News Feed
- DrugHub has agreed to fully refund all users who lost money in the SuperMarket exit scam.
- Retro Market has gone offline. Circumstances of the closure unknown.
- SuperMarket has closed following an exit scam by one of the admins.
- The admin of Incognito Market, Pharoah, has been arrested by the FBI several months after exit scamming.
- Silk Road
- darknet markets list
- Popular P2P exchange LocalMonero has announced it is closing.
So, this shows a fundamental misunderstanding of I2P and the I2P browser bundle.
First, the I2P browser bundle.
Where did you find this I2P browser bundle? Was it on github? The thing is, there is no official I2P browser. Any browser bundle you find is either developed by some passionate I2P user, or from the I2P developer "IDK". Either way, the fact that you could navigate to a clearnet website in the browser shows that the browser you are using is configured to use both clearnet and I2P proxies. Meaning, of course that website would display your real IP, as you are NOT using I2P to access that website. There are only 2 "outproxies" that let you access clearnet while first going through the I2P network, and if you were properly using one of those outproxies, the website would have displayed one of the two outproxies IP's. Think of it like an exit node on Tor, if you accessed that website through Tor, the IP that website would give you would be the exit nodes IP.
Second, I2P and your IP.
I2P is decentralized. That is a key misunderstanding here. Tor is centralized, which means that there is a select list of IPs that you can use while you are using Tor. There is a "central list". Decentralized means there is no "central list". Since every I2P user is also a router (think of that as like a Tor relay), there are as many IPs you can use as there are I2P users. If no one was connected to I2P, there would be no I2P. If only 2 people were connected to I2P, then those 2 people would be helping to route each others traffic. Since there are almost 5000 I2P users, then you could potentially use 5000 IPs while using I2P. This is very important to understand, because this means 2 important things: 1/You CANNOT hide your IP from other I2P routers, unless you hide your IP prior to entering the I2P network either with Tor or a VPN, or if you go into your routers settings and set your router to "hidden mode" (this means that you will only use other I2P users routers but don't allow other I2P users to use your router as a hop in their tunnel. This is considered "leeching", or only using the I2P network without contributing to the I2P network). And 2/When you access an I2P eepsite, the IP that the website can see CANNOT be your real IP. You cannot route your own traffic, your router must use other routers to form tunnels and connections. The IP that the I2P website will see is the LAST hop of your last tunnel. This is identical to Tor: If you use Tor to access a clearnet site, the exit node IP is the IP that they see. If you access an Onion site, the Onion site can only see the last relay in your circuit, the relay that shakes hands with the Onion sites circuit at the rendezvous point.
So, based only on the information provided by you in this post, the "huge vulnerability" is in the I2P browser itself, and it sounds like the vulnerability is that the I2P browser also allows clearnet traffic. Even the I2P devs recommend that for high risk security threat-models to configure a browser YOURSELF to your liking and needs instead of just trusting some preconfigured browser.
I2P browser bundle and I2P are different. I2P is a network, they have no official browser. Whichever browser you are using is independent of the I2P network, and is accessing the CLEARNET and NOT I2P. If the I2P eepsite requests to see the IP connecting to them, it will give them the I2P router your router is using to form the tunnel. NOT YOUR IP. You cannot route your own traffic.
https://torhoo.cc/go.php?u=TDNVdlVHRnlhWE09# A
If you look on Dread's html source you will see that we don't request anything outside of the site. Dread's requests stay within the i2p network or tor network (depending on how you are accessing). Generally speaking if you are using i2p you would want to block outside connections within your browser. Just setup a proxy connection to direct all traffic on your browser over i2p. That way you won't have any leaks when visiting i2p sites.
Report
1 day ago
/u/HackerRequiredForJob
thanks, but that is a bad vuln people should know about.. but thankyou and understood.
1 day ago
/u/HackerRequiredForJob
Have now fixed but can you please confirm for me, could a i2p web site call an external request to get my ip if I had not forced all traffic through the i2p proxy... The reason I ask is this is very dangerous and people should be aware of this, should they not?
1 day ago
25th November, 2022
https://torhoo.cc/go.php?u=TDNVdlVHRnlhWE09# A
Yes that's completely possible. If you are not properly routing your requests over the anonymizing layer of course you are putting yourself at risk.
That should be completely obvious if you are willing to commit felonies on the internet. An insecure set up is...insecure.
I am not trying to argue so I apologize if my tone is coming across as combative. This is definitely something that I2P users should be very aware of if they decide to use some experimental browser bundle. However i do take issue with your language in statements similar to "finally I know why I2P is encouraged" "some markets are pushing I2P even with this vulnerability" (not exact quotes). It very much leads people to believe that the I2P network itself has this major security vulnerability, and that LE controlled markets can exploit this vulnerability to learn your real IP. Both of which are just categorically false, I have explained. A much more constructive post would be to warn other users that the experimental browser is not hardened enough for high risk darknet operations. Using this alarmist language and blaming I2P for a browser bundle they aren't in control of, and drawing connections to the possibility that LE can somehow gain your IP if you use I2P properly is why this is being called FUD.