News for hackers. Stuff that matters.
Re:Heartbleed and TOR in practice by ufmace on Thursday April 17, 2014 @12:25PM (#7604548)
Combined with rumors that the NSA knew about Heartbleed, this makes me wonder if they actually were involved in outing Silk Road. As far as I know, we still haven't seen any indication on how the FBI managed to find and image the Silk Road server.
Re:Heartbleed and TOR in practice by antocv on Thursday April 17, 2014 @01:23PM (#7604939)
I dont think heartbleed was necessary to crack Silk Road server - after all its just another php server, those arent really known for being air-tight.

Especially the programmer who basically copypasted stuff from stackoverflow.

Re:Heartbleed and TOR in practice by Buge on Thursday April 17, 2014 @02:54PM (#7605567)
I saw a study showing it is possible to deanonymize a hidden service by doing traffic analysis for several months.
Re:Heartbleed and TOR in practice by mpyne on Thursday April 17, 2014 @12:45PM (#7604678)
I would be shocked if they weren't involved in outing Silk Road, in some sort of multiagency effort. It's not clear NSA couldn't de-anonymize specific TOR services if they wanted to even before we knew about Heartbleed though.
Re:Heartbleed and TOR in practice by m00dy on Thursday April 17, 2014 @12:29PM (#7604585)
i was going to say the same thing :)
Re:Heartbleed and TOR in practice by DatBear on Thursday April 17, 2014 @01:06PM (#7604827)
After all the NSA leaks and then Heartbleed, being anonymous anywhere really seems like a pipe dream to me.
Re:Heartbleed and TOR in practice by dmix on Thursday April 17, 2014 @01:22PM (#7604934)
Large-scale traffic analysis (dragnet surveillance) + hacking into exit nodes already made compromising TOR users technically feasible before the heartbleed exploit.

The whole cypherpunk/online anonymity movement which spawned TOR was largely predicated on nation states acting legally. But when they can secretly hack into every router, fiber cable, and gateway endpoint without any question of legality then anonymity and privacy online is no longer an option for anyone, even the most technically-proficient.