Slashdot Mirror
'Silk Road Reloaded' Launches On a Network More Secret Than Tor
rossgneumann writes A new anonymous online drug market has emerged, but instead of using the now infamous Tor network, it uses the lesser known "I2P" alternative. "Silk Road Reloaded" launched yesterday, and is only accessible by downloading the special I2P software, or by configuring your computer in a certain way to connect to I2P web pages, called 'eepsites', and which end in the suffix .i2p. The I2P project site is informative, as is the Wikipedia entry.
Honeypot???
have you seen my sig? there are many others like it but none that are the same
One crappy drug site and the whole Tor network is now infamous.
You know, tweaking would explain a lot ...
Lost at C:>. Found at C.
Two people can keep a secret, but only if one of them is dead
But then, from the I2P page
I2P is beta software since 2003. Developers emphasize that there are likely to be bugs in the software and that there has been insufficient peer review to date. However, they believe the code is now reasonably stable and well-developed, and more exposure can help development of I2P.
So while "More secret than TOR", may be true, actually being secret is unknown by the users. But I bet the TLA LEAs will be keeping an eye on it and directing resources to test I2P limits (if they already haven't - they kinda don't like communications they can't tap)
I am Slashdot. Are you Slashdot as well?
'Silk Road Reloaded' Launches On a Network More Secret Than Tor
*sigh* Sure was a nice secret network we had going up until five minutes ago. Thanks a bunch, timothy!
TL;DR - shut uuuuuuup!
systemd is Roko's Basilisk.
So, does this provide any actual additional security, or is is just security by obscurity because nobody is using it?
If it's just security by obscurity ... well, good luck with that.
Lost at C:>. Found at C.
I2P has been the successor to Tor for more than a decade, but people continue using Tor thanks to a successful campaign by media/state to maintain the protocols use in an effort to continue exploiting it and avoid having to deal with more secure alternatives. Check out fdroid.org for open source apps that enable i2p on android as well, and expect a wholesale ban on i2p traffic in the near future.
Good people go to bed earlier.
Is it really needed to make it sound as if something magical needs to be done?
I am sure that some technical information about what this "certain way" is would be understood by the readers of /.
(perhaps not the moderators, but that is something else altogether.)
And in what way is it more secure then Tor? It uses something lesser known? That is security through obscurity.
Using something less known by configuring my PC in a certain way does convince me this will be more secure. I can buy most drugs legally if I want to, so I am interested in the technical aspect. This sounds as if was written by somebody at the FBI to use entrapment to get their quota in arrests.
Don't fight for your country, if your country does not fight for you.
"You want to go to Silk Road 2.0? You're either nuts or on drugs."
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
I have tried I2P several times for torrent and iMule to avoid university anti piracy regulations and it was ridiculously slow, download times were about 10KB/sec and that is not good for movies. EEpsites are also quite slow first time they are loaded. Most nodes were in Russia, some were also in Romania and similar east european countries, also some in India and Brazilia. If it is a honeypot, it is most probably Russian honeypot as there are many Russian IPs. Not good for political activism, good enough for Silk Road I suppose...
Given that size is a fairly useful attribute for an 'anonymous' network(if the system is so small that a little traffic analysis can identify the 10 cypherpunks and couple of dozen kiddie porn enthusiasts that actually use it, it isn't too useful no matter how elegant the design), what does i2P fix about TOR to be worth the greater obscurity?
People have been designing virtual networks for decades. I2P is well advertised on Freenet, itself a well-known secure network.
Nothing new here. The security and reliability of none of this software is proven, it may not even be provable due to the distributed nature. That reduces the problem to one of how many people you're ok with knowing what you're doing.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
If we are discussing it on Slashdot, it's not secret.
That involves:
- Leaving your basement
- Knowing what areas to go/people to ask
- Having a network of real world friends who can point you to the above
- Having a basic level of street smarts and socialisation to reduce your chances of being scammed/robbed/murdered/busted by cops
- Not being shit scared of approaching people who could personally harm you
You may think the above isn't such a big deal, but to a large number of people to whom silkroad etc appeals, it is as daunting to them as setting up an encrypted currency exchange network and hidden virtualised proxy server that can withstand attacks from both law enforcement and the online equivalent of your local gangland thugs is to you.
Indeed. I am pretty convinced the propaganda implying TOR had been broken serves mainly to drive people to less secure alternatives like I2P. Would not be the first time this happened. A while ago, "they: even succeeded in causing some jihadists to make the terminally stupid decision to roll their own ciphers. Of course, with that the NSA can actually break encryption itself.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
I downloaded it from www.fbi.gov/downloads/i2p.exe and it looks okay. Why do you think it is a honeypot?
You should download the source code and compile it yourself. Be sure to use the compiler that is supplied as part of the package.
www.fbi.gov/downloads/i2p/sources/WindowsFullPackage.zip .
propaganda implying TOR had been broken
TOR's own developers admit that PRISM-level metadata collection is sufficient to break the anonymity of TOR.
Millions of idiots pay for millions of servers with credit cards in their own names. What made this idiot special, other than being able to track the packet to the server through the onion?
Was this the case where the government claimed they connected to the server and got an IP address? Where other people took the computer configuration the government released in the trial and discovered that they got a mysqladmin page but no IP address?
The minute the government presented a valid means of compromising the network, it ceased mattering whether they actually had or not. The resources to make the compromise happen are relatively trivial compared to cracking/bypassing the actual scheme. Those resources are completely within the capability of the government to allocate, so as long as they *can* overwhelm the network with their own nodes, they can do so any time they wish to.
It's much like demonstrating that you can break a previously unbreakable padlock by defeating a weakness in it with a few flathead screwdrivers used in the right way. Yeah, you need a screwdriver, but you can get those. At that point, you don't bother asking yourself whether someone has actually done it. If the method is valid, you get a new padlock.
I think the Tor developers personally keep track of who's running the exit nodes. They've been able to catch fake exit nodes and ban them before.
vi ~/.emacs # I'm probably going to Hell for this.
You do not get a new padlock that is even easier to defeat....
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
In the past, some Slashdot users have responded to a request for clarification or citation by trying to shift the burden of proof: "This isn't Wikipedia; if you want a citation, do your own search. It's not my job to teach you how to choose and use a search engine."
Tell us what about I2P makes it "even easier to defeat" than Tor and we'll address that.
Can't you just cop dope on the street corner in the hood like the rest of us joes? I suppose thats harder if you live in a really rural area though...
The street corner in the 'hood typically has one of two products, neither of which some people will want. Online drug markets have a wide selection of interesting and unusual products. For instance, opium is almost never imported into the US because of the bulk vs profit factor. Thanks to prohibition, it's much more profitable to turn it into heroin, and so it's rarely seen "on the street." But, you can order yourself a nice chunk online, and be assured of the quality because of the site's rating and comment system. Online, you have access to a World market where you can pick and choose from a wide variety, whereas, on the street - not so much.
At least, that's what I've heard.
-- sudon't
Air-ride Equipped
Not trying to launch a debate here. I do like Java for a LOT of things. But a software router needs to be lightweight so it can run in very low-overhead environments. Tor runs nicely on settop boxes and many SOC hardware opportunities like RaspberryPI or low-end VPSs.
The memory footprint of a JVM is going to keep a java-based software router like i2p off those devices.
$5 / month hosted VPS on linux = awesome!
why would you feel the need to roll your R's?
what was that supposed to mean?
Have a look into the relevant security research literature. Really.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Really, mindless propaganda. TOR is not developed by the US government. You should as Roger Dingledine how that funding came to pass (I did in 2002). Turns out that if TOR was an US government project, it would have been really easy to hide the source of funding. They did not.
What people like you do it drive people to less secure alternatives. That tells me a lot about your motivation.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Neither I nor a lot of other users who have posted comments to this story know how to find which items of security research literature are relevant to this claim. Where should we start?