More than 500,000 books have been removed from the Internet Archive's lending library due to the Hachette v. Internet Archive lawsuit, including more than 1,300 banned and challenged titles. 📚 Our patrons have shared powerful stories about how this loss has impacted them, and we need your help to make a change.

Sign our open letter to the publishers urging them to restore access to these books. 📖✍️ #LetReadersRead

👉 https://blog.archive.org/2024/06/17/let-readers-read/

Let Readers Read | Internet Archive Blogs

@internetarchive Torrenting is the only way.
@ml @internetarchive bittorrent (and all other current alternatives afaik) don't have any sort of anonymization, so ISPs can surveil torrent peers and cut off your access. it's not clear to me yet how to apply the consistent hashing used in most DHTs to tor's model yet, but tor may expose a sort of internal node ID that could be similarly used to achieve consistent hashing? @torproject has there been work to anonymize DHTs via tor or other alternatives?

@hipsterelectron Tor actually has a FAQ asking people to not use Tor for bittorrent because it stresses the network

IPFS has done some work in this space, we're not sure how far along that aspect is

@ireneista their website says ipfs is not private and to use something else if you want privacy i was checking it out yesterday

@hipsterelectron oh. drat.

I2p is an overlay network that does support bittorrent, although that falls significantly short of true anonymization, for reasons you can probably already see

@ireneista tor's anonymity via noise addition is less interesting to me anyway; VPNs can be used to interface but i recall hearing that some VPNs don't like being used for seedboxes. the level of privacy sufficient to mask participation in a particular swarm to an ISP seems less stringent than tor's guarantees and the consistent hashing needed for a DHT seems like something that could be achieved with any other identifier, but masking identity to all other participants in the swarm seems necessary as well and may be more difficult than i'm hoping :(
@hipsterelectron yeah - well the stickiest part we see is that using an identifier for the DHT means that it is, um, an identifier. "identity" only means being able to say "these two things are, in some sense, the same". you can make it a resettable pseudonym but anything done under that pseudonym will still be possible for other participants to correlate
@ireneista yeah! can't figure out a way to cheat on that part yet. can imagine spreading out packets over other peers/etc, but since the point of p2p is p2p, it seems hard to support allowing arbitrary new nodes to join without giving them arbitrary visibility into the identifiers of other participants in the same swarm (since they need that info in order to participate). doesn't seem unsolvable yet though for some reason
@hipsterelectron notice that at the low level, bittorrent uses a notion of peer reputation to disincentivize bad behavior. this is the usual tradeoff between long-lived and short-lived identities that we see in other areas.
@hipsterelectron we'd suggest that a proper solution is something along the lines of trying to clearly bound the scope or duration of these identities, and then avoid leaks that allow users or their machines to be re-identified across that boundary.
@hipsterelectron we do note that ie. "the set of stuff I am seeding" is a very important piece of information that is highly identifying
@ireneista @hipsterelectron Every torrent would at minimum need a key of its own.

Certainly no mix of various torrents behind one given identity.

@ireneista @hipsterelectron

and even if you change the pseudonym regularly, if you advertise the same set of dht entries your pseudonyms can also be correlated with each other.

@tryst @hipsterelectron yes, that's what we were alluding to in the next toot
@tryst @hipsterelectron oh sorry not the next one, but further down the replies
@ireneista @hipsterelectron ah, yeah. that’s what i get for writing a thing and waiting 90 minutes before posting it :)
@tryst @hipsterelectron oh no problem! thanks for joining the convo, regardless :)
@ireneista looking at i2p now, thanks for mentioning
@hipsterelectron @ireneista veilid's probably a better option for the backbone of a private file sharing system tbh
@beka_valentine @hipsterelectron can you say more about why?

@ireneista @hipsterelectron designed to support onion routing internally for all messages, and in testing it seems to be quite fast in doing so

biggest problem right now is lack of deployment

@beka_valentine @hipsterelectron isn't that true of I2P as well?
@ireneista @hipsterelectron i2p may or may not do onion routing, i dunno, but i2p is just a vpn-like infra, afaik. it doesnt have a bunch of the other important stuff required to make a file sharing system work. plus iinm i2p is also asymmetric in that the client is tunneled but the server is visible. so its like only the onion routing portion of TOR, absent the hidden sites, which veilid has built in
@beka_valentine @hipsterelectron @ireneista The developer documentation for Veilid also seems fairly poor.

I'm not sure it supports a given program using multiple IDs at once (while I2P does), which is important to mitigate fingerprinting of shared collections of data.

@lispi314 @ireneista @hipsterelectron @beka_valentine you could write a veilid node that uses multiple ids at once (or at least i didn’t find anything that prevented that when i was looking into it).

but veilid’s layering makes it significantly harder to disassociate sequential identities of the same node by what data they host - they have a DHT built in right along with the routing protocol.

i’m doubtful that multiple ids will actually save you though. i haven’t examined it in detail yet, but my intuition is that even if each person uses 100 ids you’ll be able to track people sharing say 1000 pieces of data randomly divided amongst the ids. (much less any sort of division optimized to improve queries like the fraction nearest by edit distance).

i’m vaguely hopeful about a friend network over an privately routed network. if you all rotate node identifiers such that you only send messages to an identifier of generation n from an identifier of generation n, there may be a chance of cleanly separating identifiers from each other (from anyone who’s not your friend that is). then you just have the problem of how much you trust your friends and finding content in a friend network…

@tryst @beka_valentine @hipsterelectron @ireneista I was thinking more a different ID per piece of data.

For the I2P case more on the level of "every torrent has its own ephemeral ID".

I'm not quite sure if Veilid's block-based structuring of data sharing should be the level of granularity for ID separation, because after a few thousand blocks, the overhead probably becomes considerable. So maybe ID separation at a higher level similarly to torrents (they do have reference blocks) would work.

> i’m vaguely hopeful about a friend network over an privately routed network. if you all rotate node identifiers such that you only send messages to an identifier of generation n from an identifier of generation n, there may be a chance of cleanly separating identifiers from each other (from anyone who’s not your friend that is). then you just have the problem of how much you trust your friends and finding content in a friend network…

My concern with friend-to-friend networks is that their security tends to fail catastrophically the second someone gets compromised and an infiltrator is substituted onto the network.

It's somewhat similar to the failure mode of Hyphanet/Freenet's with the trackability of particular file transfers with known/leaked/guessed metadata.
@lispi314 @hipsterelectron @tryst @beka_valentine these are all good thoughts, fwiw. we agree about that risk being significant, but really any of these schemes needs to be sketched out in more detail to figure out what it actually accomplishes. we definitely encourage playing around with all this

@lispi314 @ireneista @hipsterelectron @beka_valentine yeah, once you get to each top-level item on a node gets its own overlay network identifier that certainly prevents correlating content. i’m hesitant that giving each node that many identifiers wouldn’t lead to being able to correlate address on the same node though. (and any answer to means digging deep into the protocol and its assumptions :/)

My concern with friend-to-friend networks is that their security tends to fail catastrophically the second someone gets compromised and an infiltrator is substituted onto the network.

so this broadly falls under “how much you trust your friends”, but i’m not clear that your friend being compromised is much worse in a friend net situation than a not friend net situation (assuming communication over an overlay network and not directly like freenet/hyphanet). the most informative data flows from friend to friend anyway. the link to decrypt and verify data is far more sensitive than the ciphertext.

unfortunately (for anyone hoping for this to have a reasonable UI) i think we probably need both for different circumstances :/

@tryst @beka_valentine @hipsterelectron @ireneista
> (and any answer to means digging deep into the protocol and its assumptions :/)

Yeah, project for a later time.

> so this broadly falls under “how much you trust your friends”, but i’m not clear that your friend being compromised is much worse in a friend net situation than a not friend net situation (assuming communication over an overlay network and not directly like freenet/hyphanet). the most informative data flows from friend to friend anyway. the link to decrypt and verify data is far more sensitive than the ciphertext.

I mostly expect my friends not to be able to outgun or meaningfully resist their government's enforcers.

I didn't mean to imply voluntary compromise.

Building a pseudonymous friend-to-friend network atop an overlay network that takes the basic stance "every node and observer can be adversarial" does help. Though f2f interactions may also lead to the incidental accumulation of other deanonymizing information.
@hipsterelectron @ireneista Getting a VPS anonymously in a jurisdiction that you DGAF about to run your torrents and logging into it over Tor seems like the safest option that's currently practical.
@dalias @ireneista @hipsterelectron Anonymous payment to those has kept getting more complicated.

It also puts a hard limit on participation for those that can't justify the overhead of anonymous payments.
@Qbitzerre @dalias @ireneista For anonymous payment?

Zcash (which practically no one takes nor uses, so even just acquiring it will be a flag), Monero (I'm doubtful its security won't be compromised in the long term, I don't think anything is backed by proofs) or GNU Taler (which last I checked no one supports, but it otherwise also benefits from sound mathematical background like Zcash's zk-snark and doesn't have any of the cryptocurrency environment concerns).

So in practical terms you're basically left with money in a security enveloppe or Monero.

Privately acquiring Monero is itself a shitshow, and the best option at this point is peer-to-peer exchanges and a few intermediate transfers thereafter for obfuscation (which is subject to Monero's eventual failure, of course).

You certainly could say the situation is disappointing.
@lispi314 @ireneista @Qbitzerre Visa gift card purchased with cash?
@dalias @lispi314 @Qbitzerre if you take drug-dealer-level precautions around acquiring it, sure, but that's difficult for a reason
@ireneista @lispi314 @Qbitzerre I really don't think pigs are going to go hunting for old grocery store surveillance footage or whatever over a vps halfway around the world that's torrenting. Am I wrong about this?
@dalias @lispi314 @Qbitzerre over torrents? you're probably right, but it's not anonymous, and there are automated, centralized systems that process that footage these days
@ireneista @Qbitzerre @dalias Automation sure has made mass surveillance more convenient.
@dalias @Qbitzerre @ireneista > Visa gift card purchased with cash?
The particular card numbers tend to be registered to which places they were sold at.

That can give a fairly good idea of operational area.

> if you take drug-dealer-level precautions around acquiring it, sure, but that's difficult for a reason

> I really don't think pigs are going to go hunting for old grocery store surveillance footage or whatever over a vps halfway around the world that's torrenting. Am I wrong about this?

Depending on what you share? Yes. Things that inconvenience feds will absolutely result in that kind of effort, if traffic analysis didn't already screw one over (which it probably did).

As for copyright fascists... most of them haven't /yet/ bothered to do that sort of thing because the low hanging fruit of torrenting in the clear is still a thing. But everything they'd need to start earnest doxing efforts is readily commercially available.

I vaguely recall a few hacktivists getting screwed over in a similar way (point of sale had cameras & they used a currency with no functional obfuscation) as well.
@lispi314 @ireneista @dalias yeah I've held zcash from the beginning and I even used to mine it. But you're right, it hasn't caught on. I was looking for recommendations for VPS services.
@Qbitzerre @dalias @ireneista > I was looking for recommendations for VPS services.

Ah, I don't really have recommendations for those.

I don't really trust them to /not/ at a minimum scan the memory and storage of hosts (though they usually don't alter things), so the main use I see for them is as reverse-proxy endpoints for services running on my own hardware.

At which point nothing really matters beyond them being cheap and having relatively reliable networking.

Note that the aforementioned setup is /not/ for stuff intended to remain private/anonymous. It's mostly relevant if you have to deal with CGNAT nonsense and want to self-host.
@lispi314 @ireneista @Qbitzerre In the context of torrenting you don't have to trust the host. You can verify the file hashes yourself after you get them. It's really just outsourcing risk and bandwidth and temp storage.
@dalias @Qbitzerre @ireneista Right, yes, my statement was a bit more general uses than specifically applicable to torrenting.

@lispi314 @ireneista @dalias @Qbitzerre re: Monero you're speaking from absolute ignorance. Monero's underlying technologies are all established, proven crypto primitives. Monero stealth addresses are built on Diffie-Hellman key exchange, no one is breaking those. Monero RingCT has been peer reviewed in a number of journals.

https://eprint.iacr.org/2015/1098
https://eprint.iacr.org/2023/321

To say its security lacks formal proofs is simply false, although you could accurately make that assertion about Zcash.

Ring Signature Confidential Transactions for Monero

This article introduces a method of hiding transaction amounts in the strongly decentralized anonymous cryptocurrency Monero. Similar to Bitcoin, Monero is a cryptocurrency which is distributed through a proof of work ``mining'' process. The original Monero protocol was based on CryptoNote, which uses ring signatures and one-time keys to hide the destination and origin of transactions. Recently the technique of using a commitment scheme to hide the amount of a transaction has been discussed and implemented by Bitcoin Core Developer Gregory Maxwell. In this article, a new type of ring signature, A Multi-layered Linkable Spontaneous Anonymous Group signature is described which allows for hidden amounts, origins and destinations of transactions with reasonable efficiency and verifiable, trustless coin generation. The author would like to note that early drafts of this were publicized in the Monero Community and on the bitcoin research irc channel. Blockchain hashed drafts are available in \cite{Snoe}.

IACR Cryptology ePrint Archive

@hyc @lispi314 @dalias @Qbitzerre so like, full disclosure here, we have never looked into Monero in particular

but we did sit through a whole talk at PEPR 2023 from someone whose consulting firm specializes in building know-your-customer compliance features for cryptocurrency exchanges

@hyc @lispi314 @dalias @Qbitzerre there is an entire parallel set of metadata about cryptocurrency purchases, not stored on the blockchain, for the purpose of complying with KYC laws.
@hyc @lispi314 @dalias @Qbitzerre any KYC-compliant entity has to not only collect this data when people exchange fiat currency for cryptocurrency, but give it to downstream entities when it's spent
@hyc @lispi314 @dalias @Qbitzerre since we haven't messed with any of this in quite some years, we have no idea what the current state of play is in terms of where this stuff applies and where it doesn't
@hyc @lispi314 @dalias @Qbitzerre and perhaps Monero itself has some specific properties that other cryptocurrencies don't, which make this all irrelevant; we're not in a position to say
@hyc @lispi314 @dalias @Qbitzerre anyway, we're not here to criticize that in particular, but we do think it's important to always be aware that a mere technology will succeed in doing an end-run around the law forever.
@hyc @lispi314 @dalias @Qbitzerre the answer to whatever social goals we might have around non-surveillance of finance needs to have a policy dimension, or it will fail

@ireneista @lispi314 @dalias @Qbitzerre in most cases I agree with this point. But re: Monero, govts themselves have sealed their own fates. By pushing to ban Monero from the regulated centralized crypto exchanges, they've encouraged the community to develop decentralized exchanges, thus losing any chance at maintaining insight or control on its usage. The IRS tried and failed to break Monero's privacy https://www.reddit.com/r/Monero/comments/z9j62d/the_irs_bounty_the_full_story/

Now all they can do is pretend it doesn't exist.

@hyc @lispi314 @dalias @Qbitzerre oh that's quite interesting, we didn't realize
@ireneista @Qbitzerre @dalias @hyc Selling the end of financial censorship and mass surveillance is going to be pretty difficult considering it's rooted in other oppression dynamics that are the real motivation for any of it.

@ireneista @lispi314 @dalias @Qbitzerre all of that is true, but you don't need to obtain Monero from KYC-compliant vendors, nor do businesses that accept Monero payments need to obtain such info.

You can mine Monero yourself on an old smartphone or PC.

@hyc @Qbitzerre @dalias @ireneista > Monero stealth addresses are built on Diffie-Hellman key exchange, no one is breaking those.

Yet (to public knowledge). Though my expectation of breakage is for it to come down to some nonobvious implementation issue of some sort, rather than a fundamental cryptographic security problem (which admittedly is also a problem with all the other options I mentioned).

> https://eprint.iacr.org/2015/1098
> https://eprint.iacr.org/2023/321

> To say its security lacks formal proofs is simply false, although you could accurately make that assertion about Zcash.

I do have to revise some of my statement, I had to refresh my memory on a few things. Both monero's security and zero-knowledge proofs' security rely on computational hardness, which I find rather less reassuring that something based on mathematical truths (since certain changes to computer technology could drastically reduce the effective security provided).

So do consider my prior confidence in the latter withdrawn to a similar degree.
Ring Signature Confidential Transactions for Monero

This article introduces a method of hiding transaction amounts in the strongly decentralized anonymous cryptocurrency Monero. Similar to Bitcoin, Monero is a cryptocurrency which is distributed through a proof of work ``mining'' process. The original Monero protocol was based on CryptoNote, which uses ring signatures and one-time keys to hide the destination and origin of transactions. Recently the technique of using a commitment scheme to hide the amount of a transaction has been discussed and implemented by Bitcoin Core Developer Gregory Maxwell. In this article, a new type of ring signature, A Multi-layered Linkable Spontaneous Anonymous Group signature is described which allows for hidden amounts, origins and destinations of transactions with reasonable efficiency and verifiable, trustless coin generation. The author would like to note that early drafts of this were publicized in the Monero Community and on the bitcoin research irc channel. Blockchain hashed drafts are available in \cite{Snoe}.

IACR Cryptology ePrint Archive

@hyc @lispi314 @ireneista with the understanding that i don’t expect cryptographically relevant quantum computers any time soon - do you have any references to the implications for ringct and monero of that possibility?

all i’ve got at the moment is kearney & perez-delgado 2021, which seems to be more concerned with stealing than tracing money.

@tryst @ireneista @lispi314 in a post-quantum world the underlying ed25519 signature scheme would have to be replaced with something else. Lattice-based mechs get tossed around a lot but frankly nobody can really know until we get there. It's assumed that a quantum computer could break the current mechanisms, but when such a day arrives, many other more widely used systems will break and need more urgent attention - e.g. TLS, all banks and other businesses, etc.
@tryst @ireneista @lispi314 it's been researched before. Monero's proof of work algorithm RandomX (which I co-designed) is known to be quantum proof. https://www.reddit.com/r/Monero/comments/kcl547/ama_research_team_analyzing_the_implications_of/