Slashdot Mirror
Anyone Can Play Big Brother With BitTorrent
An anonymous reader writes "I was at the 3rd USENIX Workshop on Large-Scale Exploits and Emergent Threats yesterday, and there were people from the French Institute for Computer Science who have continuously spied on most BitTorrent users on the Internet for 100 days, from a single machine. They've also identified 70% of all content providers; yes, those guys that insert the new contents into BitTorrent. As a BitTorrent user, I was shocked that anyone with a box connected to the Internet can spy on what everyone is downloading on BitTorrent."
Looks like a good way to earn a paycheck from the RIAA.
As a BitTorrent user, I was shocked that anyone with a box connected to the Internet can spy on what everyone is downloading on BitTorrent."
Really? All you have to do is be on the torrent and connect to them.
It is an important reminder of just how ignorant most technology users are of the very tools they're using.
[This post removed under the first rule of USENET.]
https://www.eff.org/https-everywhere
You mean to tell me when I connect to a large pool of people, there is a large pool of people there?
from 09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
to 45 2F 6E 40 3C DF 10 71 4E 41 DF AA 25 7D 31 3F
This must mean my IP address is being BROADCAST TO THE WORLD! And I thought I had punched the monkey to prevent this.
I care about privacy and I only use bit torrent for legitimate purposes.
"There is a way that seems right to a man, but its end is the way of death." Proverbs 16:25 (NKJV)
First off, Copyright infringement is not theft.
Secondly, transmitting copyrighted material over a computer network is not necessarily copyright infringement, even if copyright holders would like it to be.
Is privacy invaded because of people pursuing copyright violators, or is privacy pursued because people want to evade copyright enforcers? Seems that if you decide it's the latter you are prepared to give away the privacy of many (those who arent copyright thieves) for the protection of the few (those that own IP that is being copied)...
You know giving up the first little bit is always the easiest...
It's P2P, you can't hide your IP from someone when they ask for a bit of movie file and your computer cheerfully sends it! It's the equivilant of the police walking down your street shouting "Are their any thieves here ?", and you sticking your head out the window to shout back "Yes Me me me! I'm a thief!!" ;-)
The best you can do is not respond to requests from IPs on a block list ... or steal Wifi from a poorly secured neighbour.
I dunno about that.
Privacy isn't just about keeping your illegal activities hidden from an authority that can punish you for those activities. I don't want anyone to be able to glean the details of my day-to-day habits, be they bittorent use, physical locations, or anything else. Even if we had NO copyright laws, I'd still have a problem with people being able to track my actions. And FWIW, I have nothing to hide, AFAIK[1], other than routinely exceeding the speed limit in my car. I refuse on principle to violate copyrights.
[1] the AFAIK is a big problem. There's probably a good chance I violate some law or other occasionally, but I have no idea since there are so many laws on the books. But that just feeds into the privacy issue... I'm no Randian, but the massive amount of laws we have on the books that make innocuous behavior illegal means that I'm probably a criminal without knowing it. The best way to protect against this extant situation is to make sure I maintain the privacy of my activity. Better not to have that situation in the first place, but that's a topic for a different discussion.
"Trolls they were, but filled with the evil will of their master: a fell race..." -- J.R.R. Tolkien on Olog-hai
Actually, despite the credulousness of the summary poster, if you click through to the abstract you also get this bit:
Perhaps I'm exposing my own ignorance (because I've never felt the need to use Tor myself) but that strikes me as surprising if it's true. And something that even savvy internet users might not think about.
Awesome. Meet any chicks?
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
Well, things like Javascript can expose the originating IP over Tor to the receiver, so it's probably not a large leap to assume that you can look at torrrent traffic and find the originating IP at the application level.
That said, its a "problem" with the originating application, not Tor specifically. As said on the Tor website "Tor does not automatically make all your communications secure."
Saying you "can spy on what everyone is downloading on BitTorrent" and TFA stating "major privacy threat" are over-the-top and fear-mongering exaggerations.
A more accurate way to state this is: Using BitTorrent will make our IP address public regarding what content is downloaded and shared online from that IP address. When someone monitors the same content, then they can log your IP address. This is obvious from how the protocol works to anyone who looks into privacy questions seriously. Yes, there is less privacy with what you download with BitTorrent compared to a direct download, as other people also sharing the same content can see your IP address.
But remember, with every download method online someone else knows you have downloaded it, with direct downloads and with all the different peer-to-peer distribution options. If you go to Adobe and download the latest Photoshop demo, they know, they log your IP, and usually even ask for even more information about you.
The only a real privacy problem (a "major threat") is for people using BitTorrent for illegal redistribution of content; it is not a major problem for distribution of open licensed or public domain content, businesses or organizations using BitTorrent for distribution to lower costs, or to distribute free content for viral or marketing purposes.
(Disclaimer: our company, ClearBits, does exactly this, offers distribution as a service to others, and we use BitTorrent extensively)
I don't lie to myself.
I steal. Rather than go out and buy the DVDs, I steal the content. And no I don't care. Movie companies steal from their workers all the time ("Sorry Mr. Cameron, actors, and crew... Titanic made no profit, so your profit share check will be zero."). If the movie is any good (like Star Trek) then I will buy it.
"I disapprove of what you say, but I will defend to the death your right to say it." - historian Evelyn Beatrice Hall
1. Host TOR exit node
...
2. Eavesdrop on traffic
3. Post results
4. Profit!
I'm sure the traffic coming out of TOR is far more interesting than BitTorrent traffic (unless you're a media company).
No, it's a pretty simple application of basic undercover investigative technique.
They pretended to be part of the Tor web, joining it at a point where the user's IP address was visible.
People willingly handed them the IP address.
And since the web was fairly limited in size, and connection points were selected randomly, and most users did multiple connections over time, eventually 70% of users willingly handed them the IP address. Since Tor has no way of ensuring trust in its security servers, its security is void. You couldn't have designed it better to funnel users' IP addresses to a spy unless you had only one server in the whole web and faked the rest of the topology.
it was wide-open to being exploited by sting operations.
This is also the reason you should never trust anonymizing proxy servers or Arab sheiks.
There's nothing so useless as a lock with a voice imprint - Lord President Borusa
Once again, copyright infringement is NOT stealing. Nor is copying copyrighted data necessarily and always copyright infringement. Finally, it's better to be on the right side for the wrong reasons than to be on the wrong side entirely.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Friends don't let friends enable ecmascript.
YOU are denying the person who created the content the sale. YOU have denied them the money they would have made. YOU have TAKEN from them something that was rightfully theirs. THE SALE.
<sarcasm>Just think of how much you've stolen by not-buying all those CDs you don't own! You must owe the RIAA more than the GDP of the United States by now!</sarcasm>
Choosing not to buy something is not theft. No one owns "THE SALE". They own their physical property, because it is scarce. And they have not been deprived of that property.
"The state is that great fiction by which everyone tries to live at the expense of everyone else." - Bastiat
I'm not going to get into the copyright violation vs theft argument (again), but this is just plain WRONG. Drivel like this reeks of **AA and artist entitlement whining.
YOU are denying the person who created the content the sale.
No, because I had no plans on buying whatever it was I'm downloading. If I can get X for free, I'll grab it. If I can't, I'll do without. No sale lost.
YOU have denied them the money they would have made.
They wouldn't have made any money, ergo I denied them nothing.
YOU have TAKEN from them something that was rightfully theirs. THE SALE.
Again, there was no sale to be made. 0 - 0 = 0.
If you want to argue on the basis of morals then I imagine most people would agree that violating a (sane) copyright is wrong. When you start talking about 120-year old copyrights or trying to prevent what most feel is fair use then people will start to disagree.
Regardless of all that, the monetary value of a potential sale is exactly $0.00.
"What do you despise? By this are you truly known." --Princess Irulan, Manual of Muad'Dib
/)
Actually, I did a report in High School on the creation of Playboy and this one girl got all pissy at me for it and said how it was degrading to women and everything. I told her that people do buy it for the articles too and she was like, Yeah who? My answer was the 10,000 blind people who order the braile edition. That shut her up pretty good.
The enlightened argument is not that the act of copying is theft, but that illegal copying deprives the copyright owner of monetary gains which would otherwise have been earned.
So does simply choosing to go without. Should that be illegal now as well?
You can't "steal" the expectation of income. Only that which is owned is subject to theft, and theft only occurs when one is deprived of its use. If one cannot be deprived of the use of a thing—as is the case for everything subject to copyright, since mere duplication cannot deprive anyone of use of the original copy—then that thing cannot be stolen.
"The state is that great fiction by which everyone tries to live at the expense of everyone else." - Bastiat
It's worse than that: they steal from us, the public.
Back when copyrights were first codified into law, there was a deal:
We, the people, gave protections to people who created works so that they could profit from those works, but in exchange for those protections, the creators of the works agreed to give us, the people, their work after a certain timeframe had passed.
Works may now - if the copyright holder wishes - no longer come into the public domain because copyright holders are corporations who are solely interested in making a profit, and who use their political influence (money) to ensure that copyright NEVER expires.
While it certainly won't give me any kind of legal defense, I simply do not care about copyright because the very basis for it has been completely violated by the holders of that copyright.
If we go back to the original law - life of the initial copyright holder + a small extension past that, and only real-live human beings can be considered to be initial copyright holders - I will give up piracy. Until then, I really don't consider copyright law to be valid because the fundamental premise of it: you get yours, we get ours, has now become "they get theirs, everyone else gets fucked."
Copyright no longer benefits anyone but the copyright holder, and that is NOT what it was intended to do.
Since I can't tell them apart, I treat all ACs as the same person.
Let me tell you a true story very much like the theoretical example you posted. When I was a kid there was a Rolling Stones song I loved, but I had no money to buy the album and my parents hated rock music. Our neighbors had that album, and I used to run to the backyard to listen when they played it. Was I stealing?
"In some (not all) cases the content owner is deprived of a sale."
Except that it is really impossible to prove such a thing. If we are willing to set aside the fact that the sale never really existed (how can you be deprived of something that does not exist), there are a lot of confounding factors. The downloader might have decided to go out to a store to buy the media, had it not been available for download, and then seen something better to spend money on, and not purchase the media. Or, perhaps the downloader never even had the money to spend on the media, and the sale never even had a chance of happening. Or perhaps the media was not even available to purchase, and the copyright holder did not feel like spending the money on making further copies.
Even if we ignore all of the above, there is a new problem with declare "deprivation of sales" to be a form of theft. Maybe my business attracts more customers than your business -- does that now make me a thief, because I am depriving you of the sales you would have had if I had not been in business? What if I go around telling people not to buy your products -- is that thievery too?
This is the problem with trying to claim that imaginary things like "potential sales" can be "stolen." In general, "stealing" something that is intangible, whether it is some sort of media, or potential sales, or an idea, or whatever else, is illogical. The term "theft" is only used by people who want "copyright" to be considered the equivalent of "real estate," which it was never intended to be.
Palm trees and 8
Incidentally, the CLI interface is fragile, and it can break out into a standard apache directory listing. It also occasionally redirects to an RFC document for some reason. Anyway, there's a log of all tried passwords there. But more interestingly, there's a lot of other stuff elsewhere in the tree, an 18MB text file with a Twitter social connection graph (just a list of name pairs), and a monitor/ directory with what looks like GSM/email/p2p monitoring stuff. Can't access most of it except an auto-refreshing IRC monitoring page though.
Somebody is using it for something it seems.
True confidence comes not from realising you are as good as your peers, but that your peers are as bad as you are.