How Dutch Police Took Over Hansa, a Top Dark Web Market

Re:How Dutch Police Took Over Hansa, a Top Dark Web Market by wlesieutre on Friday March 09, 2018 @01:54PM (#16553950)

You shouldn't do it in a web browser at all, client or server side. They can start off doing it client side and then silently switch to doing it server side. I've admittedly never used PGP, but I would think if a website at any point has access to your private key and could transmit it back to their server, you're doing it wrong.

I suppose it's a question of your threat model. Do you trust the website to not do that? Given that FBI is willing to take over and continue operating websites that distribute child porn, the default answer to that question ought to be no. You have no way of knowing if someone else has taken a server over.

Maybe a browser extension would be a good way to do PGP encryption for websites, keeping the key out of their reach but allowing a one-click encryption right in the browser.

[ Parent | on HN ]

Re:How Dutch Police Took Over Hansa, a Top Dark Web Market by vilhelm_s on Friday March 09, 2018 @02:18PM (#16554142)

Indeed, it's common advice that users of Darknet markets should not have Javascript turned on at all, since it increases their attack surface. (e.g. https://darknetmarkets.org/agora-comments-on-recent-bitcoin-...)

[ Parent | on HN ]

Re:How Dutch Police Took Over Hansa, a Top Dark Web Market by s73v3r_ on Friday March 09, 2018 @06:25PM (#16555975)

I like how that's a .org. They really do just want to get the information out there.

[ Parent | on HN ]

Re:How Dutch Police Took Over Hansa, a Top Dark Web Market by stingraycharles on Friday March 09, 2018 @02:22PM (#16554174)

Isnt that the default of the Tor browser as well ?

[ Parent | on HN ]

Re:How Dutch Police Took Over Hansa, a Top Dark Web Market by 4ad on Friday March 09, 2018 @04:33PM (#16555244)

No, it isn't, which is insane.

[ Parent | on HN ]

Re:How Dutch Police Took Over Hansa, a Top Dark Web Market by dmix on Friday March 09, 2018 @06:47PM (#16556103)

Yes it is. It wasn't for the first couple years but they turned it on a few yrs back. Last time I used Tor browser JS was disabled by default... I'd be surprised if that wasn't the case.

[ Parent | on HN ]

Re:How Dutch Police Took Over Hansa, a Top Dark Web Market by 4ad on Friday March 09, 2018 @06:55PM (#16556143)

No, it isn't. I just downloaded the latest version of the Tor Browser, 7.5, and while it comes with NoScript installed, it's turned off by default: https://i.imgur.com/7pb7nvI.png

[ Parent | on HN ]

Re:How Dutch Police Took Over Hansa, a Top Dark Web Market by mirimir on Friday March 09, 2018 @08:36PM (#16556601)

That's been a contentious point for years. The dominant faction of Tor devs fears that Javascript blocking will confuse and frustrate too many users. In the kindest interpretation, that's to protect the most users, notwithstanding that it will get some users pwned.

Less kindly, one could argue that Tor devs want to increase the anonymity set, in order to better hide US government users. That was, after all, one reason why Tor's initial Navy funders agreed with open release of the software.

There are similar issues around other Tor vulnerabilities. Such as how easy it is for apps to bypass Tor. Which has allowed the FBI's phone-home malware to pwn users.

[ Parent | on HN ]

Re:How Dutch Police Took Over Hansa, a Top Dark Web Market by crtasm on Saturday March 10, 2018 @09:45AM (#16558640)

Are you claiming that running an app in an environment where it can access the internet directly counts as a vulnerability in Tor?

[ Parent | on HN ]

Re:How Dutch Police Took Over Hansa, a Top Dark Web Market by mirimir on Saturday March 10, 2018 @05:34PM (#16560523)

Yes, of course it is. Whether it's the Tor Project's fault or the user's fault is a contentious issue.

[ Parent | on HN ]

Re:How Dutch Police Took Over Hansa, a Top Dark Web Market by crtasm on Tuesday March 13, 2018 @02:28PM (#16578516)

I disagree, Tor isn't a sandbox or firewall for your apps. If they make undesired network traffic then the vulnerability is in the app (and arguably, the environment it's running in).

[ Parent | on HN ]

Re:How Dutch Police Took Over Hansa, a Top Dark Web Market by TomMarius on Saturday March 10, 2018 @04:55AM (#16557909)

Could you please tell me more about the other Tor vulnerabilities?

[ Parent | on HN ]

Re:How Dutch Police Took Over Hansa, a Top Dark Web Market by mirimir on Saturday March 10, 2018 @05:50PM (#16560571)

I'm not aware of known vulnerabilities in Tor itself that devs haven't mitigated, out of usability concerns or whatever. Generally, I consider the focus on Windows users, and the reliance on tweaking Firefox for security, to be vulnerabilities. Also the refusal to compartmentalize the Tor process from userland, either in VMs or in separate hardware. I mean, Whonix has been around for years, and it's not featured (or even mentioned, unless you dig into the wiki) on the Tor Project website. And what about Qubes? Or Tor routers? I mean, they go after people for calling them that, citing their copyright.

[ Parent | on HN ]

Re:How Dutch Police Took Over Hansa, a Top Dark Web Market by crtasm on Tuesday March 13, 2018 @02:46PM (#16578665)

https://blog.torproject.org/tor-heart-qubes-os

https://blog.torproject.org/tor-heart-whonix

https://blog.torproject.org/tails-36-out

But I fully agree the main site should make the risks of TBB clearer and promote Whonix/similar.

[ Parent | on HN ]

Re:How Dutch Police Took Over Hansa, a Top Dark Web Market by roystonvassey on Saturday March 10, 2018 @01:15AM (#16557370)

I think it imports any JS blocker you might be using on Firefox. For instance, in my case, I installed Tor and when I started it the first time, I saw the 'NoScript' tab enabled.

[ Parent | on HN ]

Re:How Dutch Police Took Over Hansa, a Top Dark Web Market by bdhess on Friday March 09, 2018 @11:44PM (#16557137)

> I've admittedly never used PGP, but I would think if a website at any point has access to your private key and could transmit it back to their server, you're doing it wrong.

Encrypting a confidential message for another party is a public key operation. It’s the fact that the plaintext was sent to a remote server that’s problematic.

[ Parent | on HN ]

Re:How Dutch Police Took Over Hansa, a Top Dark Web Market by wlesieutre on Saturday March 10, 2018 @12:45AM (#16557292)

Oh right, good catch. So the problem is that encrypted messaging on a webpage just can't be convenient like messaging on facebook if you want to keep the server from having your messages. Other people send you messages, and you'll need to decrypt them yourself outside of the browser if you want to keep the browser from having your private key.

[ Parent | on HN ]

Re:How Dutch Police Took Over Hansa, a Top Dark Web Market by cookiecaper on Friday March 09, 2018 @03:37PM (#16554794)

Extensions get exploited from inside the browser too. If you're going to be buying contraband online, one would hope that you have at least enough commitment to move your mouse over to another window on your desktop and do the cryptography there.

[ Parent | on HN ]