HideMyAss.com Doesn't Hide Logs From the FBI

Log this! by Anonymous Coward · 2011-09-24 22:05 · Score: 0

Log this!

Who would have thought so.... by Anonymous Coward · 2011-09-24 22:08 · Score: 4, Insightful

But another question is why they kept logs anyway? Are they required to keep logs by law?

Re:Who would have thought so.... by Runaway1956 · 2011-09-24 22:25 · Score: 5, Insightful

Now, THAT is the correct question. A server that keeps no logs is a fairly secure server from which to run a VPS. Ditto proxies. When shopping for something of this sort, the important question to ask is, "What logs do you keep, and how long do you retain them?" Every server makes and keeps logs - there is no getting around that. The lifetime of the logs should depend on administrative necessity. Generally, logs should be flushed every 24 hours. Performance logs, security logs, things that pertain to the ongoing health and security of the server should be retained for as long as necessay - sometimes, for months. But every publicly facing server should routinely delete logs that aren't central to the server's main mission. VPS and proxy servers main mission being to protect the anonymity of it's users.
Shouldn't it be considered a fraud, to advertise they you will protect a user's identity, then maintain logs which can be seized by any government agency that demands them?

--
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
Re:Who would have thought so.... by jhoegl · 2011-09-24 22:54 · Score: 5, Funny

Ass logs can get pretty big.

I just dont know if I want to be the one sifting through the logs to find kernels of information.
Re:Who would have thought so.... by jonbryce · 2011-09-24 22:57 · Score: 2

Yes, Internet Service Providers are required to keep laws by the Regulation of Investigatory Powers Act.
Re:Who would have thought so.... by qbast · 2011-09-24 23:08 · Score: 1

They are based in UK, so they so not retaining logs is illegal. If you want proxy without logs find one based in country without data retention laws. Hint: it is nowhere in EU.
Re:Who would have thought so.... by Runaway1956 · 2011-09-24 23:17 · Score: 1

That sidesteps my point, really. Assuming that you want a proxy server to actually hide you - you need to determine what logs they keep, right?
You also seem to ignore my final question. Shouldn't it be considered fraud, if they promise to "cover your ass", then they hand logs to whichever government agency demands them?

--
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
Re:Who would have thought so.... by migla · 2011-09-24 23:22 · Score: 3, Interesting

They are based in UK, so they so not retaining logs is illegal. If you want proxy without logs find one based in country without data retention laws. Hint: it is nowhere in EU.
Judicially, no. But, unless I'm mistaken (and don't base hiding of ass on my level of informedness, please), Sweden is for example not abiding by that EU law yet, incurring ever growing fines in the process.
My ISP still claims the logs of who had what IP at what point in time are gone in about a week.

--
Some of my favourite people are from th US; Vonnegut, Chomsky, Bill Hicks.
Re:Who would have thought so.... by Anonymous Coward · 2011-09-24 23:34 · Score: 1

They are based in UK, so they so not retaining logs is illegal.
Not to the best of my knowledge. Certainly when I worked for a medium-ish ISP as a sysadmin we didn't have any structured logging in place, and it's my understanding that logging is only required if the organisation is on the Home Office "Prescribed List". Pretty much only the larger ISP's are on the list: the Home Office doesn't care particularly about the smaller outfits and doesn't have the resources to deal with them all anyway.
Re:Who would have thought so.... by __Paul__ · 2011-09-24 23:51 · Score: 1

Not retaining logs might be illegal, but is it illegal to not make the logs in the first place?
If it is, does that mean that it's illegal to code software that doesn't do logging at all? (eg, specifically removing the code from squid that does this, or writing one's own proxy and never actually get around to the point of writing the logging part).

--
worldmobilenet.com -- World Prepaid Wireless Internet plans
Re:Who would have thought so.... by AmiMoJo · 2011-09-24 23:54 · Score: 1, Insightful

Servers in the uk have a legal obligation to keep certain logs, and we are America's bitch. TOR is the only safe option.

--
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Re:Who would have thought so.... by qbast · 2011-09-24 23:57 · Score: 3, Interesting

The problem is that when it comes to promises of security, fraud is very common and never punished. How exactly do you determine what logs the proxy keeps? By asking them? As you see what is promised and what is actually delivered is usually not the same. For another example look at Dropbox - for a while they claimed that only user has encryption keys and it is impossible for their staff to decrypt anything. Then they changed story to 'staff is not allowed to decrypt'. Hell, even if you find a proxy in bumfuckistan which has no data retention laws, it may be a honeypot.
Re:Who would have thought so.... by Bert64 · 2011-09-25 00:01 · Score: 3, Interesting

a, not really.. you can easily eliminate potential proxy services by assuming that at minimum they comply with the local data retention laws...
b, possibly, but who do they claim to "cover your ass" from?

--
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Re:Who would have thought so.... by Runaway1956 · 2011-09-25 00:03 · Score: 2

TOR is only as safe as the government permits it to be. I stated above that the darkweb is subject to MIM attacks. TOR is merely a subset of the darkweb - albeit, less secure than I2P and other protocols.

--
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
Re:Who would have thought so.... by qbast · 2011-09-25 00:04 · Score: 3, Informative

You are right, in UK data retention is voluntary. And here I thought that all members already got pressured to implement EU Directive 2006/24/EC .
Re:Who would have thought so.... by DrgnDancer · 2011-09-25 00:19 · Score: 1

Alternately to (b), what do you expect them to do? Subpenas and warrants are not optional. You can, right up to the minute the court order comes in, tell government agencies that your policies forbid releasing customer data... after that, your choices are pretty limited (they involve "hand over information" or "go to jail and let them search for it themselves"). If you want true, court order proof, privacy, the onus is on you to find a company that can provide it, Ideally you want a company located in a place where either the there are no data retention requirements, or the court cannot compel discovery, conversely you'd like to be able to sue them if they do release your data. I'd venture that finding a country with the proper blend of anarchy and legal system will be challenging.

--
I don't need a million points of light, just two points of multi-mode fiber and a 10 Gig-E router.
Re:Who would have thought so.... by Anonymous Coward · 2011-09-25 00:22 · Score: 0

Not strictly correct. According to conversation I had with the Home Office, who are behind the legislation, the requirement currently is to retain logs once you have been requested to do so.
Re:Who would have thought so.... by lseltzer · 2011-09-25 00:26 · Score: 3, Informative

In addition to that, from TFA:

Why do we log the above^ information? Being able to locate abusive users is imperative for the survival of operating a VPN service, if you can not take action to prevent abuse you risk losing server contracts with the underlying upstream providers that empower your network. Common abuse can be anything from spam to fraud, and more serious cases involve terrorism and child porn. The main type of logging is session logging – this is simply logging when a customer connects and disconnects from the server, this identifies who was connected to X IP address at X time, this is what we do and all we do. Some providers choose not to do session logging and instead try to locate the abusive customer by using the intelligence from the complaint, for example if someone hacks XYZ.com they may monitor traffic to XYZ.com and log which customers have a connection to this website. Ask yourself this: if a provider claims not to do any form of logging, but is able to locate abusive customers, how are they able to do this without any form of logging?
Re:Who would have thought so.... by Zemran · 2011-09-25 00:31 · Score: 3, Interesting

In the UK, not only do they have to keep the logs for 18 months but practically anyone, including the fire service, can look at them. The British law is the craziest in the world in that regard and anyone stupid enough to use a British proxy/VPN must need their head examined. If you use a Swiss or a Swedish proxy they will not even keep logs, so there is nothing for the FBI to ask the court to make them hand over. If you buy a car you look into which car does the job that you want it to do... So if you get a proxy it is up to you to make sure it will do what you want. If you want to watch British TV or whatever without being told that you cannot because you are not in Britain then OK but for privacy??? MORON!!!

--
I love stacking my barbecues in the shed at the end of summer - you can't beat a bit of grill on grill action.
Re:Who would have thought so.... by ChumpusRex2003 · 2011-09-25 00:40 · Score: 2

The UK requires (under the Digital Economy Act) that any internet service provider (which the law defines in an exceedingly broad way) keeps logs of all customer connections and retain them for a minimum period of 6 months. They are not required to log the contents of the connection, merely the IP.
This includes an individual or small business offering wi-fi to customers on their premises. Under the DEA, they are an ISP and must keep the relevant logs (which include positive identity of the customer) for the required period. Failure to keep the logs is an offence, and may mean that the operator of the network is personally liable for any offences that were alleged to have been committed.
Re:Who would have thought so.... by ubrgeek · 2011-09-25 01:08 · Score: 1

I know that was sophomoric humor, but damn it was funny :)

--
Bark less. Wag more.
Re:Who would have thought so.... by KDR_11k · 2011-09-25 01:46 · Score: 1

I have to ask what exactly they expect people to use such a service for. How many people need to hide their IP address from servers badly enough to invoke a third party like this when they aren't planning anything nefarious? Without a court order that IP address cannot be matched to a person anyway and people who are just using general caution would likely prefer a service that uses its basic design for reducing your traceability, not the promises of a single third party (after all who's to say that third party is more trustworthy than whoever else could get your data?).

--
Justice is the sheep getting arrested while an impartial judge declares the vote void.
Re:Who would have thought so.... by KDR_11k · 2011-09-25 01:49 · Score: 1

On the other hand in Germany the courts have ruled that the extended data retention spans are unconstitutional. Of course they have also ruled our federal voting laws to be unconstitutional and the politicians have done nothing about that.

--
Justice is the sheep getting arrested while an impartial judge declares the vote void.
Re:Who would have thought so.... by hairyfeet · 2011-09-25 01:54 · Score: 0

Well you can clearly see this company is completely worthless and will hopefully go the way of the 8-track when they say right there in their little excuse they retain logs to prevent "abuses" such as those that " cases involve terrorism and child porn."
If anyone hasn't figured out by now that "for teh childrenz/get teh terristz" isn't a codeword for "we give anything and everything to big bro cause we down with that" they deserve to be in PMITA prison. Moral of the story is this company needs to be DOA. Everyone that uses it needs to close their accounts and cancel the checks NOW, because they have just proven beyond all doubt that you are "paying" for absolutely nothing but the smoke being blown up your ass.
And to answer your question YES IT IS FRAUD but good luck on seeing someone get busted for kissing big bro booty. See how AT&T got an entire congress to write a law covering their ass for being down with big bro. But the best lesson this bunch of bozos could be taught won't be in a court, it should be in their bank account.
Hey Anons, if you are out there? get a list of everyone that uses that service and send them a copy of TFA. Let them know they have bought NOTHING. This is a case where voting with your wallet could do some real good, because if these clowns go out of business less than a month after this hits it'll teach a BIG lesson to others in this business: you keep logs? I hope you have another business lined up.

--
ACs don't waste your time replying, your posts are never seen by me.
Re:Who would have thought so.... by lseltzer · 2011-09-25 02:04 · Score: 1

I use it mostly as an encrypting proxy so I can use open Wifi and other untrustworthy networks.
Re:Who would have thought so.... by Slashdot+Assistant · 2011-09-25 02:23 · Score: 1

It would depend on what they're promising in their terms of service. I imagine they'll have something in there to grant themselves permission to share data when required to do so under law. A contract agreeing to an illegal act would be void. HMA can no-more offer a legally binding contract to provide crackers with complete anonymity any more than a hit man could sign a legally enforceable contract in which he promises to kill someone.
Re:Who would have thought so.... by Slashdot+Assistant · 2011-09-25 02:32 · Score: 1

I doubt it'd be illegal for the developers. The onus to retain logs instead appears to be on the operators of the code.
I hope that the EU hasn't yet reached the point at which developers can face criminal prosecution for creating a tool that allows a Little Mermaid DVD to be backed-up or format shifted for private use.
Re:Who would have thought so.... by Slashdot+Assistant · 2011-09-25 02:37 · Score: 2

http://vpn.hidemyass.com/vpncontrol/legal.html

The site is a bit light on decent terms of use information for the free service, but if I sign-up for the pro-service, and use it to break the law, how have HMA committed fraud if they're legally obliged to hand-over what minimal data they log, and they've clearly stated that "Anonymity services such as ours do not exist to hide people from illegal activity..."?
Re:Who would have thought so.... by BrokenHalo · 2011-09-25 02:40 · Score: 1

TOR is the only safe option.
Hmmm. I suspect that governments could obtain TOR records too, if they were so motivated. Seems to me that the simplest way of covering your ass might be to use TOR to encrypt your traffic on someone else's network, e.g. by wardriving.

Of course, going to such trouble might presuppose that you are doing something nefarious in the first place, in which case the simplest solution is to not do it. If you were a whistleblower of some sort, such obstacles are easily circumvented by transmitting your data via sneakernet, snail-mail or avian carrier.
Re:Who would have thought so.... by blueg3 · 2011-09-25 02:43 · Score: 2

Dropbox - for a while they claimed that only user has encryption keys and it is impossible for their staff to decrypt anything
Actually, they never claimed that only the user has the encryption keys, and they didn't say "impossible", they said "can't", which is a softer guarantee.
Just goes to show you when reading security guarantees, "fraud" is not nearly as much a problem as companies being intentionally vague and optimistic, customers reading in to their statements what they want to hear, and everyone having poor reading comprehension and inadequate skepticism.
Re:Who would have thought so.... by Slashdot+Assistant · 2011-09-25 02:45 · Score: 1

I've used proxies when wanting to view TV on sites that won't accept connections from my country. It may also be that a user doesn't necessarily want their browsing habits to be visible to their ISP or even their country.

There are plenty of legitimate reasons to use proxies and VPN, and I'd consider avoiding prosecution under unjust laws in your home country to be among those. Although breaking UK law is certainly an issue for HMA, I would hope that they're not going to be turning over details to the Iranian government when they suspect that someone has offended Allah by having the temerity to fall in love with someone of the same gender.
Re:Who would have thought so.... by houstonbofh · 2011-09-25 03:01 · Score: 2

Yes, but Illegal activity where? For example, Online Gambling is illegal in much of the US, but not all, and not most of the rest of the world. So if someone in Iowa is suspected of playing videopoker in a UK on-line casino via a UK VPN, is it still illegal to them?
Re:Who would have thought so.... by houstonbofh · 2011-09-25 03:05 · Score: 1

They say that one reason is to get around geographic blocks, like the iPlayer that only works in the UK. http://en.wikipedia.org/wiki/BBC_iPlayer#Overseas_availability Of course that violates Intellectual Property law, and so it is illegal. Ooops...
Re:Who would have thought so.... by countertrolling · 2011-09-25 03:25 · Score: 1

...we are America's bitch...
Wag the dog...

--
For justice, we must go to Don Corleone
Re:Who would have thought so.... by iamhassi · 2011-09-25 04:46 · Score: 4, Insightful

But every publicly facing server should routinely delete logs that aren't central to the server's main mission. VPS and proxy servers main mission being to protect the anonymity of it's users.
Shouldn't it be considered a fraud, to advertise they you will protect a user's identity, then maintain logs which can be seized by any government agency that demands them?
reason for keeping logs:
"16:32 edit: We have had a few queries as to our logging policies. We only log the time you connect and disconnect from our service, we do not log in any shape or form your actual internet traffic.

21:05 edit: Why do we log the above^ information? Being able to locate abusive users is imperative for the survival of operating a VPN service, if you can not take action to prevent abuse you risk losing server contracts with the underlying upstream providers that empower your network. Common abuse can be anything from spam to fraud, and more serious cases involve terrorism and child porn. The main type of logging is session logging – this is simply logging when a customer connects and disconnects from the server, this identifies who was connected to X IP address at X time, this is what we do and all we do."

makes sense, they have to protect their other customers and themselves, if someone logs in and does kiddie porn or terrorism and HMA doesn't have the logs they'll lose relationships with the other VPN servers they're using. Govt might even just come in and take what servers they do have and shut down the website if HMA doesn't cooperate.

Honestly I think lulzsec was stupid for using their credit card on a VPN service for hacking online, if they thought "Let's be safe, I'll just enter my credit card number...." then they're stupid and deserve what they got. Should have gone anonymous (no credit cards, or at least prepaid) and should have gone through several VPNs in other countries.

Wanna hack anonymously? Buy a used PC, wipe the drive (or install new HD), install OS, use it only for hacking, never put any personal information on it, never check personal email, facebook, forum accounts, bank, credit card, paypal, etc. Create fake email on PC, use fake email to create fake accounts, find free VPNs and go through several of them (at least three). Wipe cookies, temp files, etc after every session. Even better if you buy a used laptop and use wifi at starbucks, mcdonalds, B&N, or open networks from wardriving and switch networks daily.

--
my karma will be here long after I'm gone
Re:Who would have thought so.... by allo · 2011-09-25 04:52 · Score: 1

what, if they really have no logs, even for themself? Then they can just say "we do not have anything, look at the systems if you like to."
What should happen? Nobody will suspect they did it themself, because they are a proxy company, its obvious that any user could have done it.
Re:Who would have thought so.... by Sperbels · 2011-09-25 04:52 · Score: 1

I've used proxies when wanting to view TV on sites that won't accept connections from my country. It may also be that a user doesn't necessarily want their browsing habits to be visible to their ISP or even their country.
Right. You're breaking the law.

What's being implied here is that the US and UK are so benevolent that you really are a criminal if you're breaking any of their laws.
Re:Who would have thought so.... by allo · 2011-09-25 04:55 · Score: 1

I think its illegal to use the software to provide the proxy-service to users. The software itself is okay and noone says how you should do the logging, only what you need to log. what's mostly the original ip proxy ip mapping.
Re:Who would have thought so.... by Penguinisto · 2011-09-25 05:30 · Score: 2

Therein lies the problem... most countries in the first world have data retention logs.
You might be able to get away with some of it in the US, but not much. Besides, unless you run a backbone node, it wouldn't be too hard for the authorities to get the logs from your upstream data providers, which can still (with effort, but still) allow them to reconstruct what they need anyway.

--
Quo usque tandem abutere, Nimbus, patientia nostra?
Re:Who would have thought so.... by user+flynn · 2011-09-25 07:15 · Score: 1

Not retaining logs might be illegal, but is it illegal to not make the logs in the first place?
This whole conversation strikes me as a bit anal retentive...

--
In the distance you hear an ominous moo.
Re:Who would have thought so.... by mmcuh · 2011-09-25 08:40 · Score: 1

Does a Tor relay keep logs of all circuits that go through it?
Re:Who would have thought so.... by mywhitewolf · 2011-09-25 09:41 · Score: 1

i never used proxies, mostly because i do go through and read the license and user agreement, realize that it offers no real protection (as they specifically state in the user agreement that they will hand over info to the authorities and maintain logs for x amount of days and keep IP access logs Indefinably as required).
Proxies are fine if your trying to hide stuff from your local administrator or spouse, but for anything you want to hid from "the man" then make sure the guys you are hiding through don't pay taxes.
Re:Who would have thought so.... by Anarchitektur · 2011-09-25 09:44 · Score: 1

Now, THAT is the correct question. A server that keeps no logs is a fairly secure server from which to run a VPS. Ditto proxies. When shopping for something of this sort, the important question to ask is, "What logs do you keep, and how long do you retain them?" Every server makes and keeps logs - there is no getting around that. The lifetime of the logs should depend on administrative necessity. Generally, logs should be flushed every 24 hours. Performance logs, security logs, things that pertain to the ongoing health and security of the server should be retained for as long as necessay - sometimes, for months. But every publicly facing server should routinely delete logs that aren't central to the server's main mission. VPS and proxy servers main mission being to protect the anonymity of it's users.
Shouldn't it be considered a fraud, to advertise they you will protect a user's identity, then maintain logs which can be seized by any government agency that demands them?
From an evidentiary standpoint, a defendant in a lawsuit is fine (in terms of spoliation) when logs are deleted per an established retention/deletion policy, but as soon as they are put on notice that they are a party in a pending official proceeding, they would have to put in place a "litigation hold" and thus preserve "any information that might be relevant" to the opposing party. So, in this case, even if they did delete all their logs every 24 hours, as soon as they were put on notice (served, subpoenaed, etc.) they would have an on-going duty to keep the relevant logs. Now, that doesn't help the FBI in proving past acts, but it would mean HideMyAss would have to release any information from that point forward that the FBI requested, unless they were able to object to the request and get the court to agree that they should not have to do so, either due to excessive burden (time or financial), or that it is privileged data. Unfortunately, the trend is that it is becoming increasingly difficult to withhold data under either objection.
Re:Who would have thought so.... by AmiMoJo · 2011-09-25 10:04 · Score: 1

You don't understand what Tor is. Yes, MITM attacks are possible, but it isn't designed to prevent them and nor are they relevant. Tor makes it impossible to tell where packets are coming from. Nothing more.
Say you want to exchange emails with someone. You swap GPG keys securely somehow and use Hotmail accounts. It doesn't matter if the government can capture every packet or impersonate the Hotmail servers because both of you can use GPG to verify that messages really are from the other person. A man in the middle can't create fake messages or tell who is sending or receiving them. If you use encryption they can't read them either, but that isn't necessary to maintain anonymity.
Of course you still have to securely exchange keys somehow and if an attacker discovered one person's identity by some other means they could take their private GPG key by force, but that is not what Tor is protecting you from.
Similarly if you had some video footage you wanted to publish there is nothing the government could do to prevent it if you use Tor, short of shutting down all encrypted traffic in the country. They certainly could not trace it back to you via any kind of MITM or other attack, as long as you are careful not to leak information some other way.
"Darkweb" does not mean what you think it means. You mean to say "darknet", and Tor is not primarily a darknet (although it does support it via .onion sites).

--
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Re:Who would have thought so.... by Anonymous Coward · 2011-09-25 10:35 · Score: 0

the important question to ask is, "What logs do you keep, and how long do you retain them?"
Doesn't mean they have to be truthful in answering said question.
For real style points, one should have real hacker skills in the first place. Pretty lame.
Re:Who would have thought so.... by Billlagr · 2011-09-25 13:16 · Score: 1

It is, but we are dealing with government and/or law after all...
Re:Who would have thought so.... by MobyDisk · 2011-09-25 15:14 · Score: 2

Some possibitilies:
- A celebrity or politician who was gay, or holds an view unpopular in their party.
- A whistleblower
- Someone who lives in a country where certain speech is considered terrorism, or books are banned, or certain technology is prohibited.
- A male who likes Justin Bieber music.
Re:Who would have thought so.... by gmhowell · 2011-09-25 15:56 · Score: 1

Not retaining logs might be illegal, but is it illegal to not make the logs in the first place?
This whole conversation strikes me as a bit anal retentive...
Most legal discussions are similar to 'how many angels can dance on the head of a pin?'

--
Jesus was all right but his disciples were thick and ordinary. -John Lennon
Re:Who would have thought so.... by WorBlux · 2011-09-25 17:04 · Score: 1

How? I mean you could get info from one relay, but it would be useless without data from another 27 relays and careful timing analysis. It's possible, but so difficult most investigators wouldn't bother except for very large crimes. Plus most exit nodes don't keep extensive logs as most of the data is coming from another tor node and the data is hard to get anything useful from without a large degree of coordinated effort.
Re:Who would have thought so.... by Anonymous Coward · 2011-09-26 03:14 · Score: 0

Using open wi-fi is only a good idea if you are in a crowded location or are hidden from view. If you're the only guy with a laptop in McDonald's, and you're ultimately traced back to that location, you can be sure the security cameras are going to rat you out. Actually, even if you're in crowded areas, if your activities are traced back enough times, you'll be discovered by the process of elimination, since you'll show up on each piece of video footage.
You always have to operate under the assumption that you're being watched. The trick is not to create a situation that ties all those observations together and forms a trail that leads back to you.
Re:Who would have thought so.... by Anonymous Coward · 2011-09-26 07:10 · Score: 0

..."this is simply logging when a customer connects and disconnects from the server, this identifies who was connected to X IP address at X time, this is what we do and all we do."
The first part sounds encouraging for an anonymiser service but the latter "...this identifies who was connected to X IP address at X time..." sounds to me like they are actually logging which ip you connect to and when. If that is the case the idea that they are an anonymiser is pretty bunk as they are effectively logging everything you do just like you stuck with your normal isp. The only thing you are paying for at that point if that they will not sell that information only offer it to the police.
Re:Who would have thought so.... by Anonymous Coward · 2011-09-27 16:48 · Score: 0

I can tell you've never worked at a McDonald's. Security cameras in those places are only used to catch criminals robbing the place and employees stealing. At the end of the day as long as they're not robbed and the cash drawers ring up close to right the tapes are written over within days. Actually they have more cameras watching the employees then they do the customers.
Re:Who would have thought so.... by Anonymous Coward · 2011-10-01 21:57 · Score: 0

unfortunately, in switzerland the pinkos (admittedly together with the mccartys here) legislated a 6 month log retention policy for ISPs (i.e. for anyone who offers access to public networks to the general public, including starbucks, Hooters, and universities etc.)
yes, i like going to Hooters.
posting AC for obvious reasons.

lol by smash · 2011-09-24 22:09 · Score: 4, Funny

If you're expecting to use public VPN servers to "hide your ass" you're doing it wrong.

If you're not competent enough to "hide your own ass" then you really shouldn't be fucking with other people's networks.

--
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.

Re:lol by Runaway1956 · 2011-09-24 22:27 · Score: 1

Perhaps you could write a "How to" for covering your ass, then. There aren't very many ways to hide your ass on the internet, and those that I know of are all subject to a MIM attack. Yes, even the darknet is subject to MIM, if the gubbermint wants to throw enough resources into finding you. So, what do you use?

--
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
Re:lol by smash · 2011-09-24 22:29 · Score: 3, Insightful

I'm not claiming to have a method. My option is "don't do retarded shit on the internet and expect not to get caught".
But using someone else's VPN service in a western country is pretty much equivalent to using nothing at all.

--
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
Re:lol by Runaway1956 · 2011-09-24 22:39 · Score: 1

Alright, can't fault your logic there.

--
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
Re:lol by SomePgmr · 2011-09-24 22:39 · Score: 1

I guess that depends on what you're trying to achieve. If it's "I'm going to do something seriously heinous and need to protect myself from huge international investigative bureaus!", then yes, some VPN service in a western country probably isn't going to cut it.

If, on the other hand, you don't want your [employer/service provider/whatever] knowing that you're doing something that's just questionable or embarrassing, it'd probably work just fine... assuming you use it properly.
Re:lol by Anonymous Coward · 2011-09-24 22:47 · Score: 0

Honestly, the best option currently is an encrypted onion network. Tor is one of the largest at the moment but with nodes not always changing and high publicity it's become a target of government surveillance. Onion networks are vulnerable to large wholesale traffic analysis, the more connections between nodes you can monitor the higher the risk your connection through the onion network will be susceptible to traffic analysis. It all depends on how paranoid you are and how much you think relevant governments are doing wholesale internet surveillance. These guys apparently had their own botnets, they should have setup their own onion network using them to at least add a layer of obscurity to an already multi-layered security approach which is what you need for an operation which has a short lifespan.
Re:lol by smash · 2011-09-24 23:03 · Score: 1

Well of course. there's a difference between not getting busted by your employer for doing stuff you shouldn't be doing at work and attacking the US government and multinational corporations, however.
If your want to fuck with the big boys, then you better have your shit in order. Be it some bot-net to hide your tracks with, an account in backpackistan, or whatever.
Renting service of a VPN provider in the UK (who is well known to be the USA's bitch in recent years) to attack megacorps and the US government is just retarded.
But sure, to hide from your boss, go for it.

--
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
Re:lol by Anonymous Coward · 2011-09-24 23:22 · Score: 0

Tor works well enough for this. MITM will not reveal your identity (unless you do something stupid to make the data available to harvest).
Also, MITM is mostly only an issue for tor with unencrypted protocols. Using SSL you are safe from MITM (to the extent you ever are with the mess that certificate authorities and such are), and SSH should be completely safe (as long as you know the server's fingerprint).
Re:lol by SuricouRaven · 2011-09-25 00:00 · Score: 2

Depends who you want to communicate with. There are a few foilhatters on Freenet who believe various conspiracies are after them - and, in the unlikely event they are actually right, freenet is going to be all but impossible to track someone on. Easier to try to bait your target into a trap by, for example, giving him a unique link to a conventional website and then looking through their logs to see where the request came from.

There are a few low-ranking pirate releasers there too, but as they tend not to do the latest blockbuster stuff I doubt anyone is trying to hunt them down either.
Re:lol by Anonymous Coward · 2011-09-25 01:32 · Score: 0

99% of tinfoil hat purposes can be achieved by a combination of VPN, custom MAC, LiveCD and a directional antenna to use someone else's WiFi.
Re:lol by KDR_11k · 2011-09-25 01:51 · Score: 1

How about "only fuck with targets that the intel agencies sniffing in the darknet don't mind seeing fucked with" like targets in countries hostile to the US?

--
Justice is the sheep getting arrested while an impartial judge declares the vote void.
Re:lol by hedwards · 2011-09-25 02:08 · Score: 1

They're plenty of sites dedicated to that, it's just that they have strange names like JC Penny and Macy's.
Re:lol by Anonymous Coward · 2011-09-25 02:54 · Score: 0

You use a hacked computer, that was hacked from another computer, that was hacked from another computer, that was hacked from a another computer, that was hacked from another computer...
Re:lol by mpe · 2011-09-25 03:49 · Score: 1

How about "only fuck with targets that the intel agencies sniffing in the darknet don't mind seeing fucked with" like targets in countries hostile to the US?

Governments can change which countries they do and don't like very rapidly. As well as publically claiming one thing, whilst actually doing something completly different. Even if you could find a country which truely had no friends you'd probably find that various "intelligence agencies" would view you as trespassing on their "turf".
Re:lol by countertrolling · 2011-09-25 04:01 · Score: 1

...the UK (who is well known to be the USA's bitch in recent years)...
*sigh* You all have it so backwards. The USA is the UK's muscle. What? you didn't notice what happened when the Americans put an Irish republican into office?

--
For justice, we must go to Don Corleone
Re:lol by Anonymous Coward · 2011-09-25 04:51 · Score: 0

You're a champion of throwing judgment at those incapable of doing what you cannot. A hero of logic... * Rolls Eyes *
Dumb ass.
Re:lol by mlts · 2011-09-25 07:13 · Score: 1

It all depends on who someone has to worry about and whom they are going to piss off with their actions. Maybe VPN services should be in tier levels for anonymity provided:
The lowest tier of anonymity are VPNs that provide high speed, but are located in the same country. These are good to protect you from compromised Wi-Fi providers (no FireSheep or BEAST attacks), ISPs who are Phorm-happy, and ISP data retention. These are VPNs who you use to keep your buying habits out of the guy at the one star motel's hands, but anything that would get an actual lawyer to spend time enough for a motion of discovery, don't bother.
The second tier would be VPNs in another Western country such as Sweden that is part of treaties, but won't rat people out because someone is sue-happy. These have fairly fast pipes (although slower than the previous tier), and are better at hiding traffic from the casual divorce attorney doing a fishing expedition, or people looking to do mass lawsuits against John Doe downloaders.
The next tier will be VPNs in countries who are not bound by ACTA, WIPO, and other treaties, like Eastern Europe.
Finally the last tier are in countries with little or no ties with Western countries. However, it is a crap-shoot if you get a good VPS or not. Some may accept a bribe and hand over every single log, because they know there will be no chance of lawsuits for violating their part of an agreement.
The key is who is one going to piss off by their network traffic. Keeping the ISP's Phorm server away from your Facebook pages is one thing, while sending material that is top secret to a large country would be another.
Re:lol by Anonymous Coward · 2011-09-25 09:26 · Score: 0

The *internet* is subject to MIM attacks. There is absolutely nothing you can do to protect yourself from others *attempting* MIM attacks unless you physically plug your cable in the destination server.
So with that point out the way .... the way to cover your ass is to create your own VPN. Hire a dedicated server and install OpenSWAN, OpenVPN, PPTP or whatever you want.
Your only two hurdles are anonymous payment options and trustworthy hosts. "seedboxes" with root shell are usually a good choice as they are usually re-rented so your name isn't on the server, and payment can be done in cash.
Re:lol by drolli · 2011-09-25 09:32 · Score: 1

If you are not good enough to collect the information yourself and construct your own path, then you should neither be given be given nor thrust others opinions.
Re:lol by Anonymous Coward · 2011-09-25 21:39 · Score: 0

Buy a second hand laptop. Use internet cafes. Visit them randomly. Check a map to make sure they don't fall into a even distribution centred on your house / work / etc. Bin laptop every month.
Re:lol by Anonymous Coward · 2011-09-27 01:47 · Score: 0

Acquire a botnet, doesn't have to be a large one, get direct access to one of the bots and disable logging and clear all log files, then route through that (maybe even using multiple bots), change bots at least once a day, you don't want the authorities to have enough time to discover that machine and install some surveillance on it (or via a MitM) to track you. How you get the botnet without leaving tracks back to you may be a problem.

So disappointed by the name by antifoidulus · 2011-09-24 22:09 · Score: 5, Funny

I was hoping something like hidemyass.com would be devoted to the anti-muffin top movement :P

--
Monstar L

Re:So disappointed by the name by carou · 2011-09-25 06:32 · Score: 2

I thought it was about camouflaging unpicturesque donkeys.
Re:So disappointed by the name by WorBlux · 2011-09-25 17:15 · Score: 1

Is there such a thing as a picturesque donkey?
Re:So disappointed by the name by tangent · 2011-09-26 08:03 · Score: 1

I figured the next news logical item was a press release for new HideMyAss.com thongs. Because they both apparently hide your ass equivalently.

Lulz! by Anonymous Coward · 2011-09-24 22:12 · Score: 0

That lulzsec guy is going to get introduced to fuckmyass.com in jail!

Censorhip anyone? by miahmiah · 2011-09-24 22:12 · Score: 2

HMA is designed to avoid censorship, not mask illegal activities. Although their may be some gray area where using the internet to organize people in political actions may be illegal, the sharing information itself is not illegal, and should not be censored. People that then actually commit cyber crimes or real crimes, will be subject to applicable laws by involved governments, and of course, the governments will take action to find the responsible parties.

Re:Censorhip anyone? by smash · 2011-09-24 22:30 · Score: 1

OK, so given that some censorship worthy information is illegal in some countries, what's to say hidemyass.com won't just bend over for a government other than the US, when presented with law breakage in that particular country?

--
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
Re:Censorhip anyone? by zlogic · 2011-09-24 22:40 · Score: 1

I always thought HMA was a service for using Facebook or any other blocked site at work.
Re:Censorhip anyone? by maxwell+demon · 2011-09-24 23:07 · Score: 1

The key part is "when an UK judge tells them to." Which means that the UK judge must be convinced that this request is justified under UK rules. Not perfect (the request can contain any amount of lies, and the judge can fall for them), but at least one more barrier. And if you're really concerned about your security, I guess you'll not do your stuff directly through that VPN, but tunnel another security protocol (e.g. Tor, or a connection to another VPN) through it.

--
The Tao of math: The numbers you can count are not the real numbers.
Re:Censorhip anyone? by MysteriousPreacher · 2011-09-25 00:58 · Score: 1

Nothing really, other than their assurance that they reject legal requests except this coming via the UK judicial system. With the European Arrest Warrant though this can be problematic. For example, prior the UK's de-criminalization of blasphemy a member state with a blasphemy law that was not just an relic could see their batshit crazy law enforced in the UK.
Do you have reason to suspect that HMA will abandon their stated policy?

--
-- Using the preview button since 2005
Re:Censorhip anyone? by jonbryce · 2011-09-25 01:21 · Score: 1

It doesn't have to be illegal in the UK to get a European Arrest Warrant. Around 25% of all European Arrest Warrants are from Poland on the charge of exceeding your bank account overdraft limit, something which isn't illegal in any part of the UK.
Re:Censorhip anyone? by MysteriousPreacher · 2011-09-25 01:35 · Score: 1

Damn, I thought that had been changed. Thanks for the clarification.

--
-- Using the preview button since 2005
Re:Censorhip anyone? by KDR_11k · 2011-09-25 01:58 · Score: 1

I expect countries with active censorship to simply ban hidemyass.com and be done with it.

--
Justice is the sheep getting arrested while an impartial judge declares the vote void.
Re:Censorhip anyone? by couchslug · 2011-09-25 03:38 · Score: 1

"HMA is designed to avoid censorship, not mask illegal activities"
Same shit, different day. The level of protection required is the same, anonymity.

--
"This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
Re:Censorhip anyone? by Anonymous Coward · 2011-09-25 04:33 · Score: 0

RTFB - it clearly states that they are a UK company and only follow UK law. If some other country asked them for
shit, they say FU. Unless that country goes through diplomatic channels and a UK Judge orders it.

Just log to the right place... by geogob · 2011-09-24 22:14 · Score: 4, Insightful

I've heard /dev/null is a pretty neat place to store logs. Compression ratio is quite high too - no need to worry about filling disks with uncompressed logs.

Re:Just log to the right place... by Runaway1956 · 2011-09-24 22:28 · Score: 1

I'm looking around my desk, looking for /dev/null. Can't find the damned thing. Not even sure what I'm looking for. Do you have a picture? ;^)

--
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
Re:Just log to the right place... by Anonymous Coward · 2011-09-24 22:30 · Score: 0

I think I'm just going to print your comment out, no way I can lay it on so thick from memory alone
Re:Just log to the right place... by Anonymous Coward · 2011-09-24 22:38 · Score: 0

You could save his comment in /dev/null too. That way it will be preserved forever.
Re:Just log to the right place... by Anonymous Coward · 2011-09-24 22:47 · Score: 0

cat /dev/null >> Runaway1956
Might take a while, hope you have a fast connection.
Re:Just log to the right place... by qbast · 2011-09-24 23:11 · Score: 2

Well, /dev/null is like gaping black hole. I am sure someone you can find relevant picture if you browse slashdot for a little longer.
Re:Just log to the right place... by geogob · 2011-09-25 01:57 · Score: 1

It's hidden. Here's the unlock key : /dev/random > /dev/mouse
no, it's not the unlock key. don't do this...
Re:Just log to the right place... by Anonymous Coward · 2011-09-25 01:59 · Score: 0

But I don't have time to browse slashdot, someone just invited me to a party with lemons.
Re:Just log to the right place... by Anonymous Coward · 2011-09-25 03:36 · Score: 0

Don't do it! I've heard that the CIA has secretly patched all versions of UNIX/Linux to capture everything that goes to /dev/null.
Re:Just log to the right place... by geogob · 2011-09-25 04:39 · Score: 1

The solution to this little problem is quite easy.... /dev/random > /dev/null.
Re:Just log to the right place... by pbhj · 2011-09-25 04:48 · Score: 1

Here's a picture of /dev/null, I think I captured its best side:
Re:Just log to the right place... by Runaway1956 · 2011-09-25 05:23 · Score: 1

Awesome. Just awesome. No photographer could have done better!

--
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
Re:Just log to the right place... by Rizimar · 2011-09-25 08:32 · Score: 1

Well, /dev/null is like gaping black hole.
If you're storing logs there, you could just call it a "memory hole"

And? This shouldn't be a surprise by jimicus · 2011-09-24 22:17 · Score: 4, Insightful

It's quite clear that HMA see their service as a way of doing things that are not illegal through a VPN. There's plenty of perfectly legitimate reasons to want to do this, and that's what the service is there for.

It's not there to allow someone to break the law with impunity. So it's not been engineered to be particularly difficult to dig into the logs and figure out who was using the service. So if they get served with a court order saying "Hand over the logs", they have to.

Want something which is a lot harder to be traced? Don't use a commercial VPN service, use something like Tor.

This isn't a story of "HideMyAss selling out". This is a story of "Person uses a service in a way it's not meant to be used and is surprised when it blows up in his face".

Re:And? This shouldn't be a surprise by heypete · 2011-09-24 22:26 · Score: 2

It's quite clear that HMA see their service as a way of doing things that are not illegal through a VPN.
Indeed. I use a similar service for accessing various online services (e.g. Netflix, Pandora, etc.) that are geographically limited to the US (or at least to US+Canada) while I'm in graduate school in Europe. Nothing illegal about that, and I wouldn't be surprised if the VPN provider kept detailed logs.
Re:And? This shouldn't be a surprise by antabus · 2011-09-24 23:17 · Score: 2

Can you link to this? I've been looking for a service like that, and wouldn't mind some recommendations.
Re:And? This shouldn't be a surprise by Anonymous Coward · 2011-09-25 00:03 · Score: 1

Just use http://www.unblock-us.com/
Not similar tech wise, but much better than any VPN solution, performance wise
Re:And? This shouldn't be a surprise by Bert64 · 2011-09-25 00:13 · Score: 1

Indeed thats primarily what UK based VPN services are used for, to access things like BBC iPlayer and other such resources.

--
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Re:And? This shouldn't be a surprise by lseltzer · 2011-09-25 00:29 · Score: 1

Hear hear. I'm an HMA Pro subscriber BTW and I'd go so far as to say that I'm glad for them that they could be part of busting these assholes.
Re:And? This shouldn't be a surprise by heypete · 2011-09-25 03:15 · Score: 2

I've had good luck with StrongVPN and their L2TP/IPSec VPN service.
I'm in Switzerland and connect to a Washington DC server (low latency from Europe to the US East Coast). The only connectivity problems I've had were related to the spotty wifi environment in the temporary place I'm presently living in (shared wifi between about 30-40 people) until I move into my private, long-term apartment in a week.
Setup was trivial, and so far connections have been limited only by my local connection speed.
Re:And? This shouldn't be a surprise by Toy+G · 2011-09-25 03:19 · Score: 1

What you do is clearly a breach of contract between you and the content provider, with more contractual implications up the licensing chain. At worst, it could be argued that you're defrauding the content provider/producer. So, "not illegal"? Maybe, maybe not, it's a grey area. For sites like HideMyAss to state that this sort of usage is fully legal is very self-serving and clearly false.
Let's be honest, we now know that HMA will fold when the first copyright troll comes knocking with a court order. Their reputation is shot.

--
-- Let's go Viridian.
Re:And? This shouldn't be a surprise by mpe · 2011-09-25 03:36 · Score: 1

What you do is clearly a breach of contract between you and the content provider, with more contractual implications up the licensing chain.

The only way a contract could possibly exist with a streaming media site would be where a user had to "sign in" somehow.
If this server was just making a decision based on the IP address it saw then how could such a contractual relationship exist?
Re:And? This shouldn't be a surprise by Anonymous Coward · 2011-09-25 05:45 · Score: 0

Out of curiousity, why do you think there's nothing illegal about that? Without digging into it myself, I could think of a couple reasons that might make it illegal (eg violation of contract, local laws making that service illegal)
Re:And? This shouldn't be a surprise by Anonymous Coward · 2011-09-25 05:49 · Score: 0

Sure: This is asuming that all the FBI does is solve actual crimes, where people are actually doing illegal things. History and common sense would prove otherwise. From the begining, the FBI has been involved in spying on and trying to disrupt perfectly legal political groups that might not have seen eye to eye with the administration at the time. I've heard stories that range from simple harrassment and surveillence all the way to court cases involving FBI agents planting bombs in activists cars/cutting break lines, etc. . .
Given that unfortunate reality, information sharing with the FBI is prone to be abused to go against potential whistleblowers, and political activists. Also, in the "post 9/11 world" (I hate that term), information sharing between governments is almost frighteningly far reaching. There is no way to tell if a Chinese dissident who tries to hide their identities aren't basically outed by the FBI for (counterterrorism reasons). It's been frighteningly common to see even Western agencies openly refer to protestors and political activistis as "terrorists" without any illegal or violent activity taking place.
It's unfortunate to say, but I'd rather some criminals go scott free than deal with the horror of an all encompasing Big Brother. I am statistically far more likely to be harmed by a government than any single criminal. I wouldn't want an Identity Theft ring given all of my personal information, so why would I want a government, who is much more likely to cause harm to me for little or no reason to have that same information? Especially since a criminal gets arrested if he commits a crime against me, but a government agent gets a promotion (Get those evil political protestors! Good job fer Amerkuh!)
Re:And? This shouldn't be a surprise by bruce_the_loon · 2011-09-25 06:35 · Score: 1

HMA is intended to get past corporate firewalls for blocked sites like Facebook and so on. It certainly ain't a TOR or similar.

--
Trying to become famous by taking photos. Visit my homepage please.
Re:And? This shouldn't be a surprise by heypete · 2011-09-25 17:39 · Score: 1

I was thinking more of the "stealing the content" type of illegality. Since I continue to pay for it, I don't think that is an issue. I'm not a lawyer, so I could very well be breaking some law somewhere. Mea culpa.
Re:And? This shouldn't be a surprise by Sparrow1492 · 2011-09-26 00:26 · Score: 1

I'll second that. I stream Netflix to Germany for $50 a year and a cheap router to do the PPTP.

Shocker? by Manip · 2011-09-24 22:20 · Score: 1

Is this really surprising to anyone? There are two ways to hide traffic. The first is illegal and it will cover your tracks because you can use hacked machines without any logging. The second is legal and it is very hard to hide yourself. The only legal way which might actually work is if you bounced through a country with no diplomatic ties to the West but very few of those are even on the internet.

So back to this company. Does it surprise anyone that a company located in the UK of all places would have to give up logs when a judge orders it to? It is that way in almost every Western state. If US law enforcement requested such information I see no reason why a UK court shouldn't grant it (although you'd have to decide on a case by case basis).

Re:Shocker? by Anonymous Coward · 2011-09-24 22:53 · Score: 0

You could break into machines and disable logging, but that doesn't prevent ISPs from doing so.
Sure, traffic logs are not enough to convict you of anything, but someone out there is going to wonder how come the attacks came from the compromised machine right when you were having a heated exchange on port 22.
Re:Shocker? by SuricouRaven · 2011-09-25 00:07 · Score: 1

There is a third: Have friends in very high places. This option isn't available to most people, but it's an open secret that there is some amount of international espionage going on with countries trying to blame their hacking efforts on independant hackers who happen to live within their borders.
Re:Shocker? by Anonymous Coward · 2011-09-25 00:23 · Score: 0

Yea, the nutty hollywood-esque conspiracy theory is a valid third option. I'll call up my friends at the bureau and make them blame my next crime spree on you for bringing our insidious plan to light.
Re:Shocker? by Anonymous Coward · 2011-09-25 00:27 · Score: 0

You'd need to break into several machines in different countries, preferably countries which do not generally co-operate with the law enforcement agencies of the country you are attacking or the country where you are based. Sure even this isn't infallible, but they will have a hard time tracing you back hop by hop through un-cooperative ISPs...
Also make sure your machine is rootkitted too, gives you plausible deniability that you are just another victim being used as a relay by the unknown hackers.
And of course, don't hack your own country... Your local law enforcement is far more likely to co-operate with local organisations than foreign ones.
The harder you make it, the more serious the offense has to be in order for them to bother.
Also depending on who you hack, most commercial companies won't want any publicity so unless you do something high profile like deface their website, will just want the whole incident brushed under the carpet as public knowledge of a security breach is bad for business. Non commercial targets however, like educational and government targets are less likely to care about loss of business and are more likely to come after you.
Re:Shocker? by stonewallred · 2011-09-25 01:01 · Score: 1

So North Korea could make a fortune running proxy services?

It took a judge by He+who+knows · 2011-09-24 22:21 · Score: 2

at least they wait till a judge tells them to.Too many companies/websites are handing over information if they are asked.

Amateurs. by Anonymous Coward · 2011-09-24 22:22 · Score: 0

Haha, LulzSec was using hide my ass? Talk about amateurs. Just get some VPN or VPS account from some "We have a long 6 month history" company from India or Italy. Any legitimate business or entity will always give logs to the authorities since they are compelled to by law and in some cases can be held in contempt of court if they refuse. What happened to CloudFlare? They were turning a blind eye even during the whole saga, so were a bunch of other companies. These guys didn't trust Tor but they didn't think to turn their botnets into their own onion network either.

Proxies by Hentes · 2011-09-24 22:24 · Score: 1

A lot of proxies get around this problem by launching a new site every few days.

Re:Proxies by Raenex · 2011-09-25 02:03 · Score: 1

And what makes you think you can trust those proxies? You might remember about the Sarah Palin email hack during the 2008 election. The perp got busted because he used a proxy that claimed it didn't keep logs. Turns out that they did and the owner made sure that the logs were available for the feds.

Oh no by lucm · 2011-09-24 22:26 · Score: 1

I'd like to make a smart comment here but I don't have time, I have a lot of stuff to delete before the feds knock to my door!

--
lucm, indeed.

This is what you do to truly hide your ASS! by MindPrison · 2011-09-24 22:27 · Score: 5, Informative

Not everyone understands computers, that doesn't mean they're incompetent, wikileaks, openleaks and other needs to help their submitters keep anonymous, and there are better ways to do this, follow my instructions below, and you'll be as safe as you CAN be in this world:

1) First of all, you need to download TAILS

http://tails.boum.org/download/index.de.html

2) Burn this .ISO on a CD

3) Get a second computer

4) Tear out its harddisks

5) Make sure there are NO USB-memory sticks either.

6) Make it boot from the CD only, (enter the bios and set Boot Priority to CDROM)

7) Now you can surf relatively safely, but you're not done yet!

8) When surfing, do NOT surf into familiar places of yours, do NOT use your real name, do NOT search for your real name or even your internet alias, if it's known in combination with your name (if you surfed with it on your computer, google already knows your IP, so forget it!)

TAILS uses TOR, google it if you're truly curious. It can't keep you 100% anonymous but it's the safest "service" out there, and it's only relatively safe if YOUR SURFING HABITS ARE SAFE TOO.

Good luck!

--
What this world is coming to - is for you and me to decide.

Re:This is what you do to truly hide your ASS! by akanouras · 2011-09-25 02:26 · Score: 2

and you'll be as safe as you CAN be in this world
Are you fishing for idiots?
"Go find an unsecured AP in some other city and/or country" is the first step in getting some anonymity.
After that, there's a never ending list of precautions you should take, of which your advice is only one part.
Re:This is what you do to truly hide your ASS! by Anonymous Coward · 2011-09-25 03:13 · Score: 0

TAILS still has numerous open bugs against it and leaks quite a bit of information on bootup that it shouldn't...
Re:This is what you do to truly hide your ASS! by MindPrison · 2011-09-25 03:22 · Score: 1

A good thing to do when making a claim like that, is to start by pointing out a few of them. I'm sure there's bugs and exploits, but do you REALLY know, or is it just your average basic assumptions you could technically say about anything?

--
What this world is coming to - is for you and me to decide.
Re:This is what you do to truly hide your ASS! by Anonymous Coward · 2011-09-25 09:49 · Score: 0

Tails isn't perfect... its not bad considering there isn't a publicly available solution which is better. And overall your set of instructions are solid. Depending on what you are doing it might be advisable to take some other measures though such as a wifi hotspot of a significant distance away where there aren't cameras to record you/your car. There are also attacks which can be performed if you are planning to mail something which can be performed. There are potential solutions to this though.
Re:This is what you do to truly hide your ASS! by Anonymous Coward · 2011-09-27 04:20 · Score: 1

It isn't hard to go and look at the bugs page, that you didn't bother means you are lazy, from the bugs page, this this and this seem to be of concern to me if I was to consider it truly secure.

seriously... by Anonymous Coward · 2011-09-24 22:28 · Score: 0

Use a coffee shop connection or any other open/crackable WIFI + tor.

Re:seriously... by SuricouRaven · 2011-09-25 00:08 · Score: 1

Might want to change your MAC too.
Re:seriously... by allo · 2011-09-25 05:12 · Score: 1

the mac is only transmitted to the next router, not to the target site.
Re:seriously... by SuricouRaven · 2011-09-25 06:48 · Score: 1

You're quite right, which means that on your typical home broadband changing the MAC is pointless. On a public access point, however, it can be used to help track someone. Once the investigaters (be they police enforcing uncontriversial law, private investigators or agents of some oppressive regime) track the IP address down to the physical location, the first thing they'll do is grab the DHCP logs and get a list of MAC addresses in use at that location at the right time. Then they can use that to either trawl databases (OEM sales, ISP mac/modem associations, public hotspot customer lists) or to use to prove a suspect was at that location at the appropriate time. Either way, if you want to be paranoid, fake the MAC.

Russian or chinese proxies. by unity100 · 2011-09-24 22:29 · Score: 1

thats what you should use.

--
Read radical news here

Re:Russian or chinese proxies. by Anonymous Coward · 2011-09-24 22:31 · Score: 1

Too slow, unreliable and low bandwidth and who knows how many are passive or active MITM honeypots.

USAOwnsOurAss by fantomas · 2011-09-24 22:30 · Score: 2

Something we suspected for a long time...

Don't get me wrong, we're truly grateful you stepped in 70 years ago to help save us being conquered by the nazis (even if you did take 2 years to finish your breakfast before getting your spurs on) , but jings, we do seem to have a procession of Prime Ministers whose real dream seems to be made a governor of a USA state...

Re:USAOwnsOurAss by Anonymous Coward · 2011-09-24 23:20 · Score: 0

Eddie, that you?
Re:USAOwnsOurAss by Anonymous Coward · 2011-09-25 00:42 · Score: 1

even if you did take 2 years to finish your breakfast before getting your spurs on
That's an incredibly naive view of what really happened back then.
For one thing, back then Americans were almost 100% against foreign involvement after the fiasco that led to WWI. To put it bluntly, we were doing exactly what everybody is bitching at us for not doing today- staying out of their business.
But more importantly, we really did not have the military hardware, troops, etc. to do much at all. Everything from WWI was used up, sold off, or converted to civilian applications, or was already horribly outdated to the point of being useless. We didn't spend 2 years eating our breakfast, we spent 2 years converting our industry to military manufacturing and getting ready for war. And a good bit of that time we were sending a ton of help in the forms of food, medical supplies, and military equipment over to Europe.
Re:USAOwnsOurAss by DrgnDancer · 2011-09-25 01:09 · Score: 1

Oh come on, really? Sure the UK and the US work hard to keep each other happy. We're almost certainly amongst each others most important allies (Canada is probably more important to us, France more important to you, for geographic reasons; but we're hugely important to each other). I won't deny that the UK has bent over backward to help the US before (and we've done the same), but in this case you're just being a tinfoil hatter. A law enforcement agency of a sovereign nation went to your courts and presented solid evidence that an international crime had been committed partially on your soil. They asked for a warrant to search for information from a company linked to said crime. It doesn't matter if the country in question was the US or Portugal, they'd have gotten the warrant. It's a simple process and it happens daily, probably hourly. International law enforcement cooperation is strong amongst all the western nations.
As long as the action in question is in fact a crime in the UK (it appears to be), and the evidence presented is sufficient (it appears to be), a warrant will be issued.

--
I don't need a million points of light, just two points of multi-mode fiber and a 10 Gig-E router.
Re:USAOwnsOurAss by hedwards · 2011-09-25 02:11 · Score: 1

I think we'd be willing to give you Texas if you promise not to give it back.
Re:USAOwnsOurAss by Anonymous Coward · 2011-09-25 06:31 · Score: 0

For one thing, back then Americans were almost 100% against foreign involvement after the fiasco that led to WWI. To put it bluntly, we were doing exactly what everybody is bitching at us for not doing today- staying out of their business.
Exactly. We had laws that were intended to keep us from getting involved in foreign conflicts.

And a good bit of that time we were sending a ton of help in the forms of food, medical supplies, and military equipment over to Europe.
And when our future allies were feeling the pinch we made slight adjustments to those laws that would allow us to sell the military equipment they needed. We'd have sold it to whoever was able to come here, pay cash, and haul it away. Technically we'd have sold it to the Axis if they came calling but they didn't have the shipping capabilities.

i dont use a vpn to hide criminal acts by drolli · 2011-09-24 22:38 · Score: 2

I use a VPN because i firmly believe that a malicous neighbor on the same cable trunk does not need to know what i am doing or intercept certain connections. I use a VPN because public and free WLANs and Hotels LANs are uncontrolled cesspools. I use a VPN because i dont want every server operator to be able to identify my location to the block-level (and combine it with other techniques to identify me). I use a VPN because i dont trust GSM encryption. I use a VPN because i dont want to be throttled based on IP or content.

If the FBI wants to see the log of my VPN provider, they can. If i would want anonymity i would go to other measures.

Re:i dont use a vpn to hide criminal acts by Anonymous Coward · 2011-09-25 00:10 · Score: 0

You are putting way too much faith in your VPN provider if you are that paranoid.
Re:i dont use a vpn to hide criminal acts by Anonymous Coward · 2011-09-25 00:41 · Score: 0

Cable internet (DOCSIS) use encryption so that others on same segment cannot see your traffic.

Anonymouse by E.I.A · 2011-09-24 22:43 · Score: 5, Interesting

Would the same go for anonymouse.org? I have visited my own website through their proxy, and it remains unlogged in (wordpress) WassUp stats. Hidemyass actually shows up though, along with my browser type and screen res. Also, why do more people not consider that these anonymity services are not honey pots?

--
Laws are like sausages. It's better not to see them being made. - Otto von Bismarck

Re:Anonymouse by zzyzyx · 2011-09-25 14:00 · Score: 1

These services provide network-level protection, not application-level. If you need this, document yourself about it and take the additional necessary steps.

hidemyass.com by mehrotra.akash · 2011-09-24 22:46 · Score: 1

HMA is primarily used to bypass school/college firewalls

Re:hidemyass.com by Anonymous Coward · 2011-09-24 23:18 · Score: 0

and national censorship, including geofiltering by websites. I use the free proxy service to view all those videos geofiltered by Youtube because they have background music and the German RIAA equivalent threatened to sue for fees.
Re:hidemyass.com by BrokenHalo · 2011-09-25 03:13 · Score: 1

Seems to me that if bypassing work/school firewalls is your concern, the simplest solution is to not use those networks for personal stuff. After all, it doesn't cost that much for a USB dongle and wireless plan, or for that matter to use a data connection on your phone.

Two words... unprotected WIFI by Anonymous Coward · 2011-09-24 22:48 · Score: 0

two more words... proxy chaining, one word... TOR

Have your last proxy in a questionable country as well - fckknowswhere-istan

Use a Nic that you can write a mac address to and change it on occasion and have a separate encrypted removable HDD that you swap out and stash when your 'private' activities are over. Boot from a CD or a virtual machine so even if something was uploaded to you it is wiped next boot.

CCTV on the entrances to your house will also help with seeing the Feds coming and you power down.

Also have lots of old spare and unused encrypted HDD around. Go ahead narcs get all forensic on those terra bytes of drives you found - time consuming and plausible deniability about forgetting passwords to the numerous encrypted partitions spread around.

If they can find and prosecute you after all that then you've probably been found by men who stare at goats.

Re:Two words... unprotected WIFI by SuricouRaven · 2011-09-25 00:04 · Score: 4, Insightful

In most cases, changing your MAC is pointless. It doesn't go beyond your segment anyway, and your ISP will be tracking you based on either modem identifier or physical line your connection comes in via.

The only exception is if you are using a public(/hacked) wireless hotspot, in which case they may be able to use the MAC to track you down (Some OEMs, like Apple, keep the MAC on record and associated with purchaser) or else use it as proof if they already have enough suspicion to sieze your laptop.
Re:Two words... unprotected WIFI by Anonymous Coward · 2011-09-25 00:25 · Score: 0

In most cases, changing your MAC is pointless.
In of itself, yes. But it will trigger the DHCP server of most ISP's to hand out a new IP address, which cycles the old one back into the useable pool. Depending on how long your ISP holds records, you might get lucky and the record of you having that address might be purged before anybody comes looking. Don't count on it, however, since those logs are usually kept for at least 3 years in the US.
The accuracy, and actual retention time of those logs is open for debate. Some ISP's do a good job, others are so miserable at it that they routinely cannot identify users once a lease expires and/or will give faulty info to the authorities.
Re:Two words... unprotected WIFI by Anonymous Coward · 2011-09-25 00:27 · Score: 1

RE: "In most cases, changing your MAC is pointless" and "The only exception is if you are using a public(/hacked) wireless hotspot"
Did you read the heading of the post you replied too (and hence the subject of your post)? - "Two words unprotected wireless"
The whole presumption of the post was that wifi was used and 'stolen' from a source not linked to the anonymous computer user.
It would be a shame to have everything encrypted and stitched up secure (perhaps even magnetized if time permitted) only to have them match the wireless traffic to the unique MAC address in your laptop that was seized.
So I would say in the context of the post you replied to not pointless at all.
Re:Two words... unprotected WIFI by KDR_11k · 2011-09-25 01:55 · Score: 1

I don't know about your ISP but mine deliberately doesn't give you the same IP again after a disconnect (and disconnects at least once every 24 hours) so that you cannot reliably serve stuff from your IP address.

--
Justice is the sheep getting arrested while an impartial judge declares the vote void.
Re:Two words... unprotected WIFI by Slashdot+Assistant · 2011-09-25 02:47 · Score: 1

That is annoying. I recall a friend having the same thing happening at around 3 or 4 each morning.
Re:Two words... unprotected WIFI by BrokenHalo · 2011-09-25 02:51 · Score: 1

I would have thought that would be a waste of effort. Anyone who has the slightest interest in serving stuff over a dynamic IP is bound to have heard of dynDNS.
Re:Two words... unprotected WIFI by nurb432 · 2011-09-25 11:13 · Score: 1

Vmware
Solves several problems, such as traceable mac address, and easily deletable files but retaining your 'os' install so it does not look suspicious.
I also doubt Apple keeps that sort of record, as there is this pesky thing called the 'second hand market' which would make that database obsolete in minutes.

--
---- Booth was a patriot ----

I'm OK by catmistake · 2011-09-24 22:48 · Score: 1

Logging is for thick-necked, dull-witted, arborphobic lumberjacks.

--
The Admin and the Engineer

Re:I'm OK by FrootLoops · 2011-09-24 23:40 · Score: 1

Wow. I just got through a wild ride visiting very strange places. Thanks for that.
Re:I'm OK by Anonymous Coward · 2011-09-25 03:16 · Score: 0

I assume your home is made of concrete and furnished with plastic, then?

Comment removed by account_deleted · 2011-09-24 22:55 · Score: 1

Comment removed based on user account deletion

Re:Bear with me here, but... by E.I.A · 2011-09-24 22:56 · Score: 1

My best guess is legal compliance.

--
Laws are like sausages. It's better not to see them being made. - Otto von Bismarck

Use a provider in a different jurisdiction by Anonymous Coward · 2011-09-24 23:10 · Score: 0

To quote the PRQ "About us" page (http://www.prq.se/?p=company&intl=1).

"The only thing we need to know about you to set up the service is which e-mail address that should receive the invoices. Logging is only done to the minimal extent required for trouble-shooting in case of problems, and thus we do not have any logs whatsoever of data traffic."

I'm not saying PRQ are the only (or even the best) VPN provider that conduct their business in this way, I just want to point out that there are indeed alternatives to the apparently crap-a-delic service HideMyAss is providing. If the UK has seen it fit to force ISPs to keep logs, don't use an ISP that falls under their jurisdiction. Easy as that.

Re:Use a provider in a different jurisdiction by Mister+Transistor · 2011-09-25 01:08 · Score: 1

Well, if you had read TFA, they say exactly the same shit on the HideMyAss website. They state they don't log data traffic at all and they only keep logs of when people connect in and out so they can "troubleshoot" any troublesome connections (like illegal activity, spamming or anything else they are ordered to keep track of, no doubt). The only variable is how long they keep them and how easily foreign governments (i.e. the US) can get the info. It sounds like PRQ is just more of the same to me.
Any "legitimate" VPN service is going to be subject to their local laws and very likely to the influence of US gov't interests as well. Not the best place to be doing "anonymous" stuff from, most definitely.

--
-- You are in a maze of little, twisty passages, all different... --

officially 1337 by Anonymous Coward · 2011-09-24 23:11 · Score: 1

From the court order:

a. "Anonymous" was a collective of computer hackers [...]
b. "Lulz Security," or simply "LulzSec," was a group of elite computers hackers affiliated with Anonymous.

So elite that they were able to hack more than one computer at once! So elite that they used the paid VPN service of a legal UK company under their real names...

Re:officially 1337 by Bert64 · 2011-09-25 00:56 · Score: 2

If you have to admit to having been hacked (and its hard not to when its already gone public), its less shameful to be hacked by an elite group of hackers than a bunch of script kiddies.
All about PR spin.

--
http://spamdecoy.net - free throwaway anonymous email - avoid spam!

Of course. Duh. by Sasayaki · 2011-09-24 23:17 · Score: 4, Insightful

Unless you're some kind of super 4Chan, you can't run a business that actively keeps no logs and relies upon -- as your buisness model -- the idea that you can keep people 100% anonymous online no matter what they do. That's just retarded.

Generally speaking, the best you can hope for is, "We will keep you safe from basically anyone who doesn't come knocking with a court order or warrant. Depending on your country, they may not even have that, but they'll definitely have to be law enforcement related."

I mean, really. Would you willingly operate a legitimate business that had, as its business model, the idea that your clients give you a hunk of money and then you give them back an entirely different set of money (minus 15%) in non-sequential bills? Do you think such a business would operate without being investigated by the FBI/CIA/ASIO etc? Who would you think the primary clientele of such a business would be and is it really ethical to protect them?

Somewhat more tin-foil-hatty is the idea that anyone who runs a business that promises to give the finger to the law, doesn't keep any logs and is prepared to go to jail to project your online anonymity... well, to me, that screams that they're a honeypot. Probably paid for directly by the FBI, with 95% of their clientelle being 13 year old 4Chan script kiddies, PirateBay users and other harmless folk who are utterly ignored and left in peace... but that other 5% being pedos (there are *very very* few pedophiles online; don't buy into the panic!), drug runners and organized crime members who are kept under close surveillance.

In short, I would rather use an anonymizing VPN service who spells out exactly what is kept and why, and what level of law enforcement intervention is required. A service I would use would probably have the following terms of service:

1) If you commit any crime, or transmit evidence of any crime, that has a minimum of one year in jail OR do anything *truly* retarded (like Skype-out over the VPN and call the White House legitimately threatening to assassinate the President of the United States) then your arse is grass.
2) If you are DDOSing from behind the VPN service, or sending spam e-mail, or operating any form of spam/volume based attack behind the VPN we'll disconnect you since that typically rapes our already overloaded services. Generally no legal butthole-raping, just a D/C, one day timeout, and an e-mail explaining why. Note rule #1 still applies if you are scamming people.
3) If the cops come with a 100% legal warrant issued by a judge, irrespective of the crime, we'll comply with its order.

I believe that's entirely fair and I know some people will scream for more, but realistically, I think that if your business doesn't basically follow those three rules it's not going to survive... or is a honeypot.

--
Check out my sci-fi book "Lacuna" at http://goo.gl/MVxX8

Re:Of course. Duh. by Anonymous Coward · 2011-09-25 02:07 · Score: 0

"Would you willingly operate a legitimate business that had, as its business model, the idea that your clients give you a hunk of money and then you give them back an entirely different set of money (minus 15%) in non-sequential bills?"
It's called a casino and there's dozens of them in Vegas.
Re:Of course. Duh. by Anonymous Coward · 2011-09-25 02:29 · Score: 0

If your business operates from a country where you are not legally obliged to keep log files and there is nothing akin to the PATRIOT act, providing anonymizing services are a perfectly fine and legal business model. Not everywhere in the world can law enforcement authorities force people to lie or commit fraud.
I don't know which countries qualify for this, though. I'm pretty sure the UK does not.
Re:Of course. Duh. by misexistentialist · 2011-09-25 04:18 · Score: 1

What's the point of using it under those terms? Warrants and subpoenas are hardly scarce, and could be issued for copyright infringement or divorce proceedings. Threatening the President is also a pretty low threshold since in the scheme of things it is less significant than littering.
Re:Of course. Duh. by Triklyn · 2011-09-26 07:47 · Score: 1

holy crap, littering is a class D felony? http://en.wikipedia.org/wiki/Threatening_the_President_of_the_United_States#Penalties
evidently, less than threatening a federal judge, but yeah... i wouldn't say it's a particularly low threshold.
unless you're starting a facebook group about "killing president bush with shoes," any threat made about killing the president is treated fairly seriously cuz, you know, it's happened before.
Re:Of course. Duh. by misexistentialist · 2011-09-26 23:46 · Score: 1

It's a punishment for political speech that ends up mostly netting the mentally deficient. Doubt they find one remotely plausible suspect for every $100 million spent. Meanwhile they of course invest in airtight physical security to protect against the professionals or intelligent crazies who actually are threats to the most legally dispensable elected official.

Obviously by cheekyjohnson · 2011-09-24 23:21 · Score: 2

Anyone who doesn't want logs/wants them deleted quickly is an evil criminal.

--
Filthy, filthy copyrapists!

Idiots by Arancaytar · 2011-09-24 23:36 · Score: 1

Yes, your ISP, who knows your identity since you have a commercial relationship with them, cannot hide logs of your data from the authorities, because they're a registred business. Whatever shall you do? OH I KNOW! Enter a commercial relationship with someone else who is also a registered business.

To paraphrase the old adage, "if you think, speak, write, publish and don't use Tor, don't be surprised."

Re:Idiots by Anonymous Coward · 2011-09-25 00:30 · Score: 0

If you think Tor will hide you from any non-trivial investigation you're in for a surprise aswell.
Re:Idiots by Arancaytar · 2011-09-25 01:24 · Score: 1

No VPN or proxy protects you from leaking information outside the secure channel (or to the exit node and endpoint) if you use it wrong...
Re:Idiots by flappinbooger · 2011-09-25 09:32 · Score: 1

So, if I wanted to be a l33t hacker and hack something, I should do it from someone else's computer?

Step 1: 0wnz some doodz pc

Step 2: hack from 0wnzed pc

Step 3 ????

Step 4: Profit!!

Makes sense to me.

--
Flappinbooger isn't my real name

why does HideMyAss.com even KEEP logs??? by popo · 2011-09-24 23:46 · Score: 1

Isn't the surest form of protection to not log user activity in the first place?

--
------ The best brain training is now totally free : )

When did they change domain names... by dyfet · 2011-09-25 00:08 · Score: 1

...to "coverourass.com"?!

Do NOT use webservices, paid or free! by MindPrison · 2011-09-25 00:21 · Score: 2, Insightful

A lesson in paranoia, it's all logic:

Do you seriously think you can surf for free, unlimited bandwidth on some service out there in internet land? Sure, they may finance their services with advertising, and that's probably the main idea and intentions with their services to BEGIN WITH, but as with all such services, no one is ABOVE the LAW, and don't think for a minute you'll even be safe under such services.

Sure...your ISP won't see your actions
But the Service you use (eg. Hidemysorryass.dot.com) WILL know your every move, they have to...why? Liability, that's why! No one can truly circumvent their own countrys laws, not even the best of them, the only reason you don't get caught, is because you ain't important enough, if you do the CRIME, you WILL eventually do the TIME.

It's all a giant game of who do you trust (to quote Jack Nicholson) - Who DO YOU TRUST? Some free internet service out there, are you freaking KIDDING me? They WILL COVERTHEIROWNASS.com when the feds come knocking on their doors, they're in it for the money, not to save your ass, that's for sure.

Networks like TOR (google it and learn) works, because it's a giant network of private individuals that lend their computers to forward encrypted chopped packets of information they have no chance of assembling, only that makes sense as you couldn't really assemble this unless you owned the entire network ...or...figured out who where behind the originating address trough mistakes such as leaving your name on a forum, user name + previous IPs with that user name etc... Nevermind that, we're getting too technical, point remains though.

Learn to surf safely first

And then you may use TOR!

--
What this world is coming to - is for you and me to decide.

Re:Do NOT use webservices, paid or free! by b4upoo · 2011-09-25 02:31 · Score: 2

Many crimes go unsolved and even undiscovered. As far as serious crimes are concerned the odds are with the criminal. It is repetition over time, the nature of a crime, and just dumb luck that allow criminals to continue. It is rather like a car thief. You catch him but he may have stolen hundreds of cars over many years and you have him under arrest for stealing one car. He'll get probation unless he has prior convictions.
The real penalties of being a criminal include never being able to talk to or admit to anyone anything about your way of earning your living. Keeping mobile so that you aren't drawing attention to yourself or patterns of crime in an area pointing to you. You also are very vulnerable as you can not deposit money anyplace where you might be discovered with unexplained wealth.
On top of that you need to dedicate time to maintaining a good image. Being a regular at church and other normal activities, doing and saying the right things and having a really good reputation are all tools of a professional criminal. It's a hard path to follow.
Re:Do NOT use webservices, paid or free! by MindPrison · 2011-09-26 04:05 · Score: 1

I can imagine the real penalty of being a criminal would be the mental dissolution of earning a living, actually believing the criminal HAS to be a criminal in order to earn a living. Many criminals automatically see themselves as victims of society, and use that as a continuing excuse to live the way they do, now THAT is a penalty inflicted on themselves BY themselves, and not the single incident that started it all.

--
What this world is coming to - is for you and me to decide.

If I were MI5/CIA/... by Alain+Williams · 2011-09-25 00:26 · Score: 2

I would set up services like HideMyAss and run it in a competent way .... and let my analysts have a look at what people want to hide. If people are trying to hide something then it is likely to be interesting or embarassing. OK: most of it would be uninteresting from the point of view of a national security agency, but there would probably be an occasional gem from some dumb ass who believes that such a service really does give him the secrecy that he wants.

Re:If I were MI5/CIA/... by b4upoo · 2011-09-25 02:34 · Score: 1

Or you could work as a computer technician and get access to a bunch of materials that enable you to put yourself in a very lucrative position such as buying a chunk of land that is sought by a developer for a large project. It takes money to buy that little piece of raw land right in the middle of your intended mega golf course- resort.
Re:If I were MI5/CIA/... by Anonymous Coward · 2011-09-26 17:26 · Score: 0

What, like Hushmail?

Lol indeed by siddesu · 2011-09-25 00:27 · Score: 5, Informative

Actually, there is a ton of things the government will attempt to do to try to get you, even if it is a puny, pariah, poor government. I was helping a few friends of mine who live in a country, where people who laugh at politicians are still beaten up, to publish some funny videos about their top politician. Since I also visit there occasionally, we took full precautions. Private VPN to a foreign country, rather unfriendly to the regime, chained proxies, then TOR, new email addresses and video upload accounts, different chained proxies to access each of those, etc.

Once the videos hit the tubes,some people got mightily pissed off, and started an official, but silent investigation. Imagine my surprise, when two of our e-mail accounts (free, with a large US-based web mail provider) that we used for the services were blocked, and login attempts redirected us to customer support barely a day into the operation. Since the investigation in these countries tends to leak like a sieve, we got info that that particular country was paying someone mid-level in customer support dept. to give them data on customers.

They hit the video upload sites with official requests and apparently tried to hack into one, obtained logs from the ISPs of all online forums that we used to advertise the videos to, had videos deleted and did other funny things. They persisted into this business for about 18 months until they decided to close it down.

Given this much effort about a few videos from a near-third world country, imagine what a really powerful government can do to you, and despair :)

Re:Lol indeed by Anonymous Coward · 2011-09-25 00:51 · Score: 0

Not much they can do if there's no logs, though.
Re:Lol indeed by Anonymous Coward · 2011-09-25 03:31 · Score: 0

Cool story bro
Re:Lol indeed by DarwinSurvivor · 2011-09-25 04:33 · Score: 1

I guess that's why you posted as AC. Oh, wait......
Re:Lol indeed by AmiMoJo · 2011-09-25 06:21 · Score: 2

It depends what you expect from Freenet and Tor. On the one hand the powers that be can tell you are using them, but they can't tell what for. Of course sometimes that alone is enough for them to raid you, take your computers, lock you up, render you to some place to be tortured etc. Generally speaking though people in Western Europe are probably reasonably secure because unless those countries generally stick to the law, and make it hard for the US to grab you inside their borders now that rendition has come to light.
Security is not the same thing as being able to live reasonably though as there are still plenty of things they can do to you. Accusations of terrorism or paedophilia tend to destroy your life, alienate your friends and family, make you lose your job and so on. The police have a nasty habit of throwing in a few child porn charges against anyone whose computer they confiscate, presumably based on some flimsy browser cache evidence or dubious domain names found in your ISPs logs. On the bright side merely using Freenet or Tor is not normally enough to attract that kind of unwanted attention, but once you start putting out videos that might contain some clue that allows the authorities to start gathering evidence beyond the normal level of logging you have to consider these things.
Of course you might not want to rely on the authorities respecting the law and your rights, but that comes with the territory if you decide to do something that will upset them.

--
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Re:Lol indeed by Anonymous Coward · 2011-09-25 11:52 · Score: 0

Actually, there is a ton of things the government will attempt to do to try to get you, even if it is a puny, pariah, poor government. I was helping a few friends of mine who live in a country, where people who laugh at politicians are still beaten up, to publish some funny videos about their top politician. Since I also visit there occasionally, we took full precautions. Private VPN to a foreign country, rather unfriendly to the regime, chained proxies, then TOR, new email addresses and video upload accounts, different chained proxies to access each of those, etc.
Once the videos hit the tubes,some people got mightily pissed off, and started an official, but silent investigation. Imagine my surprise, when two of our e-mail accounts (free, with a large US-based web mail provider) that we used for the services were blocked, and login attempts redirected us to customer support barely a day into the operation. Since the investigation in these countries tends to leak like a sieve, we got info that that particular country was paying someone mid-level in customer support dept. to give them data on customers.
They hit the video upload sites with official requests and apparently tried to hack into one, obtained logs from the ISPs of all online forums that we used to advertise the videos to, had videos deleted and did other funny things. They persisted into this business for about 18 months until they decided to close it down.
Given this much effort about a few videos from a near-third world country, imagine what a really powerful government can do to you, and despair :)
Cool story bro
Re:Lol indeed by Anonymous Coward · 2011-09-25 15:53 · Score: 0

Way cooler than yours.

Re:Bear with me here, but... by Anonymous Coward · 2011-09-25 00:59 · Score: 0

What is the point of services like these storing logs for longer than 24 hours?

If I was running services like these, I would wipe them daily

Well, in addition to legal compliance measures, the guys who maintain the security of the site might want to take the weekend off once in a while. It's pretty damn tough to run any kind of secure network if your memory of all potential intrusion attempts is only 24 hours long.

They can't find you if.... by Anonymous Coward · 2011-09-25 01:00 · Score: 0

1. Go buy a cheap USB wireless card (with cash).
2. Disable your wireless card on your laptop.
3. Go to Starbucks or other public Wi-Fi hot spot.
4. Plug in newly purchased wireless card and get on to "the inter tubes"
5. Do what ever nasty sh*t you're going to do.
6. Dispose of newly purchased wireless card.

They can't find you, period.

Re:They can't find you if.... by heypete · 2011-09-25 03:26 · Score: 1

Why not? What prevents the authorities from determining that the traffic in question came from that hotspot at a particular time, and then subpoenaing the security camera footage from that time? If you're within wifi range, you're almost certainly within range of the cameras covering the interior and exterior of the business.
Re:They can't find you if.... by Anonymous Coward · 2011-09-25 04:08 · Score: 0

So can the authorities can tell which MAC address belongs to particular laptop from security camera footage of a crowded public area? Plus disposing of the wireless card they can't trace it back to anyone.
Re:They can't find you if.... by heypete · 2011-09-25 06:39 · Score: 1

Perhaps not, but if this is something that you do on a regular basis, they can see a pattern.
Perhaps I haven't been going to the right places, but most public hotspots I've seen (outside of travel centers, like airports) have only had a few people using laptops at any given time. The number has decreased since smartphones have become more popular.
Re:They can't find you if.... by syncrotic · 2011-09-25 06:46 · Score: 1

You could just spoof your MAC address. Many wireless cards, through their windows drivers, allow you to do so directly from the device property page. I'm sure there are other solutions on every platform.
Also, paying cash... what, as if the store logged the MAC addresses of wireless cards and tied them to customers' credit card numbers?
Re:They can't find you if.... by Anonymous Coward · 2011-09-25 08:30 · Score: 0

They will have video of you paying cash at the store. If you dont wear a disguise epic fail.

Piratebay / relakks to rescue by Anonymous Coward · 2011-09-25 01:29 · Score: 1

I'd rather use relakks ( http://www.relakks.com/ ) than HMA. If I'm not mistaken, Relakks is formed by the people behind piratebay. Everyone knows piratebay, the tracker from Sweden which has told MPAA/RIA to buzz of so many times.

Relakks is protected by Swedish data security laws, which require a severe crime before anything can be given to authorities. Quote from the FAQ ( https://www.relakks.com/faq/legal/?cid=gb&lang=en ):

RELAKKS Safe Surf enjoys the strongest legal protection possible under Swedish Law because of the service type (pre-paid flat-rate service). This means that RELAKKS do not have to keep an ordinary customer database (to be able handle transactions etc.). This is of importance if forced to hand over information.

If Swedish authorities can prove beyond reasonable doubt that they have a case for demanding subscription information from RELAKKS (they have to be of the opinion that if convicted the user will be imprisoned – fined not enough). .

RELAKKS then have to hand over the subscription information entered by you (but that’s all). RELAKKS do not store any subscribtion information about you except what you entered yourself when signing up for the RELAKKS Safe Surf service.

For Swedish authorities to force RELAKKS to hand over “traffic data” including your RELAKKS IP at a specific point in time, they will have to prove a case with the minimum sentence of two years imprisonment.

Regarding inquires from other parties than Swedish authorities RELAKKS will never hand over any kind of information.

(emphasis mine) "What you entered".. They will not check the information, though I'm not sure if and how long the payment data is stored by the payment processor. Why would you use any other VPN service? The only reason I can come up with is when you need to appear from coming from country X to get around content filtering based on your location. (Ie. something is not sold to say UK, but it is available for USA).

Dumbasses by Anonymous Coward · 2011-09-25 02:10 · Score: 0

Why do people do illegal shit from their homes. There are thousands of public WiFi connections in any city. Change the MAC on your laptop and then drive somewhere far from your home and park outside a coffee shop, supermarket, hotel, motel, or just about any other business and do your evil business in a way that could never be traced back to you. Do people do that? No, because they're lazy.

The Difference by izomiac · 2011-09-25 02:13 · Score: 1

With a VPN:

FBI requests a court order to acquire log information.

Without a VPN:

Random dude e-mails an ISP, gets every bit of data on that user, and the ISP disables the account without revealing the identity of the complainer.

IOW, an ISP has little incentive to stand-up for user rights, whereas that's a VPN's major selling point.

Re:The Difference by dohnut · 2011-09-25 06:42 · Score: 1

Yes, and if your VPN has to terminate your account (because of DMCA violations, for instance) you still have your ISP's broadband account. In places where you have no other options for broadband, this is an important consideration.
Obviously if you are committing serious crimes or you torrent something and your name/IP gets turned over to the MPAA (by the VPN or your ISP) you can still (easily) be found and prosecuted, but for a majority of cases it just means you have to hunt for a new VPN instead of a new ISP.

--
Stupider like a fox! - H.S.

Weak excuses by QCompson · 2011-09-25 02:48 · Score: 2

Regarding censorship bypassing, some have stated it is hypocritical for us to claim we do not allow illegal activity, and then claim our service is used in some countries to bypass censorship illegally. Again we follow UK law, there isn’t a law that prohibits the use of Egyptians gaining access to blocked websites such as Twitter, even if there is one in Egypt though there are certainly laws regarding the hacking of government and corporate systems.

But if the Egyptian government went through the appropriate channels and got a UK court order, presumably HMA would turn over the logs immediately. Besides, there are a number of censorship-related situations where HMA would apparently pass out user information like cookies at a bake sale regardless of whether a boogedy-boogedy scary middle east country is involved or if it is the US/UK... the wikileaks fiasco would be an obvious example.

Why not at least keep the connections logs for only 2 or 3 days? I would imagine that would still enable them to crack down on abuse while avoiding having to comply with most court orders.

Re:Weak excuses by Anonymous Coward · 2011-09-25 05:34 · Score: 0

But if the Egyptian government went through the appropriate channels and got a UK court order
The Egyptian government wouldn't be able to get a UK court order to enforce its own laws over here, it would have to be something that was illegal in the UK before that would be granted.
Re:Weak excuses by Anonymous Coward · 2011-09-25 07:31 · Score: 0

They may have laws that make them keep them for 6 months to years. Depending on who their clients are.
For example here in the US if you work with transportation. You are by law required to keep logs up to 2 years for some things.

Choose a country where you have rights instead. by couchslug · 2011-09-25 03:29 · Score: 1

Not EUSia.

--
"This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."

DaveProxy-UkProxy-Jap Proxy-HideMyass-Slashdot by Anonymous Coward · 2011-09-25 03:37 · Score: 0

First go to:
http://www.daveproxy.co.uk/

the use that proxy to access UK proxy:
http://docoja.com/blue/

then use that to access Japanese proxy:
http://www.ejapan.eu/blue

then use that access Hidemyass proxy:
http://hidemyass.com/

then go to slashdot and post Anon!

They'll never find you!!

You'd think by woboyle · 2011-09-25 03:45 · Score: 1

You'd think that a tor-like vpn service would be smart enough to not enable logging, except for errors that they may need to fix, and then not log IP addresses in any case. Then, they can hand over the logs, knowing that no, or little, information will be available.

--
Sometimes, real fast is almost as good as real-time.

Re:You'd think by Anonymous Coward · 2011-09-25 11:49 · Score: 0

HideMyAss is not tor-like at all. It lets you use one of their servers in another country as a relay (encrypted on your network, unencrypted once it gets to the end of their relay (except for SSL/TLS/whatever additional encryption your webservice uses)). Tor is encrypted by 2 different keys, on 2 different relays, which may change randomly as far as I know. Still not encrypted beyond standard web-services at the last node, but more encrypted than standard VPNs will be.

Ah, the human element... by mosel-saar-ruwer · 2011-09-25 04:17 · Score: 0

Since the investigation in these countries tends to leak like a sieve, we got info that that particular country was paying someone mid-level in customer support dept. to give them data on customers.

All the corporate privacy/security policies [and, for that matter, government privacy/security LAWS] in the world aren't worth diddly squat in the presence of a determined mole.

I seem to recall that the key element of the plot of Dune involved a traitor at the heart of House Atreides...

PS: Wow, has it been almost 30 YEARS since Dune was released?!?

Yikes!!!

I feel old.

Old. Old. Old. Old. Old.

PPS: Man, you know that Virginia Madsen was a world-class piece of tail if she was as hawt in Sideways (2004) as she had been in Dune [if not even hawter?].

Whew.

Re:Ah, the human element... by Runaway1956 · 2011-09-25 04:40 · Score: 1

You WATCHED Dune? I "watched" it in print - more than 30 years ago. Is it 40 years? I know that I read it in high school, probably my sophomore year, and I graduated in '74. So, yeah, Dune has been around for awhile.

--
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
Re:Ah, the human element... by Chris+Mattern · 2011-09-25 05:00 · Score: 1

PS: Wow, has it been almost 30 YEARS since Dune was released?!?
No. It's been fifty-eight years. Assuming you count from when it first started serializaion in Analog.
Re:Ah, the human element... by Chris+Mattern · 2011-09-25 08:14 · Score: 1

Excuse me, I should have said "forty-eight years".

Your log... by AliasMarlowe · 2011-09-25 04:35 · Score: 2

Log this!

Your log appears to be a floater.

--
Those who can make you believe absurdities can make you commit atrocities. - Voltaire

Anyone remember the Palin email hack? by Anonymous Coward · 2011-09-25 05:16 · Score: 0

This is just what ctunnel.com did when they were hit with subpoenas in that case. Silly to think that a VPN service would be any different in that regard from a plain old web proxying service.

Also, to all the smug fuckers who are saying "Well what do you expect, it's the UK and its stupid laws, this would never happen in the US": it already did. Duh.

Duh. by Vellmont · 2011-09-25 05:32 · Score: 1

It doesn't take a whole lot of thought to arrive at the conclusion that choosing a UK based VPN provider to attack US based sites is a bad idea. What country has a better relationship with the US than the UK? Even if that company "doesn't do logging", do you think that a court order can't change that very, very quickly?

--
AccountKiller

Hiding from marketing not gov't by drnb · 2011-09-25 05:41 · Score: 1

You are using a narrow definition of privacy, many of the users of this site probably have something else in mind. They are not necessarily morons. Most of these people are probably not trying to hide from government, its more likely they don't want to be tracked for advertising and marketing purposes.

RTFA and you will get your answer. N/T by Anonymous Coward · 2011-09-25 05:56 · Score: 0

RTFA and you will get your answer.

How do we protect activists by Anonymous Coward · 2011-09-25 06:07 · Score: 0

From corrupt western governments? There are a lot of people in the world that need protection from USA, EU, China, India, Russia and other powers.

How do we protect political activists that have a legitimate need to be protected from western intelligence agencies?

You know that right now the CIA is happily turning over everything they know to the Syrian dictatorship, just like we fully cooperated with the Libyan dictatorship.

Hide Your Ass by turgid · 2011-09-25 07:15 · Score: 1

Put it in a barn.

--
Stick Men

Re:Hide Your Ass by lennier · 2011-09-25 09:13 · Score: 1

Or if it's a Higgs, hide it in an inverse femtobarn.

--
You are not a brain: http://books.google.com/books?id=2oV61CeDx-YC

Please by Anonymous Coward · 2011-09-25 07:37 · Score: 1

The whole point of calling themselves "hide my ass" is that they imply they can't tell anyone who did what when.

So now we know the name "hidemyass" simply means they take money from stupid people.

Okay...? by Runefox · 2011-09-25 11:28 · Score: 1

So basically, someone out there thought that a site like this was actually a legitimate way to shield from any kind of tracking?

And the fact that that someone was wrong is surprising?

They make their points very clear in the linked statement: The service is not intended to provide anonymity or shelter from legal repurcussions; They are there to provide a workaround for those who are being censored, to provide a way of bypassing "Great Firewalls", or simply to prevent your ISP or wireless network from seeing your HTTP requests. There is no expectation of privacy, and nor should there be. The same expectations are true of Tor and other "anonymity" initiatives (though Tor is inherently less open to tracking due to the way packets flow through the Tor network (that is to say, it's very decentralized)).

Sure, services like HMA partially obfuscate the trail, but they aren't bound by any agreement to guarantee your privacy, don't claim to, and ultimately will not.

--
Screw the rules, I have green hair!

Maybe they should call themselves... by Anonymous Coward · 2011-09-25 16:03 · Score: 0

ShowMyAsscom

i have a right by AP31R0N · 2011-09-25 22:57 · Score: 1

It is my Constitutional RIGHT to be able to break the law in PRIVATE!

--
Utilizing the synergization of benchmark e-solutions to pre-workaround action items!

LulzSec by Anonymous Coward · 2011-09-28 12:55 · Score: 0

How can these idiots claiming to be "hackers" use this service for illegal activity? All these *chans people make me laugh when they claim to be "Anonymous Hacking on Steroids" They deserve to get their houses raided by the FBI! for being n00bz!

Slashdot Mirror

HideMyAss.com Doesn't Hide Logs From the FBI

233 comments