Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is Tor still safe to use?

blog.torproject.org

Post reply on HN
Print view View original

231–240 of 602 posts

Re: Is Tor still safe to use?

#231

Post by llm_trw »

appendix-rock wrote: post #76
system33- wrote: post #44

Earlier quoted context omitted.

It’s then best we’ve got for achieving actually meaningful privacy and anonymity. It has a huge body of research behind it that is regularly ignored by those coming up with sexy or off-the-cuff alternatives. It’s the most popular so it gets the most attention: from academics, criminals, law enforcement, journalists, …

These sort of “Tor evangelism” comments are so tiring, frankly. There are quite a few like it in this thread, in response to…not people poo-pooing Tor, or throwing the baby out with the bathwater, rather making quite level-headed and reasonable claims as to the shortcomings and limitations of the network / protocol / service / whatever. One should be able to make these quite reasonable determinations about how easy i…

The issue is that the people making 'level headed' claims have read none of the literature and their mathematical ability seems to end at multiplying numbers together.

It sounds reasonable to anyone who hasn't read the papers, to anyone that has these comments are so wrong that you can't even start explaining what's going wrong without a papers worth of explanation that the people don't read.

Re: Is Tor still safe to use?

#232

Post by fragmede »

avidiax wrote: post #229
itake wrote: post #210

Earlier quoted context omitted.

1/ if a user sends 10,000 requests, you're saying 14 of them might see 3 compromised nodes? 2/ Police can use parallel construction. Although, given enough time (in theory) parallel construction is eventually exposed.

> given enough time (in theory) parallel construction is eventually exposed. Parallel construction has existed for decades. It's even in "The Wire". It has never been tested in court, probably because it is nearly impossible to discover outside of being the agents that implement it.

it's not been tested in court, but it's not some crazy Internet theory. https://arstechnica.com/tech-policy/2013/08/us-drug-agency-g...

Re: Is Tor still safe to use?

#233

Post by ggm »

Absolutist statements about services like TOR or VPNs are often not helpful. It's highly contextual to the threat. If the threat is a state actor it's likely nothing, TOR included, can preclude them from determining things about you that you would prefer them not to know.

Some specific state actors operate TOR entry and exit routers and can perform analysis which is different to others who just have access to the infra beneath TOR and can infer things from traffic analysis somewhat differently.

I have never been in a situation where my life and liberty depended on a decision about a mechanism like TOR. I can believe it is contextually safe for some people and also believe it's a giant red flag to a lead pipe and locked room for others.

Re: Is Tor still safe to use?

#234

Post by llm_trw »

pushupentry1219 wrote: post #69
Spooky23 wrote: post #43

Earlier quoted context omitted.

Tor was literally developed by the intelligence community. I’m sure there are a variety of means to gather actionable intelligence from it, with or without the cooperation of the exit node volunteers. Beyond a principled stance re communications, I can’t think of a reason to use it. If you’re planning to resist some regime that controls telecom infrastructure, the fact that you’re using it is both uncommon and notabl…

> Tor was literally developed by the intelligence community. I’m sure there are a variety of means to gather actionable intelligence from it, with or without the cooperation of the exit node volunteers. These two statements make little sense together. It was originally developed by the Navy. Okay. So why would they design it from the get-go with such a fatal flaw that would risk their own adversaries gathering "actio…

People saying that the government funds Tor so it's insecure is like saying that the government funds the army which kills people on purpose, so any government hospital will also kill people on purpose

Re: Is Tor still safe to use?

#235

Post by teaearlgraycold »

bragr wrote: post #222
alasdair_ wrote: post #35

Here is what I don't understand: Let's say I as a private individual fund 1000 tor nodes (guard and exit nodes included) and have them all log everything. This could cost less than $5000 for a month, with some time needed to get guard node status. I want to find a certain kind of person so I look for people that access a specific hidden service or clearnet url. Surely eventually I'm going to get a hit where all three…

>This could cost less than $5000 for a month I ran a bunch of nodes for a couple years and that's optimistic by perhaps an order of magnitude. No $5 a month VPS provides enough bandwidth to sustain the monthly traffic of a Tor node, and nodes need to be continuously online and serving traffic for about 2-3 months[1] before they will be promoted to guard relays. Throttling traffic to stay in your bandwidth allocation…

Still easily within the budget of the US, Russia, China, Israel, etc. I wouldn't be surprised if a majority of nodes are ran by intelligence agencies.

Re: Is Tor still safe to use?

#236

Post by slg »

emseetech wrote: post #218
alasdair_ wrote: post #35

Here is what I don't understand: Let's say I as a private individual fund 1000 tor nodes (guard and exit nodes included) and have them all log everything. This could cost less than $5000 for a month, with some time needed to get guard node status. I want to find a certain kind of person so I look for people that access a specific hidden service or clearnet url. Surely eventually I'm going to get a hit where all three…

Using Tor, like all security and privacy tools, must be balanced against what it is being used for. We will always live in a world of limited resources for policing, and systems of privacy work by increasing the difficulty and cost to deanonymize someone. They don't have to be perfect, they just have to be expensive. If you want basic anonymity while researching someone powerful or accessing information, it's extreme…

>If you want basic anonymity while researching someone powerful or accessing information, it's extremely unlikely anyone is going to go the lengths people are bringing up here as a way to compromise Tor. The intersection of expertise, funding and time required is too great for such a low value target.

Doesn't a solid VPN service also satisfy this exact need? Tor seems to occupy a narrow niche in which you have to care much more about privacy than the average person, but not at a nation state level. I think that is how it got associated with that 2nd tier of internet crime like buying drugs on the dark web or sharing CSAM. The truly sophisticated internet criminals probably know better and the people who only really care about anonymizing themselves are probably doing something simpler.

Re: Is Tor still safe to use?

#237

Post by alt187 »

fsckboy wrote: post #74
barbazoo wrote: post #65

Earlier quoted context omitted.

Are you implying that Tor is primarily used for illegal or "immoral" purposes?

are you implying that Tor is not used for illegal or immoral purposes? (I took out the primarily that you threw in to make your argument stronger because that made my argument stronger, and I took out your scare quotes because morality doesn't scare me)

What's a scare quote?

Re: Is Tor still safe to use?

#238

Post by iancarroll »

londons_explore wrote: post #189
basedrum wrote: post #185

Earlier quoted context omitted.

I run an exit node, and I know several people who do, I dont suspect any of them to be anything but people who care about privacy, surveillance, and helping people get access to the free internet from restrictive locations. I admit, I bristled at your comment, because I do not like myself, the EFF, and many of my close friends being imagined as part of the US Government.

I ran an exit node for a while, and found myself auto-banned from so many services that I stopped running the node and threw away my IP range (which now would be worth $$$ - oh well!)

I ran Tor nodes, had a bunch of blacklisted IPs, and just stopped running them and it was fine? Blacklisting Tor nodes requires updating the data often, so it falls off pretty quickly. To discard an entire /24 would be pretty funny over that!

Re: Is Tor still safe to use?

#239

Post by DabbyDabberson »

throwaway37821 wrote: post #178
sigmoid10 wrote: post #64

Earlier quoted context omitted.

>Surely eventually I'm going to get a hit where all three nodes in the circuit are my nodes that are logging everything? The word "eventually" is doing a lot of heavy lifting here. Let's say you actually manage to add 1000 servers to the tor network somehow without getting detected. The network currently sits at just under 8000 nodes. For simplicity, lets also ignore that there are different types of nodes and geogra…

75% [0] of all Tor nodes are hosted within 14 Eyes [1] countries, so it would actually be quite trivial for the NSA to de-anonymize a Tor user. It baffles me that Tor Browser doesn't provide an easy way to blacklist relays in those countries. [0] Here, you can do the math yourself: https://metrics.torproject.org/rs.html#aggregate/all [1] https://en.wikipedia.org/wiki/Five_Eyes#Fourteen_Eyes > Edit: For all the cynics…

Its important to realize that TOR is primarily funded and controlled by the US Navy. The US benefits from the TOR being private.

It provides a channel for operatives to exfiltrate data out of non-NATO countries very easily.

Re: Is Tor still safe to use?

#240

Post by bawolff »

teaearlgraycold wrote: post #235
bragr wrote: post #222

Earlier quoted context omitted.

>This could cost less than $5000 for a month I ran a bunch of nodes for a couple years and that's optimistic by perhaps an order of magnitude. No $5 a month VPS provides enough bandwidth to sustain the monthly traffic of a Tor node, and nodes need to be continuously online and serving traffic for about 2-3 months[1] before they will be promoted to guard relays. Throttling traffic to stay in your bandwidth allocation…

Still easily within the budget of the US, Russia, China, Israel, etc. I wouldn't be surprised if a majority of nodes are ran by intelligence agencies.

I think the threat model is that the majority are not run by cooperating malicious parties.

Russia, china and usa all dont like each other much so are probably not sharing notes (in theory).

Post reply on HN