Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is Tor still safe to use?

blog.torproject.org

Post reply on HN
Print view View original

271–280 of 602 posts

Re: Is Tor still safe to use?

#271

Post by panarky »

ClumsyPilot wrote: post #244
panarky wrote: post #204

Earlier quoted context omitted.

> what is the probability that someone randomly chooses three nodes that you own. The answer is less than 0.14%. You calculated the probability that a specific person randomly chooses three nodes of the 1,000. But that's not the scenario you're responding to. >> I can't target a specific person, but eventually I can find someone who has all three bounces through tor nodes I control Tor estimates that 2.5 million peop…

> could capture the sessions of 10,940 criminals in a given month Let’s say to do that, and now you have found 10k people accessing pirate bay in countries where it is blocked. Also you captured someone who lives in Siberia and watches illegal porn, now what? Many of these will not be actionable, like not criminals you would have interest in.

An autocratic regime of a large nation locks up its critics and other undesirables in camps.

100,000 activists who haven't been caught yet switch to Tor for anonymity.

For $60,000, the regime monitors Tor for a year, identifies 6,500 activists, and marches them off to the camps.

And by discrediting Tor the regime pushes the other 93,500 activists even farther underground, constraining their ability to recruit, limiting their ability to coordinate with each other, and reducing what they can publish about what's happening to their country.

Re: Is Tor still safe to use?

#272

Post by try_the_bass »

DabbyDabberson wrote: post #239
throwaway37821 wrote: post #178

Earlier quoted context omitted.

75% [0] of all Tor nodes are hosted within 14 Eyes [1] countries, so it would actually be quite trivial for the NSA to de-anonymize a Tor user. It baffles me that Tor Browser doesn't provide an easy way to blacklist relays in those countries. [0] Here, you can do the math yourself: https://metrics.torproject.org/rs.html#aggregate/all [1] https://en.wikipedia.org/wiki/Five_Eyes#Fourteen_Eyes > Edit: For all the cynics…

Its important to realize that TOR is primarily funded and controlled by the US Navy. The US benefits from the TOR being private. It provides a channel for operatives to exfiltrate data out of non-NATO countries very easily.

> The US benefits from the TOR being private.

Slight correction: The US benefits from TOR being private to _everyone but the US_

Re: Is Tor still safe to use?

#273

Post by bmicraft »

duskwuff wrote: post #103
jancsika wrote: post #70

Earlier quoted context omitted.

A question before I enter your Manichean universe: Does Tor Browser Bundle currently ship with Ublock Origin installed and on by default?

It would be irresponsible for it to do so. Ad blocker lists can inject scripts into web pages which could compromise user privacy.

Well then ship a version that can't inject js and only block network requests. Could it be that hard?

Re: Is Tor still safe to use?

#274

Post by spl757 »

RiverCrochet wrote: post #169
2OEH8eoCRo0 wrote: post #42

It's safe if you ain't a pedo or terrorist. Sometimes I wonder wtf y'all are doing with such crazy security expectations and paranoia.

1. It's fun. Playing with these technologies is entertaining and will learn you some good stuff about the networking and the encryption and what not. 2. Tor allows reception of unsolicited TCP/IPv4 traffic if you are behind a NAT you can't open ports for, because your connection to the network is initiated on your side. This is nice, especially with increasing prevalence of CGNAT. 3. Something my niece stated when I…

I'd like to place a camera in every room of your house and stream them on my website. Surely you won't mind because you have nothing to hide. Right?

Re: Is Tor still safe to use?

#275

Post by bmicraft »

yupyupyups wrote: post #156
lukan wrote: post #112

Earlier quoted context omitted.

I would assume very likely yes? There definitely are legit use cases for it and in an ideal world, I think all traffic should go over onion routing by default to protect them. But in reality today besides a handful of idealists (like me some years ago), and legitimate users, like protestors under oppressive regimes - I would assume the biggest group with a concrete interest to hide would be indeed pedophiles and othe…

I'm pretty sure many people use Tor for other things than journalism and CP. Tor is a privacy tool. Much of what we do in our lives is on the internet, and privacy is important. Tor helps people enjoy privacy in a medium that they are increasingly dependant on.

Tor also helps you to increase your average loading time of a webpage to 10x. That's a very good deterrent against using it if you don't need it for some reason

Re: Is Tor still safe to use?

#276

Post by EasyMark »

sophacles wrote: post #198
yupyupyups wrote: post #85

Earlier quoted context omitted.

>Wonder what has replaced “Xkeyscore” given the wide adoption of TLS. Cloudflare is a US-based company that does MITM attacks on all traffic of the websites that it protects. It's part of how their DDoS mitigation works. Many people still use large US-based mail providers such as Outlook or Gmail. Many large services use AWS, GCP or Azure. Perhaps there are ways for the NSA to access customers' virtual storage or MIT…

It is MITM, but is it an attack? Literally the website owner hires Cloudflare explicity to decrypt and filter the traffic. Attack implies that it's unwanted behavior, yet the reality seems to imply that its wanted behavior by the site owner at a minimum, although continued use of the site by visitors also suggests that they want that behavior (or they'd go elsewhere).

Isn’t the attack assuming that NSA/FBI/TLO has full access to the MITM connection at will? I mean that doesn’t seem too far fetched does it give various revelations over the years and things like The Patriot Act actually passing when it’s obviously unconstitutional

Re: Is Tor still safe to use?

#277

Post by wheelerwj »

try_the_bass wrote: post #272
DabbyDabberson wrote: post #239

Earlier quoted context omitted.

Its important to realize that TOR is primarily funded and controlled by the US Navy. The US benefits from the TOR being private. It provides a channel for operatives to exfiltrate data out of non-NATO countries very easily.

> The US benefits from the TOR being private. Slight correction: The US benefits from TOR being private to _everyone but the US_

I’m glad I didn’t have to scroll too far to see your comment.

In fact, A major power wins by creating a mote just big enough that only they can cross.

Re: Is Tor still safe to use?

#278

Post by panarky »

Eisenstein wrote: post #248
panarky wrote: post #204

Earlier quoted context omitted.

> what is the probability that someone randomly chooses three nodes that you own. The answer is less than 0.14%. You calculated the probability that a specific person randomly chooses three nodes of the 1,000. But that's not the scenario you're responding to. >> I can't target a specific person, but eventually I can find someone who has all three bounces through tor nodes I control Tor estimates that 2.5 million peop…

> could capture the sessions of 10,940 criminals What does that mean? The way I understand it you would be getting traffic correlations -- which means an IP that requested traffic from another IP and got that traffic back in a certain time period. What does that tell you, exactly, about the criminal? If you aren't looking for a specific person, how would you even know they are doing crimes?

Activists fighting an autocratic regime use a large social media site to recruit, coordinate and publish so they can reach the broadest number of people possible.

The billionaire owner of the site supports the strongman leader and provides IP addresses for those who post wrongthink on his platform.

Now the regime can link social media activity of anonymous activists to their real IP addresses, devices and locations.

Re: Is Tor still safe to use?

#279

Post by firen777 »

DabbyDabberson wrote: post #239
throwaway37821 wrote: post #178

Earlier quoted context omitted.

75% [0] of all Tor nodes are hosted within 14 Eyes [1] countries, so it would actually be quite trivial for the NSA to de-anonymize a Tor user. It baffles me that Tor Browser doesn't provide an easy way to blacklist relays in those countries. [0] Here, you can do the math yourself: https://metrics.torproject.org/rs.html#aggregate/all [1] https://en.wikipedia.org/wiki/Five_Eyes#Fourteen_Eyes > Edit: For all the cynics…

Its important to realize that TOR is primarily funded and controlled by the US Navy. The US benefits from the TOR being private. It provides a channel for operatives to exfiltrate data out of non-NATO countries very easily.

> It provides a channel for operatives to exfiltrate data out of non-NATO countries very easily.

I'm not convinced this is the case. For example China's gfw has been very effective at blocking TOR traffic, and any TOR connection in other countries is like announcing to the government that you are suspicious.

Re: Is Tor still safe to use?

#280

Post by anticorporate »

aftbit wrote: post #267
bawolff wrote: post #240

Earlier quoted context omitted.

I think the threat model is that the majority are not run by cooperating malicious parties. Russia, china and usa all dont like each other much so are probably not sharing notes (in theory).

Or perhaps they _are_ sharing notes about tor users with each other, as part of a global club of intelligence agencies (a sort of new world order) who would rather not be overthrown. How are we to know?

Because if they each only have incomplete information, they each wouldn't know whether the information they have is relevant to preventing overthrow of their collective order, or intelligence that is only going to help their geopolitical adversary.

Basically, a variation of the prisoner's dilemma.

Also, those nukes we have pointed at each other are a pretty healthy hint.

Post reply on HN