Slashdot Mirror
Anyone Can Play Big Brother With BitTorrent
An anonymous reader writes "I was at the 3rd USENIX Workshop on Large-Scale Exploits and Emergent Threats yesterday, and there were people from the French Institute for Computer Science who have continuously spied on most BitTorrent users on the Internet for 100 days, from a single machine. They've also identified 70% of all content providers; yes, those guys that insert the new contents into BitTorrent. As a BitTorrent user, I was shocked that anyone with a box connected to the Internet can spy on what everyone is downloading on BitTorrent."
If copyright law was more sane we wouldn't have to argue so much about privacy.
Shh.
As a BitTorrent user, I was shocked that anyone with a box connected to the Internet can spy on what everyone is downloading on BitTorrent."
Really? All you have to do is be on the torrent and connect to them.
It is an important reminder of just how ignorant most technology users are of the very tools they're using.
looks like something that won't work for those who understand that plenty of these IP addresses could be spoofed or not even uploading, or knows what I2P does, or uses VPN. This is just a list of IPs that they are assuming are 100% valid because they were listed in the tracker when the content went up. They're saying that if someone is listed on more than one tracker, it confirms who they are.
That= a bad study.
All they're saying is "We can tie an IP to a torrent", but that doesn't mean you can get anything more than that. Judges already don't accept an IP simply being tied to a torrent.
With ISP cooperation you can narrow an IP down to a physical address. At that point, you're screwed.
Speak for yourself. I do all my bittorrenting from open wireless networks ;)
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.
This is actually an argument for buying a wireless router and leaving it open without a password. Sure, you can be owned by your malicious neighbors, but they could also be the ones doing the torrent downloads... hmm. LOL
Currently hooked on AMP
Thank you for that DUH. Bram Cohen originally designed the protocol to be an ultra-scalable file distribution approach, and every attempt to add security, encryption, or whatever is trying to add something against the grain of its origin. (It may still be worth doing it, in the same sense that steganography may still be worth doing.) Bittorrent is for above-board, everyone-knows-you're-doing-it file distribution. If you want to hide what you're doing, do it with something else.
If they get enough to get a search warrant, you're screwed, because even if you're masking you're MAC they'll be able to figure that out once they have access to your machine and make a positive link to the IP address.
If you use whole-drive encryption, recent court cases have shown you've opened up a whole new can of worms, and didn't really save yourself any trouble.
If you try hard enough at hiding it, you could be in a situation where the circumstantial evidence is enough to push a jury past the "reasonable doubt" threshold, in which case you've saved yourself nothing.
It really is not easy to shield yourself when you use a protocol that by its very nature must identify your machine uniquely. The best you can do is hide and make your discovery more difficult. You can't completely prevent it completely and still access the internet in any useful way.
Security is mostly a superstition... Avoiding danger is no safer in the long run than outright exposure. - Helen Keller
You do realize that they can track it down to the boarders AP and will know with reasonable accuracy (within 100 meters or so) where the downloader must live, right?
Then it's just a matter of getting a search warrant to find the PC with the right MAC address. Even spoofing your MAC won't protect you at this stage, unless you catch wind of what is going on and remove all traces of spoofing from your machine.
Fortunately, the police aren't that interested in downloaders, and are the only ones with the kind of authority to get a warrant for a whole group of people at a time. Fishing for a defendant is pretty difficult for a civil action, and I can't see it happening if all you have is a list of 50 people who it may be.
Still, technically there is nothing preventing such a situation.
Security is mostly a superstition... Avoiding danger is no safer in the long run than outright exposure. - Helen Keller
So you're going to issue warrants to search every domicile within 100 meters? What if the "perp" lives in Manhattan? Do you think a judge is going to sign warrants to search ~30 apartments?
Yeah, some assholes use Tor for BitTorrent, and it's awful for the network. Then people like me who live behind the Great Firewall of China, get slower-than-molasses browsing of censored web sites (terrible things like Google Pages, Blogger, anything from Taiwan, any page containing a string the PRC doesn't like, etc.). The main use for such work-arounds is usually just for my own research and education, and this is the basic reason that Tor exists. Users who run BitTorrent through Tor are really abusing what is basically a charity for people who need it.
Systemd: the PulseAudio of init systems
Let me tell you a true story very much like the theoretical example you posted. When I was a kid there was a Rolling Stones song I loved, but I had no money to buy the album and my parents hated rock music. Our neighbors had that album, and I used to run to the backyard to listen when they played it. Was I stealing?
We are talking about civil actions here, not criminal ones. How would RIAA go about tying your MAC address back to you, even if you weren't smart enough to spoof it? Are they going to file discovery motions on every single house within range of the AP that was used? Heck, for that matter, how would law enforcement do it? No Judge would issue a warrant for "every computer within a 150 meter radius of this location", not for something as mundane as file sharing.
BTW, you can get a lot further than 150 meters with the right antenna setup. I've seen associations made at ranges exceeding two kilometers, under less than ideal conditions.
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.
As a BitTorrent user, I was shocked that anyone with a box connected to the Internet can spy on what everyone is downloading on BitTorrent."
That's nothing! Imagine how shocked were content providers, when they discovered that anyone with a box connected to the Internet can insert the new contents into BitTorrent!
You can have your MAC address change every day, by a simple little script.
The article goes into a lot of detail about how they identify those users who are on VPN, Proxy, tor, etc. They've also identified over 10,000 IPs that "monitor" only, from a few data centers in the United States. If you're using BT, you should definitely read this article..
I was just thinking that in the year 2010, how is it possible for a Slashdot reader not to know that Bittorrent is not private?
Let's say I find myself a man to play the guitar at dinnertime each night. It's now the end of the week, and he has the "expectation" of income. He was deprived of the use of his time, and I enjoyed the fruits of his labour. If I choose to not pay him, have I not stolen from him?
That depends. What does your contract say? If the contract states that you give him a certain amount of money on the condition that he plays for you, and after he plays you refuse to turn over the money, then you are indeed stealing from him—that's his money you're withholding. One can envision other circumstances, including the absence of any contract (not necessarily written), where refusal of payment would not be theft. The expectation is not enough, by itself.
If I'm not stealing in the second case, I'm not stealing in the first.
In the second case you explicitly did not agree in advance to pay him. This changes matters. If you did agree to such in the first case then the situations are not analogous.
he was deprived of the use of his time
Perhaps, but not by you. The decision to spend his time playing or recording his performances was his own. You have not deprived him of any additional time by listening. He was under no obligation to make his recordings available to you without first arranging for payment. Only the existence of a voluntary contract would create an obligation on your part for payment after the fact.
"The state is that great fiction by which everyone tries to live at the expense of everyone else." - Bastiat