Assuming TOR is compromised, what is to stop someone buying a vps (with fake/disposable credit card etc) hiding the main server behind this vps (with haproxy or stunnel)?
FBI come along and image the vps, but it wont be the main server, connection details could be stored in RAM and if server taken down to image no configs would be left.
Thoughts? obviously buying vps/servers in own name is dumb opsec.
That way even if TOR is compromised you lose just a frontend point.
Don't think that'd add anything. The people investigating you would presumably look at your network traffic and see all of the non-anonymized TLS packets traveling between your VPS and the real server. And they shouldn't need to bring the VPS down to get an image of its disk (or its RAM).
Of course tho' I doubt it be enough for evidence in court especially if everything is bought with fake aliases.
And the saving memory contents (could hold config files on tmpfs for example) seems to be a difficult process, from wikipedia
"Holding unpowered RAM below −60 °C helps preserve residual data by an order of magnitude, improving the chances of successful recovery. However, it can be impractical to do this during a field examination."
It would be interesting to get perspective from any forensic experts.
The key imho is to put as many hoops in attackers path.
It doesn't need to be like that. You can have a frontend server with a public .onion domain that just pulls everything from a different remote and private .onion domain.
Yes, the latency will suck.
FBI come along and image the vps, but it wont be the main server, connection details could be stored in RAM and if server taken down to image no configs would be left.
Thoughts? obviously buying vps/servers in own name is dumb opsec. That way even if TOR is compromised you lose just a frontend point.