Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is Tor still safe to use?

blog.torproject.org

Post reply on HN
Print view View original

81–90 of 602 posts

Re: Is Tor still safe to use?

#81

Post by PeterisP »

sigmoid10 wrote: post #64
alasdair_ wrote: post #35

Here is what I don't understand: Let's say I as a private individual fund 1000 tor nodes (guard and exit nodes included) and have them all log everything. This could cost less than $5000 for a month, with some time needed to get guard node status. I want to find a certain kind of person so I look for people that access a specific hidden service or clearnet url. Surely eventually I'm going to get a hit where all three…

>Surely eventually I'm going to get a hit where all three nodes in the circuit are my nodes that are logging everything? The word "eventually" is doing a lot of heavy lifting here. Let's say you actually manage to add 1000 servers to the tor network somehow without getting detected. The network currently sits at just under 8000 nodes. For simplicity, lets also ignore that there are different types of nodes and geogra…

If someone would do the thing-to-be-detected (e.g. accessing CSAM) every day, then that 0.14% probability of detection turns out to be 40% for a single year (0.9986^365) or 64% over two years, so even that would deanonymize the majority of such people over time.

Re: Is Tor still safe to use?

#82

Post by bornfreddy »

nurumaik wrote: post #68
2OEH8eoCRo0 wrote: post #42

It's safe if you ain't a pedo or terrorist. Sometimes I wonder wtf y'all are doing with such crazy security expectations and paranoia.

Not everyone lives in a country where government is a friend

And even if it is today, a fiend is just one bad election away.

Re: Is Tor still safe to use?

#83

Post by qwery »

yieldcrv wrote: post #5

This isn't written in the most confidence inspiring way But the things that do inspire confidence: Tor is updated against vulnerabilities pre-emptively, years before the vulnerability is known to be leveraged Tor Project happens to be investigating the attack vector of the specific tor client, which is years outdated They should have just said “we fixed that vulnerability in 2022” with a separate article about the ol…

> confidence inspiring

I don't want them to try to sell me something. If they were making bold claims as you suggest I would be more concerned.

Re: Is Tor still safe to use?

#84

Post by alasdair_ »

gaba wrote: post #39
alasdair_ wrote: post #35

Here is what I don't understand: Let's say I as a private individual fund 1000 tor nodes (guard and exit nodes included) and have them all log everything. This could cost less than $5000 for a month, with some time needed to get guard node status. I want to find a certain kind of person so I look for people that access a specific hidden service or clearnet url. Surely eventually I'm going to get a hit where all three…

Tor Project has a team that looks at relays and checks if relays are engaging in bad practices or any suspicious activity like a lot of nodes run by one operator. https://community.torproject.org/relay/governance/

Iran probably has enough money that it could pay a thousand different isps in a thousand different ways with a thousand different os versions and tor versions. This could all be automated pretty easily.

Re: Is Tor still safe to use?

#85

Post by yupyupyups »

xyst wrote: post #38
no-dr-onboard wrote: post #25

Earlier quoted context omitted.

After the Snowden revelations regarding FOXACID and QUANTUM going largely undressed in the tor project, people have every right to feel sketched out with using ToR for anything. "We're still helping people" just isn't a good enough argument for most people. https://www.schneier.com/blog/archives/2013/10/how_the_nsa_a... https://blog.torproject.org/yes-we-know-about-guardian-artic...

Wonder what has replaced “Xkeyscore” given the wide adoption of TLS. I know ISPs, especially national ISPs like AT&T (see: titanpointe - 33 thomas st, nyc) would feed data to NSA since traffic at the time was mostly via http (rather than https). I suppose the unencrypted dns queries are still useful (although DNSSEC is supposed to defend against snooping/deep packet inspection)

>Wonder what has replaced “Xkeyscore” given the wide adoption of TLS.

Cloudflare is a US-based company that does MITM attacks on all traffic of the websites that it protects. It's part of how their DDoS mitigation works.

Many people still use large US-based mail providers such as Outlook or Gmail.

Many large services use AWS, GCP or Azure. Perhaps there are ways for the NSA to access customers' virtual storage or MITM attack traffic between app backends and the load balancer where TLS is not used.

Re: Is Tor still safe to use?

#86

Post by jeffbee »

alasdair_ wrote: post #35

Here is what I don't understand: Let's say I as a private individual fund 1000 tor nodes (guard and exit nodes included) and have them all log everything. This could cost less than $5000 for a month, with some time needed to get guard node status. I want to find a certain kind of person so I look for people that access a specific hidden service or clearnet url. Surely eventually I'm going to get a hit where all three…

This attack is quite practical. In 2007 I controlled a huge chunk of Tor traffic from 2 racks of cheap servers in a basement on Folsom Street in SF. It was easy to arrange and nobody noticed. Yeah those were early days for Tor but I don't think scale changes anything. If you're using Tor because you think it is private, you have fooled yourself.

Re: Is Tor still safe to use?

#87

Post by sigmoid10 »

PeterisP wrote: post #81
sigmoid10 wrote: post #64

Earlier quoted context omitted.

>Surely eventually I'm going to get a hit where all three nodes in the circuit are my nodes that are logging everything? The word "eventually" is doing a lot of heavy lifting here. Let's say you actually manage to add 1000 servers to the tor network somehow without getting detected. The network currently sits at just under 8000 nodes. For simplicity, lets also ignore that there are different types of nodes and geogra…

If someone would do the thing-to-be-detected (e.g. accessing CSAM) every day, then that 0.14% probability of detection turns out to be 40% for a single year (0.9986^365) or 64% over two years, so even that would deanonymize the majority of such people over time.

That assumes you could run thousands of malicious tor nodes for several years without being detected. Unless you have vast resources and time, this is unlikely.

Re: Is Tor still safe to use?

#88

Post by appendix-rock »

stavros wrote: post #37
jstanley wrote: post #13

The best attack against Tor is convincing people not to use it. If anyone tries to convince you Tor is not safe, ask yourself: cui bono?

I'll ask the inverse: if Tor is unsafe, who benefits from telling you to use it?

Especially “the solution to an unsafe Tor is more Tor!” it feels like I’m at a charity drive.

Re: Is Tor still safe to use?

#89

Post by amatecha »

system33- wrote: post #78
amatecha wrote: post #72

Earlier quoted context omitted.

I think if the Tor Project wants to boost their network they might try putting anything about how to do so on their website, easily-accessible. I'm trying to figure out how to run a relay and having a pretty challenging time finding anything at all about this. They just really want me to download Tor Browser, it seems. Edit: I finally found it![0] I had to go to Donate, Donation FAQ, "Can I donate my time?" , "Learn…

Sorry that it is hard to find. This is the root link to point you towards. https://community.torproject.org/relay/ Thanks for considering to run a relay.

No prob - and thanks! Looks like I found it right as you were drafting this message. It would be really useful to add some call to action about "Help grow the Tor network!" anywhere on the home page. Partly just to increase the "welcoming-ness" but mostly to reduce friction for ppl who want to contribute, and help make it clear that the network needs support from whoever :)

Re: Is Tor still safe to use?

#90

Post by [deleted] »

Nathanael_M wrote: post #59
system33- wrote: post #50

Earlier quoted context omitted.

Tor was literally developed by the Naval Research Lab. Not a part of the IC. I know because I work there. AMA (edit: about tor. Because people say a lot about it without actually knowing much. But now I should put my phone down so… too late!) To protect our most sensitive communications and vulnerable communities , Tor usage should be normalized so it is common and not notable.

Unrelated to Tor, what was your favourite project to work on that you're allowed to talk about? That must be a fascinating job.

[deleted]
Post reply on HN