Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is Tor still safe to use?

blog.torproject.org

Post reply on HN
Print view View original

151–160 of 602 posts

Re: Is Tor still safe to use?

#151

Post by _yb2s »

alasdair_ wrote: post #35

Here is what I don't understand: Let's say I as a private individual fund 1000 tor nodes (guard and exit nodes included) and have them all log everything. This could cost less than $5000 for a month, with some time needed to get guard node status. I want to find a certain kind of person so I look for people that access a specific hidden service or clearnet url. Surely eventually I'm going to get a hit where all three…

The skilled labor to set that all up, especially in a way that TOR won't notice and shut you down will be worth much much more than $5k.

People that have such a sophisticated and resourced team actively hunting them down, likely know about it, and are using many additional layers of security on top of TOR. Even just for personal use out of curiosity to "see what the darkweb is," I used 1-2 additional methods on top of TOR.

Re: Is Tor still safe to use?

#152

Post by smoe »

lifeisstillgood wrote: post #137

I am interested in the “legitimate” uses for tor. I have not kept up with this but I understand it was designed by US Navy to make it hard for oppressive regiemes to track their citizens use of web. What do we want Tor for except as a hope that Russian citizens might be able to get to the BBC site? I am asking honestly - and would prefer not to be told my own government is on the verge of a mass pogrum so we had bett…

Don't know if it is still used much. There is SecureDrop to facilitate communication between investigative journalists and sources/whistleblowsers via Tor that was at some point deployed by several prominent news organizations.

https://en.wikipedia.org/wiki/SecureDrop

Re: Is Tor still safe to use?

#153

Post by Jach »

system33- wrote: post #50
Spooky23 wrote: post #43

Earlier quoted context omitted.

Tor was literally developed by the intelligence community. I’m sure there are a variety of means to gather actionable intelligence from it, with or without the cooperation of the exit node volunteers. Beyond a principled stance re communications, I can’t think of a reason to use it. If you’re planning to resist some regime that controls telecom infrastructure, the fact that you’re using it is both uncommon and notabl…

Tor was literally developed by the Naval Research Lab. Not a part of the IC. I know because I work there. AMA (edit: about tor. Because people say a lot about it without actually knowing much. But now I should put my phone down so… too late!) To protect our most sensitive communications and vulnerable communities , Tor usage should be normalized so it is common and not notable.

I still think the IC, and especially the state department, benefits from having Tor fulfill its actual design goals most of the time. There are operations and state department goals that can benefit from Tor working properly. It's the same with encryption in general -- the IC benefits from there being strong and bug-free crypto implementations. That they have in the past backdoored some of them doesn't change that they've also hardened others. I'm sure they come up with and deploy various attacks on Tor all the time, same with foreign nations (whom the state department would like to thwart). I'm skeptical though that they can do working attacks at any time and against any set of people.

For your AMA, if you want: How's the job? What keeps you working there? How's patriotism these days?

Re: Is Tor still safe to use?

#154

Post by qwery »

alasdair_ wrote: post #80
sigmoid10 wrote: post #64

Earlier quoted context omitted.

>Surely eventually I'm going to get a hit where all three nodes in the circuit are my nodes that are logging everything? The word "eventually" is doing a lot of heavy lifting here. Let's say you actually manage to add 1000 servers to the tor network somehow without getting detected. The network currently sits at just under 8000 nodes. For simplicity, lets also ignore that there are different types of nodes and geogra…

>The answer is less than 0.14%. Is this per circuit? So if someone switches circuits every X hours, the chance of being caught after a year is actually quite high? And even catching 0.14% of pedophiles would probably be worth it to the FBI or whatever, nevermind Iran catching dissidents or whatever. My point is that is seems very cheap to do this (I as a random staff engineer could do it myself) and catch some people…

You're misusing probability and ignoring critical information.

There's 1000 red marbles added to a jar with 8000 blue marbles (9000 total). Take three marbles from the jar randomly, one at a time. The odds of getting three red marbles is ~0.14%. That's all.

Tor nodes are not randomly picked marbles. The Tor network is not a jar.

Re: Is Tor still safe to use?

#155

Post by fragmede »

knodi123 wrote: post #143
lifeisstillgood wrote: post #137

I am interested in the “legitimate” uses for tor. I have not kept up with this but I understand it was designed by US Navy to make it hard for oppressive regiemes to track their citizens use of web. What do we want Tor for except as a hope that Russian citizens might be able to get to the BBC site? I am asking honestly - and would prefer not to be told my own government is on the verge of a mass pogrum so we had bett…

For the same reason we have SSL on this site, despite the fact that it has no sex, no storefront, nor any access to my banking or private information. If everything is SSL secured, then we don't have to explain why any specific thing is SSL secured. The same reason can be applied to use of TOR.

The point ranking on comments, which is private, would be of interest to parties training an LLM and want the data annotated, but your point stands.

Re: Is Tor still safe to use?

#156

Post by yupyupyups »

lukan wrote: post #112
barbazoo wrote: post #65

Earlier quoted context omitted.

Are you implying that Tor is primarily used for illegal or "immoral" purposes?

I would assume very likely yes? There definitely are legit use cases for it and in an ideal world, I think all traffic should go over onion routing by default to protect them. But in reality today besides a handful of idealists (like me some years ago), and legitimate users, like protestors under oppressive regimes - I would assume the biggest group with a concrete interest to hide would be indeed pedophiles and othe…

I'm pretty sure many people use Tor for other things than journalism and CP.

Tor is a privacy tool. Much of what we do in our lives is on the internet, and privacy is important. Tor helps people enjoy privacy in a medium that they are increasingly dependant on.

Re: Is Tor still safe to use?

#157

Post by londons_explore »

k__ wrote: post #148
londons_explore wrote: post #130

Earlier quoted context omitted.

You only need to control the entry and exit node - since you know the next and previous hop for all traffic you touch, and default chains are 3 long. With circuits changing every 10 mins, within a few days you would have deanonymized at least some percentage of traffic for nearly every user. I'd call tor broken against any adversary with a little technical skill and willingness to spend $5000. I'm 80% sure Tor is des…

How do you control an exit node? I had the impression, with onion services they are a thing of the past.

https://blog.torproject.org/tips-running-exit-node/

Re: Is Tor still safe to use?

#158

Post by lcnPylGDnU4H9OF »

_yb2s wrote: post #151
alasdair_ wrote: post #35

Here is what I don't understand: Let's say I as a private individual fund 1000 tor nodes (guard and exit nodes included) and have them all log everything. This could cost less than $5000 for a month, with some time needed to get guard node status. I want to find a certain kind of person so I look for people that access a specific hidden service or clearnet url. Surely eventually I'm going to get a hit where all three…

The skilled labor to set that all up, especially in a way that TOR won't notice and shut you down will be worth much much more than $5k. People that have such a sophisticated and resourced team actively hunting them down, likely know about it, and are using many additional layers of security on top of TOR. Even just for personal use out of curiosity to "see what the darkweb is," I used 1-2 additional methods on top o…

> used 1-2 additional methods on top of TOR

Curious: what did you do and what were you hoping to mitigate?

Re: Is Tor still safe to use?

#159

Post by some_random »

oytis wrote: post #49

Don't quite get it - why doesn't CCC share information with the Tor Project maintainers?

I suspect that the reporter has a bone to pick with Tor and the CCC members that were given the documents were compelled legally or socially to not share them further.

Re: Is Tor still safe to use?

#160

Post by [deleted] »

k__ wrote: post #148
londons_explore wrote: post #130

Earlier quoted context omitted.

You only need to control the entry and exit node - since you know the next and previous hop for all traffic you touch, and default chains are 3 long. With circuits changing every 10 mins, within a few days you would have deanonymized at least some percentage of traffic for nearly every user. I'd call tor broken against any adversary with a little technical skill and willingness to spend $5000. I'm 80% sure Tor is des…

How do you control an exit node? I had the impression, with onion services they are a thing of the past.

[deleted]
Post reply on HN