Comment by jxcole | Hacker News Reader

Comment by jxcole | Hacker News Reader

Parent Full thread

Man in the middle attacks may not work as well as you think. While it is possible to create false information using this darknet mechanism, it is possible using things like PGP to ensure that you are getting data from the same node. Of course, you have to figure out how to set it up right from the beginning; if someone messes with you before you know what their key is supposed to be, they can feed you false information.

You might be able to overcome this by using a many-to-many authentication mechanism. But realistically, what could the government hope to accomplish by feeding you false information? (this is the only thing they are likely able to do). Consider:

There is no way to back track traffic and discover who sent the request.

Once you realize a source is feeding false information, you know to never trust that source again.

It is easy to imagine a decentralized rating system for the quality of information provided by various keys on the network. Keep in mind you can't really fake who you are. You are your public key, no one else can publish under your public key but you.

EDIT: I highly recommend reading the freent paper: http://freenetproject.org/papers/ddisrs.pdf

> There is no way to back track traffic and discover who sent the request.

If you control a vast majority of the nodes, this is simply incorrect.

Sort of. The only way to tell if a person made a request is if you control all the nodes that this person is connected to. If you do not control even one node that a person is connected to, there is always the possibility that the request came from this other node, not the real node. This is because the difference between making a request for something on your behalf and making the request on someone else's behalf looks exactly the same as far as another node is concerned.

This is how freenet works. Of course, in freenet there is a time to live associated with each request so it will die eventually if, for example, the searched for item is not present on the network at that time. You could figure out that it's from a particular node by seeing what the time to live is from that node, but small amounts of random variance in time to live values can effectively ensure that both requests don't live forever and that it is suitably difficult to determine the origin of the requesting node.

Now, it is certainly possible with enough concerted effort to find out what a user is doing with some statistical probability that a user is looking at something, but you can rarely be absolutely sure.

I think 100% certainty that a node is the originator of a request is not necessary for most purposes. If you are thinking of a court case, then maybe, but only if there is no corroborative evidence.

And in other situations where people might want to use a darknet (e.g. a repressive regime) a few false positives aren't going to bother anyone concerned.

All the government needs to know is what information is being requested, and who is requesting it.

Reply on news.ycombinator.com