Phishing attacks : DaevaMarket | Torhoo darknet markets

Also wondering about this

You are a one of kind gem. Always open to any kind of feedback, especially from you.

It is okay to be wrong. It means you are human. Every once in a while try your best to be human and not Lord.

"Roger Dingledine, a recent Massachusetts Institute of Technology (MIT) graduate, began working on an NRL onion routing project with Paul Syverson. To distinguish this original work at NRL from other onion routing efforts that were starting to pop up elsewhere, Roger called the project Tor, which stood for The Onion Routing. Nick Mathewson, a classmate of Roger's at MIT, joined the project soon after."

Give credit where credit is due: Roger Dingledine

The funding came through Syverson from the Office of Naval Research (ONR) and DARPA.

"Dingledine and Mathewson took code originally written by Matej Pfajfar and turned it into a fully fledged onion routing system."

Prior to this:

" Alan Berman Research Publication Award given for "Anonymous Connections and Onion Routing". This paper provides the most detailed specification published of generation 1 Onion Routing, although some features are added later.

"Work on Onion Routing development is suspended. There is no new funding for it, plus most principals and all developers have left NRL for other pursuits. Nonetheless, research and analysis work continues."

" A security analysis paper is presented at the first Privacy Enhancing Technologies Workshop---where the seeds of future Tor development are unknowingly sown when Syverson meets Dingledine for the first time. (official title of the first workshop was Design Issues in Anonymity and Unobservability and the proceedings was titled Designing Privacy Enhancing Technologies). This paper is where the c^2/n^2 analysis is set out. Analyses of strategies for picking route length and the effect on security are also made but not published in the final version of the paper.

Patent issued in July."

"Work on OR development resumes, funded by DARPA under Fault Tolerant Networks Program with initial goal of making the generation 1 code complete enough to run a beta network and the subsequent goal of adding fault tolerance and resource management.

Edison Invention Award presented for the invention of Onion Routing."



"Funding from the Naval Department was only relevant because that's where Dr. Syverson worked at the time (and works still).

Further, while his official justifications to his bosses and funders might have been something like "create anonymity software that the US Navy can run so our warfighters can securely communicate in the field", his personal reasons were probably more like "create anonymity software that everyone can run to protect themselves all over the world."

"create anonymity software that everyone can run to protect themselves all over the world." -- WHAT THE FUCK???????



DARPA and ONR via Naval Research Laboratory - 2001-2006 [No longer a donor]

Thank you, /u/biosphere

No problem, thank you!

about:config

All up to you.

JavaScript and Webgl are the two important ones.

The rest isn't crucial.

I was going to say the same thing but you beat me to it. There is no way in the world we have to check all these settings each time we need launch tor which most like myself are using disposable whonix workstation which resets all configs when we close it down. Having to do this every time would drive me mad. Is there a script or something we can use?

Unfortunately, every time Firefox does a major upgrade the settings default to whatever they set them as.

The only thing we really need to do is a quick check every now and then like this:
about:config
javascript.enabled

If it states true, immediately disable it by setting it to false.

Don't count on the slider or NoScript as they have failed in the past. A quick visual check will do.

And, major upgrades don't happen that often.

Thank you, /u/UKDistribution. You are a diamond.

Thank you, /u/suzie

In Qubes it is a whole different ball game with Tor. Will reply with how tomorrow after work.

♥♥♥♥♥ Much love to you, /u/TorLarp ♥♥♥♥♥

Thank you! That absolutely was preventing me from logging into Dread.

I thought about this one plenty. I'm even considering removing it because it might prevent entry into some sites.

This would more likely be the case you are referring to [network.http.referer.hideOnionSource]

But since we are using a Private Window in Tor, I believe that it defaults to 0

What would be problematic is:

network.http.referer.XOriginPolicy
network.http.referer.spoofSource
network.http.referer.trimmingPolicy
network.http.referer.XOriginTrimmingPolicy
network.http.referer.hideOnionSource
network.http.sendSecureXSiteReferrer

I took into consideration the below with integration with CSS

Referrer-Policy: no-referrer
Referrer-Policy: no-referrer-when-downgrade
Referrer-Policy: origin
Referrer-Policy: origin-when-cross-origin
Referrer-Policy: same-origin
Referrer-Policy: strict-origin
Referrer-Policy: strict-origin-when-cross-origin
Referrer-Policy: unsafe-url

Payment providers might rely on the Referer header of incoming requests for security checks.

But visiting Dread would be via about:config

Tor sets the referer to the destination address.

The problems I see are related to
Payment Providers
Being depicted as a bot
Integration with CSS
Hotlinking

When one exits the Tor network, Tor automatically hides the referrer.


As far as Cross-Origin Fingerprinting Unlinkability, Tor states:

"User activity on one URL bar origin MUST NOT be linkable to their activity in any other URL bar origin by any third party. This property specifically applies to linkability from fingerprinting browser behavior."

As far Cross-Origin Identifier Unlinkability, Tor states:

User activity on one URL bar origin MUST NOT be linkable to their activity in any other URL bar origin by any third party automatically or without user interaction or approval. This requirement specifically applies to linkability from stored browser identifiers, authentication tokens, and shared state. The requirement does not apply to linkable information the user manually submits to sites, or due to information submitted during manual link traversal. This functionality SHOULD NOT interfere with interactive, click-driven federated login in a substantial way."

Because we are in a Private Window, the referrer is suppose to be set to 0 by default.

But my worry is that by setting it 0 we no longer blend in with the other 97% of Tor.

It's that that is my concern which is why I think, despite leaking information.

Even when we obtain a "New Identity" Tor mandates that "All linkable identifiers and browser state MUST be cleared by this feature."

So, we get a New Identity and we can still connect to Dread. If we have failed the CAPTCHA too many times, Dread tells us to get a new identity and in doing so are referrer is set to 0.

But I feel like wiping this one out because of the differentiation issue. Many of the other ones won't have much of an impact. Many are killed the moment we disable JavaScript.

But I personally never use a refer when visiting a site outside of Dread.

If I were to visit a market, it's New Window.

Also, if you Right-Click on any link in Tor your will see the option "Copy Link without Site Tracking."

Mandatory: if you are on the darknet you must disable JavaScript.

On the clearnet you can't use the clearnet without JavaScript.

Notice how simple all Onions (hidden services) are: they use HTML, CSS and a bit of PHP on the front-end. BUT **ALL** browsers (meaning 100% of them) know how to render JavaScript.

Look at Dread's source code, or any market. And you will never find JavaScript.

Go to cnn.com and it's all JavaScript but it is not malicious. It provides rapid functionality that any browser can render regardless of the operating system.

cnn.com is not trying to harm you. All the corporations are trying to satisfy their shareholders and their revenue, not hack you.

"the government for sure has enough resources to get these people"
-- The US government has firewalls that can detect Tor usage in real-time.

But (1) is it a major crime to export any encryption tool to another country.
(2) A country like Pakistan and Afghanistan will not have the technology we do.

We have "stealth technology":

The F-22 Raptor
The F-35 Lightning II

Export of cryptography from the United States is a very serious crime.

We have technologies like Splunk, Sophos, Cisco ASA 5510 Firewall that can easily detect Tor usage. But that is US.

And, even if a restricted country detects Tor usage, it's not that easy to pin-point someone. It is so demanding and so costly.

The purpose of most of these settings is simply to prevent leaking unnecessary information.

"if Tor is illegal in your country" you are fine like the MILLIONS of non-darknet users. You use plugable transport to evade detection by your ISP.

Think of the thousands of users in Iran and China who use Tor daily to read cnn.com or go on facebook.com

And think of "Off Shore Hosting."

Being a Tor user is, I hate to downplay it, but not that big of a deal unless YOU are a big deal.

The Cost of finding Bin Laden took $3 Trillion and over 15 Years. Not many Tor users and worth that.

Thank you, this is what /d/OpSec is all about.

We turn it off because—please forgive me for being rude—many people don't both turning of JavaScript.

An innumerable amount of people don't use PGP.

So, they are FALLBACKS.

But out of all the readers, how many do you think will actually be concerned about this?

How many are connecting to Dread with their Smart Phone?

Will more than 5 people here ever read the Tor specifications?

Still, it's my job to, at the very least, make these things know rather than expect that "no one cares".

I just realized, you made me realize, that needs to be removed.

What that would do if set to true is allow Firefox to send DNS requests for hostnames with a .onion TLD.

This leaks information about what the user is attempting to access via Firefox.

That shouldn't even be in about:config but Tor is Firefox. The developers should have removed it entirely.

A .onion TLD on the clearnet is a scam site.

If you run into dread.onion --- it is not a v3 Onion site.

Tor does not make DNS requests, Tor resolves names via Socks.

Tor does not directly use the traditional DNS request to resolve domain names because it operates on a network of hidden services.

It is the re-directing of clearnet pages/sites to their Onion version that has been disabled.

Thank you, /u/newbieforever2018

Respect and love. And the safety of us all.

Thanks, /u/MrBacon420

What I wish is that we could have NoScript as this:

⚠️NoScript_DarkNet⚠️

And, as /u/Paris always states, after each upgrade (at least a major one like 14.0) the settings go right back to default.

One can make Persistent NoScript Settings with

extensions.torbutton.noscript_persist is set to true

My only concern is that not all Tor browsers are the same.

As far as fingerprinting:

Whonix uses the original Tor Browser from The Tor Project.

Tails tries to hide the fact one is using Tor.

There is so much of a difference in so many aspects between Tor in Whonix, Tor in Tails, the Tor Browser Bundle, Qubes OS TorVM.

Here: I just found the detailed breakdown:

https://www.whonix.org/wiki/Comparison_with_Others

Table: Verifiable Builds Comparison
Table: Fingerprinting Issues
Table: Security Hardening

But, of course, the more alike we look the better!

Would I?
No, I would not be able to.

It's a massive project of developers merging many commits.

These settings won't affect our fingerprint much. What is most important is to disable JavaScript and Webgl

Of the entire Tor network, right now, approximately 3% is darknet users.

So, what is released is for the 97% -- which makes complete sense.

It'll take no more than two minutes to make the "important" changes.

I simply visually noticed these.

Thanks, /u/grogger!

Thank you, ace.