Wow, not a single mention of "illegal" in your blog posting. Maybe have some thoughts about the legality of the services offered with your technology and just stop offering services that can easily be abused by criminals? Just a thought ...

I don't think you can be anonymous from any fixed location like your home, business, etc. You can be anonymous by using someone else's connection although terming that "anonymous" is a bit of a misnomer. Stolen or a fraudulent identity might be a more correct term. Think Linux Live distros for jumping on the net via some else's open unsecured wi-fi or whatever and if you're really paranoid, make sure you can swap out your memory chips in your laptop when you are through with using some else's connection for some nefarious reasons. The object is no record, no history, nothing on your machine.

All this doesn't mean they can't (or won't) plant something on your machine if they really want you.

But be very aware of surveillance cameras around frequently touted "free wifi" with Cheeseburgers locations. Always seems to be a lot of cameras in the mix.

All these people got busted because of their hosting provider. The DDoS attack is unrelated.

Hetzner is like all big companies in Germany, in Europe and in the USA forced and paid gold by the local NSA (the BND) to run a grep-like tool on the disks of their customers. A simple pattern like .onion will show all hosts with contents somehow related with Tor and it's quite easy to detect and bust hidden services in this way, though at a random success rate.

Phonbos

I consider this a strange post. We have known for more than a decade that TOR is not NSA-resistant.

"Low-latency systems like Onion Routing aim to provide
anonymity against an adversary who is not watching both
Alice and Bob [39]. If the adversary watches both, he can
for instance count packets and observe packet timing to
become confident that they are communicating."
http://freehaven.net/anonbib/cache/minion-design.pdf

The problem is not so much how to make anonymity perfect, but that TOR is only accepted by law enforcement BECAUSE these vulnerabilities are built-in.

The real challenge IMHO is how to build mutual societal security on top of perfect anonymization in order to get clearance to e.g. upgrade TOR and scale it across all communication.

Regards

Stephan Engberg

Maybe the solution is to be found on the machines that were NOT seized. What have they done to go unnoticed ?

You see guys, *this* is why you always purchase servers for your hidden service far away from you geographically, and purchase them anonymously (no, bitcoins are not anonymous by default. You have to either get them anonymously, which is more difficult than most people are comfortable with, or wash them through something like Bitcoin Fog). And of course, use disk encryption. That way if your hidden service is deanonymized and the feds go to the very datacenter it is hosted in, the worst they can do is take it offline (and if they perform a cold-boot attack, read even the encrypted disk, but you are still safe because you purchased it anonymously).

Now a very important note to hidden service operators, especially those who run controversial/taboo services like drugs, cp, various political views, etc:
USE PGP! Somewhere on your site, sign the current onion URL with your key. If your site is seized and the feds gain access to your hidden service's private key, they will be able to redirect all traffic to that URL to a site of their choice. But worse than that, if you don't use PGP, anyone can create a new clone of your site and pretend to be you. If you do use PGP however, when you bring up a new site under a new URL, you can sign that URL with the same key to prove it is official. This effectively allows you to keep a "master key" for all your hidden services that remains offline (i.e. it will not be up for grabs by anyone who gets access to your server). The next HS protocol will have something like this built-in, but for now you will have to use PGP.

On a more "experimental" note, I suggest that hidden service owners monitor their logs for possible denial of service attacks, and if any are detected, *disable your hidden service* and wait a little bit before bringing it back online. If you have the resources, bring it up immediately at a different location. Hopefully this will prevent active deanonymization attacks that rely on DoS, because the feds will be unlikely to get enough samples. I say "experimental" because I have not thought this through thoroughly so it is certainly possible that doing this just makes things worse. Anyhow, it's just a thought I'd like to put out there.

tl;dr
1) Assume your servers will be deanonymized and take measures to ensure that even if they are, you personally will remain safe (buy them anonymously).
2) Get use to using PGP so you can prove you are the real you if your site goes down and you are forced to create a new one.
3) If you're getting DoSed, it might be a deanonymization attempt. It *might* be a good idea to shut your server down for a little bit, or move it somewhere else completely if you have the resources.

... computer security ALWAYS fails on the same exploit ... human stupidity

And what about simply running a browser with a script trying to connect to the target onion site all day long for a few months and through random tor circuits, then mathematically correlate the failed attempt dates/times with known, publically available maintenance/failure reports from ISPs and other Internet actors.
The more the service fails because of external network problems, the faster you'll find your guy. And if you have the power to selectively shut down sections of the Internet, you can find it even faster (dichotomy => logarithmic time)...

Tor had too many bugs since one of its March updates. In May the entire network got slower and now apparently using Tor is simply using another browser to gain excess to hidden sites but Tor offers no anonymity anymore.

All these people going argh what do we do, you make me laugh, try reading a technical paper on anti-web framework and loading INFERNO-OS everywhere... Fuck Tor! Time to employ some next generation security everywhere and if the Feds dont like it, just remind them that we can delete there entire IP range for-eva!

did you notice this research:

http://thestack.com/chakravarty-tor-traffic-analysis-141114

81% of Tor users can be de-anonymised by analysing router information, research indicates

On the Effectiveness of Traffic Analysis Against
Anonymity Networks Using Flow Record

https://mice.cs.columbia.edu/getTechreport.php?techreportID=1545&format…

In this paper, we assess the feasibility and effectiveness of
practical traffic analysis attacks against the Tor network using
NetFlow data. We present an active traffic analysis method based
on deliberately perturbing the characteristics of user traffic at the
server side, and observing a similar perturbation at the client side
through statistical correlation. We evaluate the accuracy of our
method using both in-lab testing, as well as data gathered from a
public Tor relay serving hundreds of users. Our method revealed
the actual sources of anonymous traffic with 100% accuracy for
the in-lab tests, and achieved an overall accuracy of about 81.4%
for the real-world experiments, with an average false positive rate
of 6.4%.

By the way, the "Russian" tor exit node which distributed malware recently probably comes from NSA

http://www.f-secure.com/weblog/archives/00002764.html

Why? Because it distributed a miniduke variant and there is a link between miniduke and NSA:

A mathematics professor was attacked with a Miniduke variant that was
sent to him with a faked linkedln message. This miniduke variant
communicated with a hacked Belgacom server over encrypted channels.
And thanks to Snowden, we know that this Belgacom server was hacked
by NSA.

http://www.pcworld.com/article/2093700/prominent-cryptographer-victim-o…

Belgacom was hacked with a quantum insert attack, that only
an agency is capable to do if it has access to the backbones of the
american internet.

The Russians and Chinese do not have this access to US backbones and thereby they can not do a quantum insert attack on Belgacom.

Hence it is unlikely that both NSA and Russians hacked Belgacom.

So the Communication relay for the Miniduke variant on the professor's laptop was likely set up at Belgacom by NSA.

As a result, we have a link between Miniduke and NSA....

And then there is a link between Miniduke and the recently distributed malware from the "Russian" tor node:

http://www.techienews.co.uk/9720308/rogue-russian-binary-patching-tor-e…

“This strongly suggests that although OnionDuke and MiniDuke are two separate families of malware, the actors behind them are connected through the use of shared infrastructure,”

Probably NSA went to a Russian server to distribute their tor malware after their last attack on tor in 2013 was traced by researchers to NSA servers directly:

http://arstechnica.com/tech-policy/2013/08/researchers-say-tor-targeted…

See here : http://log1.bitcoin-assets.com/?date=15-11-2014#924415

Buncha fucktards.