Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor Wars: The Signal Awakens

techcrunch.com

Post reply on HN
Print view View original

21–30 of 43 posts

Re: Tor Wars: The Signal Awakens

#21

Post by rodgerd »

hackuser wrote: post #20

I don't agree with this statement from the article: This, and Tor’s history of US government sponsorship, has led to series of really embarrassing conspiracy theories from the likes of PandoDaily. This is why non-technical journalists should not write about technical subjects. If you’re going to suggest that open-source software has dark ulterior vulnerabilities, you need to point at exactly where they are in the cod…

> it's not possible to review it all much less to catch subtle exploits that might have been introduced by security agencies - we can't even catch many unintentional exploits

Precisely. In the wake of Shellshock and Heartbleed the sneering tone of the passage you've cited should profoundly embarrass the author. It does not accord well with the facts.

Re: Tor Wars: The Signal Awakens

#22

Post by Karunamon »

hackuser wrote: post #20

I don't agree with this statement from the article: This, and Tor’s history of US government sponsorship, has led to series of really embarrassing conspiracy theories from the likes of PandoDaily. This is why non-technical journalists should not write about technical subjects. If you’re going to suggest that open-source software has dark ulterior vulnerabilities, you need to point at exactly where they are in the cod…

There's a difference between being aware and a conspiracy theorist - and claiming backdoors exist in a given piece of software without the slightest shred of proof is the latter.

Re: Tor Wars: The Signal Awakens

#23

Post by dandelion_lover »

hackuser wrote: post #20

I don't agree with this statement from the article: This, and Tor’s history of US government sponsorship, has led to series of really embarrassing conspiracy theories from the likes of PandoDaily. This is why non-technical journalists should not write about technical subjects. If you’re going to suggest that open-source software has dark ulterior vulnerabilities, you need to point at exactly where they are in the cod…

>How many HN readers, a sophisticated population, have reviewed Tor's code?

"Who actually reads the code?" https://www.fsf.org/blogs/community/who-actually-reads-the-c...

Re: Tor Wars: The Signal Awakens

#24

Post by Sir_Cmpwn »

mark_l_watson wrote: post #2

An important point the article makes is how important it is for a large number of people to use Tor, even if only occasionally. I try to use Tor at least once or twice a week for general web browsing. I also donated money to them. It is really important for people to also support groups like the EFF and ACLU financially: a good investment in future freedom. History shows that large empires tend to get tough on their…

I configure things that I don't need to be fast to run over Tor. IRC and email are examples.

Re: Tor Wars: The Signal Awakens

#25

Post by api »

hackuser wrote: post #20

I don't agree with this statement from the article: This, and Tor’s history of US government sponsorship, has led to series of really embarrassing conspiracy theories from the likes of PandoDaily. This is why non-technical journalists should not write about technical subjects. If you’re going to suggest that open-source software has dark ulterior vulnerabilities, you need to point at exactly where they are in the cod…

It's also not possible to catch all systematic design flaws. It's possible for someone who is deeply knowledgable in an area like crypto to deliberately introduce strategic design weaknesses into a system that might seem like reasonable choices to anyone who doesn't understand the exact context.

I have always been suspicious of Tor's choice of long-lived circuits over packet-level onion routing. It seems like each packet should follow a different path. It would also be easier in a packet-based scheme to implement some level of noise / decoy traffic generation to make statistical analysis of traffic more difficult. It seems like a design choice that would make statistical inference easier by someone who has a God's-eye view of traffic. Large powerful nation states absolutely have this, while smaller ones may not, making it an ideal asymmetric vulnerability.

But that's just one example. A true deliberately-introduced weakness might be something far more subtile than this: a choice of order of operations or timing for example.

Re: Tor Wars: The Signal Awakens

#26

Post by ikeboy »

hackuser wrote: post #20

I don't agree with this statement from the article: This, and Tor’s history of US government sponsorship, has led to series of really embarrassing conspiracy theories from the likes of PandoDaily. This is why non-technical journalists should not write about technical subjects. If you’re going to suggest that open-source software has dark ulterior vulnerabilities, you need to point at exactly where they are in the cod…

Friendly reminder that SELinux was developed by the NSA, and is now part of Linux. So clearly the open source community doesn't care too much about who created a piece of code.

Case study 2: bitcoin.

Re: Tor Wars: The Signal Awakens

#27

Post by ikeboy »

tete wrote: post #3
mark_l_watson wrote: post #2

An important point the article makes is how important it is for a large number of people to use Tor, even if only occasionally. I try to use Tor at least once or twice a week for general web browsing. I also donated money to them. It is really important for people to also support groups like the EFF and ACLU financially: a good investment in future freedom. History shows that large empires tend to get tough on their…

I actually switched to using Tor whenever I go on wild hunts about stuff that I find interesting. Basically that means whenever I visit Wikipedia, because I can waste hours there, going over the weirdest topics. Usually I get drawn in by stuff like history and end up on things like Soviet Union, Nazi Germany, Japan in WW2, etc. or stuff like Ku Klux Klan, the "Islamic State". If there is some surveillance system it w…

You can download a copy of Wikipedia articles from https://dumps.wikimedia.org/. It's surprisingly small, around 15GB for all articles, and 50GB or so uncompressed.

Then just browse offline, and nobody can tell what articles you looked at.

Re: Tor Wars: The Signal Awakens

#28

Post by moxie »

rodgerd wrote: post #21
hackuser wrote: post #20

I don't agree with this statement from the article: This, and Tor’s history of US government sponsorship, has led to series of really embarrassing conspiracy theories from the likes of PandoDaily. This is why non-technical journalists should not write about technical subjects. If you’re going to suggest that open-source software has dark ulterior vulnerabilities, you need to point at exactly where they are in the cod…

> it's not possible to review it all much less to catch subtle exploits that might have been introduced by security agencies - we can't even catch many unintentional exploits Precisely. In the wake of Shellshock and Heartbleed the sneering tone of the passage you've cited should profoundly embarrass the author. It does not accord well with the facts.

People tend to cite heartbleed as an example of how "open source" has no intrinsic security value. While I agree that something being "open source" does not automatically make it secure, I think that it does allow us to gauge the security of the project.

In the case of heartbleed, anyone who has ever spent more than 30 seconds looking at OpenSSL can tell you that it is not secure software and never will be. We can't identify and remedy every possible vulnerability, but we do have enough information to know that events like heartbleed will happen again and again.

Re: Tor Wars: The Signal Awakens

#29

Post by hellofunk »

noondip wrote: post #9
fredsted wrote: post #6

Earlier quoted context omitted.

The problem with these VPNs is that they can log your traffic. Even if they say they don't, what's to stop them?

Moreover, VPNs are juicy targets for surveillance corps since so many do use them to conduct illegal or questionable activities. My personal strategy is to use Tor with a private obfuscating bridge rotated frequently between hosting providers.

Do you mean you use Tor with VPN together?

Re: Tor Wars: The Signal Awakens

#30

Post by noondip »

hellofunk wrote: post #29
noondip wrote: post #9

Earlier quoted context omitted.

Moreover, VPNs are juicy targets for surveillance corps since so many do use them to conduct illegal or questionable activities. My personal strategy is to use Tor with a private obfuscating bridge rotated frequently between hosting providers.

Do you mean you use Tor with VPN together?

Not quite, I'm referring to https://www.torproject.org/docs/pluggable-transports.html

My favorites are obfs4 and StegoTorus, running on a private machine in some "cloud".

Post reply on HN