They can do this without keeping any meaningful information quite easily: They sign a client certificate with an expiry date at time of purchase using their CA private key (that the court obviously can't force them to give up, HSM etcetera).
Into the client certificate's DN or extended field they write the allocated public IP.
The only information they need to store is that that IP is spoken for and not to be allocated again. They could also work this out on the fly.
When the client comes to connect, they note that the certificate is signed and presented, and they route the public IP to the in-tunnel address of the peer, which they will have standardized to something meaningless like 10.0.0.2
As long as they don't log anywhere in the process, the signing of certificates means you don't have to remember the client at all.
The certificate approach has the advantage of the server storing nothing at all, but a standard username+password could accomplish something similar. It's not a big deal if the result of the query is a username and password. The central question is what type of records they kept for the payment.
Username and password doesn’t inherently have an HMAC+timestamp, so it has to be kept alongside payments. A certificate could be a one-time transaction, so the payment could be logged while the certificate is issued, the only worry after is if timestamps are present in the transaction method and timestamps are present (obviously) in the certificate, then correlation is still possible. Perhaps a workaround would be to take orders at any time but process orders in batches, where payment for all customers and certificate issuance for all customers happen at the same time/date. Or decouple certificate issuance from payment such that payment can occur any time and what is provided is a certificate that was previously generated/allocated at the start of the month or year. The downside to the preallocation is that the certificate private key would also have to be known in advance, it weakens security, but is perhaps an acceptable trade off for privacy. If transaction proof is possible, perhaps again with an hmac secret, you could provide proof of transaction at the start of the next month to keep the certificate issuance secure by presenting and issuing key material at a later date from when the transaction occurred. Actually, an hmac probably isn’t tamper-resistant enough given its value, unless you include a timestamp and correlate to transaction dates, or use a really long secret, or both and rotate the secret, perhaps. So you’d exchange payment for tokens, and tokens for certificates, decoupling the two. If your tokens are trusted, you could sell multi-year certificates or multiple tokens at the same time at the cost of reduced privacy if different features or timestamps are present in the tokens or transaction cost.
> Username and password doesn’t inherently have an HMAC+timestamp, so it has to be kept alongside payments.
I don't follow your logic here. A userdb record could simply consist of user+pass, service level, static public IP, and an expiration date - essentially the same information that a certificate would carry.
The existence of a user record is certainly more legible to the legal system, and might help support a court order to actively surveil that "user's" activity. But from a technical perspective of what information can be gleaned here, they're the same.
Your method is probably the best you can do. I think the security firm claims, that while the tunnel is up, there is a connection - actual TCP connection, or UDP stream - that associates the client IP to the socket in the VPN infrastructure. If you could intercept that data and track it inside their infra, you could discover what IP PirateBay has on their backend.
> “Although [OVPN] strive to store as little data as possible, there must be data connecting users and identities to make the VPN service work. In this case, a user has paid for a VPN account with the ability to connect a public static address to OVPN which the user has then chosen to link to the file sharing site ‘the piratebay’, i.e the user has configured his VPN account to point to the given domain.”
The article doesn't seem to go into why a VPN service _must_ have data connecting users and identities. AFAIK, Mullvad allows you to be completely anonymous with your purchase, granted they throw away the IP who made the purchase, which doesn't seem impossible to do. Simply store no data about the transactions and you have no data about it. Not sure I see the reason there has to be data about it.
I think the article covers that. They are hosting a website at a static IP, so a mapping of public IP -> secret IP must be stored somewhere. They are hoping that knowing this secret IP will let them find their true hosting provider.
> They are hosting a website at a static IP, so a mapping of public IP -> secret IP must be stored somewhere.
Not necessarily. The stored mapping could also be public IP -> username, plus a separate mapping username -> password or username -> key; with a mapping public IP -> TCP connection or public IP -> UDP connection existing only in memory and only while the connection is active. And from what I understood from the article, and from an earlier article linked to by the first link in this article, the connection has last been active in June.
Not entirely sure what I'm talking about now, but couldn't you in theory implement this in Intel SGX and therefore be unable to read it unless from code running inside the enclave itself?
Depends on the implementation. Not sure exactly how OVPN works, but with Mullvad it works by top-up the account, so no need to keep track of CC <> Account number. When the account runs out, the VPN simply stops working until you refill.
My personal reasons: been using Mullvad for a couple of years. Team and company based in Sweden, country known for it's strong privacy laws (FRA non-with-standing). One of the first VPN companies to launch Wireguard support with tons of their edge servers supporting it. Anonymous payments and finally super easy to use, even for non technical users.
> AFAIK, Mullvad allows you to be completely anonymous with your purchase
I paid for Mullvad with Paypal and they used my Paypal email as the login email! Strange that they done that. Never assume a Paypal email is the one a user will use for the login. I like to compartment my emails for different things, so one dedicated to Paypal, another specifically for Mullvad etc
Login email? There is no such thing in Mullvad. All you have is a Account Number, and there should be no identifiers beyond that. Where do you even find any inputs to enter your email?
Sorry I meant they sent some link to login at the email I use for Paypal. They probably have some new system. I done that about 2 years ago to try them out
Correct, the Pirate Bay simply hosts magnet links, which contain cryptographic hashes for the torrent contents and where to bootstrap the transfer from.
That’s what’s so crazy, TPB doesn’t host or distribute any content. All they do is serve you a “magnet link” which means when you put “Titanic” in the search box they give you a string that uniquely identifies one specific copy of the movie. You then paste it into other peer-to-peer software.
No, TPB doesn't do that. Normally you would have a .torrent file which is a small file containing metadata (name, files in torrent) and a list of trackers which are servers that keep track of the peers. You acquire a .torrent, open it with a torrent client, and it connects to the trackers to get a list of peers and start p2p sharing. Peers can also directly exchange more peer information when connected.
Instead of a .torrent file you can instead use a magnet link which is a magnet://... that contains the same information. TBP hosts a lot of magnet links. Basically like if you made a webpage with a list of a bunch of hyperlinks to websites like google.com, and allowed people to submit more hyperlinks. You're not distributing the google.com page content, just links to the location of the information. Except instead of links that tell you where to find http webpages it's links that tell you where to find a torrent.
The Pirate Bay is still relevant for me; I’ve even setup my own proxy to avoid ISP blocks. It’s not stale - new stuff is added within a day or two of release.
Edit: Just want to reiterate. This is an actual official tor onion mirror. TPB has had problems with an assortment of proxies over the years doing nefarious things, such as while hosting a copy of TPB, the malicious proxy would inject JS/start crypto-mining in your browsers background. The link I included is from TPB official site and doesn't have said issues.
For me, TPB became irrelevant once high-speed broadband and cheap multi-terabyte storage became available. Today (and really for the past decade) there is no reason not to torrent full-size Blu-ray images or remuxes, but TPB never abandoned an overall culture of sharing only small-size and usually low-resolution transcodes.
True, I don't have any traffic numbers but based on some content lacking on TPB and present on other sites, I'd say the current king is somewhere else.
It appears like actual court orders to force registrars to take down domains are hard to come by in Canada (where the registrar is incorperated), and their registrar famously refuses to take down domains just because someone writes a sternly worded letter asking for it [1]
Plenty of countries block or blocked the domain at ISP level.
Furthermore, DNS isn't necessary. From the inception of computer networking, it has only ever been a usability and discovery aid, that has arguably introduced more centralized control mechanisms than anyone intended.
If you think TPB is hard to legally pin down now, I can't wait to see the come-to-Jesus moment when authorities (in the U.S. in particular) have to come to terms with "the Pirate Bay" being nothing more than a nominative signpost passed between users, and the entity merely existing as a set of services popping up for a while on one IP address or another, with news of transfers spread by word of mouth, and someone has the chutzpah to challenge enforcement on free speech grounds.
This is why this Pirate Bay crusade is a losing gambit. Everyone isn't going to start using the abusive service providers in town just because you shut down one tunnel or branch of the local speakeasy.
Squash one, another pops up, because information wants to be free. You've already got private trackers that are very particular about the people they support, and actively forbid easy onboarding in order to keep the edifice from being trivially subverted by adversaries.
The natural state of human beings is change from the now to the ideal. Content creation companies are guilty of demanding the overly ambitious carve outs that lead to things like TPB existing at all. Get things more reasonable, and work on being better at making content on demand quickly accessible and cross-referenceable and you have a service that people will generally pay for either straight up, or by other means such as time and awareness. Clamp down on information dissemination, and watch as the castle sinks as the sand that would otherwise buoy it up screw off elsewhere where artificially barriers to getting things done aren't erected.
I'm not sure what you mean, that is where they started. The full story is as follows: Their DNS registrar stores the following A records for `thepiratebay.org`:
;; ANSWER SECTION:
thepiratebay.org. 300 IN A 162.159.136.6
thepiratebay.org. 300 IN A 162.159.137.6
Those IPs are owned by Cloudflare. The Rights Alliance then asked Cloudflare what IP address those IPs redirect cache-misses to. Cloudflare then gave them an IP address that belongs to a Swedish ISP. In turn, that ISP pointed to the VPN provider `OVPN.se` as the user of that IP address.
This article then updates on a lawsuit between the Rights Alliance and the VPN provider, since they're refusing to give out the VPN user of that IP address (because they can't).
These IP addresses are also routed through so-called premium PoPs of Cloudflare. I get never routed through IST when connecting to websites on Free plan. Seeing that Cloudflare accepts card payments and PayPal only, why the adversary is not focusing on the payment method that made the purchase?
The DNS records in this case are hosted on Cloudflare servers, so presumably for free.
If looking at the domain registrar instead, we find the registrar `easyDNS.com`. Their payment options aren't public, so I can't say for sure. I can however say that there is no requirement for domains to be paid through an identifiable mean.
Take for example the registrar `njal.la`, a service founded by Peter Sunde, that accepts payment in various crypto-currency.
Contrary to popular belief, not everyone is on board with systems aiming to create identifiers that map 1:1 with people. That's a very politically driven philosophy generally intended to enforce a means of auditability or control.
The thing that makes it seemingly inevitable to give up identifying information as part of financial transactions is the nature of Credit/Payment processing/Anti-Money Laundering regulations enforcing a KYC (Know-Your-Customer) component to being a legally operating financial transaction processor.
Do note, this audit trail creation is a big portion of the push to obviate and disincentivise cash transactions. The thinking goes, if you can only use the financial system by identifying your endpoints, there should be a clear audit trail if anything hinky is going on. Unfortunately, the much less well publicized corollary to that is that suddenly payment processors become an effective population scale control mechanism.
This should hopefully cause discomfort on further reflection, but to each their own.
IIRC, they have had their DNS entry cancelled before and at one point was briefly registered in North Korea. Not sure this is the best course of action especially since it can be abused for other purposes once a system is in place for making it possible.
TPB used to host db dumps at https://thepiratebay.org/static/dump/ which would be useful in case it was ever taken down but it seems that they removed them.
This illustrates just how hard it is to stay anonymous while conducting commerce. Ie. the pirate bay has been de-anonymized across several political jurisdictions and is one VPN bug or compromise away from being exposed and being shutdown again.
And is interesting to contrast to how seemingly easy it is for the wealthy (people and corporations) to Legally hide their wealth to minimize their taxes.
> is one VPN bug or compromise away from being exposed
You assume they use one vpn, after the sort of attack they suffered in the past? That's naïve.
TPB, by now, is likely a marvel of security engineering. They've definitely put too much trust in legal systems in the past, but I bet they won't make that mistake again.
Let’s be honest, The Pirate Bay exists and is primarily used to illegally download porn, movies, video games, and other software. You can try to sugar coat what PB can theoretically be used for, but that’s not what it is actually used for. A fraction of a fraction of the data transactions that originate from the PB are for “conducting commerce”. I have no idea what that has to do with people legally following tax codes in multiple jurisdictions for their own financial gain... that just seems smart.
Edit, to add: given what the PB is generally used for, people should not be surprised that content creators are hiring people to try to disrupt its existence.
I have Netflix, Youtube TV, Tivo with OTA, Amazon Prime, Apple TV (from new iphone). I have no problem acquiring new subscriptions.
I still grab stuff off TPB just because it's easier, faster, and more convenient. I cannot stand this cluster-f of gimped interfaces (eg. youtube on pretty much any device), dangling boxes, remote controls, and hdmi switches.
I don't have time for all that crap. TPB downloads appear right at the top of the list of my primary device.
I don't mind paying. But we have to admit television is a mess right now and tpb fixes that mess.
edit: obvious caveat I'm sure many people on tpb are pirate
I 100% agree and am in the same boat - I have many subscriptions and still use TPB at least weekly. I’m just not surprised when I hear that big corps are actively trying to dismantle TPB, nor do I think they are doing anything untoward in actively trying to protect their IP and profit from their media. I wish they would put that money and energy into making their products better and more accessible even when I am trying to pay for them, but that’s just my view. I try to give my money away to watch a number of Euro soccer leagues and nobody will take it. So I pirate all those streams.
Bah. The powers that be are abusing their influence over the legislative to completely pervert the original intent of the copyright system. I have not problem whatsoever with TPB existing and applaud its continued presence on the web.
I guess with "Content creators" you mean the multinational corporations that bind the artists, rob them of their creations and strip them of their ability to ever be able to make money from their art?
Remember, it's only external, artificial entities who say something is illegal for you. And often they do not have your best interest at heart. Therefore, live life the way you want to as long as it doesn't infringe on the rights of others.
A true libertarian society would be Heaven on Earth.
It's an odd time to tackle PB for these issues, however. The convenience of streaming services is well worth the cost to most people. Credential sharing is likely a much bigger issue for these markets.
People use torrents to download porn? Actually? Why? Why would someone spend the time to torrent porn when there's a bajillion instantaneous free ways of seeing porn?
Anti-Piracy wont save any industry which falls for revenue into the panem and circensis category. Your products price-points are capped by a political consesus to keep the population peacefull.
Into the client certificate's DN or extended field they write the allocated public IP.
The only information they need to store is that that IP is spoken for and not to be allocated again. They could also work this out on the fly.
When the client comes to connect, they note that the certificate is signed and presented, and they route the public IP to the in-tunnel address of the peer, which they will have standardized to something meaningless like 10.0.0.2
As long as they don't log anywhere in the process, the signing of certificates means you don't have to remember the client at all.