101–110 of 123 posts
Intelligence agencies could run a substantial part of the tor network with ease.
That's why I'd like to see some sort of identification for tor exit node operators. Like keybase or github accounts that can verify who they are and that they have a "normal" presence on the internet.
Earlier quoted context omitted.
I was pretty confused, because the title mentions "FSB", but all of this discussion in this thread is about the US. I literally assumed that FSB must be an acronym for some US intelligence agency I don't know of. Then I went and read the article, and it really is about the Russian FSB.
The majority of people don't read the articles posted, only the titles. Most TLAs are American, so if you don't know what the FSB is then "a US IC org" is a pretty safe guess.
ASD
CSE
GCHQ
GCSB
NSA
FVEY
only one of FVEY is a US IC org. See also Nine Eyes and Fourteen Eyes.
Earlier quoted context omitted.
Correlation attacks are attacing anonymity. If you are an embassy, there is no need for anonymity. Ok, an embassy connected to vpn.whitehouse.gov and sent 20 gb of data, so what? (unless you are thinking about high level things, like "lots of traffic" -> "something going on", but tor won't help with that either)
I feel like if I were a network operator for something that sensitive I might send some bursts of traffic to nothing just to keep anyone trying to infer "lots of traffic" → "something going on" on their toes. (Though certainly things like packet timing, packet size, etc. might make more thorough analyses harder to escape…)
Earlier quoted context omitted.
Controlling just the exit nodes doesn't mean much, but by controlling the majority of all nodes you break TOR. If I controll all nodes your connection uses I can trivially deanonymize you (even if you use hidden services). It has also been shown multiple time that it is enough to control the first and the last node of the connection because timing correlation works great. The upside is that no government would admit…
Running Tor exit node is dangerous. Very few people would dare to do so. Most of hosters will forbid that. Now running ordinary Tor node is not dangerous. It does not consume a lot of resources (I'm running node on 256 MB OpenBSD VPS) and hosters don't care at all. It takes few minutes to install and set it up. So there's absolutely no reason for people not to run Tor node on every server they have access to. And I'm…
Within 30 minutes of my public IP changing, CloudFlare would get wind of it again and then it'd be back to hitting a captcha for 75% of all of my own NOR tor traffic with the same origin IP as a TOR exit node. This among myriad other misadventures resulted in me shutting it off after ~6 months.
Earlier quoted context omitted.
Correlation attacks are attacing anonymity. If you are an embassy, there is no need for anonymity. Ok, an embassy connected to vpn.whitehouse.gov and sent 20 gb of data, so what? (unless you are thinking about high level things, like "lots of traffic" -> "something going on", but tor won't help with that either)
I feel like if I were a network operator for something that sensitive I might send some bursts of traffic to nothing just to keep anyone trying to infer "lots of traffic" → "something going on" on their toes. (Though certainly things like packet timing, packet size, etc. might make more thorough analyses harder to escape…)
Earlier quoted context omitted.
Or just set up an OTP then use the OTP to send new OTPs securely, boom.
If you do this, it is no longer OTP.
1. Alice and Bob set up their OTP
2. Alice randomly generates a new OTP
3. Alice encrypts the new OTP with the original OTP and sends the ciphertext to Bob
4. Bob decrypts... the new OTP
5. Alice and Bob burn the original OTP
6. Now Alice and Bob have a copy of the new OTP
I mean, it's pointless. But I don't see how it isn't secure.
Nobody with an ounce of intelligence can believe for one moment that the most powerful intelligence agencies in the most powerful country of the world will stand idly by and watch a protocol/network be completely opaque for them. Whether there is evidence or not (in such cases there may never be enough evidence), it is safe to assume that many if not most Tor exit nodes are govt run (various govts), and one or more o…
Earlier quoted context omitted.
Not a single intelligence agency or diplomatic service will rely on ToR for security that’s madness. A properly configured commercial or open source VPN is considerably more reliable and secure than ToR since you have no idea who is listening on the exit nodes or who can execute unmasking attacks by traffic shaping or monitoring if they control enough relays. For the most part any country which can perform intelligen…
>Not a single intelligence agency or diplomatic service will rely on ToR for security that’s madness... For the most part any country which can perform intelligence collection out of its embassy will have sufficient budget and and technical capacity to develop their own secure means of phoning home. The CIA has it's own onion service: ciadotgov4sjwlzihbbgxnqg3xiyrg7so2r2o3lt5wz5ypk4sxyjstad.onion Tor was developed by…
Earlier quoted context omitted.
If you do this, it is no longer OTP.
I think it still is: 1. Alice and Bob set up their OTP 2. Alice randomly generates a new OTP 3. Alice encrypts the new OTP with the original OTP and sends the ciphertext to Bob 4. Bob decrypts... the new OTP 5. Alice and Bob burn the original OTP 6. Now Alice and Bob have a copy of the new OTP I mean, it's pointless. But I don't see how it isn't secure.
jancsika is right in the sense that this is possible, but meaningless. The reason for that is that in OTP, you use your key ("pad") for every transmission, in 1-to-1 ratio to amount of data being transmitted. And you can only use your key once (hence "one time pad")
So let's say you brought 1000 MB of OTP keys to embassy in diplomatic mail, you can use it to send up to 1000 MB of encrypted data, and then you have to get a new one. If you are low on OTP keys, and you use it to send a new one, you'll have to spend 100 MB of "old" OTP keys to get 100 MB of "new" OTP keys -- entirely pointless process, as amount of unused key data won't change.
Earlier quoted context omitted.
I think it still is: 1. Alice and Bob set up their OTP 2. Alice randomly generates a new OTP 3. Alice encrypts the new OTP with the original OTP and sends the ciphertext to Bob 4. Bob decrypts... the new OTP 5. Alice and Bob burn the original OTP 6. Now Alice and Bob have a copy of the new OTP I mean, it's pointless. But I don't see how it isn't secure.
For those who do not know exactly how OTP works: jancsika is right in the sense that this is possible, but meaningless. The reason for that is that in OTP, you use your key ("pad") for every transmission, in 1-to-1 ratio to amount of data being transmitted. And you can only use your key once (hence "one time pad") So let's say you brought 1000 MB of OTP keys to embassy in diplomatic mail, you can use it to send up to…