wiki something or other said:
Honey Pot : In computer terminology, a honeypot is a trap set to detect, deflect, or, in some manner, counteract attempts at unauthorized use of information systems. Generally, a honeypot consists of a computer, data, or a network site that appears to be part of a network, but is actually isolated and monitored, and which seems to contain information or a resource of value to attackers. This is similar to the police baiting a criminal and then conducting undercover surveillance.
I have read this and read this and thought about it and thought about it and I can't make the connection. Can somebody chime in and help me understand this honetpot setup by LE?
Would it matter if it was a honey pot? If you are following all of your security protocols, I don't see why it would matter.
For instance, if you and your vendor used PGP only for communication (which you should anyways), then what would it matter if you communicated in a site monitored or created by the government? You would use a stand alone, Live Distro like Tails from a public location that has free wifi and is crowded with a laptop you bought for cash.....
As long as the vendor wasn't LE, then it wouldn't matter who was operating the site, they wouldn't have your information.
Let's say they track the Bitcoins in the blockchain......so you use Bitfog first. Then move things around a bit and before you know it, tracking those bitcoins from other bitcoins will be statistically impossible.
So the catch is a good vendor - that is what throws a monkey wrench in this whole thing. If LE set this up, then a good vendor using proper safety procedures could remain anonymous and keep thier customers safe - all at the expense of the government. If that got out, wouldn't thier be a public outcry? Is empowering the hacker drug dealers to catch the not so computer literate ones even worth it? Maybe it is, maybe it isn't. But keep the fact that regardless, if this is LE or not, they can't be every vendor and they wouldn't be able to control sales from vendors that used secure methods. They would only know what the description of what is being sold is as it was displayed.
Furthermore, it is not Tor that is unsafe. It is the people that use it. Tor by design is very safe when used properly and purely.
DDos attacks are used to help show the geographic location of a hidden service. This only shows how secure Tor is, not the other way around. This is the way it works. They setup hundreds or thousands of "zombie" machines to constantly send packets to that hidden service via the .onion address. Then they start analyzing network traffic in large portions to see where the large portions of traffic actually stop. The USA government has access and even own Tor exit relays giving them the ability to statistically analyze connections in aggregate to postulate where Ddos attacks are ending on the IP layer rather through Tor. Tor runs on the internet so if you can't figure out where a service is, the try to drown it and then look for the tiny hole in the internet that shows where the little bit of data is actually trickling. So, the funny part about Silk road and all the traffic is, BY DESIGN the more traffic, the easier it is to tell the actualy location of a service.
So why does Silk Road run? If it is busy enough to be located and has enough media coverage to be a target, then how is it running?
The story told is that the servers images reside in a country(ies) that do not coorperate with the USA or NSA for any reason. I believe that is easily possible and a much better failover plan. Some careful planning with proxy servers, some encrypted tunnels and very secure ftp setups could easily allows an image of Silk Road to stay backed up in multiple locations and giving rise to many failovers in a short amount of time. This would keep SR up and running regardless of what happened. It is a good idea and would require a lot of effort at the architectual level to defeat. They would have to know how it was designed, you know and I just don't see how that would happen unless they had an insider.
I digress and I'm back to where I started.
Who gives a fuck if it is a honey pot if you trust the vendor? Used correctly the government would be empowering security conscious criminals.....am I missing something?