So - how to do it correctly? The onion server should not be able to access the internet directly and should never know it's own IP-address. So putting it inside a virtual machine/container and redirecting outgoing traffic through Tor (on another VM) should fix that.
As for the backend servers - if all machines are connected through OpenVPN with TLS-Auth they can use private IP space and are not accessible from outside. The OpenVPN tunnels are configured outside of the onion VM and Tor VM and the backend machines are also in a VM that pipes all outgoing traffic (except OpenVPN traffic) to the internet through Tor.
This setup should at least omit the problem of leaking public IP addresses on compromise or did I overlook something? Let's ignore VM outbreak exploits (ksplice/unattenend-upgrades should help here if it's not the NSA).
With TLS-Auth and a default DROP firewall rule all machines should not even appear in scans on the internet. So any outside contact to any machines is only possible if you know the OpenVPN TLS-Key + Certificates. An intruder would only see local IP addresses even if he manages to compromise a backend server. All created outgoing traffic to find the machines would be routed through Tor.
As the Tor onion VM is separate from the webserver only a Tor remote exploit or a VM outbreak exploit would be critical. Maybe encryption can help here.
Another point is using dedicated hardware with Full Disk Encryption and just enter the passphrase via the provider console. There are cold boot attacks but VPS servers allow to dump a memory image while running - that's not so easy with dedicated hardware.
If I were doing this, I would not use a VM for it. Running on bare metal has a significantly smaller (by several orders of magnitude) risk profile and is much simpler to do right. I'd have three boxes: webserver, Tor server, external exposure box. The webserver would connect solely to the Tor server, and would expose absolutely nothing other than HTTP. The Tor server would run the hidden service pieces and would expose nothing to either side, but would connect to the webserver and tunnel things accordingly, and would send its Tor connections through the external box. The external box would have a simple forwarder to tunnel connections to the Tor server.
There are always going to be bugs, but this would very strongly isolate each of the risky components. Feeling even more paranoid? Put a strong network filter in place between each of the components to make sure that only the specific subset of TCP that's actually in use makes it through; that'll prevent network stack-level issues.
> The onion server should not be able to access the internet directly and should never know it's own IP-address.
I may be overly pedantic here but it should be "public IP address" as there is no TCP/IP without an IP address. The address may be in the private ranges, though.
Say you have your own hardware, what would you need to access the display and keyboard securely remotely over the network? Are there such devices available? I imagine you can have the OS disable its display and keyboard input after boot for added security, and lock down the boot process, but it still seems like it's hard to do this securely. I'm trying to think of a scenario where you can have:
1) Full Disk Encryption
2) Two physical machines owned by you, perhaps stored in some basement
3) Be able to boot them back on without physical access (perhaps this is simply a Bad Idea?)
4) One machine with two NICs running Tor, exposing only Tor to one of the NICs
5) The other machine running a VM host with 1 VM for each of your services. The host is connected to the NIC of the first machine, thus only has access to the internet through Tor
The computers run a small client program in the initial RAM disk environment which will communicate with a server over a network. All network communication is encrypted using TLS. The clients are identified by the server using an OpenPGP key; each client has one unique to it. The server sends the clients an encrypted password. The encrypted password is decrypted by the clients using the same OpenPGP key, and the password is then used to unlock the root file system, whereupon the computers can continue booting normally.
Dropbear (SSH access) still requires you to manually log in and unlock the disks; a primary feature of Mandos is that it can boot completely unattended (unless configured otherwise).
Mandos can be configured to be not automatic by setting the “approved_by_default” option for a client to “False” in the clients.conf file; See mandos-clients.conf(5): (http://www.recompile.se/mandos/man/mandos-clients.conf.5).
You also need to adjust the “approval_delay” setting.
It’s just the CAcert certificate which doesn’t exist in Chrome. Either ignore it or install the CAcert root certificate from http://www.cacert.org/?id=3
> Frankly it is also immoral. This guy was selling drugs without caring about the consequences on people's lives, medical and otherwise and was organizing assassinations.
Frankly, the War on Drugs is immoral. The science doesn't back it up[1]. It's done without caring about the consequences on peoples' lives, medical and otherwise.
> This is not the FBI enforcing the letter of some stupid law
Debatable! The drug laws are 'stupid', if you take into account science and economics[2].
> and was organizing assassinations.
This is unlikely to have happened under a system of legal drugs. I've never heard of Walmart -- where legal products are sold -- putting out hits on people.
The drugs laws are broken. They create perverse incentives.
> This is unlikely to have happened under a system of legal drugs. I've never heard of Walmart -- where legal products are sold -- putting out hits on people.
Selling diamonds is not illegal but I've heard allegations of hits being put out there.
The drug laws are bad. But a la A Man for All Seasons, we should give the devil the benefit of law; what silk road does would cut a path through every law in the country.
I always thought that the statement "give the devil the benefit of law" meant that we should be especially careful to follow the law to the letter, __even__ when dealing with people that we think Deserve To Be Punished (because they're bad! They're evil!), because doing otherwise is a slippery slope towards treating other people with less than the utmost care for following the rules.
Regardless of how you feel about drugs, he also hosted (and profited from) markets for identity theft tools, hacking tools, and he tried to have his enemies assassinated.
Only sociopaths and libertarians are holding him up as some bastion of morality.
People are becoming increasingly interested in the case because it's looking probable that enforcement/prosecution has done something untoward.
Everybody has an interest in law enforcement operating under the rules that supposed to constrain its behavior.
If the prosecution can straight up lie to the court about how evidence is gathered with impunity, then at the very least it may be an effective strategy to raise the cost of effective defense.
More scarily, it may be used to cover up useful lines of defense.
In every case, you should imagine an innocent man accused, and consider whether the tactics used against him are designed to demonstrate the truth, to cast artifacts in a false light, or to raise the odds of conviction regardless of the truth.
We should never convict on the strength of the information that someone has been charged.
I haven't heard anything regarding his alleged hit since he was originally arrested. It's also not one of the formal charges brought against him, which is odd because it's significantly more damning than running a marketplace for drugs.
Identify theft and hacking tools are both pretty (a|im)moral, though.
"This is unlikely to have happened under a system of legal drugs. I've never heard of Walmart -- where legal products are sold -- putting out hits on people."
Take a look into the dirty underside of the distribution (of legal goods) industry and you will find intimidation and violence used.
Thr prohibition of drugs and organized crime are highly linked. Look at alchohol as an example. For all intents and purposes the war on drugs is a war against poor minoritites. All research has shown that it is not only innefectvie, but detrimental to families and communities.
You didn't respond to what your parent post said. You just opened up some canned rhetoric and dumped it onto the page.
Are you in agreement that it's ok for people to commit drug-related murders just because the War on Drugs is "bad m'kay?" Or should people be held accountable for their actions? Just because there are incentives to become a drug lord due to immoral laws doesn't mean that it's all of the sudden moral to become a drug lord. You seem to want to use your "War on Drugs is bad" opinion as an excuse for the choices that people make.
I can't down vote this for some reason but it should be. Asking someone if they believe murder is ok with righteous indignation is absurd.
The comment pointed out that crime in general around drugs - up to and including murder - is much more prevalent because of the War On Drugs.
There is no moral absolutism in this world, and the government can absolutely enact laws and policies that lead to increased crime rates. Of course the perpetrator of a murder should be held to full account. But the circumstances that create the motive for murder in drug cases are at least partially due to government policies that have been proven to be a failure over and over again.
@jamespo said "Well that's the weakest excuse for ordering someone to be murdered I've read today"
Responding to that with some canned rhetoric around how drug-related murders would be fewer in a post War on Drugs world it's really a response to that post.
I have no righteous indignation. I'm frustrated that the conversation is going like this:
Person 1: Ordering an assassination is bad, and saying that
the War on Drugs is bad isn't an excuse for it.
Person 2: But if the War On Drugs didn't exist, then
drug-related murder wouldn't exist! Perverse
incentives!
> Of course the perpetrator of a murder should be held to full account.
This is the point that I see some of these "War no Drugs == Bad" posts dancing around. They ignore this in favour of using this story as a platform to preach their views.
We can likely all agree murder is almost always bad, and murder over drugs is categorically bad.
So when someone asks for an acknowledgment that murder is bad from another person, it's almost ad hominem, or so it seems to me.
So the debate is whether or not government policies create incentives or motive for crime. There are several documented reasons [1] that good people do bad things, and creating an environment for that isn't helping anyone.
It's not to say that the murderer is less to blame, but culpability isn't something that reduces criminal responsibility.
This argument seems to be whether Ulbricht was acting immorally though, not if the "War on Drugs" should vanish. I think it's quite clear that Ulbricht deserves prosecution considering how he put hits on 2 people without hesitation, and even believed that the 2 hits were carried out successfully still without hesitation.
I am not in agreement that its ok to commit murder because the war on drugs is bad. Those people should be held accountable for their actions to the full extent of the law.
I do believe that there are steps policy makers could take to remove the amount of people who find themselves incentivized to commit violent crimes.
I agree that the war on drugs, though misguided, should not shoulder the blame for the actions of violent offenders, but two wrongs don't make a right.
Is calling for changes to draconian and detrimental policies and condemning those individuals who commit violent crimes mutually exclusive?
Imagine if the government started paying people to break into houses. You would obviously be mad at your neighbor if they took advantage of the new policy, and rightfully so, but you would be a lot more upset at the government for even allowing the situation to happen.
Seems like a lot of this hand-wringing is unnecessary. No one is condoning free-enterprise murder. That's just not a fair reading of any posts I have seen, so far.
legalizing drugs will not get rid of he black market. As we've see with medical mj, it's taxed heavily and more expensive than you can get from a local dealer. Many people don't want t pay this price.
We've seen similar things with cigarettes in some areas.
But I would have to assume that the majority of people wishing to partake in such drugs would prefer the legal route if it is available to them. Unless you're talking an obscene amount of difference in pricing. But then the free market should kick in because if the government wants the tax revenue the pricing will have to be adjusted.
Of course, I'm never shocked to see governments plan to spend all that nice new tax revenue that never appears due to their own policies.
Of course not, but this is the difference between prohibition era levels of black market participation and current day alcohol black market dealing. Sure, people still make moonshine, and there's a bit of traffic in things like illegal cigarettes (guy tried to sell me singles yesterday), but its far less than truckloads coming over the border to fill our demand.
> This is unlikely to have happened under a system of legal drugs. I've never heard of Walmart -- where legal products are sold -- putting out hits on people.
> The drugs laws are broken. They create perverse incentives.
So... when the laws are wrong, it's ok to murder people. It's the government's fault that you murdered people because they created perverse incentives, therefore you shouldn't go to jail for attempting to murder people?
[Edit] parent post responded to "tried to have people assassinated" with some rhetoric about perverse incentives. Sure with better incentives, it might not have happened, but the parent post comes across as giving DPR a free pass because the incentives were perverse.
That is far too nuanced a position to take here on Hacker News.
What's next, the suggestion that MongoDB has certain use-cases that make it preferable over normal SQL databases while at the same time lacking some of their guarantees?
I've got to say: this thread level had me confused until you sorta just pointed at it. Somehow an argument happened/started, but I couldn't tell from where or why (especially since one of the root comments is dead now).
The parent post comes across to you as giving DPR a free pass. IMO this says much more about you than it does about the parent post. I see no such implication myself.
I think you're ignoring the context of the parent post. The topic of the post Multics was commenting on wasn't "Is DPR a sketchy dude?" It was closer to "Supporting operations like Silk Road is inherently immoral. Look at all the bad juju around this. Surely anyone who isn't against drugs is evil, agreed?"
I think it's still an overstatement to even say that no one would be murdered over drugs if they were legal. For example, there are gangs that specialize in things like illegal movement of cigarettes between areas where the taxes/import duties are different. While not as large as it would be were cigarettes to be completely illegal, you can't say that it will go to zero.
Your thought process is simplistic. It's not ok to murder good people, but it's ok to murder bad people. DPR was trying to kill an extortionist threatening to sell out Silk Road users to the police, which would have resulted in many families being destroyed. He definitely deserved death.
It's illegal already to explain to setup a secure hidden service on the Tor network? I don't think this discussion is only relevant to criminals. There are a lot of places on this planet where this information might be useful.
I don't support the Silk Road - never used it - I don't even use Tor a lot by myself. But if someone is coming at me and tells me that this information is forbidden I'll get angry.
It's not like there is a drug problem besides Silk Road already. It's likely safe to assume that illegal drugs are consumed in near distance to your and my place right now. I don't think the Silk Road is a good place but it's likely better than your shady dealer on the schoolyard. If you ask why people use drugs than take a look at society at large.
What exactly is illegal here? I'm also not located in the US.
When you get to a point where government agencies fabricate evidence in order to incriminate people that they "know" are guilty, they are acting as judge, jury and executioner, and undermining the whole system of justice on which our democratic societies are built. And that has much graver consequences than letting a few supposed criminals slip through the net.
> undermining the whole system of justice on which our democratic societies are built
That's cute. Our Societies are built on the labor of the underclass, on lies and deception and on violent turf wars. Talk about justice.
What about gun-manuals? How about teaching people to drive? Teaching them to use a knife? Makeup classes? Wig instruction manuals? Zipping files with encryption? SSL?
The list goes on and on and on. All those things help criminals evade capture, or to commit some sort of crime. You've just drawn some arbitrary line (drivers education ok, tor setup advice bad) because you have absolutely no idea what makes one worse and the other not.
I'd love to see what laws you're breaking, as that would be at the level of "thought police". How do you know he's helping criminals, is Tor and hidden services just used by criminals in your mind?
Yes - he broke the law, but that does not mean that the FBI should get a pass for doing something shady. If we start to accept that kind of behaviour from them, I can only imagine how it will be 20-30 years from now.
Explaining how something works is not illegal in the US. Not sure why you think it is.
Most people don't feel sorry for the guy but we don't want the country to turn in to a lawless place where law enforcement doesn't have to follow the law.
Where I live it is required to be reasonably convinced that a specific person or persons exist that you are helping[1] commit a crime. If you just publish information that helps the general criminal public then the freedom of speech & information trumps the potential harm done to society.
Plus, you're usually also helping the security community. If they know the criminals can do attack X, they can protect against X (no security from obscurity).
[1] Although you don't have to know their identity.
Criminal is an opinion about a person, but a conviction is a fact. For people outside the U.S., it may help to understand that our constitution stipulates that a person is not to be considered or treated as guilty without a conviction.
As for the backend servers - if all machines are connected through OpenVPN with TLS-Auth they can use private IP space and are not accessible from outside. The OpenVPN tunnels are configured outside of the onion VM and Tor VM and the backend machines are also in a VM that pipes all outgoing traffic (except OpenVPN traffic) to the internet through Tor.
This setup should at least omit the problem of leaking public IP addresses on compromise or did I overlook something? Let's ignore VM outbreak exploits (ksplice/unattenend-upgrades should help here if it's not the NSA).
With TLS-Auth and a default DROP firewall rule all machines should not even appear in scans on the internet. So any outside contact to any machines is only possible if you know the OpenVPN TLS-Key + Certificates. An intruder would only see local IP addresses even if he manages to compromise a backend server. All created outgoing traffic to find the machines would be routed through Tor.
As the Tor onion VM is separate from the webserver only a Tor remote exploit or a VM outbreak exploit would be critical. Maybe encryption can help here.
Another point is using dedicated hardware with Full Disk Encryption and just enter the passphrase via the provider console. There are cold boot attacks but VPS servers allow to dump a memory image while running - that's not so easy with dedicated hardware.