Live data from Hacker News

Is Tor still safe to use?

blog.torproject.org

331–340 of 602 posts

Re: Is Tor still safe to use?

#331

Earlier quoted context omitted.

75% [0] of all Tor nodes are hosted within 14 Eyes [1] countries, so it would actually be quite trivial for the NSA to de-anonymize a Tor user. It baffles me that Tor Browser doesn't provide an easy way to blacklist relays in those countries. [0] Here, you can do the math yourself: https://metrics.torproject.org/rs.html#aggregate/all [1] https://en.wikipedia.org/wiki/Five_Eyes#Fourteen_Eyes > Edit: For all the cynics…

TOR as it exists now is a honeypot simple as. Same as that documentary called "Benedict Cumberbniamnatch's Great Work" where they cracked the radio signals of the Frenchmen but they had to let the submarine sink so that they knew that the other guy doesn't know that they knew. NSA uses ROT which is TOR-inspired but takes the techniques and incognito aspects 7 or 8 steps ahead.

What? Tor is a honeypot? I don't think so. What do you instead expect me to use instead of tor?

Re: Is Tor still safe to use?

#332

Earlier quoted context omitted.

I'm not an exit node. You can buy a vps with xmr if you're worried about privacy from law enforcement.

most vps don't support xmr though. any suggestions to whom I can trust (I basically only trust hetzner in vps space)

https://monerica.com/

ctrl-f for web hosting

Re: Is Tor still safe to use?

#333

Earlier quoted context omitted.

I'm not an exit node. You can buy a vps with xmr if you're worried about privacy from law enforcement.

most vps don't support xmr though. any suggestions to whom I can trust (I basically only trust hetzner in vps space)

Some do though. I got started a minecraft server the other month that i paid for in xmr. You can go to like a VPS aggregator like serverhunter.com and filter those that allow altcoins as payment

https://www.serverhunter.com/#query=stock%3A%28in_stock+OR+u...

Re: Is Tor still safe to use?

#334

Earlier quoted context omitted.

Its important to realize that TOR is primarily funded and controlled by the US Navy. The US benefits from the TOR being private. It provides a channel for operatives to exfiltrate data out of non-NATO countries very easily.

> It provides a channel for operatives to exfiltrate data out of non-NATO countries very easily. I'm not convinced this is the case. For example China's gfw has been very effective at blocking TOR traffic, and any TOR connection in other countries is like announcing to the government that you are suspicious.

It’s a little silly to say “for example” and then intentionally pick what is widely known as the most sophisticated and pervasive system for controlling Internet traffic ever created.

The parent said “non-NATO countries”… there are 162 of those that are not China.

(It’s also a little silly to specify “non-NATO” since U.S. intelligence services have to exfiltrate data from NATO countries too…)

To get data out of China, the U.S. undoubtedly has special systems, which are worth the special investment because it’s China.

Re: Is Tor still safe to use?

#335

The more privacy the better as far as I'm concerned, but I've never used tor. What are people using tor for? General comms, piracy (mild illegal), other (very illegal), ...?

Besides regular browsing (basically a free VPN), a pretty nice use case of Tor is that some news sites have non-paywalled onion addresses.

The Guardian: https://www.guardian2zotagl6tmjucg3lrhxdk4dw3lhbqnkvvkywawy3...

New York Times: https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2l...

BBC: https://www.bbcweb3hytmzhn5d532owbu6oqadra5z3ar726vq5kgwwn6a...

Re: Is Tor still safe to use?

#336

Earlier quoted context omitted.

This would help negate that interference. https://en.wikipedia.org/wiki/Five_Eyes

Specifically what I chose US (allies implied), China, and Russia. These should be three competing factions.

I think even Russia and the US still do intelligence sharing on a lot of stuff - and that's before you consider that the US seems to be in everybody's networks anyhow, so non-sharing is probably just sharing with a bit more skullduggery.

Re: Is Tor still safe to use?

#337

Here is what I don't understand: Let's say I as a private individual fund 1000 tor nodes (guard and exit nodes included) and have them all log everything. This could cost less than $5000 for a month, with some time needed to get guard node status. I want to find a certain kind of person so I look for people that access a specific hidden service or clearnet url. Surely eventually I'm going to get a hit where all three…

>Surely eventually I'm going to get a hit where all three nodes in the circuit are my nodes that are logging everything? The word "eventually" is doing a lot of heavy lifting here. Let's say you actually manage to add 1000 servers to the tor network somehow without getting detected. The network currently sits at just under 8000 nodes. For simplicity, lets also ignore that there are different types of nodes and geogra…

> If you look closely at the actual high profile cases where people got busted despite using tor, these people always made other mistakes that led authorities to them.

Assuming tor always was or became broken and is exploitable by law enforcement, authorities would try to maintain a false believe of tor's integrity so as to crack high profile cases for as long as possible.

Within this scenario, it is plausible to assume that authorities can decipher and discover information that can be used as the official pretextual charge / minor reason ("they made the mistake to use their public email address on the dark net forum") in order to not spill the beans on the actual means (here, tor being broken).

Re: Is Tor still safe to use?

#338

Here is what I don't understand: Let's say I as a private individual fund 1000 tor nodes (guard and exit nodes included) and have them all log everything. This could cost less than $5000 for a month, with some time needed to get guard node status. I want to find a certain kind of person so I look for people that access a specific hidden service or clearnet url. Surely eventually I'm going to get a hit where all three…

This came out yesterday: https://www.youtube.com/watch?v=Gs0-8ZwZgwI

Apparently in germany they caught a pedo like that. Watching certain nodes and the sizes of files that are sent between them to identify the admin of a pedophile image sharing forum. Took them 1 1/2 years to identify the specific person, but they got him.

Considering this I would imagine it's pretty safe for the average user since they have to specifically target you for a long time, however it seems like with enough effort it's possible to identify someone even without Clearnet slip-ups like it was the case with Silkroad.

Once they have your address they will just storm your house and catch you on the computer, then you are done for.

Re: Is Tor still safe to use?

#339

Here is what I don't understand: Let's say I as a private individual fund 1000 tor nodes (guard and exit nodes included) and have them all log everything. This could cost less than $5000 for a month, with some time needed to get guard node status. I want to find a certain kind of person so I look for people that access a specific hidden service or clearnet url. Surely eventually I'm going to get a hit where all three…

>Surely eventually I'm going to get a hit where all three nodes in the circuit are my nodes that are logging everything? The word "eventually" is doing a lot of heavy lifting here. Let's say you actually manage to add 1000 servers to the tor network somehow without getting detected. The network currently sits at just under 8000 nodes. For simplicity, lets also ignore that there are different types of nodes and geogra…

[dead]

Re: Is Tor still safe to use?

#340

Earlier quoted context omitted.

How are you imagining the penultimate node in the chain connects to the target server without knowing anything about them?

This is well understood public knowledge. https://community.torproject.org/onion-services/overview/

Hook, line, and sinker.

https://www.sciencedirect.com/science/article/pii/S266729522...

https://www.usenix.org/system/files/raid2019-iacovazzi.pdf

https://www.ndss-symposium.org/ndss-paper/flow-correlation-a...

Post reply on HN