Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is Tor still safe to use?

blog.torproject.org

Post reply on HN
Print view View original

71–80 of 602 posts

Re: Is Tor still safe to use?

#71

Post by whimsicalism »

sigmoid10 wrote: post #64
alasdair_ wrote: post #35

Here is what I don't understand: Let's say I as a private individual fund 1000 tor nodes (guard and exit nodes included) and have them all log everything. This could cost less than $5000 for a month, with some time needed to get guard node status. I want to find a certain kind of person so I look for people that access a specific hidden service or clearnet url. Surely eventually I'm going to get a hit where all three…

>Surely eventually I'm going to get a hit where all three nodes in the circuit are my nodes that are logging everything? The word "eventually" is doing a lot of heavy lifting here. Let's say you actually manage to add 1000 servers to the tor network somehow without getting detected. The network currently sits at just under 8000 nodes. For simplicity, lets also ignore that there are different types of nodes and geogra…

> Could someone like the NSA with limitless resources do it? Sure

Yes, this is obviously the sort of adversary we would be discussing.

> , lets also ignore that there are different types of nodes

causing your number to be an underestimate

> The answer is less than 0.14%.

So almost certainly thousands of people

Re: Is Tor still safe to use?

#72

Post by amatecha »

system33- wrote: post #50
Spooky23 wrote: post #43

Earlier quoted context omitted.

Tor was literally developed by the intelligence community. I’m sure there are a variety of means to gather actionable intelligence from it, with or without the cooperation of the exit node volunteers. Beyond a principled stance re communications, I can’t think of a reason to use it. If you’re planning to resist some regime that controls telecom infrastructure, the fact that you’re using it is both uncommon and notabl…

Tor was literally developed by the Naval Research Lab. Not a part of the IC. I know because I work there. AMA (edit: about tor. Because people say a lot about it without actually knowing much. But now I should put my phone down so… too late!) To protect our most sensitive communications and vulnerable communities , Tor usage should be normalized so it is common and not notable.

I think if the Tor Project wants to boost their network they might try putting anything about how to do so on their website, easily-accessible. I'm trying to figure out how to run a relay and having a pretty challenging time finding anything at all about this. They just really want me to download Tor Browser, it seems.

Edit: I finally found it![0] I had to go to Donate, Donation FAQ, "Can I donate my time?" , "Learn more about joining the Tor community.", and then "Relay Operations" -> "Grow the Tor network" at the bottom right. I would really hope there's a more direct path than this...

[0] https://community.torproject.org/relay/

Re: Is Tor still safe to use?

#73

Post by whimsicalism »

donmcronald wrote: post #61
alasdair_ wrote: post #35

Here is what I don't understand: Let's say I as a private individual fund 1000 tor nodes (guard and exit nodes included) and have them all log everything. This could cost less than $5000 for a month, with some time needed to get guard node status. I want to find a certain kind of person so I look for people that access a specific hidden service or clearnet url. Surely eventually I'm going to get a hit where all three…

> Surely eventually I'm going to get a hit where all three nodes in the circuit are my nodes that are logging everything? If you're looking for static assets, why would you need to see the whole chain? Wouldn't a connection to a known website (page) have a similar fingerprint even if you wrap it in 3 layers of encryption? Does Tor coalesce HTTP queries or something to avoid having someone fingerprint connections base…

? tor reroutes the packets so how would you identify who is visiting who? it's not just 'layers of encryption' it is layers of redirection

Re: Is Tor still safe to use?

#74

Post by fsckboy »

barbazoo wrote: post #65
supportengineer wrote: post #63

Earlier quoted context omitted.

Society benefits when people refrain from illegal and immoral activities.

Are you implying that Tor is primarily used for illegal or "immoral" purposes?

are you implying that Tor is not used for illegal or immoral purposes? (I took out the primarily that you threw in to make your argument stronger because that made my argument stronger, and I took out your scare quotes because morality doesn't scare me)

Re: Is Tor still safe to use?

#75

Post by mzs »

sigmoid10 wrote: post #64
alasdair_ wrote: post #35

Here is what I don't understand: Let's say I as a private individual fund 1000 tor nodes (guard and exit nodes included) and have them all log everything. This could cost less than $5000 for a month, with some time needed to get guard node status. I want to find a certain kind of person so I look for people that access a specific hidden service or clearnet url. Surely eventually I'm going to get a hit where all three…

>Surely eventually I'm going to get a hit where all three nodes in the circuit are my nodes that are logging everything? The word "eventually" is doing a lot of heavy lifting here. Let's say you actually manage to add 1000 servers to the tor network somehow without getting detected. The network currently sits at just under 8000 nodes. For simplicity, lets also ignore that there are different types of nodes and geogra…

So if there are greater than only 357 people on topics the GP is interested in that's better than 50/50 odds.

Re: Is Tor still safe to use?

#76

Post by appendix-rock »

system33- wrote: post #44
_5hxt wrote: post #40

Earlier quoted context omitted.

Yes, there aren’t that many tor nodes. It’s not the safe haven protocol or transport suite people make it out to be.

It’s then best we’ve got for achieving actually meaningful privacy and anonymity. It has a huge body of research behind it that is regularly ignored by those coming up with sexy or off-the-cuff alternatives. It’s the most popular so it gets the most attention: from academics, criminals, law enforcement, journalists, …

These sort of “Tor evangelism” comments are so tiring, frankly. There are quite a few like it in this thread, in response to…not people poo-pooing Tor, or throwing the baby out with the bathwater, rather making quite level-headed and reasonable claims as to the shortcomings and limitations of the network / protocol / service / whatever.

One should be able to make these quite reasonable determinations about how easy it’d be to capture and identify Tor traffic without a bunch of whataboutism and “it’s still really good though, ok!” replies which seek to unjustifiably minimise valid concerns because one feels the need to…go on and bat for the project that they feel some association with, or something.

The self-congratulatory cultiness of it only makes me quite suspicious of those making these comments, and if anything further dissuades me from ever committing any time or resources to the project.

Re: Is Tor still safe to use?

#77

Post by greyface- »

xyst wrote: post #38
no-dr-onboard wrote: post #25

Earlier quoted context omitted.

After the Snowden revelations regarding FOXACID and QUANTUM going largely undressed in the tor project, people have every right to feel sketched out with using ToR for anything. "We're still helping people" just isn't a good enough argument for most people. https://www.schneier.com/blog/archives/2013/10/how_the_nsa_a... https://blog.torproject.org/yes-we-know-about-guardian-artic...

Wonder what has replaced “Xkeyscore” given the wide adoption of TLS. I know ISPs, especially national ISPs like AT&T (see: titanpointe - 33 thomas st, nyc) would feed data to NSA since traffic at the time was mostly via http (rather than https). I suppose the unencrypted dns queries are still useful (although DNSSEC is supposed to defend against snooping/deep packet inspection)

Lots of juicy Internet protocols are still running in cleartext. OCSP, for example, and DNS, as you noted. And the IP-level metadata of TLS connections is still enough to uniquely identify which entities are communicating with each other in many situations. I very much doubt XKeyscore has been retired.

Re: Is Tor still safe to use?

#78

Post by system33- »

amatecha wrote: post #72
system33- wrote: post #50

Earlier quoted context omitted.

Tor was literally developed by the Naval Research Lab. Not a part of the IC. I know because I work there. AMA (edit: about tor. Because people say a lot about it without actually knowing much. But now I should put my phone down so… too late!) To protect our most sensitive communications and vulnerable communities , Tor usage should be normalized so it is common and not notable.

I think if the Tor Project wants to boost their network they might try putting anything about how to do so on their website, easily-accessible. I'm trying to figure out how to run a relay and having a pretty challenging time finding anything at all about this. They just really want me to download Tor Browser, it seems. Edit: I finally found it![0] I had to go to Donate, Donation FAQ, "Can I donate my time?" , "Learn…

Sorry that it is hard to find. This is the root link to point you towards.

https://community.torproject.org/relay/

Thanks for considering to run a relay.

Re: Is Tor still safe to use?

#79

Post by sigmoid10 »

whimsicalism wrote: post #71
sigmoid10 wrote: post #64

Earlier quoted context omitted.

>Surely eventually I'm going to get a hit where all three nodes in the circuit are my nodes that are logging everything? The word "eventually" is doing a lot of heavy lifting here. Let's say you actually manage to add 1000 servers to the tor network somehow without getting detected. The network currently sits at just under 8000 nodes. For simplicity, lets also ignore that there are different types of nodes and geogra…

> Could someone like the NSA with limitless resources do it? Sure Yes, this is obviously the sort of adversary we would be discussing. > , lets also ignore that there are different types of nodes causing your number to be an underestimate > The answer is less than 0.14%. So almost certainly thousands of people

>Yes, this is obviously the sort of adversary we would be discussing.

OP explicitly asked about himself, not some government organisation.

>causing your number to be an underestimate

Not necessarily. It might even be an overestimate if the attacker fails to supply enough nodes of the right kind.

>So almost certainly thousands of people

We're talking about a targeted attack. Of course the statistics game works better when you don't target specific people and just fish randomly. But there are probably more cost effective methods as well.

Re: Is Tor still safe to use?

#80

Post by alasdair_ »

sigmoid10 wrote: post #64
alasdair_ wrote: post #35

Here is what I don't understand: Let's say I as a private individual fund 1000 tor nodes (guard and exit nodes included) and have them all log everything. This could cost less than $5000 for a month, with some time needed to get guard node status. I want to find a certain kind of person so I look for people that access a specific hidden service or clearnet url. Surely eventually I'm going to get a hit where all three…

>Surely eventually I'm going to get a hit where all three nodes in the circuit are my nodes that are logging everything? The word "eventually" is doing a lot of heavy lifting here. Let's say you actually manage to add 1000 servers to the tor network somehow without getting detected. The network currently sits at just under 8000 nodes. For simplicity, lets also ignore that there are different types of nodes and geogra…

>The answer is less than 0.14%.

Is this per circuit? So if someone switches circuits every X hours, the chance of being caught after a year is actually quite high?

And even catching 0.14% of pedophiles would probably be worth it to the FBI or whatever, nevermind Iran catching dissidents or whatever.

My point is that is seems very cheap to do this (I as a random staff engineer could do it myself) and catch some people. A nation state could easily catch a much higher percentage if they increased the number of logging nodes slowly and carefully and deliberately did things like use many isps and update the servers gradually etc.

Post reply on HN