Anyone tried XeroBank (formerly Torrify)

Discussion in 'privacy technology' started by Genady Prishnikov, Mar 6, 2007.

Thread Status:
Not open for further replies.
  1. caspian

    caspian Registered Member

    Joined:
    Jun 17, 2007
    Posts:
    2,363
    Location:
    Oz
    Thanks Steve. I have been using Nod32 but maybe I will switch to Kaspersky when my sub runs out. I also use Returnil so but I do use an external hard drive and a USB stick so I guess I am vulnerable there. XB Pro is awesome though and I am grateful for it.
     
  2. Paranoid2000

    Paranoid2000 Registered Member

    Joined:
    May 2, 2004
    Posts:
    2,839
    Location:
    North West, United Kingdom
    Number of nodes most certainly matters (and trying to argue that passing through one node is the same as 50 from a tracking perspective is downright nonsense) since anyone trying to trace a user on Tor needs to match their incoming and outgoing connections on each node in turn.

    Monitoring major network exchanges may make it easier to capture traffic from multiple nodes, but exchanges tend to be arranged on a per-country basis, so Tor's international spread means it is still harder to cover than any other anonymity network. A study (1.4MB PDF here, summary here) has been done on this but XeroBank is likely to be more vulnerable since it has fewer nodes in less countries.
    If you know the IP address of the real user and the IP address of the exit node they are using at the time, then yes. However since the exit node is randomly chosen and the path changes every 10 minutes by default, the only situation where this is going to occur in practice is where the "monitor" knows in advance what site the target is going to visit.

    There was a case where someone threatened to attack a site and later did so using Tor - the police were able to view traffic traffic from his PC to the Tor network and traffic from a Tor exit node to the site concerned, correlate the traffic patterns and prosecute on that basis. However this required the user to effectively identify themselves in advance and is not a situation that should apply to any "normal" Tor or XeroBank user.
    First of all, Tor does share (and reuse) connections so there is a degree of multiplexing. There is also an element of bandwidth shaping in that non-participants are limited to 50KB/s transfer. Unless you are padding traffic out with extra delays, this applies to XeroBank also since both are low latency networks.
    Please explain this?
    Untrue - I typically see 100+ circuits on my node which is offering a mere 250KB/s bandwidth. The largest Tor nodes offer over 6MB/s so should have thousands of circuits. The only case where low crowding is likely to occur is if 3 low-bandwidth nodes were selected and I've yet to see that occur in my usage.
    High distribution (lots of users) is a key advantage for anonymity - I'd like to hear a more detailed explanation of how (aside from contention) it could be a problem.
    Do I detect an element of Bill Gates style angst here? Tor works well enough for many - the main problem in my view is that large downloads are too fast, meaning less bandwidth for more delay-sensitive activities like webpage access.
    People who use Tor (and anonymity systems generally) do so to avoid monitoring from their workplace, neighbours, ISP or government so even if an exit node was sniffing traffic, they are still better off in that this traffic cannot be linked back to them (as long as anything personal is limited to HTTPS webpages). Of course, there is another system for people who want trusted exit node operators - JAP which also has a commercial option.
    "Legal consequence"? Exactly which court could a dissatisfied user file suit against XeroBank in then? Saint Kitts and Nevis where your company is registered? Germany where the website is hosted? The US where your domain is registered? Be realistic here, the same legal setup you have adopted to avoid legal sanctions is going to block dissatisfied users as much as (or more than) any government or law enforcement body. As for logging, even if you don't log your exit nodes' traffic, the ISP where they are based very likely does.
    And Tor users can protect themselves from any malicious behaviour - this isn't new. Furthermore, non-Tor users are facing a similar problem with the increasing number of website compromises. This is an argument for adopting stringent web content filtering and secure browsers, not for avoiding Tor.
    It's a consequence of providing access to unencrypted websites and is an issue common to every anonymity service, Xerobank included.
    Not a problem for a properly locked down configuration (where a firewall is used to limit browser connections) since it would have required a rule allowing browser access to port 9051. It is a good example of how Tor cannot on its own provide a comprehensive security solution, but the Tor project does make that clear and there has been plenty of discussion (including in this thread) about how to prevent it.
    Great - now how about putting such information up on your website along with details like how many servers you have, which countries they are in and how traffic is handled (basically, the same sort of details that services like Tor or JAP supply). That way, people interested in your service can find key technical details without having to plough through threads like this.
    That submission simply contains notes on USB Tor bundles (download and install size, components, etc) are you sure you picked the right entry? Also wasn't XB browser itself "inspired" by Firefox?

    Now I do appreciate that you have a product to sell, but constantly portraying non-commercial competition as a den of iniquity where exit node operators routinely gather to sacrifice goats and hold all-night orgies (I wish!) isn't constructive and does little for anyone's credibility. It is misleading to continually associate those who provide software and bandwidth to protect online privacy with malware peddlers or criminals and while I accept that there is a need to inform users about the caveats of any service, Tor provides plenty of details on this already.
     
  3. JohnSmith5d75

    JohnSmith5d75 Registered Member

    Joined:
    Apr 13, 2008
    Posts:
    7
    I think you summed it up nicely, Paranoid2000. XeroBank argues for his proprietary, untrustworthy, centralized (even if distributed) service without any justification, only insults ("Tor is like socialism") and lack of any analysis. If you compare this to the volume of academic and industry (Tor started at Navy?) you can see whose claims are more respected and validated.

    Perhaps we agree to disagree, but until substantial and conclusive evidence is given regarding XeroBank network and operations is provided, this is snake oil salesmanship at its finest.

    Nothing more to say until XeroBank gives us significant detail. I don't care how fast it is, if it isn't trustworthy, it isn't useful.
     
  4. SteveTX

    SteveTX Registered Member

    Joined:
    Mar 27, 2007
    Posts:
    1,641
    Location:
    TX
    We should define the attacker we are talking about. Most people seem to imagine this super-user who has a single IX router control, but not worldwide monitoring capability. That is where people think they are being defended up to by the node hopping, but that isn't the case. There are about 50 major IX core routers on the planet and that covers pretty much all internet traffic. Access to those routers is shared by multiple countries and agencies. If they have access to one, they have access to more or most or nearly all. Watching traffic flows at that height is trivial if you have that much power. It doesn't matter how many nodes the data passes through.

    See above. That is the difference between an academic review and reality. Let's take another of SJM's theoretical attacks like the clock skew timing attack to discover hidden services. It sounds good on paper, but it doesn't work at all in reality. CPUs get hot and cold and some run at max already, all from other processes running on the machine, all wiping out the skew timing attack. So papers provide an intellectual warm fuzzy, but unless backed up with not just lab but real world tests, they aren't really valuable except in theory, which may be the maximum area of coverage where the vulnerability can exist.

    Paranoid, you're right on for most of this. low latency has inherent anonymity issues, but not all those same problems of Tor structure apply to XB structure. It is obvious that we need a whitepaper to discuss this on a scientifically meaningful level. Prior to performing the public security review, a whitepaper will be released. Then we can all be happy.

    The IX accessed attacker need only know either the IP of the real user or the final address. Either will lead to the other, establishing the full circuit, simply by watching packet flow. And you don't need 10 minutes to figure it out.

    And let's consider, there is no point discussing any model protecting against and adversary more powerful than an ISP/superuser but less powerful than an a superpower with IX access that covers all nodes on the circuit. So the ISP can only see a single node, in the user is safe from them, or the superpower can see all traffic, and nobody is safe from that.

    I'm not talking about circuits that become dirty and are used to request different information so it kind-of sort-of is like multiplexing. I'm talking about true mux - demux of data channels. gah, I'm not trying to talk bad about tor, i'm saying that xb really is different, so a compare is going to be difficult till we have whitepapers and real world tests.

    Actually, i think that lack of bandwidth shaping is an excaserbated issue for XB2 vs Tor. At least in the tor network, everybody is slow, giving some shaping and bandwidth symmetry. :D Unfortunately, this will not be the case very long for Tor. And no, I can't elaborate on that last statement yet.

    100+ circuits, but you're pumping only 250KB/s, or <12Kbps/circuit if all were active. How many of those circuits are actively pumping data at any one moment?

    I love open-source, but TINSTAAFL despite the attraction of the "free," and such is the cost of socialistic resource planning of nodes.

    Heh. I think you may be one of the only people experiencing that problem. I know 100k+ people who may disagree with your assessment. Now if you're saying that tor favors large downloads over web pages well... that is a different issue.

    That is another academic distinction where it sounds good in theory, but just isn't the case in practice. If you are a malicious exit node controlling non-https traffic, there are nearly limitless ways to track people, from injecting code, collusion, sniffing, ajax injection to detect keystroke frequency, etc. Just tons and tons and tons of ways to spider in to get personal info. And people just don't know or just don't care, thinking that they are immune, that it isn't likely that the node they are using is colluding, hoping blindly that the exit node isn't malicious. Case and point that people who use it don't understand it or do and don't correctly use it, was shown in the news recently as we all know and saw those government credentials leaked. Tor, by far and away, is the richest and most exotic phishing area. I dare say that some people, who would have only had to deal with their ISP monitoring them trivially, may be exposed to more malicious attackers and danger by unsafely using Tor. I've been thinking about that problem for a while. It keeps me up nights when I think about how many millions of users I have brought to Tor who may not have been ready for the responsibility. But that is just it, it wasn't designed for the irresponsible, it was designed in a vacuum and based on theory. It has some really great possible uses, but a trustworthy public-ready and free anonymity system is not one of them. There are two possible solutions that spring to mind: allow only https, as is, or switch to a method with trustworthy exit nodes.

    All the power in the world to JAP, except for their wiretapping system that is deactivated but not entirely removed, if I remember correctly from what Roger told me.

    I think that is probably a triple-edged sword. Of course, at the end of the day, I think I or another can step in for XB and resolve all such issues that may arise, but what is more, is we're happy to do so. For an evil empire, that would present a problem, and a frequent one.

    Right, it is possible, but that risk is larger for home-based node for Tor. The point being, like Tor, there is no central place to go for logs of the whole enchilada.


    I completely agree. And I've got a solution to that (secret, sorry). One that will obviously but inevitably take business away from XB, but they don't care since our values and goals are the same (non-financial).

    It isn't just that Tor isn't an end-all be-all solution. That was never the point. Even in the more narrow scope of some of its goals, it can't accomplish them without a rigorous re-education of the common user (unlikely) or except by limiting its goals and functionality.

    Again, this is something I think about often. I really like the idea of free anonymity. And I think I have some solutions on that concern, but until the exit node issue is solved, I'll probably be involved with XB to get more people protected (because i don't think https-only tor access is going to succeed). And don't think this is just some allegiance to XB, I work for other anonymity networks/projects with commercial interests, I just am vocal about what goes on at XB because I know the other people there and the corporate values at XB are compatible with mine.

    We are in agreement. Everything that doesn't work in favor of leveraged unpredictability should be published. I don't have all the answers about it because I didn't design it, but rest assured they will be provided on the website at some point in the near future.

    Heh. Yes, I'm sure. When I have to get out and explain to the Tor devs how it all works, document the build process, and then I get asked to start writing whitepaper and threat models about the design under the claim of an endorsement, and then they start working on their own browser after some really damning press? I don't see these as extraordinary coincidences.

    exchange of money creates responsibility and contract. Let's take a common example. Compare the professional movers you pay, versus your buddy and his truck. I always prefer the diligent work of the commercial service versus the lackluster, begrudging, and slow work of those who I am hiring by a sense of guilt or obligation. Money just is a better motivator to get the job done better and faster, IMHO. The reality is not that I'm against non-commercial, it's the contrast of the academics' disdain of the commercial. Please don't confuse my lack of love for dislike, I have to deal with anti-profit socialists all day long. You underestimate the irrational dislike and distrust of commercial activities by tor zealots.

    You've been going to the wrong parties I guess!


    My god. Just look at it. All text to sift through, and you don't even have to search it out, it's cleverly placed not in the user experience at all. :rolleyes:

    Did you ever read hitchhikers guide to the galaxy? Sure you did. Remember when Arthur Dent was told the plans had been on display? Well putting them on the webpage only, below the download, and not in the users' experience where it is necessary due to risks, is like hiding them in the basement, in a file cabinet, in a lavatory, with a poster on the door that says "beware of the leopard".
     
  5. 5y5t3m

    5y5t3m Registered Member

    Joined:
    Apr 26, 2008
    Posts:
    1
    Paranoid2000,

    Can you please help me understand this

    Does or does not the ISP know about users visits to websites if those users are using tor (or other privacy tools)?

    And if ISPs know (In some countries or all countries) and logs users activities, then whats the point of using such tools?
     
  6. caspian

    caspian Registered Member

    Joined:
    Jun 17, 2007
    Posts:
    2,363
    Location:
    Oz
    I think he is saying that the ISP that handles XB traffic possibly monitorso_O But even if someone is monitoring the exit node of tor, unless you say "I am such and such.....and here is some personal identifiable information", then they have no way of knowing who you are. UNLESS, you allow Java and they know how to use it to bypass Tor. That is what I hate about Tor. I have to worry about Java and javascript. Over half of what I do involves art and video and stuff. I love all of that. So that is why I need XB VPN. I want to be free to do whatever I like. The other thing too is that Tor is so slow. I research stuff just on a whim all the time and I have 3 or 4 windows open at once sometimes and I bounce around all over the place etc.... I need more speed than that otherwise I just wouldn't be able to do what I want to do. If I did not have speed, I would have to just give up privacy......for the most part anyway. I could still use Tor for really personal stuff.
     
  7. Paranoid2000

    Paranoid2000 Registered Member

    Joined:
    May 2, 2004
    Posts:
    2,839
    Location:
    North West, United Kingdom
    It does matter since seeing traffic flows isn't enough when you're dealing with multi-node anonymisers. To identify a single user's activities you have to correlate the traffic flows (with Tor this would mean inbound to node 1, node 1 to 2, node 2 to 3, node 3 outbound). Unless that user's traffic is unusual (e.g. a 75KB/s download through Tor - which I've seen just once) then the combination of user numbers, reuse and sharing of inter-node connections and the reselection of routes every 10 minutes (meaning that you have to correlate again) makes this quite impractical.
    It always struck me that Tor's variable latency would be a bigger problem with that one.
    This is more a node selection issue - having a greater choice of nodes and taking measures to ensure disparate ones are used is the best defence. Tor takes some steps towards this, but more may be needed.
    Let's take a detailed example - user A connects to Tor entry node 1, middleman node 2 and exit node 3. His ISP (and anyone with access to the path between A and 1) can observe him accessing Tor initially. 99 other users are also connecting to node 1 so it has multiple exit connections to other Tor nodes (including node 2). Given that some of those connections will be shared, a straight matching of traffic patterns isn't going to work (A's traffic from 1 to 2 may well be bundled with B's, C's and D's) so unless A's traffic profile is unusual it would require longer-term analysis to correlate A's inflow and outflow from node 1. To complicate matters further, A is connecting to different sites with variable response times so, for example, 3 simultaneous page requests could result in return traffic peaking 5, 10 and 15 seconds later (ruling out attempts to correlate return traffic to outgoing traffic).

    Now over a longer duration, you could (with a high degree of confidence) use the peaks and troughs in A's traffic to node 1 to link it to his node 1-2 traffic, but I would certainly say that 10 minutes is too short. A few hours would be more realistic.
    Why not? You have countries like Russia and China that are very unlikely to have a global view, but nonetheless have greater capabilities than an ISP. And as Murdoch's research indicates, some ISPs have a greater ability to monitor global traffic than we may realise.
    All I know about XB at the moment is that according to you it uses 2 nodes rather than 3 which would suggest a greater need to obfuscate traffic patterns. More information would certainly be useful.
    You big tease, you... ;)
    I don't honestly know. I only keep an eye out for what I define as "excessive" bandwidth consumption and the amount of traffic my node handles does vary (low levels early in the morning with principally Far Eastern related addresses, picking up later in the day as American users come online). On top of that, I'm mirroring the Tor directory which seems to involve keeping connections alive to the main Tor nodes. On average though, once my node has been up for a while, traffic levels tend to stay at 120-150KB/s unless a large download is in progress (I block access to certain filesharing sites to keep bandwidth clear for normal webpage access) so I would guess from 5-20 active circuits at any one time.
    I don't really get where the socialism comes in. People can choose to donate bandwidth to Tor if they want but there is no compulsion to do so.
    Well, I did mean favouring large downloads too - it is particularly galling to see someone getting 25-30KB/s if you are only getting 3-5KB/s.
    Sure, but all these methods rely on allowing Javascript at the very least. And the exit node doesn't have any control (aside from setting a policy restricted to specific IP addresses) over who comes through making it impractical to target any specific individual.

    Of course there are cases of malicious nodes trying to inject Google ads or redirect users to malware-pushing pages (I've identified one myself) but this danger is also present for non-Tor users (website compromises, DNS hijacks, etc) and the proper recommendation for everyone is to disable active content (Javascript, Java, Flash, ActiveX) except for sites that really need it.
    If you mean this, then the researcher Dan Egerstad should have the last word: "ToR isn't the problem, just use it for what it's made for".
    I'd agree - using Tor for web access without filtering content is asking for trouble, and a user not prepared to use a filter should be discouraged from using Tor at all.
    Https only would be impractical without some sort of http gateway - adding a trust index for exit nodes would seem a better idea and this could use existing mechanisms for flagging "reliable" and "fast" nodes. Requiring nodes to participate in the network for a probationary period along with a registered name and a confirmed contact email before they could be selected as exit nodes would seem a good place to start.
    It wasn't wiretapping but backtracing that was triggered if (and only if) a specific IP address was accessed.

    It should be noted that the JAP project not only fought (and overturned) the court order but they introduced this feature in a way that made it as obvious as they could. The JAP and Crime Prevention page has more details, including a (PDF download) declaration on future policy - which looks rather similar to XeroBank's (i.e. limited to cases where past or future crimes are involved, requiring a court order which is first examined by legal staff, etc).

    As JAP reports receiving only one such order during 2006, it would seem they receive less "attention" than XeroBank (or the legal requirements for a German court order are significantly higher than for a US subpoena).
    For non-technical users, Tor could certainly include a more aggressive configuration for Privoxy in their Privoxy/Tor/Vidalia bundle but at a cost of breaking some mainstream sites. Privoxy is the weak link here I think since it is non-interactive (you can't change it's configuration on the fly) making it next to impossible for new users to diagnose and fix issues. However an integrated solution like MozPets may be a better option.
    Money is no guarantor of quality as the plethora of sloppy services, shoddy products and outright scams show and a contract is of little use when the company is based in another jurisdiction.

    Pride and professionalism are the best motivators and with Tor, the core setup (software and directories) can be considered pretty reliable. The problem is with the fringes, and that can be addressed by raising the barrier of entry - the problem is doing this without deterring legitimate participants.
    Well, you've shown some distrust of commercial anonymity too. ;)
    Feel free to point to some right ones. :p Disclaimer: parties must be able to accommodate other interested visitors, including but not limited to the other 75,802 Wilders forum members...
    You store your leopards in strange places then. ;) It is pretty prominent except to those who point, click and install without reading and anyone in that category is in far greater danger than Tor could ever present (or protect against).
    If you are using an encrypted anonymity system (Tor, JAP, XeroBank, etc) then your ISP can see your encrypted traffic going to it - nothing more. The (different) ISP at the Tor/XeroBank/JAP exit nodes can see what sites are being accessed but not who requested them unless there is something in the traffic to identify you personally. Continually posting to forums under your real name or having your personal details on a social networking page which you frequently visit would be 2 examples where you could compromise your own anonymity.
    This has been discussed at length and it comes down to browser, filter and firewall configuration. XeroBank provide you with an preconfigured solution making it more convenient, but you can achieve similar security on your own. It is on speed that XeroBank will win hands down.
     
  8. caspian

    caspian Registered Member

    Joined:
    Jun 17, 2007
    Posts:
    2,363
    Location:
    Oz
    So it would be possible for me to use Tor with Java and javascript enabled so I could watch Google videos and stuff? If so, does this take much technical knowledge? Because I am severely lacking in that department, hehe! But it's always good to know what my options are.
     
  9. Paranoid2000

    Paranoid2000 Registered Member

    Joined:
    May 2, 2004
    Posts:
    2,839
    Location:
    North West, United Kingdom
    You can certainly use Tor with Java and Javascript enabled (Firefox's NoScript extension is the easiest method of controlling this - but that simplicity results in less flexibility) though I would strongly advise doing so only for sites you trust and that won't work otherwise (even then, there is an element of risk from a malicious exit node). BTW, I would certainly not consider Google trustworthy - despite their "do no evil" mantra they are one of the biggest (if not the biggest) data collectors on the Internet.

    However video traffic is highly demanding of bandwidth so if you want to watch videos, stay with XeroBank or another commercial service.
     
  10. SteveTX

    SteveTX Registered Member

    Joined:
    Mar 27, 2007
    Posts:
    1,641
    Location:
    TX
    Would you be surprised to hear that we've done it, and it is quick and easy to follow the flows through the IX servers to discover the complete circuit? I would really love to share a lot of this info with you. Will you be coming to Defcon? I think Kyle and I are going to do a talk on peeling onions. :)

    Definitely needed, but rather cart before the horse. Tor can't yet figure out how to resource manage and distribute directory lists efficiently. It will be a decade before this gets properly addressed.

    I can see you've assumed that the IX router controllers aren't introducing any hiccups to watch the bubbles. I'll have to ask our CSO for confirmation, but I think that would make figuring out which straw the data was flowing through, much easier. Tracing isn't my forte, but it is his.

    That is exactly who I'm talking about. And I would disagree about their viewing ability. Are you aware that the Chinese government has infiltrated very high levels of our military networks? The internet is much easier to control than military networks. They are superpowers, they have IX access not only to their own routers, but to many others that are shared. They aren't in a murky middle, they are exalted in observation powers. As for the ISPs, they can sometimes pretend to be superpowers, because the internet is very small. Let me put it another way, the ISPs have to ask permission whereas the superpowers don't. They can be interchangable in other respects, except ISPs don't have any sovereign powers or aims other than to stay in business.

    And so it shall be provided. I'm wondering how detailed of a whitepaper we need to break out... probably a high-level with diagrams, and a deep tech to put you to sleep...

    In soviet onion, resource limits define honesty of you.

    There we go. 5 to 20 circuits per node. That is some *really* terrible crowding if you could call it that. Not even enough circuits for a monte carlo simulation. Compare that to 200 - 500 circuits per node on xb, and then factor in our true multiplexing of traffic. Visualize it like this: A cable of 200 to 500 strings that multiplex together. And now, 5 to 20 strings unmultiplexed. That is where large distribution + inefficient resource usage/planning is a problem.

    Tor gives everyone the same amount of soup as long as they show up at the door.

    You might be upset to see me stroll through Tor at 250KB/s without batting an eye.

    Heh, not entirely. I'm quite sure we'll be seeing some browser attacks from exit nodes, not relying on javascript. And targeting depends on how big of a net you want to cast. Waiting for a specific individual? you could be waiting a while if you only control 1 exit node and it is unfavorable by the victim. If you just want to attack anyone that can get infected, like most attackers do, you have an unlimited supply of unwitting victims, lining up.

    Defending against attacks at layer 7 of the OSI is an exercise in futility.


    I disagree slightly. I don't want to cut off my nose to spite my face. I want my active content. And I don't want to defend at Layer 7. So let's drop it three levels and run the active content and local network in a sandbox.

    Mr. hacker of the year said more than even he knew...

    Ponzi anyone? :) If I'm an attacker, I don't mind running a fast, reliable node for a year if I can get everyone to trust me for that big juicy kill. There are currently no good reputation systems, and inherent problems abound.

    A confirmed contact email? A registered name? I think you can buy 1000 of these at a time on certain IRC channels.



    And I bet the subpoena had a good chance of compromising the client. 1:1 is a bad track record, and oblivion compared to 300 : 0. But let's step away from that, and look at it another way: We have much more experience with this sort of thing, and we're prepared to fight back, not send it to a lawyer and ask for the most diligent way to cave.

    Too true.

    It isn't a guarantor, that is for sure, but the charge is due to a supposed value exchanged, and a byproduct is reputation. If you have a service that is prohibitively expensive but offers less value in return, it is likely to become known. That's one of the main factors of why I chose to be with XB, i hated all the sub-par alternatives and thought I could help do better. People have had their hopes for digital democracy crushed many times, by many scammers and sometimes by lethal intervention. I can't tell you how many times I hear that xb is "too good to be true." and it makes me proud, but also a little sad that people have lost hope and become so worn and cynical for how many times they've been let down. When the real deal comes along will they notice it?

    What do you have in mind, abstractly?

    Only my distrust is due to disliking most offerings, not that they cost money. I think there are a few winners out there, but most of these things are black boxes adorned with buzz words and platitudes that don't deliver.

    Exactly.

    Can we quote you on that?

    Actually, you can do it for free, yourself, too, by using xB Machine for access through Tor. Now you get all your active content without any risk. Problem solved with xero effort. :)
     
  11. fuzzylogic

    fuzzylogic Registered Member

    Joined:
    Mar 12, 2008
    Posts:
    149
    I'm sure there will always be a way to unravel the TOR network, being the most mainstream and popular anonymity network. But it proves to the the best of the bunch and a system most people are confident in. I wish this much was discussed about the XB network, we are yet to hear anything more about the network, the beta, xbmail, etc. Its almost a competition between the FREENET crew and XB on whom has a more glacial update schedule. I was really excited about the possibilities but the more i watch this thread the more i doubt. In the end we need to see the network up and running or we are going to see XB be nothing better than the competition. This is not a go against you but the general feel I get from observing. I enjoy the plus service and really am watching and waiting for the next big upgrade, but since that was suppose to happen 2 months ago I feel like I would be better with just normal VPN service and be done with it.

    BTW any word on the new light service that was mentioned in the thread?

    (edit) Here is the two alternative projects (now dead) that i thought some might find interesting ToasT and DemocraKEY
     
  12. LockBox

    LockBox Registered Member

    Joined:
    Nov 20, 2004
    Posts:
    2,328
    Location:
    Here, There and Everywhere
    Steve, Wasn't DemocraKEY and ToasT using your old Torpark code?
     
  13. SteveTX

    SteveTX Registered Member

    Joined:
    Mar 27, 2007
    Posts:
    1,641
    Location:
    TX
    Yes, they were entirely using my Torpark code. :)

    Fuzzy, did you not yet get to try out xB 2.0 network beta?
     
  14. fuzzylogic

    fuzzylogic Registered Member

    Joined:
    Mar 12, 2008
    Posts:
    149
    never had any luck with the beta, either a timeout error or a software problem. Eiither way i didn't really bother spending time with it. It didn't seem to be anything different than what findnot was offering, basically just choosing which vpn server you wanted. I was actually thinking that it would a as simple as the plus package and then you'd just pick the entry and exit node. Not the case. It seems what was posted here and what was done was two different things. Unless things have changed, xb 2.0 wasn't all it could of been.
     
  15. SteveTX

    SteveTX Registered Member

    Joined:
    Mar 27, 2007
    Posts:
    1,641
    Location:
    TX
    You may have gotten a beta during the DNS upgrade, which makes you connect but unable to get to any sites. Anyway, yes, you'll be able to select your exit routes naturally, and the round robin DNS will select your entry route. Currently, business services are setup where they can pick their own entry node and custom entry node/exit nodes etc.
     
  16. fuzzylogic

    fuzzylogic Registered Member

    Joined:
    Mar 12, 2008
    Posts:
    149
    Fair enough, through i don't think i'll be paying the 500 dollars a month for a corporate account just to select my entry node :D I suppose that doesn't really matter at a personal account level but would be nice, guess that just for load balancing for the quickest speed. Wouldn't of been nice if that had been explained. Guess we'll just have to wait until the network matures to see what it exactly has to offer, good luck. :)
     
  17. benjmonge

    benjmonge Registered Member

    Joined:
    Apr 3, 2008
    Posts:
    2
    Once again i can't connect to the service, this time i get a 'Invalid host please check internet connection' error message. I tried to visit the website but that also seems to be down at the moment.

    Do we know when the service may be up and running again?
     
  18. Paranoid2000

    Paranoid2000 Registered Member

    Joined:
    May 2, 2004
    Posts:
    2,839
    Location:
    North West, United Kingdom
    Was this on Tor or on XeroBank? How many minutes did the connection last and how much data was sent through it? As Steve Murdoch's paper (linked to above) notes on page 13, there was a 50% chance of being able to correlate traffic on a node with 500 flows/hour where the target had sent 20,000 packets (about 10MB of data).

    In practice, anyone doing large file transfers is going to stick out like a sore thumb (on Tor especially due to their relatively high data throughput) but for straightforward webpage access (excluding pages with video streams - these are to all intents and purposes large file transfers) you are talking about a few hundred KB and a sporadic traffic pattern. Since webpage access is where anonymity is most needed (far more information can be revealed about a person from the webpages they visit, compared to the files they download) any statistical correlation of traffic flows is only likely to work with https: access where the same circuit is maintained for an extended period.
    That should bring tears to a few eyes. :D I don't however intend to visit the US as long as the current travel requirements (fingerprinting, disclosure of personal data, etc) persist.
    Hopefully not that long - the main directory servers are going to be severely stressed by then. Individual nodes can choose to mirror the directory though which is a half-way house.
    Wouldn't that require them to identify Tor traffic first? And how would they do that, given the quantity of data passing through (150Gb/s for LINX) without wholesale use of DPI crippling network performance generally?
    I'm not in a position to provide informed comment on military networks - but even if the Chinese government had root access to the main IXs, how are they going to transfer across the giga/terabytes of data they'd need to collect/analyse without attracting notice or bringing their own networks to a standstill? If they had privileged access, it would make far more sense for them to limit snooping as much as possible, e.g. to government/military IP address ranges.
    Unless several Tier-1 ISPs co-operate, they are unlikely to be able to comprehensively monitor Tor nodes (going back to Murdoch's paper, Level 3 had the highest visibility of paths from UK Tor nodes at 22%, NTL was second at 16%).

    However, this sort of discussion does beg the question of how vulnerable XeroBank is in comparison. With Tor at least, there are several lists of nodes showing the scale and spread of that network.
    A summary page (as Tor/JAP offer) and a regularly updated statistics page (showing number of nodes, approximate number of active users) would be a great start. Full whitepapers (and complimentary pillows) can wait till later. :)
    Um, *cough* I'm only handling 250KB/s traffic which makes my node small fry compared to the topmost nodes (1-6MB/s) though still in the top 10%. Scale the flows up accordingly, and the major Tor nodes should compare pretty well with XeroBank (and virtually every route I've seen on Tor has included a >1MB/s node). Then you have Tor's routing using 3 nodes to XeroBank's 2.

    Looking at the list of Tor nodes, there are 29 currently offering more than 2MB/s bandwidth, 1,223 online and 2,957 listed.
    Not through my node you're not. :p
    Targeting an individual user is going to be almost futile as you note (unless the attacker can identify a specific site they visit, like a social networking homepage). Targeting all users via an exit node could work but not for long (it would be reported quickly and possibly even detected automatically by projects monitoring exit nodes). However using a similar exploit on a mainstream website (or ad network) where it could catch both Tor and non-Tor users would offer far greater payback.
    But you then have significant expense (bandwidth, maintenance, potential abuse reports) for, at best, a limited capability to catch and alter web traffic. Even if you chose to target a high-value site (bank, online stock trader) and were able to somehow spoof the https certificates needed, you'd still get better results from other techniques like router hijacking or DNS pharming.
    They aren't infallible by any means but could prevent certain automated attacks (like setting up rogue nodes en masse).
    Don't bet, read the details (19K PDF download) for yourself.
    I think this bears repeating, the JAP project fought the court order and won. Unless and until XeroBank manages a similar result in a court of law, it has no right to claim the high ground here.
    "Lethal intervention"? Sounds like someone's got killer lawyers at work. ;)

    More seriously though, confidence and trust require time to build. Commercial anonymity systems have a higher hurdle due in part to past (and present) scams but also with the extra requirement of providing truly anonymous payment mechanisms. You have the benefit of an insider's view of XB which the rest of us lack, so I would suggest that providing as much information about the who's, how's and why's of XB is the best way to advance public trust, rather than focusing on the shortcomings (real or speculative) of competitors.
    *winces* Oh dear me, another advertising slogan is born.
     
  19. moro

    moro Registered Member

    Joined:
    Apr 30, 2008
    Posts:
    2
    Hi Paranoid2000, I'm not a security expert (or a security anything for that matter) but I've been following this thread and just have one question for you. Being someone who understands 10% of this thread but wants to protect their privacy when browsing, would you say XB (xBrowser or xB Machine) is the best option available to me?
     
  20. Paranoid2000

    Paranoid2000 Registered Member

    Joined:
    May 2, 2004
    Posts:
    2,839
    Location:
    North West, United Kingdom
    Have a look at the Now how to choose a VPN / anonymizer service ? thead for some discussion on anonymity services (it's also only 3 pages long currently!). The "best" solution will depend on your needs for privacy, security and performance.
     
  21. moro

    moro Registered Member

    Joined:
    Apr 30, 2008
    Posts:
    2
    Thanks P2K, geez I should have searched a little harder for that one. Thanks for pointing it out! Unfortunately, it appears that this stuff is too over my head for me to apply it effectively however, it seems like protecting privacy is by no means an easy task (even to the experts). I guess I'm just looking for a way to visit websites without revealing my human identity (or anything that can lead to it). Funny how just saying that makes me feel guilty but all suspicions of moral intention aside, I think paranoia would be the best way to describe it. I asked you because you're clearly concerned with privacy as opposed to selling something. Thanks again for your support!

    ps. P2K Anonymizer has such a nice ring to it....is that a non-possibility?
     
  22. Paranoid2000

    Paranoid2000 Registered Member

    Joined:
    May 2, 2004
    Posts:
    2,839
    Location:
    North West, United Kingdom
    In that case, why not give JAP a try? It's easy to set up (once you install the Java applet, just configure your browser) and it has both free and commercial services. Its downside (which applies to most anonymity services) is that all its servers are based in one country (Germany in this case) but as long as you are connecting from elsewhere and don't need a fast connection (for P2P or similar stuff) it should be good enough.
    There's a monster thread here on this topic - Don't Fear Internet Anonymity Tools. While there are certainly some who'll use such services to cover illegal activity there are many reasons for the honest majority to protect themselves also, ranging from the indiscriminate online data retention legislation that many countries have passed to ISPs who sell their customers' online activities to advertisers (a Google search on NebuAd and Phorm should provide details aplenty there).
    Heh, running an anonymity business is a lot harder than just pontificating about them on forums - I'm sure XeroBank would agree on this. :D

    ~Reply to deleted post removed. - Ron~
     
    Last edited by a moderator: May 21, 2008
  23. fuzzylogic

    fuzzylogic Registered Member

    Joined:
    Mar 12, 2008
    Posts:
    149
    theres a business opportunity for your Paranoid2000, you could rise the next anonymous network TOR 2.0, you certainly know the pitfalls of it all and have the expert knowledge of all things anonymous. Wasn't this xerobanks thread, seem to have gone for a small holiday, haven't seen him around the forum. (quick while hes away announce a rival network and hijack the thread lol :D )
     
  24. SteveTX

    SteveTX Registered Member

    Joined:
    Mar 27, 2007
    Posts:
    1,641
    Location:
    TX
    Greetings again everyone.

    New version of xB browser is up. Download Here

    Tons and tons of updates.
     
  25. SteveTX

    SteveTX Registered Member

    Joined:
    Mar 27, 2007
    Posts:
    1,641
    Location:
    TX
    A simulated darknet based on onion routing.

    SJM is a smart guy, but things are worse than his calculations imply. There are only about 3 major locations where all the US IX servers are. That means those 25+ US IX servers should only be counted as 3, and handle nearly ALL of the internet's traffic.

    I think I'll be presenting this info at defcon.

    That's a pretty good way to put it, except it implies that you're half-way to a solution :) ... not even close. It will take entirely rethinking directory structure and distribution. Again, things are glacial at Tor and may only be slowing down because they have their fingers in so many pies.

    Just trial and error at lightspeed. It's like dropping ducks in a river to watch the current. Don't quote me on this, it isn't *my* specialty, just my understanding of it. If our guy wants to do some detailing on how to discover and track tor traffic, that's up to him.

    I imagine they would have a device and connection to that device on the local network to transmit at Gbps to a snort/naurus box. It isn't *that* hard to believe.

    That's one school of thought, but it is already a prisoners dilemma, where the US has to assume that the Chinese are snooping, and thus snoop, and vice versa, just to keep up with each other.

    3 major IX locations for most of the world's traffic. Who need Tier-1 when you have all the sensitive data in the same physical location.

    We were thinking of doing a network health map as a java generated image or as a flash module. That way you could see nodes and saturation and uptime etc.

    Sooner than later, I think.

    What shall we wager?

    There are fingerprint techniques that can be used to some great degree. As long as your node is online, it is only a matter of time.

    Not if we're snorting for the fingerprint success and only attacking that user/userset.

    Drive-by attacks, though, are easier to launch. And you may be surprised that we can do all of these attacks, when we display at Defcon. We can remotely take control of DNS, install new root certificates, take full control of computer, etc. with this new Tor-oriented attack.

    Fighting in court is already a battle where you have the possibility of losing. When you can kill it before it ever gets to court, that is something. Six years, 300 wins, nearly none ever getting to court.

    We'll be introducing one at DefCon (assuming my talk proposal is accepted.)
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.