Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is Tor still safe to use?

blog.torproject.org

Post reply on HN
Print view View original

101–110 of 602 posts

Re: Is Tor still safe to use?

#101

Post by worldsayshi »

sigmoid10 wrote: post #87
PeterisP wrote: post #81

Earlier quoted context omitted.

If someone would do the thing-to-be-detected (e.g. accessing CSAM) every day, then that 0.14% probability of detection turns out to be 40% for a single year (0.9986^365) or 64% over two years, so even that would deanonymize the majority of such people over time.

That assumes you could run thousands of malicious tor nodes for several years without being detected. Unless you have vast resources and time, this is unlikely.

But it doesn't seem unfeasible for a state actor that wants to track their population then?

Re: Is Tor still safe to use?

#102

Post by ziddoap »

worldsayshi wrote: post #101
sigmoid10 wrote: post #87

Earlier quoted context omitted.

That assumes you could run thousands of malicious tor nodes for several years without being detected. Unless you have vast resources and time, this is unlikely.

But it doesn't seem unfeasible for a state actor that wants to track their population then?

The comment that spawned this chain starts with:

>Let's say I as a private individual

Re: Is Tor still safe to use?

#103

Post by duskwuff »

jancsika wrote: post #70
jstanley wrote: post #13

The best attack against Tor is convincing people not to use it. If anyone tries to convince you Tor is not safe, ask yourself: cui bono?

A question before I enter your Manichean universe: Does Tor Browser Bundle currently ship with Ublock Origin installed and on by default?

It would be irresponsible for it to do so. Ad blocker lists can inject scripts into web pages which could compromise user privacy.

Re: Is Tor still safe to use?

#104

Post by smileson2 »

Yawrehto wrote: post #56
smileson2 wrote: post #29

Depends on your risk, if are are trying to avoid censorship and political repression in say Iran or china you are probably fine If you are an enemy of the United States you probably aren’t but that’s a high bar

Maybe. I think the real distinction is reach. Are you consuming content passively, or are you creating content for many people? If you're creating content on torture China's doing, they absolutely will track you down. If you're in North Korea and revealing what life is really like in South Korea, or in Russia exposing the realities of the Ukraine war, Tor is probably unsafe. But there is also an element of resources.…

Yes fair point

Re: Is Tor still safe to use?

#105

Post by basedrum »

system33- wrote: post #44
_5hxt wrote: post #40

Earlier quoted context omitted.

Yes, there aren’t that many tor nodes. It’s not the safe haven protocol or transport suite people make it out to be.

It’s then best we’ve got for achieving actually meaningful privacy and anonymity. It has a huge body of research behind it that is regularly ignored by those coming up with sexy or off-the-cuff alternatives. It’s the most popular so it gets the most attention: from academics, criminals, law enforcement, journalists, …

it was used by Snowden to leak documents...

Re: Is Tor still safe to use?

#107

Post by system33- »

Nathanael_M wrote: post #59
system33- wrote: post #50

Earlier quoted context omitted.

Tor was literally developed by the Naval Research Lab. Not a part of the IC. I know because I work there. AMA (edit: about tor. Because people say a lot about it without actually knowing much. But now I should put my phone down so… too late!) To protect our most sensitive communications and vulnerable communities , Tor usage should be normalized so it is common and not notable.

Unrelated to Tor, what was your favourite project to work on that you're allowed to talk about? That must be a fascinating job.

Unfortunately the tor part is the part I can most obviously talk about. Not that I work on anything classified. I just need to be mindful.

I got to travel to Canada, Mexico, and Europe (from the US) for tor meetings and privacy-enhancing technology conferences.

More or less every single cell that goes through the tor network today is prioritized and scheduled by the cell scheduler I wrote.

Re: Is Tor still safe to use?

#109

Post by alasdair_ »

sigmoid10 wrote: post #87
PeterisP wrote: post #81

Earlier quoted context omitted.

If someone would do the thing-to-be-detected (e.g. accessing CSAM) every day, then that 0.14% probability of detection turns out to be 40% for a single year (0.9986^365) or 64% over two years, so even that would deanonymize the majority of such people over time.

That assumes you could run thousands of malicious tor nodes for several years without being detected. Unless you have vast resources and time, this is unlikely.

My point is that it doesn't require "vast resources". A VPS is $5 a month. A thousand of them would be in the disposable income budget of a single FAANG engineer never mind a nation state.

Pay people on Fiverr to set them up for you at different ISPs so that all the setup information is different. You can use crypto to pay if you want anonimity (this is actually the main reason I used to use bitcoin - I'd pay ISPs in Iceland to run TOR exit nodes for me without linking them to my identity).

This isn't a difficult problem. A single individual with a good job could do it.

And sure, each connection only has a very small chance of being found, but aggregate it over a year or two and you could catch half of the users of a site if they connected with a new circuit one time per day.

I honestly can't see why a nation state or two hasn't already done this.

Re: Is Tor still safe to use?

#110

Post by colechristensen »

mistercheph wrote: post #95
sigmoid10 wrote: post #87

Earlier quoted context omitted.

That assumes you could run thousands of malicious tor nodes for several years without being detected. Unless you have vast resources and time, this is unlikely.

I can't think of anyone with vast resources and time that would want to deanonymize cybercriminals

Outside of 3 letter agencies which is obvious, I have known people who would do this for fun or whatever other personal motivation.

A lot of "hacker" mentality projects involve putting a tremendous amount of effort into something with questionable utility.

People climb mountains because they're there.

Post reply on HN