Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is Tor still safe to use?

blog.torproject.org

Post reply on HN
Print view View original

261–270 of 602 posts

Re: Is Tor still safe to use?

#261

Post by throwme0827349 »

adamrezich wrote: post #187
throwme0827349 wrote: post #182

Earlier quoted context omitted.

Respectfully, a large number of people rightfully fear for their lives, safety, and freedom due to being stalked or abused by a current or former partner. I have personally known several. Using victims' devices and communications in order to locate, and then harass, trap, or attack them, is commonplace for stalkers.

How many of these people are justified (by evidence, not merely paranoia) in thinking that Tor would circumvent whatever communications interception may or may not have been put in place? And of those people, how many people have ever even heard of Tor, let alone know how to use it?

What fraction of domestic violence shelter occupants are paranoid rather than reasonably fearful? What fraction are paranoid, vs. those who are reasonably afraid of being spied on in general? Probably some, but I believe many have well founded reasons to want to be anonymous and in hiding.

I concede that tor is probably not a useful tool in general for these people. I meant to point out only that one needn't be paranoid to fear one's spouse.

Re: Is Tor still safe to use?

#262

Post by bobbylarrybobby »

tg180 wrote: post #256
MR4D wrote: post #254

I’m a tor novice, so please excuse the simplistic question… Couldn’t a national security organization just modify a node to route traffic to other nodes it controls instead of uncontrolled nodes?

No! The client controls path selection, and each hop is verified using its encryption keys.

You're saying that if you modify the tor software, other clients will be able to tell before connecting to you? And you can't trick them into sending to a bad node?

Re: Is Tor still safe to use?

#263

Post by cainxinth »

theonionrouter wrote: post #197
cainxinth wrote: post #21

Earlier quoted context omitted.

The best attack against Tor is creating entrance and exit nodes that monitor traffic. That was the biggest risk factor when Tor was invented and it still is today.

How does that work technically, if I am connecting with SSL? The only thing I see is seeing which IP addresses are using Tor, when, and how much traffic exchanged, but mostly it will be a bunch of reused residential IPs? If you know who you are looking for anyway better to work with their ISP? With the exit nodes, you know which IP addresses are being looked up. You might get an exit node IP when investigating a crim…

They don't use encrypted data. They look at the metadata like packet size and timing and perform traffic correlation, which defeats Tor's primary purpose: hiding the connection between the source and destination of traffic.

Re: Is Tor still safe to use?

#264

Post by belorn »

bragr wrote: post #222
alasdair_ wrote: post #35

Here is what I don't understand: Let's say I as a private individual fund 1000 tor nodes (guard and exit nodes included) and have them all log everything. This could cost less than $5000 for a month, with some time needed to get guard node status. I want to find a certain kind of person so I look for people that access a specific hidden service or clearnet url. Surely eventually I'm going to get a hit where all three…

>This could cost less than $5000 for a month I ran a bunch of nodes for a couple years and that's optimistic by perhaps an order of magnitude. No $5 a month VPS provides enough bandwidth to sustain the monthly traffic of a Tor node, and nodes need to be continuously online and serving traffic for about 2-3 months[1] before they will be promoted to guard relays. Throttling traffic to stay in your bandwidth allocation…

Now to add additional problems. 1000 tor nodes on a single platform would be very noticeable and geographically limited. Platforms also have different weight attached to them in the consensus, which adds further time requirements before a node is promoted. The developers do not want a single platform provider to be able to observe a large portion of all the traffic, so there are counter measures.

The attacker could try to create a handful of accounts on hundreds of platforms in as many countries as possible, assuming one verify that the platforms accepts tor and do not share underlying providers and data centers. The cost would then be the average price of said providers, which is going to be a fair bit more than the cheapest providers out there. Managing and spreading them out is also going to cost a lot of man hours. Also the secops need to be fairly on the point and need to be maintained quite strictly across all the providers.

Re: Is Tor still safe to use?

#265

Post by viraptor »

throwme0827349 wrote: post #182
adamrezich wrote: post #166

Earlier quoted context omitted.

Those second and third points are pretty laughably paranoid-fantasy reasons to use Tor—even if one found oneself in either situation.

Respectfully, a large number of people rightfully fear for their lives, safety, and freedom due to being stalked or abused by a current or former partner. I have personally known several. Using victims' devices and communications in order to locate, and then harass, trap, or attack them, is commonplace for stalkers.

If you can use victim's device, then Tor or any network level protection will not help you. If you can use their network, then just about everything uses https these days... and you still need to know their location to snoop in the first place. GP raised a good point of Tor not helping in those two cases.

Those are situations that people deal with, but suggesting they use Tor is not going to help them. (Apart from some very specific situations)

Re: Is Tor still safe to use?

#266

Post by chatmasta »

bragr wrote: post #222
alasdair_ wrote: post #35

Here is what I don't understand: Let's say I as a private individual fund 1000 tor nodes (guard and exit nodes included) and have them all log everything. This could cost less than $5000 for a month, with some time needed to get guard node status. I want to find a certain kind of person so I look for people that access a specific hidden service or clearnet url. Surely eventually I'm going to get a hit where all three…

>This could cost less than $5000 for a month I ran a bunch of nodes for a couple years and that's optimistic by perhaps an order of magnitude. No $5 a month VPS provides enough bandwidth to sustain the monthly traffic of a Tor node, and nodes need to be continuously online and serving traffic for about 2-3 months[1] before they will be promoted to guard relays. Throttling traffic to stay in your bandwidth allocation…

You don’t technically need separate nodes, just separate IP addresses. Although Tor has some marginal protections against circuits sharing relays with similar IP, so you couldn’t just get a /24 and hope they all get the same circuit.

Re: Is Tor still safe to use?

#267

Post by aftbit »

bawolff wrote: post #240
teaearlgraycold wrote: post #235

Earlier quoted context omitted.

Still easily within the budget of the US, Russia, China, Israel, etc. I wouldn't be surprised if a majority of nodes are ran by intelligence agencies.

I think the threat model is that the majority are not run by cooperating malicious parties. Russia, china and usa all dont like each other much so are probably not sharing notes (in theory).

Or perhaps they _are_ sharing notes about tor users with each other, as part of a global club of intelligence agencies (a sort of new world order) who would rather not be overthrown. How are we to know?

Re: Is Tor still safe to use?

#268

Post by chiefalchemist »

verbify wrote: post #219
sigmoid10 wrote: post #64

Earlier quoted context omitted.

>Surely eventually I'm going to get a hit where all three nodes in the circuit are my nodes that are logging everything? The word "eventually" is doing a lot of heavy lifting here. Let's say you actually manage to add 1000 servers to the tor network somehow without getting detected. The network currently sits at just under 8000 nodes. For simplicity, lets also ignore that there are different types of nodes and geogra…

> Edit: For all the cynics and doomsayers here, consider this: Tor has been around for a long time, but there has never been an uptick in arrests that could be correlated to cracking the core anonymity service. If you look closely at the actual high profile cases where people got busted despite using tor, these people always made other mistakes that led authorities to them. During WW2, the British cracked the German…

> these people always made other mistakes that led authorities to them.

Says who? The intelligent community entity that busted them? If they're using a tool to discover X or Y they're not to let anyone know that.

For example, I live in the NYC area. A couple of times per year there's a drug bust on the New Jersey Turnpike of a car headed to NYC. The story is always a "random" police stop ends up in a drug bust.

Random? My arse. Of the thousands of cars on the NJTP the cops just happened to pick the one loaded with drugs? A couple times a year? I don't buy it. But what are they going to say? They have someone on the inside that tipped them off? That's not going to happen.

The intelligence community doesn't deal in truth and facts. It deals in misinformation and that the ends justify the means. What they're doing and what they say they're doing are unlikely the same.

Re: Is Tor still safe to use?

#269

Post by pphysch »

stavros wrote: post #37
jstanley wrote: post #13

The best attack against Tor is convincing people not to use it. If anyone tries to convince you Tor is not safe, ask yourself: cui bono?

I'll ask the inverse: if Tor is unsafe, who benefits from telling you to use it?

The groups that primarily fund The Tor Project, i.e. the US State and Defense Departments.

Re: Is Tor still safe to use?

#270

Post by alfiedotwtf »

bragr wrote: post #222
alasdair_ wrote: post #35

Here is what I don't understand: Let's say I as a private individual fund 1000 tor nodes (guard and exit nodes included) and have them all log everything. This could cost less than $5000 for a month, with some time needed to get guard node status. I want to find a certain kind of person so I look for people that access a specific hidden service or clearnet url. Surely eventually I'm going to get a hit where all three…

>This could cost less than $5000 for a month I ran a bunch of nodes for a couple years and that's optimistic by perhaps an order of magnitude. No $5 a month VPS provides enough bandwidth to sustain the monthly traffic of a Tor node, and nodes need to be continuously online and serving traffic for about 2-3 months[1] before they will be promoted to guard relays. Throttling traffic to stay in your bandwidth allocation…

If it’s that expensive to run Tor nodes, who is actually paying for them? I’ve heard individuals getting doors kicked in for participating in the network, so it’s not individuals. Corporates too wouldn’t want this type of burden… so is it really just spy-vs-spy
Post reply on HN