Live data from Hacker News

Is Tor still safe to use?

blog.torproject.org

281–290 of 602 posts

Re: Is Tor still safe to use?

#281

Here is what I don't understand: Let's say I as a private individual fund 1000 tor nodes (guard and exit nodes included) and have them all log everything. This could cost less than $5000 for a month, with some time needed to get guard node status. I want to find a certain kind of person so I look for people that access a specific hidden service or clearnet url. Surely eventually I'm going to get a hit where all three…

Using Tor, like all security and privacy tools, must be balanced against what it is being used for. We will always live in a world of limited resources for policing, and systems of privacy work by increasing the difficulty and cost to deanonymize someone. They don't have to be perfect, they just have to be expensive. If you want basic anonymity while researching someone powerful or accessing information, it's extreme…

The problem with this assumption, that all possible attacks have been narrowed down to expensive only attacks i.e nation station level. These are complex systems and its not possible to prove that the only form of attacks are within these overton Windows. There may be much simpler forms of attack that aren't expensive, but the experts aren't aware of them, and therefore not focusing on. This is one of the big reasons for provably secure systems like Sel4 and other functional programming paradigms. We can't prove that all the problems are in this expensive box we put ourselves in, and all it takes is a 12 year old to discover one of these cheap attacks with a tooth pick or kids toy undermine very expensive defence systems.

Take for example, John Draper who discovered in the 60's that a Captain Crunch whistle toy could be used to make free phone calls on the telephone systems. Or the discovery of Side Channel attacks by an engineer at Bell Telephone company who noticed that a Bell Telephone model 131-B2 would produce distinct spikes for each key pressed on the oscilloscope across the room. Therefore not requiring nation station level expense to break the encryption used by Navy and Army's encryption systems. Or during the Afghan war, the US was deploying armored vehicles that they assumed would provide good protection, and would be expensive to attack by the enemy. Turned out they could make IEDs from inverted copper cheaply and within locals kitchens. That proved very successful. Or the kid who discovered he could bypass the mint screensaver by smashing random keys on the keyboard (https://github.com/linuxmint/cinnamon-screensaver/issues/354). The list of these types of cheap attacks are throughout history.

Re: Is Tor still safe to use?

#283

Here is what I don't understand: Let's say I as a private individual fund 1000 tor nodes (guard and exit nodes included) and have them all log everything. This could cost less than $5000 for a month, with some time needed to get guard node status. I want to find a certain kind of person so I look for people that access a specific hidden service or clearnet url. Surely eventually I'm going to get a hit where all three…

Your 1000 Tor nodes would quickly be detected as bad relays and be removed from the network. It would also cost you far more than $5,000 a month.

Re: Is Tor still safe to use?

#284
post #112

Earlier quoted context omitted.

Are you implying that Tor is primarily used for illegal or "immoral" purposes?

I would assume very likely yes? There definitely are legit use cases for it and in an ideal world, I think all traffic should go over onion routing by default to protect them. But in reality today besides a handful of idealists (like me some years ago), and legitimate users, like protestors under oppressive regimes - I would assume the biggest group with a concrete interest to hide would be indeed pedophiles and othe…

You would assume wrong then. The majority of Tor traffic is just normal people, not illegal stuffs.

The regular internet aka clearnet has far more malicious activity and traffic.

Re: Is Tor still safe to use?

#286
post #233

Absolutist statements about services like TOR or VPNs are often not helpful. It's highly contextual to the threat. If the threat is a state actor it's likely nothing, TOR included, can preclude them from determining things about you that you would prefer them not to know. Some specific state actors operate TOR entry and exit routers and can perform analysis which is different to others who just have access to the inf…

I'm being pedantic but it's simply just Tor, not TOR.

https://support.torproject.org/about/why-is-it-called-tor/

>Note: even though it originally came from an acronym, Tor is not spelled "TOR". Only the first letter is capitalized. In fact, we can usually spot people who haven't read any of our website (and have instead learned everything they know about Tor from news articles) by the fact that they spell it wrong.

Re: Is Tor still safe to use?

#287

Earlier quoted context omitted.

It’s then best we’ve got for achieving actually meaningful privacy and anonymity. It has a huge body of research behind it that is regularly ignored by those coming up with sexy or off-the-cuff alternatives. It’s the most popular so it gets the most attention: from academics, criminals, law enforcement, journalists, …

it was used by Snowden to leak documents...

Snowden got caught.

Re: Is Tor still safe to use?

#288
post #194

Earlier quoted context omitted.

Isn't this yet another example of if they have your physical machine, it's already game over?

No? Any modern disk encryption system with a strong passphrase (basically, anything but default-BitLocker) is very effective against "they have your physical machine and it's off" for any known, current adversary. And, the basic cryptography in use is common, robust, and proven enough that this is probably true even if your tinfoil hat is balled quite tightly. Where modern research effort goes is into protecting agai…

You're talking much more hypothetical than the actual situation that was linked up stream from here. Context is crucial

Re: Is Tor still safe to use?

#289
post #222

Earlier quoted context omitted.

>This could cost less than $5000 for a month I ran a bunch of nodes for a couple years and that's optimistic by perhaps an order of magnitude. No $5 a month VPS provides enough bandwidth to sustain the monthly traffic of a Tor node, and nodes need to be continuously online and serving traffic for about 2-3 months[1] before they will be promoted to guard relays. Throttling traffic to stay in your bandwidth allocation…

You don’t technically need separate nodes, just separate IP addresses. Although Tor has some marginal protections against circuits sharing relays with similar IP, so you couldn’t just get a /24 and hope they all get the same circuit.

This is what providers such as https://www.vultr.com/ are for:

https://www.vultr.com/features/datacenter-locations/

Re: Is Tor still safe to use?

#290
No. It is not. More than 1/3 of the Tor servers are run by US Federal Govt as does other members of the Five Eyes. Israel has a large number as well. Cases are built backwards or in parallel that are from the fruit of the poisonous tree. If you don't know what that term means, look it up.

Use Tor with extreme caution.

Post reply on HN