in practice probably is, if you don't take any precautions, the least anonymous currency in the world, where everyone can inspect the transaction history of coins and anyone with decent turn-over can map out a lot. Trivially (these databases will, of course, be sold and leaked). And since most services at some point require you to reveal yourself mapping out individuals from bitcoin transactions isn't exactly difficult.

The sad part is that since the history is public, if you goof up and reveal your identity sometime in 2015 your actions of today might also get revealed. To any third party. Potentially way worse than any sort of currency ever used; but the only thing people talk about is how bitcoin is this anonymous currency...

Any government entity interested in setting up honeypot VPN services would also set up honeypot bitcoin laundering services - which would do everything efficiently, properly and cheaply (you can subsidize costs), while keeping logs that can be used when/if really needed.

> which would do everything efficiently, properly and cheaply

Doesn't really sound like government to me...

What government entity cares this much about bittorrent vpns?

Even if you use magic to pay for the VPN, there's still lots of linkability just based on time of use, source-IP, etc. Add to that all the traffic which goes over the VPN, and you're probably screwed.

Tor is the right solution here, not a VPN.

I wonder how large percentage of tor exit nodes (and nodes in general) are operated by intelligence agencies? I remember reading that the various agencies across Europe were active in setting up and running mixmaster remailers -- and the (stated) purpose of TOR is to be a viable covert communication channel for spies.

Remember that a "node run by the CIA", can just mean that the ph.d. student that required some resources from the IT department has a handler. Said student might even think the thing isn't monitored -- although I suspect it would be easier to to involve the admin, then keep him/her in the dark.

I think the solution to this problem probably doesn't involve trying to track down these bad nodes. Rather, more people should host Tor nodes, so as to reduce the chance of someone connecting to a bad one. As big as intelligence agencies are, they cannot operate too many nodes easily - the more nodes they operate, the bigger the chance that someone notices suspicious activity going on. On the other hand, there are a lot more civilians who can host Tor nodes without it being suspicious, thus dealing with the threat of intelligence agencies.

I'm curious about what the exact ratios would be, if there were a way to find this out (probably not).

How would you go about hosting a Tor node, without exposing yourself to problems like this? http://raided4tor.cryto.net/

I've thought about running an exit node, but I'm not willing to sacrifice my own safety and freedom to do it. The only solution seems to be buying hosting anonymously (bitcoins?), and making sure you only log in to the server over Tor.

FWIW I think one is helping the Tor network even if they decide to only run an internal Tor node (not an exit). I believe Tor hidden services might become more popular in the months to come, and a lot of resources that the users were initially trying to access anonymously are / will be reachable as hidden services (e.g. wikileaks).

I run an exit node in Egypt on a server from CityNet Host [1], that I got on a promo. Pumping 400 Gb/m through it for $2.50 a month. I would not host one at home but Egypt seems far enough.

[1] http://citynethost.com/vps.asp

Note: You link to the VPS page, but looks like the "Shared Hosting" is where the $2.95/mo package is, and it says it only comes w/ 50GB of bandwidth.

I got my VPS on a promotion, so it really is $2.50 though it looks like you can't get the same deal anymore. http://lowendbox.com has plenty of these, including $15/year deals from BuyVM.

A sybill attack on Tor is probably the least efficient attack. It'd be far easier to perform a correlation attack if you know the probable endpoints, or compromise the target's computer (if you only know the source).

I'm sure government agencies run Tor exits, which means they'll see the middleman node's IP addresses and whatever traffic the originator sent (usually HTTPS). They can't do much with that.

Unfortunately, even Tor is not perfect. It obviously cannot prevent end-to-end correlation, and it also turns out to be very hard to do Tor right (e.g. not leaking information in the data streams).

Reply on news.ycombinator.com