4

This question is interesting in that it reveals some assumptions people have about the internet as whole. First of all, the basic premise of this question is, for lack of a better term, wrong. The internet as a whole was designed by the US Department of Defense to be resilient to a Soviet nuclear attack and to withstand elimination of nodes without losing ...


4

Yes, this is a common practice. There are many ways to identify a user. Here's a few. user agent string in the request browser fingerprinting (pantoclick IP address (country, region, ISP, known VPN ranges, blacklists, etc.) referrer header cookies previous history (look through your own logs to ID return traffic) URL history harvesting css fingerprinting ...


3

The dark web is like a lair for hackers/criminals/etc. That's an oversimplification, but we'll go with it. But has anyone, like FBI or CIA ever found the main server of the dark web? Where is the main server located? I thought all Internet data flows are being watched by many government institutes like FBI/CIA. Why have they not chased the main server of ...


3

This is nearly a dupe of How do organizations check what has been hacked? While that question deals with unraveling what, you're asking about unraveling how and by whom. What other possibilities are there to identify an attacker, when he knows his business and is hiding his IP/Info and not making stupid mistakes? There are a lot of possibilities. ...


3

I run honeypots, and I once caught a hacker because he used his full legal name as a password, and he used the same username he used for an online dating profile. With those two pieces of data, I was able to go so far as to get his phone number at his place of work. Sometimes, technology doesn't unmask you, but the way you attack does.


2

According to this, when you connect to a hidden service using tor you go through 6 nodes instead of 3... why? To hide the hidden service IP address in case the rendezvous point is under adversary control. The hidden service communicates with Tor client through a chosen node, which is called rendezvous point (RP). Normally they both build a standard Tor ...


2

No, there isn't any log on the satellite - it's just broadcasting a time signal and an identifier. Anyone can pick it up - think of it as being like a radio broadcast. Phone location, as in how police track a specific phone, doesn't work using GPS directly. A limited amount of location data can be obtained by looking at which cell tower the phone is ...


2

As long as you are not storing IP addresses alongside other personally identifiable information, they do not have to be handled under GDPR rules. They only become sensitive when enriched with a user's name, email address, or any other such data. Just make sure that the systems limiting requests are separate from those handling logging in and user data, and ...


2

“So we all know that NSA has the ability to track down Tor, I2P and all those anonymous networks.” Actually we know nothing of the kind. Tor was originally TOR (The Onion Network) and was developed by U.S. Naval Research Labs (NRL) specifically to provide a mechanism that was both secure and anonymous against nation state level threats. Since then it has ...


2

whois on an IP address shows whom this IP address (range) is assigned to. If you get that the address is assigned to some company doing anonymous proxies then this is exactly that, i.e. there is no way to look behind since there is nothing behind. What you would need to look further is the original IP of the user which an anonymous proxy hides by design. ...


1

From a pure security standpoint, I see 3 possible improvements to your system: Using a slow hash like bcrypt. It is serveral order of magnitude slower than SHA-1. Your application won't be impacted, but it will take weeks for a motivated attacker to bruteforce every possible IP, instead of a fraction of second. Change the salt regularly. The attacker will ...


1

GDPR requires reasonable protection of such data but does not totally forbid storing these data. Since the hashes are only stored on the server (where the attacker should have no access anyway and since the use case you have only needs short term storage and you can (and should) delete these hashes afterwards I see no real problem here. Even when the ...


1

You are missing a part of the equation. Using HTTPS, the traffic between you and the destination server is protected from snooping and alteration, but you know the identity of the server, and the server knows yours. If you post something the government considers a crime, the server may be compelled to give them your identity. On the other hand, if the ...


1

For one, you may care about the attacker (government?) knowing about which sites you access. Sure it may not be such an issue in the US right now but there are countries where just visiting western news/info sites to get real information instead of propaganda could get you into trouble (not that news can be trusted these days but that is another issue). The ...


1

You could do something like that (other solutions could be possible): Step 1: The user fills the consent form. Step 2: The server validates the consent form then generates a unique link to the questionnaire, not tied to the consent form. This link that can only be used to validate one questionnaire. The server flags (in its database) the session cookie as ...


1

No! This is exactly what Tor hidden services are designed to accomplish. Nothing is absolutely safe and given enough worldwide oversight and resources, Tor is vulnerable in theory. In practice the vulnerability bar is very very very high. If you are the only user of your hidden service, you may want to make it a "Stealth Hidden Service". This requires an ...


1

... it compares the size of incoming traffic and the outgoing one and see which one matches? Once you understand what inbound traffic is, you can get the IP of the affected client, right? To do this kind of correlation an attacker would need to have access not only to the endpoint of the VPN but also need to sniff near the entry points, i.e. at the ISP ...


1

Is this technique used? I can't speak specifically to mobile phones, but in general, it's a regularly used technique usually referred to as de-anonymization or re-identification. One common legal application is in web advertising. Advertisers aren't allowed to have access to your personally identifiable information, but they may have access to your ...


1

Is it a bad idea to access over the same VPN both sites that know your real identity and those that don't? From a hyperparanoid perspective yes. You will likely have the same visible IP for both sites. Whilst usually you would expect other users to be present at the VPN IP it still makes pairing up your requests easier. What kinds of attacks could expose ...


1

While strict anonymity can be seen as a preference to a user attempting to conceal all aspects of their identity, it is infeasible and impossible to say the least. Tor, Blockchain, and other anonymizing technologies designed for a specific purpose can never be made to be infallible. After all, people do make mistakes and those are the elements that lend to ...


1

There is nothing you can "install" to deanonymize an attacker. Once you get the data from Kippo about the IP and connection type, you have as much as you can get unless the attacker reveals more about themselves from their actions. There are tools that you can use to enhance the data a little, but that does not break anonymity. Most of the investigations ...


1

To add to the answer above: If b. is true, then the client and hidden service hoster don't communicate outside of the rendezvous point, becuase it's unsafe... So how do they find out which rendezvous point they will both be communicating at? The rendezvous point is chosen by a client, randomly, from a list of Tor relay nodes (they don't have to be ...


1

Another way I have interpreted this is that the client, nor Tor, needs to know the real IP address of the hidden service hoster, since they only communicate through a rendezvous point, and they both go through 3 encrypted hops just like normal to the rendezvous point, providing them both anonymity.  Yes, this is correct. It's helpful to think of the hidden ...


1

For question 1, Matthew answer is perfect, with nothing to add. For question 2, the answer is no, but only if the phone is in the airline more (not just SIM card is out). Please note that the phone can still connect to cell towers even without a SIM card, because the Emergency number could be dialed without a valid SIM card. Of course GPS and Wi-Fi should ...


1

This is like any exercise in forensic investigation. Attackers leave trails. These can sometimes be correlated to evidence left behind in other attacks. Time of day may not seem like much, but if its from the same block of time every day, that may not be coincidence. Hacking tools left behind may have native language artifacts, custom directory path names,...


1

There are some ways for a website to find your real IP. Here are some: evercookies - are some kind of persistent cookies which are not deleted like the normal ones. They can be bypassed by disabling JavaScript. VPN accidental disconnection - if you have accessed a site in which you have some kind of account, even a single time, with your real IP, then the ...


1

Yes, if you've got a complete view of the network, you can de-anonymize TOR circuits: as the circuit is built up, the nodes build their connections one after another. This is the most favorable condition for performing a timing attack on the network, and works regardless of the length of the circuit or how often it changes. This is also by far the hardest ...


Only top voted, non community-wiki answers of a minimum length are eligible