Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Italian Anti-Corruption Authority Adopts Onion Services

blog.torproject.org

Post reply on HN
Print view View original

21–30 of 101 posts

Re: Italian Anti-Corruption Authority Adopts Onion Services

#21

Post by 3pt14159 »

newbuser wrote: post #2

Anyone able to comment on the state of Tor security and suggest an up to date OpSec guide to using Tor?

This opinion is controversial, and I’m not going to go into all of the reasons why, but unless you REALY know what you’re doing Tor can’t be trusted.

I’d wager only 1% of people on Hacker News would be capable of using a Tor setup for more than a day without getting owned.

You’re better off buying a burner iPod or iPad, stick to public wifi spots, and factory reset it once a week. Even then, watch what you type since vocabulary is fingerprintable.

It’s very hard to stay dark these days.

Re: Italian Anti-Corruption Authority Adopts Onion Services

#23

Post by jernejzen »

3pt14159 wrote: post #21
newbuser wrote: post #2

Anyone able to comment on the state of Tor security and suggest an up to date OpSec guide to using Tor?

This opinion is controversial, and I’m not going to go into all of the reasons why, but unless you REALY know what you’re doing Tor can’t be trusted. I’d wager only 1% of people on Hacker News would be capable of using a Tor setup for more than a day without getting owned. You’re better off buying a burner iPod or iPad, stick to public wifi spots, and factory reset it once a week. Even then, watch what you type since…

Pretty bold claim about !%.

Do you by any chance have any refs or links at hand explaining the topic more into depth. There are quite a lot on Tor www but covering more common use.

Re: Italian Anti-Corruption Authority Adopts Onion Services

#24

Post by asquabventured »

3pt14159 wrote: post #21
newbuser wrote: post #2

Anyone able to comment on the state of Tor security and suggest an up to date OpSec guide to using Tor?

This opinion is controversial, and I’m not going to go into all of the reasons why, but unless you REALY know what you’re doing Tor can’t be trusted. I’d wager only 1% of people on Hacker News would be capable of using a Tor setup for more than a day without getting owned. You’re better off buying a burner iPod or iPad, stick to public wifi spots, and factory reset it once a week. Even then, watch what you type since…

[Citation needed]

Re: Italian Anti-Corruption Authority Adopts Onion Services

#25

Post by kernelPan1c »

jstanley wrote: post #20
kernelPan1c wrote: post #16

Earlier quoted context omitted.

If you access an http site, a government controlled exit node could inject js and eventually gather enough info through profiling mouse movements and browsing habits to ID you. Even with https, if the feds are in cahoots with the certificate authorities, you would be just as vulnerable to this sort of injection right? However, tor hidden services is another story. I think this is where a bad actor would hit a wall.

You're probably at more risk of a criminal-controlled exit node stealing your login details than you are of a government-controlled exit node working out your physical location.

Yes, anonymity and security are separate but related issues.

Re: Italian Anti-Corruption Authority Adopts Onion Services

#26

Post by andai »

jelly wrote: post #13
singularity2001 wrote: post #5

Too bad onions was compromised by the NSA. that makes speaking up against the Bad Guys a bit more dangerous. Admittedly there is a high chance that the Italian high brass has NO finger on the American high brass, however as long as there is no certainty it's a safety risk.

Tor was /targeted/ by the NSA, but I haven't read anything that makes me believe it (or onion routing in general) has been compromised. I get the feeling tor has proven so effective that the only reasonable attack against it is sowing mistrust.

The only reasonable attack is using it carelessly. Check out How they got caught:

https://youtu.be/eQ2OZKitRwc

Re: Italian Anti-Corruption Authority Adopts Onion Services

#27

Post by 3pt14159 »

jernejzen wrote: post #23
3pt14159 wrote: post #21

Earlier quoted context omitted.

This opinion is controversial, and I’m not going to go into all of the reasons why, but unless you REALY know what you’re doing Tor can’t be trusted. I’d wager only 1% of people on Hacker News would be capable of using a Tor setup for more than a day without getting owned. You’re better off buying a burner iPod or iPad, stick to public wifi spots, and factory reset it once a week. Even then, watch what you type since…

Pretty bold claim about !%. Do you by any chance have any refs or links at hand explaining the topic more into depth. There are quite a lot on Tor www but covering more common use.

If you're good enough to understand how to use Tor securely you're good enough to know why random "newbuser"s shouldn't be on it. Tor is far more fingerprintable than people think it is and its riddled with adversaries and malware. Even if you're good you have a separate problem now: Keeping the USG et al from painting a target on you.

It isn't worth it.

You're in league with wannabe terrorists, misguided natsec journalists, blackhats, child pornographers. For what? What problem are you solving that warrants this heat?

Just use a burner iPad and wipe it frequently. If you're truly paranoid light up a DigitalOcean droplet with a pre-paid credit card and a false name and install OpenVPN on it make an image and cycle your IP. But short of being both a data scientist & cybersec expert (or an actual state actor with training from both) you aren't going to stay black from the NSA and to pretend otherwise is stupid.

Re: Italian Anti-Corruption Authority Adopts Onion Services

#28

Post by mar77i »

singularity2001 wrote: post #12
jstanley wrote: post #6

Earlier quoted context omitted.

Even if you believe the NSA have some practical attacks against Tor, are you not still better off using Tor than not using it?

What happened to my brain? I just bought the idea that the surveillance state is overall more effective in suppressing criminality.

It's simple. Hand over the monopoly on information to your surveillance state and you don't get to know when it still doesn't work.

If thinking the govt is broken is treason, you can't fix it any more, but not because it's perfect.

Re: Italian Anti-Corruption Authority Adopts Onion Services

#29

Post by rotrux »

chii wrote: post #18
rotrux wrote: post #14

It's been unfortunate to watch regulatory bodies accross the globe try to suppress p2p over the last few months by highlighting only its illicit uses. Kudos to Italy for betting on the horse that will inevitably win.

why do you think tor is going to 'inevitably win'? Win at what exactly?

Ahh ok good question I didn't really flesh that out.

>"Why do you think tor is going to 'inevitably win'?"

Not just tor, but p2p in general. Basically the theory is that, as a species, we're used to few-source/many-sink communications networks.

We've been using them from the printing-press all the way up to DVDs. The internet & its "many-source" capabilities represents a threat to the prior (and existing) information-source monopolies...such as any media industries, national-banks, or governments.

A great way not completely lose control of information dissemination is to control the paths information must take.

Two great examples of threatening p2p protocols are Tor and the distributed bitcoin-ledger. Taken in conjunction with "criminal activity" historically being the way to demonize most cutting-edge tech when it challenges the status-quo, and a pattern starts to present itself.

To answer your question: I think our regulators are being reactionary Luddites & that p2p is sort of the spirit of what's driving this whole internet-thing...otherwise it would be interactive television.

Re: Italian Anti-Corruption Authority Adopts Onion Services

#30

Post by [deleted] »

chii wrote: post #18
rotrux wrote: post #14

It's been unfortunate to watch regulatory bodies accross the globe try to suppress p2p over the last few months by highlighting only its illicit uses. Kudos to Italy for betting on the horse that will inevitably win.

why do you think tor is going to 'inevitably win'? Win at what exactly?

[deleted]
Post reply on HN