I've been playing around a lot with i2p and there is a good chance my platform will become i2p only. The reason is simple: You can route i2p over Tor. Whonix has an easy solution for routing i2p over Tor and you can even set up a dedicated Qubes VM template for it. While Tor allows you to access both the clearnet and the darknet, the i2p network is self—contained. I have long taken an issue with the Tor Browser not having an option to block any and all clearnet requests. This has been exploited by the glowies before by taking over a darknet site and adding a hidden clearnet image into the HTML source code. When the clearnet image url is different based on the user on the site, it's possible to track people and when combined with other strategies, it can be used to deanonymize users.
An additional issue I have with Tor is that it's never fully clear whether a node is in fact a glowie node. There are certain giveaways that increase the risk of it being glowie node, such as the node being hosted with Hetzner, Contabo, or Amazon given the massive contracts those corpos have with the glowies. However, it's not too far fetched to also assume they host nodes elsewhere, rent entire IP ranges, take over existing nodes, or use other dirty tricks to deanonymize users. Generally speaking it's advisable to block the UK, Australia, Canada, United States, France, and Germany at a minimum for the entry node and preferably also for the exit node.
There was a case of ricochet using an older version Tor and that in combination with some routes going entirely through Germany allowed the German glowies to request data directly from the ISPs. This is something that not many people think about. To quote a different post I had made on fedi:
- Tor is traceable. Contrary to what some may believe about Tor being anonymous and untraceable, it isn't. I'm not just talking about malicious nodes, but also about all the other parties involved in hosting Tor nodes. This includes the web host, the data center, and the ISP. All of them have access to the network and both the host and data center have physical access to the server itself. All of them have the capability of logging network activity. It gets even worse when all three hops route through the same country. Germany has deanonymized users before by requesting data from the ISPs and cutting the node operators out of the equation entirely. There is also far more cooperation between nations now than there used to be. Maybe you'll wanna throw a North Korean server in there somewhere and pay a little fee to little rocket man to preserve your anonymity. Seriously, it would be a great business model. The Taliban really ought to look into building some data centers as well.
Full post: http://social.kikurievy2gz765eyexqbgcdgv4t34md4wjk3aadnwoofjitbkgk3xqd.onion/post/019f78fd-289d-b3af-5928-fe2fcc91fa84
Both Tor and Monero aren't as anonymous as people like to think — even if you use them properly following standard practices. I for one even take issue with the cash by mail option that people are so fond of recommending. You are still leaving traces behind by sending cash by mail, some countries even fine you for sending undeclared cash, and others verify ID. It depends on your jurisdiction, so YMMV. Nonetheless, there are risks. Given how Monero is treated by governments, there is also a chance the Monero seller will be investigated for one reason or another. For example, they could have obtained Monero from illicit sales. Technically, they should get rid of any and all evidence of those transactions, but they don't always do, because people get lazy and complacent. My point is risks are present regardless of the purchase. Mining is sometimes mentioned as an alternative and while I agree it is a decent way of obtaining coins anonymously, it is incredibly resource and time intensive for very small amounts. It's just not a viable method in most cases.
The best way to approach the anonymity problem is by limiting the entry or exit of funds from one ecosystem to another, which means earning money within the same environment you're spending it in. In a way Tor works the same way by using trusted entry nodes while applying broader configurations to relay and exit nodes. There are different Tor node providers within our little space and adjacent ones, which can be used for that purpose. Unfortunately, Tor nodes are still largely hosted in data centers, which have their own form of traffic monitoring software. So while the node operator might be safe and doing things right, they rarely have physical hardware access. The glowies on the other hand can just acquire some legal papers and install trackers to the physical hardware. There is no conceivable way of possible defending against a physical attack, if the node operator only rents a server without ever inspecting it physically.
So what's the solution? This is where i2p swoops in. While Tor gives you some level of anonymity and protection, i2p mitigates some of the above risks through its P2P nature. The community is smaller as is the adoption, but the protocol itself is a solid addition to our overall toolbelt. Similar to Tor, it's not invulnerable, but it can be effective when used in conjunction with other methods. The primary issue with i2p is how difficult it is for the average user to set up and configure. There are some projects that attempt to make things easier by combining the i2p daemon with a browser, but these projects are far from ideal and iirc the browser was based on icecat. Setting up a daemon, understanding the ports and protocols, managing address books, and reconfiguring the Tor Browser specifically for i2p is a challenge for your average user including Tor users.
There is another element to i2p that I've been exploring for my own platform: i2p torrents. One major issue with the darknet is sharing larger files. It takes a long time and there is a chance the connection will simply be interrupted and you wasted a ton of time. i2p torrents are a viable alternative for this purpose and that is what I've been experimenting with by implementing a private torrenting system directly into Kikuri's upcoming community platform. It won't be released right at the beginning, but it is something I'm in the process of setting up. It's a major technical challenge, but I believe this is one of the only viable solutions we have to share larger files on the darknet.
Ever since I founded Kikuri, I've also been of the belief that we must create our own network and in a way we're moving further and further into that direction. In a way, it's inevitable. The clearnet is riddled with telemetry and analytics, you have AI generated slop hosted by virtually every single page listed on the results page of almost any search engine, big tech has a total monopoly in too many aspects, the expectation of privacy is met with chronic disappointment, and the normienet has turned into a totally idiocratic abomination ever since the mass migration to the internet in 2016. There is no possible hope for us to have a presence on the clearnet in the long term nor do we have the power to assert any influence over decisions that impact all of us. The only way forward is by creating our own web with our own tools, platforms, networks, and potentially even protocols. While i2p isn't perfect, it does serve a crucial purpose at this time — something which other tools can not provide at this time.
I do wish the broader community would see and acknowledge the existence of this exodus rather than continue creating more JS slop hosted by Amazon or Vercel. All of this does take far more effort due to its sheer and overwhelming complexity, but I do believe this is the right direction for us. Unfortunately, many technical resources are being wasted on SlopWare projects and reinventing the wheel over and over again (how many more wallets and note taking apps could we possibly need?). Imagine the progress we could make by allocating resources more effectively to things that actually have an impact.
