Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is Tor still safe to use?

blog.torproject.org

Post reply on HN
Print view View original

301–310 of 602 posts

Re: Is Tor still safe to use?

#301

Post by Naturally »

RiverCrochet wrote: post #169
2OEH8eoCRo0 wrote: post #42

It's safe if you ain't a pedo or terrorist. Sometimes I wonder wtf y'all are doing with such crazy security expectations and paranoia.

1. It's fun. Playing with these technologies is entertaining and will learn you some good stuff about the networking and the encryption and what not. 2. Tor allows reception of unsolicited TCP/IPv4 traffic if you are behind a NAT you can't open ports for, because your connection to the network is initiated on your side. This is nice, especially with increasing prevalence of CGNAT. 3. Something my niece stated when I…

Your niece's reasoning sounds excellent to me, I am pleased you have included it.

Re: Is Tor still safe to use?

#303

Post by sureIy »

lifeisstillgood wrote: post #137

I am interested in the “legitimate” uses for tor. I have not kept up with this but I understand it was designed by US Navy to make it hard for oppressive regiemes to track their citizens use of web. What do we want Tor for except as a hope that Russian citizens might be able to get to the BBC site? I am asking honestly - and would prefer not to be told my own government is on the verge of a mass pogrum so we had bett…

How would you feel if a stranger came up to you in the street and said they appreciated the wiki article you were reading last night?

I think everyone wants “privacy by default”, they just don’t make the connection between this hypothetical and real life. In real life you’re still spied but nobody confronts you directly.

Re: Is Tor still safe to use?

#304

Post by alphan0n »

throwaway37821 wrote: post #178
sigmoid10 wrote: post #64

Earlier quoted context omitted.

>Surely eventually I'm going to get a hit where all three nodes in the circuit are my nodes that are logging everything? The word "eventually" is doing a lot of heavy lifting here. Let's say you actually manage to add 1000 servers to the tor network somehow without getting detected. The network currently sits at just under 8000 nodes. For simplicity, lets also ignore that there are different types of nodes and geogra…

75% [0] of all Tor nodes are hosted within 14 Eyes [1] countries, so it would actually be quite trivial for the NSA to de-anonymize a Tor user. It baffles me that Tor Browser doesn't provide an easy way to blacklist relays in those countries. [0] Here, you can do the math yourself: https://metrics.torproject.org/rs.html#aggregate/all [1] https://en.wikipedia.org/wiki/Five_Eyes#Fourteen_Eyes > Edit: For all the cynics…

This entirely ignores the fact that traffic to and from onion sites never leaves the Tor network, never utilizes an exit node. It doesn’t matter if a bad actor has control of every exit node if your communications are within the network unless the underlying encryption protocols have been compromised.

Re: Is Tor still safe to use?

#305

Post by HDThoreaun »

DabbyDabberson wrote: post #239
throwaway37821 wrote: post #178

Earlier quoted context omitted.

75% [0] of all Tor nodes are hosted within 14 Eyes [1] countries, so it would actually be quite trivial for the NSA to de-anonymize a Tor user. It baffles me that Tor Browser doesn't provide an easy way to blacklist relays in those countries. [0] Here, you can do the math yourself: https://metrics.torproject.org/rs.html#aggregate/all [1] https://en.wikipedia.org/wiki/Five_Eyes#Fourteen_Eyes > Edit: For all the cynics…

Its important to realize that TOR is primarily funded and controlled by the US Navy. The US benefits from the TOR being private. It provides a channel for operatives to exfiltrate data out of non-NATO countries very easily.

I dont see how TOR is better than just spinning up a server on the public cloud for each asset. Since each asset would have a different IP they couldnt use one assets knowledge to catch the others. Non-NATO countries tend to monitor internet traffic and so would know if you access TOR.

Re: Is Tor still safe to use?

#306

Post by literallycancer »

firen777 wrote: post #279
DabbyDabberson wrote: post #239

Earlier quoted context omitted.

Its important to realize that TOR is primarily funded and controlled by the US Navy. The US benefits from the TOR being private. It provides a channel for operatives to exfiltrate data out of non-NATO countries very easily.

> It provides a channel for operatives to exfiltrate data out of non-NATO countries very easily. I'm not convinced this is the case. For example China's gfw has been very effective at blocking TOR traffic, and any TOR connection in other countries is like announcing to the government that you are suspicious.

How do they see TOR traffic in a TLS tunnel?

Re: Is Tor still safe to use?

#307

Post by ec109685 »

deviantbit wrote: post #290

No. It is not. More than 1/3 of the Tor servers are run by US Federal Govt as does other members of the Five Eyes. Israel has a large number as well. Cases are built backwards or in parallel that are from the fruit of the poisonous tree. If you don't know what that term means, look it up. Use Tor with extreme caution.

Or just hit onion services that don’t require exit nodes.

Re: Is Tor still safe to use?

#308

Post by [deleted] »

panarky wrote: post #271
ClumsyPilot wrote: post #244

Earlier quoted context omitted.

> could capture the sessions of 10,940 criminals in a given month Let’s say to do that, and now you have found 10k people accessing pirate bay in countries where it is blocked. Also you captured someone who lives in Siberia and watches illegal porn, now what? Many of these will not be actionable, like not criminals you would have interest in.

An autocratic regime of a large nation locks up its critics and other undesirables in camps. 100,000 activists who haven't been caught yet switch to Tor for anonymity. For $60,000, the regime monitors Tor for a year, identifies 6,500 activists, and marches them off to the camps. And by discrediting Tor the regime pushes the other 93,500 activists even farther underground, constraining their ability to recruit, limiti…

[deleted]

Re: Is Tor still safe to use?

#309

Post by arktos_ »

voldacar wrote: post #299
bragr wrote: post #222

Earlier quoted context omitted.

>This could cost less than $5000 for a month I ran a bunch of nodes for a couple years and that's optimistic by perhaps an order of magnitude. No $5 a month VPS provides enough bandwidth to sustain the monthly traffic of a Tor node, and nodes need to be continuously online and serving traffic for about 2-3 months[1] before they will be promoted to guard relays. Throttling traffic to stay in your bandwidth allocation…

I started a tor relay on a spare vps about a month ago and it got guard status around 2-3 weeks in, so that info seems to be out of date.

Pardon my ignorance, but I thought it fruitful to ask: Are there any issues that can arise by doing this on a VPS?

I ask because I know of stories of law enforcement sending inquiries to owners of, say, exit nodes requiring certain information about given traffic. I don't know if this happens for middle-nodes (or whatever they're called).

Moreover, are there any issues with associating a node to, you know, your name and billing information?

I don't know much about this, and although I could look it up, I think that my questions - and your respective answers or those of others - might do some public service of information sharing here.

Re: Is Tor still safe to use?

#310

Post by dumbo-octopus »

alphan0n wrote: post #300
dumbo-octopus wrote: post #92

Earlier quoted context omitted.

You don’t need all the middle nodes. Just the entry and exit, and enough data to do packet timing analysis to correlate them. It’s in fact shockingly easy for a well provisioned actor to trace tor traffic, and this is something the TOR project openly admits. They’re financed by the US Government after all…

Onion sites do not utilize an exit node.

There is a node that delivers your packet to the target server, is there not?
Post reply on HN