31–40 of 48 posts
I'm waiting for someone to build an implementation of Tor in a proof-verifiable language. That would be pretty cool, since anyone could prove source correctness automatically.
I'm waiting for someone to build an implementation of Tor in a proof-verifiable language. That would be pretty cool, since anyone could prove source correctness automatically.
Tor has failed its users because the idea of running a public Tor cloud with volunteer entry, onion, and exit nodes is ludicrous. It means that the entire network is under surveillance all the time, the exact opposite of what you want. There has been widespread confirmation that the data you transfer via the public Tor cloud is being passively surveilled at the endpoints and actively modified when you, for example, download software. This makes it incredibly dangerous to use, likely more dangerous than just using the regular internet.
There are many other problems (like the fact that .onion sites are a dirty hack and likely have many undiscovered weaknesses like the ones CMU found) but nearly all of them are either deployment or architectural issues, not code security issues.
Earlier quoted context omitted.
NSA is schizophrenic in that regard. Remember that one of the things it does besides looking in everyone's underwear drawers is it also advises US govt (3 letter agencies, military) on what crypto to use. In other words it tells Uncle Sam how to lock his underwear drawers so other agencies don't peek in there. It is always interesting to see what they say there. Because if they know, for example, one type of crypto t…
NSA themselves have used Dual_EC_DRBG (which can be distinguished from a PRF even if you don't have the 'backdoor key': it's not just backdoored and slow, it's bad - and they know that). GCHQ behaves even worse and is at this point almost entirely out of control. In either case, I feel information assurance and signals intelligence arms really should never have been the same agency: they are roles entirely at odds wi…
I'm waiting for someone to build an implementation of Tor in a proof-verifiable language. That would be pretty cool, since anyone could prove source correctness automatically.
For example, side channel attacks. A classic attack on computerized cryptography. I don't know of any proof language that can protect against side channel attacks.
If you look online there are a few lists of tor attacks. The attacks include: snooping on exit relays, application issues, traffic correlation, website fingerprinting, congestion attacks, blocking tor access (declining to extend). Most of these are issues in the design of the tor system, not something I think source code proof systems are capable of preventing.
It's two months after the FBI debacle and people still don't know the difference between CMU and CERT.
CMU[http://www.cmu.edu/] SEI[http://www.sei.cmu.edu/] CERT Division
[CERT logo] [SEI logo] [CMU Logo]
The first words on www.sei.cmu.edu are
CMU SEI CERT Division
[SEI logo] [CMU Logo]
CMU is clearly endorsing the actions of CERT.
Earlier quoted context omitted.
Yes, but if they're under some Kafkaesque gag order there not much they can do right?
I still find it hard to ever trust an institution that wouldn't raise a huge stink about the ethical implications of this. They don't exist to serve "national security interests", that's what the NSA is for.
Yes they do. From their website:
"The Software Engineering Institute (SEI) is a not-for-profit Federally Funded Research and Development Center (FFRDC) at Carnegie Mellon University, specifically established by the U.S. Department of Defense (DoD) to focus on software and cybersecurity."
It's two months after the FBI debacle and people still don't know the difference between CMU and CERT.
I'm waiting for someone to build an implementation of Tor in a proof-verifiable language. That would be pretty cool, since anyone could prove source correctness automatically.
>... a few weeks earlier had canceled a security conference presentation on a low-cost way to deanonymize Tor users. The Tor officials went on to warn that an intelligence agency from a global adversary also might have been able to capitalize on the vulnerability. This is kind of worrying. I hope the Tor Project has information on the attack is looking into ways to mitigate this. But if it's due to the protocol natur…
> Tokyo University has this pledge to make sure basically no military research is done on campus, which I feel to be pretty laudable. So, you move it off-campus. See e.g. the MIT Lincoln Lab, https://www.ll.mit.edu/
1.) Custom Firefox 'Browser Bundles' which do not auto-update and ensure latent vulnerabilities are left un-addressed
2.) Trusted 'Third Parties' running exit nodes who we hope and pray are doing their job correctly
3.) Weird and non-innocuous looking domains on the wire that do nothing more than alert the neighborhood that somebody's using TOR (Unless everyone's using it you stand out like a sore thumb)
4.) Sybil attacks in the form of people-with-more-money-than-you polluting the network
5.) ???
6.) Any number of other issues (which have since been patched in the past), but still work if the TOR user is uneducated about how TOR works (traffic analysis / correlation attacks / zero-knowledge-proof attacks, etc)