i2p general thread - general thread about the i2p network

[Fresh Meat]

Only internal I2P communications are end-to-end. To me it's unclear if that's a feature that is done automatically on your end with some sort of trick on your end and the recipient/sender end or if the service provider like Postman does it automatically with your messages like how Proton does it.

Good news: specification 167 for peer to peer I2P e-mail is in the works and nearing completion, thanks to zzz's work.
http://zzz.i2p/topics/3641-p2p-email-proposal [b32, archive attached]
http://git.idk.i2p/zzz/i2p.i2p/src/branch/prop167-i2cp/ [b32, clearnet]



I think this specification is supposed to be a second attempt at I2P-Bote, since that was abandoned 7 years ago. For those not in the know, I2P-Bote was a plugin for I2P that allowed direct sharing of e-mail through DHT, automatically encrypting and signing them. Someone tried reviving the project [a], and the fork got abandoned the same way shortly after.
http://git.idk.i2p/I2P_Developers/i2p.i2p-bote [b32, clearnet]
http://zzz.i2p/topics/2853-rip-bote [b32, archive attached]
https://github.com/i2p/i2p.i2p-bote

HTML archives made using SingleFile, contain no scripts.

---

As I was bemoaning the lack of a web archival service on I2P while writing this very post, I decided to actually search deeper and see if there was any real alternative for archiving eepsites, and, I found out an actual archival service appeared yesterday, under the address "archiver.i2p" [b32]

It has a lot of limitations [b32], however. Mainly the fact that there is a forceful 30 day grace period between archival of the same specific URL, and the fact that only 2000 pages can be saved per domain.

I also wasn't able to find any contact information whatsoever, no e-mail nor IRC contact.

 

[Fresh Meat]

To the 5 people watching this thread: good news
http://kiwifarmsvca77sewh5ghjkhtpcp32qvmucdszujxmqnbgb5wlfa.b32.i2p/
It is official

 

[Jotch]

It took a few years but he finally gave it a shot

 

[geckogoy]

How do you look at the i2p version of the site btw?

I set up i2p for torrenting and it seems to work (can see and get data from i2p address peers now) but IDK about anything else

 

[Jotch]

How do you look at the i2p version of the site btw?

I set up i2p for torrenting and it seems to work (can see and get data from i2p address peers now) but IDK about anything else

Set your browser to use the proxy of "http://127.0.0.1:4444" for any address matching *.i2p
But I've not been able to get ahold of the eepsite

 

[Dreamland]

I went to this ip2 website, but I saw a video of a man scraping dead flesh and gangrene off his diabetic foot.
How will this help me protect my privacy?

 

[Georgia Lucas]

I2P2-D2

 

[Westaboocal]

To the 5 people watching this thread:

Count me in, make that six.

I'm skepitical of using i2p, however. The userbase is much smaller than Tor so this makes it much easier for feds to swamp and saturate the pool for correlation analysis. Both Tor and i2p aren't PQ-safe nor PFS. A good amount of traffic is definitely being collected right now for HNDL. Feds will prioritize getting decrypting higher value target's ciphertext but they'll get to us eventually. At least we're another step towards more censorship resistance by having an eepsite. How good do you think i2p is right now?

 

[Fresh Meat]

The userbase is much smaller than Tor so this makes it much easier for feds to swamp and saturate the pool for correlation analysis. [...] How good do you think i2p is right now?

It has its purposes, and at the moment it is a better alternative to Tor in terms of network freedom and flexibility, along with having a more focused purpose, that is, not just be a proxy for the clear-net, but be very effective in anonymizing internal eepsite (I2P user <-> I2P user) traffic. The choices one can make in configuring the router and the amount of tunnels, the amount of bandwidth to share, is good, and is a more open and accessible network one can more easily contribute in, and can hide themselves better in also.

Yes, it is still extremely susceptible to sybil attacks. It is as susceptible to sybil attacks as literally any other privatized or anonymous network project, unfortunately. A good approach was Lokinet [a], but the project is currently stale [1, 2], and its administration seemed a little cloudy. The most recent one on I2P being the Kimwolf botnet operator attempting to use it as a way to hide its C2 server, then realizing what the consequence of 700 thousand IoT devices connecting all at the same time does to the network. Nobody yet has found a real solution to the issue.

The main issue, yes, is popularity and engagement: it is nowhere near as big and lively as Tor, but some (me included) see it as an advantage, since, with the fragile domain registering infrastructure [reg.i2p, stats.i2p], registering new custom .i2p domains might become even more of a hassle, with spammers and exploiters. I2P is good as a tight knit community, and it will remain to be good at that for the foreseeable future. It would be nice, even still, for it to harden for more intense traffic situations, say, Tor is exposed to have 87% of its nodes ran by the same organization / government, a good chunk of refugees would jump ship to I2P.

Here's some more reading material on I2P and some of its advantages and disadvantages: I2P vs Tor, I2P's Threat Model

Both Tor and i2p aren't PQ-safe nor PFS. A good amount of traffic is definitely being collected right now for HNDL.

This is almost a thing of the past in regards to I2P, as the default Java client has enabled support and encourages building tunnels using PQ encryption, and there is stable progress in getting all of the transport methods fully under PQ. [1, a | 2, a] I2P also does have perfect forward secrecy [1, a | 2. a], so does Tor [a]. Tor, however, does not have yet PQ encryption yet. There's been proposals [1, a], but not much else that I've been able to find.

Spoiler: off topic

get off the computer bro lol

 

[Westaboocal]

I'm nowhere near your level in this field Thank you tons for your replies. You took on "archive everything" as a middle name. Thank you for putting all those links inline. It is very accessible. I am sorry that you had to do BB Code and all that. Thank you for taking the time to format all that. I will sperg about my hatred for Xen Foro UX philosophy in Technical Grievences later. I will sperg on how I want magical crypto right now.

I2P, as the default Java client has enabled support and encourages building tunnels using PQ encryption, and there is stable progress in getting all of the transport methods fully under PQ. [1, a | 2, a] I2P also does have perfect forward secrecy [1, a | 2. a], so does Tor [a]. Tor, however, does not have yet PQ encryption

If the goal is to be HNDL-immune, it doesn't actually matter if we switch to PQC now if the new math gets cracked in 20 years anyway. I want to fucking feel safe. I hate that there is never a measurement of how much time math buys. We won't know until there is CRQC. Unless we have something that stays secure for a full human lifespan, we're just pushing the deadline back a few decades. It doesn't feel safe enough for me. If the underlying algorithm is broken, PFS doesn't really save us because the session keys just get derived from the recorded handshake.

The main issue, yes, is popularity and engagement: it is nowhere near as big and lively as Tor, but some (me included) see it as an advantage, since, with the fragile domain registering infrastructure [reg.i2p, stats.i2p], registering new custom .i2p domains might become even more of a hassle, with spammers and exploiters. I2P is good as a tight knit community, and it will remain to be good at that for the foreseeable future. It would be nice, even still, for it to harden for more intense traffic situations, say, Tor is exposed to have 87% of its nodes ran by the same organization / government, a good chunk of refugees would jump ship to I2P.

I get that a smaller pool makes it harder for spammers. It's less of an incentive if we think of targeting the mass low hanging fruit. However, there is a proportion of high value fruit. The same "inconvenience" that filters out the bots also filters out the real prospective users. If the barrier to entry is too high or the network is too small, you end up with a smaller anonymity set, which just makes it easier for a nation-state actor to swamp the pool and do correlation analysis and all that shit in the same genre. Tor Project is very beginner-friendly which is a reason of safety in numbers. Everyone who joins makes it safer. We leech from the same nodes, however. I think the cons outweight the pros when it comes to millions of users vs tens of thousands.

Every fucking privacy tool now feels like a globohomo psyop. At the end of the day, tech is just a layer. But this is a very important layer that allows me to truthfully communicate my take. I would never say the same things in real life. Nor would I ever discuss what we're talking about. I love anonymity. I would not be on KF if it hadn't been for anonymity. Me knowing that crypto will crack in a matter of time still has a chilling effect on me. I want to know for sure when I can expect the fedbois to certainly know who I am. I don't like not knowing. Should I even be on KF at this point?

I see that you took a look at my profile to see my sperging. I leave my profile visibility on intentionally because I don't think it will pose much of a roadblock for fedbois who scrape the public site but poses a barrier to real users. What exactly do you mean in the screenshot that makes you think I really need to get off the computer?

 

[Fresh Meat]

Unless we have something that stays secure for a full human lifespan, we're just pushing the deadline back a few decades. It doesn't feel safe enough for me. If the underlying algorithm is broken, PFS doesn't really save us because the session keys just get derived from the recorded handshake.

Yeah, well, that's the boat we're in right now. The most bulletproof thing I can think of at the moment would be using SimpleX Chat or reticulum-meshchat and setting up one-time pads (or JS8call with an antenna, as the post documents) with your communication buddy. Nobody's getting in that! Data fragmentation through relays (and padding) is also another method that makes HNDL much harder to do, as implemented inside the aforementioned SimpleX Chat.

Every fucking privacy tool now feels like a globohomo psyop. At the end of the day, tech is just a layer. But this is a very important layer that allows me to truthfully communicate my take. I would never say the same things in real life. Nor would I ever discuss what we're talking about. I love anonymity. I would not be on KF if it hadn't been for anonymity. Me knowing that crypto will crack in a matter of time still has a chilling effect on me. I want to know for sure when I can expect the fedbois to certainly know who I am. I don't like not knowing. Should I even be on KF at this point?

You're entering a level of schizoidism I haven't quite reached yet, sorry. If you want to feel safe, flee to Russia, squat in an abandoned shack next to a Kebab place where they have free Wi-Fi, get a DPI-bypassing proxy protocol and hope for the best. This is the best we get right now, and that's that. No much more one can do at the moment.

I see that you took a look at my profile to see my sperging. I leave my profile visibility on intentionally because I don't think it will pose much of a roadblock for fedbois who scrape the public site but poses a barrier to real users. What exactly do you mean in the screenshot that makes you think I really need to get off the computer?

it's not that serious bro you don't have to repeat things to yourself in the mirror in order to participate in a public forum. no hard feelings

 

[Westaboocal]

Data fragmentation through relays (and padding) is also another method that makes HNDL much harder to do

Thank you for your time in replying. The whole point of HNDL is to record everything right now because it will be valuble when there is a breakthrough. Fragging doesn't help. All it does is buy a few years at most. I2P can't sustain me as the only gateway to the digital world. I would still need Tor. Thank you for your honest suggestions on apps to implement.

You're entering a level of schizoidism I haven't quite reached yet, sorry. If you want to feel safe, flee to Russia, squat in an abandoned shack next to a Kebab place where they have free Wi-Fi, get a DPI-bypassing proxy protocol and hope for the best. This is the best we get right now, and that's that. No much more one can do at the moment.

I honestly don't feel schizo about this topic at all. I don't think it's paranoia because it's real anticipation. I am not joking about this the slightest bit. I am laughing at myself a little. I have a fucked-up life that I do not share in person at all. I hide it. I appear normie. That is what I want. I do not have what you normally call a normal social life. I appear professional. I do not get close to anyone. I wish I trusted someone enough. I don't know if I'll ever hear the voice of a femanon when I get home. I want a family. I know I'm doing the meme.

Kebab place as in a muzzie place? Why? I'm thinking of Remove Kebab. Correct me if I'm wrong. I must be making a false connection. DPI-bypassing and PTs is a lie.

I want to know when exactly I should expect the feds to know who I am but I know we can't know until it happens. Why are you comfortable with knowing that crypto is only delaying an inevitable globohomo knowing you? All politicans want dumb populations because it's easier to not get questioned and get voted on naturally than shill shekels. Knowing that an extremely bad president gets in office one day, why would you want them to have information about your political views that is outside the Overton window?

it's not that serious bro you don't have to repeat things to yourself in the mirror in order to participate in a public forum. no hard feelings

I was half joking and mad at the internet in that post you viewed.

 

[Canine Stereo]

HNDL is a concept that I'll hear mentioned, but often without the context as to how such an operation is implemented. If there are any resources that illustrate how such infrastructure is implemented into the internet, that would help in developing the conversation.

As to the breadth of information that is hoarded, I am skeptical of its size—it would be infeasible to capture every bit of information traveling through the internet. Storing all of that information long-term would require an unprecedented amount of storage and compute. Theoretically, if the US were doing this, allocating the budget and construction towards collecting any and all information would be infeasible; yes, the economy is currently funding billions in compute at this very moment, but this is towards the industry of leasing processing towards AI and infrastructure services, not merely to hoard data passing through the internet.

Rather, the likely strategy employed by the US and other countries is collecting metadata and targeted interests. They don't need to know what information is being sent—the totality of social media content is readily available and redundant to collection; rather, knowing who sent or received what kind of content from where—the metadata of content—is all that's important in profiling and mapping the internet. That being said, certain interests would take priority, and the total hoarding of data concerning specific targets, such as high-profile organizations, likely occurs even now.

Encryption has always been a matter of increasing sophistication. In the event that current PQC is eventually cracked, tougher encryption would likely be developed. While the fear that everyone is doxed through the decryption of every network connection they have made is not unfounded, such feelings would no doubt be held by much larger organizations, who in anticipating the total breach of their security would enact policies towards guaranteeing that the government can't just harvest every bit of their information. It's possible in the future that the manner and procedures through which the world operates may have already shifted beyond direct network intervention.

Remember that before HTTPS, all HTTP traffic was unencrypted, and yet the behavior of everyone on the internet was not immediately broadcasted and leaked. To believe that the totality of everyone's prior habits will be publicly relayed and held against them is to gamble on the total competency of the powers that be; that being said, this is the KiwiFarms, and we deal in documenting the lives of lolcows—but such characters are of specific interest and lacking in any restraint. Awareness in one's OPSEC and its continuous improvement is tantimount to maintaining an online presence—speculative outcomes towards a global privacy death disregards the breadth of societal checks and balances as well as organization pushback to complete obediance.