Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zed Shaw: Why I Don't Use Tor

sheddingbikes.com

Post reply on HN
Print view View original

101–110 of 170 posts

Re: Zed Shaw: Why I Don't Use Tor

#101

Post by neild »

The problem with Tor, as I see it, is that it can easily make you more vulnerable rather than less so.

When I access some random website from home, my traffic is vulnerable to capture and analysis by my ISP, the intervening backbones, and the website that I am accessing. I don't trust my ISP and the backbone providers not to examine my traffic, but I do have quite a bit of confidence that they don't care about me. I'm not very interesting.

If I use Tor, I add another party who can capture and examine my traffic: The Tor exit node.

I most emphatically do not trust random Tor exit nodes not to examine my traffic. I'm quite confident that the NSA and other government organizations run their own Tor exit nodes--after all, a stream of traffic generated by people who are interested in hiding their activities is likely to be quite interesting.

I can encrypt my traffic...but not all of it, and do I really want to trust that everything important is properly encrypted?

If I had something to hide, I'd do so by blending into the crowd, not by slapping a big "I'm trying to hide" label on my traffic and sending it to the people most likely to be interested in it.

Re: Zed Shaw: Why I Don't Use Tor

#102

Post by dkarl »

Funny, I think in terms of my "informational immune system" all the time, and the one time I used it here I got downvoted into oblivion (though it looks like I recovered a bit!): http://news.ycombinator.org/item?id=2006412

Geeks are opposed to certain sources of knowledge, probably because they see themselves as on the receiving end of bad assumptions based on their clothes and mannerisms, and I agree with them that it's always best to avoid subjective judgments when possible. However, there are so many situations in life where you can't audit the source code yourself, and when there's serious risk, you have to make use of the information you have. You can't investigate the provenance of the cheese sandwich, and even if you could, do you really want to spend your whole life playing Sherlock Holmes? I'm thankful for open source and the people who read code, but I am not going to read the source code of every damn piece of software I use. Sometimes I'm just going to say, "The only source for this software is a shareware site in a country I've never heard of, and it claims to come bundled with porn, so I do not feel comfortable installing it on my Windows PC no matter how good some guy on 4chan says it is." Nothing against porn or countries I've never heard of, but my Spidey sense is tingling.

Re: Zed Shaw: Why I Don't Use Tor

#103

Post by jonprins »

gnosis wrote: post #90
dublinclontarf wrote: post #32

As someone living on the other side of the Great Firewall of China it's become VERY clear that a government can effectively censor the internet(without VPN to get out it's terrible), provided that the government in question put enough effort into it. As I said in another comment, the Chinese government has beaten Tor. You can't download it or even read about it(almost everything Tor related is blocked). Even when you…

This is why more people need to learn about and use steganography: http://en.wikipedia.org/wiki/Steganography Properly used, good steganographic software will hide your use of encryption. Ideally, your communication stream will seem perfectly innocuous to all observers. Of course, in real life nothing is perfect. So there's always a chance your use of encryption will be detected. But using steganography properly shou…

I'm envisioning a piece of software that lets you IM folks, but with the messages steganographically embedded in emoticons and the cleartext messages autogenerated.

Re: Zed Shaw: Why I Don't Use Tor

#105

Post by wazoox »

TheCondor wrote: post #95
wazoox wrote: post #27

Earlier quoted context omitted.

There were several security advisories in the past years, of various privilege escalation or other security holes that were actually in SELinux and not present in the vanilla source. I didn't keep a log of the details but you probably can find them in the advisories archives.

Holes SELinux created? Or holes where SELinux was circumvented in new or changed functionality? I'm not aware of any time SELinux has actually introduced a new hole.

I don't remember precisely, just that the proof of concepts simply didn't work on a kernel without SELinux. When the proof of concept is for instance a privilege escalation, this is quite significant.

Re: Zed Shaw: Why I Don't Use Tor

#106

Post by cookiecaper »

dublinclontarf wrote: post #48
JonnieCache wrote: post #46

Earlier quoted context omitted.

At the end of the day when you're dealing with a government that has absolutely no qualms about simply taking you away and killing you discreetly, regardless of who you are, there is no hack clever enough to protect you.

True, but a good Friend to Friend darknet cannot be stopped as long as there is a network to run it on.

They could switch from a blacklist to a whitelist and then you would only be able to connect to other nodes if they were run surreptitiously on pre-approved networks.

Re: Zed Shaw: Why I Don't Use Tor

#107

Post by gnosis »

jonprins wrote: post #103
gnosis wrote: post #90

Earlier quoted context omitted.

This is why more people need to learn about and use steganography: http://en.wikipedia.org/wiki/Steganography Properly used, good steganographic software will hide your use of encryption. Ideally, your communication stream will seem perfectly innocuous to all observers. Of course, in real life nothing is perfect. So there's always a chance your use of encryption will be detected. But using steganography properly shou…

I'm envisioning a piece of software that lets you IM folks, but with the messages steganographically embedded in emoticons and the cleartext messages autogenerated.

The more different types of traffic that messages could be hidden in, the better.

But, personally, I think the best place to hide them right now is video streams.

The thing about steganography is that the smaller your hidden message is and the larger the data it's hiding in is, the less of a chance there is of it being detected, and also the greater the cost of such detection will be.

Think of it this way:

How effective you are at hiding your message, and the cost of hostile detection are proportional to:

        size of covertext
  --------------------------
     size of hidden message
In my opinion, the ideal medium for two-way, realtime steganographic communication would be something like Skype, where large, bidirectional video streams are used. It might not be too hard to hack up some webcam filter that injects hidden messages in to the outgoing videostream and another filter to decode messages from the incoming videostream.

For one-way communication (or even two-way, delayed communication) any of the video hosting services like Youtube or Vimeo would be great. This should be even easier to implement than the Skype filters I describe above, as the processing can be done offline at your own leisure.

If using steganography to hide information in these videostreams becomes common, the cost to snoopers trying to find messages in them will become simply gigantic. And those costs will only increase as videostream sizes dramatically increase as they inevitably advance to offering higher resolutions (in the short-term), and even 3D-video (in the long-term).

An extra tip, if you're going to try something like this, is to make sure to use crappy/defective webcams that naturally inject noise in to the videostream anyway, and maybe film whatever you're filming on a nicely chaotic background like a closeup of trees billowing in the wind, ocean waves crashing on the shore, etc... that should hopefully provide plenty of chaos for your message to hide in.

Re: Zed Shaw: Why I Don't Use Tor

#108

Post by kirubakaran »

bjonathan wrote: post #21

Full twitter conversation between @zedshaw and @ioerror: http://nearmetter.com/ioerror/zedshaw (I'm in no way affiliate to NearMetter, it's just the best way I found to easily read a twitter conversation)

Their cockfight theme is brilliant. If they had voting, bystanders can egg the participants on and add fuel to the fight... not that this particular duo need to be. When one "wins" votes, this can be displayed http://www.ruleworks.co.uk/poultry/images/mating.jpg

Re: Zed Shaw: Why I Don't Use Tor

#109

Post by tptacek »

gnosis wrote: post #99
poet wrote: post #93

Earlier quoted context omitted.

Stealth circumvention tools are even harder to write than just plain old circumvention tools, which we already are struggling with. It's a disaster waiting to happen. See Haystack and this comment by Thomas: http://news.ycombinator.com/item?id=1690871 .

From Thomas' post: "Get circumvention at all wrong and you achieve the opposite of what the tool is intended for: you put a big red flag on people breaking their local laws. ... Don't build circumvention tools." That attitude is so wrongheaded I hardly know where to begin. First of all, anyone who uses something like TOR in China has already put a huge (and very very obvious) red flag on their communications stream.…

If you're going to put a big blinking red light on all your packets so that the largest, best-armed surveillance state in the world can collect and analyze them, I guess there's very little harm in waving rubber chickens over them too. Go ahead with the stego.

You might want to read Neils Provos' stegdetect stuff, first. The world needs more fun grad student projects, and you wouldn't want people to have to rehash the same stuff he broke 10 years ago.

Re: Zed Shaw: Why I Don't Use Tor

#110

Post by onlythelonely »

ajays wrote: post #96

I, for one, would like to point out to Mr. Shaw (and others) that the Swastika is a religious symbol to a lot of people ; maybe even 20% of all humanity (the Hindus, for one). Just because the Swastika was co-opted by Hitler and his cronies means nothing to most people outside the western world (which is in a minority). Secondly (while I have this soapbox): whether you take the sandwich from Hitler or not depends on…

Zed Shaw has practiced Kung Fu. He has no doubt bowed to the Swastika chested Buddhas many times.
Post reply on HN