Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is Tor still safe to use?

blog.torproject.org

Post reply on HN
Print view View original

341–350 of 602 posts

Re: Is Tor still safe to use?

#341

Post by treebeard901 »

ARandomerDude wrote: post #317
yencabulator wrote: post #315

Earlier quoted context omitted.

> man in the middle decryption How would that work?

Start an NSA cutout called Cloudflare. Configure sites to use an SSL/TLS connection to Cloudflare, then a separate SSL/TLS connection from Cloudflare to your actual machine. Then have the marketing team call it "Strict" encryption. Make it free so everyone uses it.

It is also a lot easier since ceetificate pinning has fallen out of favor. Many sites use LetsEncrypt. The Certificate Authority system itself is not reliable.

In a way it is the perfect solution from a Govt perspective. Other countries have systems at this scale and larger. China for example.

Re: Is Tor still safe to use?

#342

Post by tptacek »

xyst wrote: post #38
no-dr-onboard wrote: post #25

Earlier quoted context omitted.

After the Snowden revelations regarding FOXACID and QUANTUM going largely undressed in the tor project, people have every right to feel sketched out with using ToR for anything. "We're still helping people" just isn't a good enough argument for most people. https://www.schneier.com/blog/archives/2013/10/how_the_nsa_a... https://blog.torproject.org/yes-we-know-about-guardian-artic...

Wonder what has replaced “Xkeyscore” given the wide adoption of TLS. I know ISPs, especially national ISPs like AT&T (see: titanpointe - 33 thomas st, nyc) would feed data to NSA since traffic at the time was mostly via http (rather than https). I suppose the unencrypted dns queries are still useful (although DNSSEC is supposed to defend against snooping/deep packet inspection)

DNSSEC is a replacement for the commercial WebPKI that is run by world governments.

Re: Is Tor still safe to use?

#343

Post by bigbacaloa »

sigmoid10 wrote: post #87
PeterisP wrote: post #81

Earlier quoted context omitted.

If someone would do the thing-to-be-detected (e.g. accessing CSAM) every day, then that 0.14% probability of detection turns out to be 40% for a single year (0.9986^365) or 64% over two years, so even that would deanonymize the majority of such people over time.

That assumes you could run thousands of malicious tor nodes for several years without being detected. Unless you have vast resources and time, this is unlikely.

[dead]

Re: Is Tor still safe to use?

#344

Post by lukan »

edm0nd wrote: post #284
lukan wrote: post #112

Earlier quoted context omitted.

I would assume very likely yes? There definitely are legit use cases for it and in an ideal world, I think all traffic should go over onion routing by default to protect them. But in reality today besides a handful of idealists (like me some years ago), and legitimate users, like protestors under oppressive regimes - I would assume the biggest group with a concrete interest to hide would be indeed pedophiles and othe…

You would assume wrong then. The majority of Tor traffic is just normal people, not illegal stuffs. The regular internet aka clearnet has far more malicious activity and traffic.

Can you link to some data, that proofs this?

I have no data, just assumptions.

Re: Is Tor still safe to use?

#345

Post by cubesnooper »

lifeisstillgood wrote: post #137

I am interested in the “legitimate” uses for tor. I have not kept up with this but I understand it was designed by US Navy to make it hard for oppressive regiemes to track their citizens use of web. What do we want Tor for except as a hope that Russian citizens might be able to get to the BBC site? I am asking honestly - and would prefer not to be told my own government is on the verge of a mass pogrum so we had bett…

I browse social media sites like Facebook and Reddit using their onion services. I was sick of seeing ads pop up that were clearly based on tracking my general browsing activity through IP correlation, tracking pixels and embedded “like” buttons. So now I block all cleartext Facebook/Reddit traffic completely.

Using Tor this way doesn’t anonymize me—on Facebook at least, I’m logged in under my own account—but it limits the profile Meta builds on me to the union of what it directly observes on Facebook and what it can purchase through data brokers. Ever since I started doing this, I’ve noticed a huge drop in relevance in my Facebook ads, so apparently it’s working. When the ads become suddenly relevant again (which has happened a few times), it exposes an information leak: usually a credit card purchase that Meta must have obtained from either my bank or the shop vendor and tied to my identity.

Using a VPN could theoretically provide the same benefit, but in practice Facebook tended to temporarily lock my account when using a VPN and Reddit blocks VPN traffic completely. So I stick to the onion services, which are run by the websites themselves and so are less likely to be treated as malicious traffic.

If you use these platforms, I recommend bookmarking their onion sites in Tor Browser and using it as your primary interface to them for a while. Then, if you don’t find it too inconvenient, start blocking the non‐onion versions of the sites on your network.

https://old.reddittorjg6rue252oqsxryoxengawnmo46qy4kyii5wtqn...

https://www.facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg...

(P.S.: You shouldn’t trust the links I just posted; I could have posted fake ones! I recommend double‐checking against https://github.com/alecmuffett/real-world-onion-sites which links to proofs of onion site ownership under their usual domain names.)

Re: Is Tor still safe to use?

#346

Post by worldsayshi »

ziddoap wrote: post #102
worldsayshi wrote: post #101

Earlier quoted context omitted.

But it doesn't seem unfeasible for a state actor that wants to track their population then?

The comment that spawned this chain starts with: > Let's say I as a private individual

Yes that's why I said 'but'. It still seems relevant to the discussion and I wasn't aware that such attack was possible.

Re: Is Tor still safe to use?

#347

Post by GTP »

arktos_ wrote: post #309
voldacar wrote: post #299

Earlier quoted context omitted.

I started a tor relay on a spare vps about a month ago and it got guard status around 2-3 weeks in, so that info seems to be out of date.

Pardon my ignorance, but I thought it fruitful to ask: Are there any issues that can arise by doing this on a VPS? I ask because I know of stories of law enforcement sending inquiries to owners of, say, exit nodes requiring certain information about given traffic. I don't know if this happens for middle-nodes (or whatever they're called). Moreover, are there any issues with associating a node to, you know, your name…

I never operated a TOR node, but as far as I know and heard from other sources, TOR realays don't get much attention from law enforcement, it any attention at all. Which makes sense: all they're doing is getting encrypted traffic in and giving encrypted traffic out. It would hard for them to link a relay node to a specific connection, and even if they do, you can't help them in any way: even you as the node operator are only able to see encrypted traffic.

Edit: there's a youtuber called "Mental Outlaw" that published a while ago some videos about setting up and operating TOR nodes. He sometimes gives inaccurate information regarding more theoretical topics, so I don't follow him much. But I think he can be trusted for this practical topics.

Re: Is Tor still safe to use?

#348

Post by Refusing23 »

alasdair_ wrote: post #35

Here is what I don't understand: Let's say I as a private individual fund 1000 tor nodes (guard and exit nodes included) and have them all log everything. This could cost less than $5000 for a month, with some time needed to get guard node status. I want to find a certain kind of person so I look for people that access a specific hidden service or clearnet url. Surely eventually I'm going to get a hit where all three…

But the more who use it and/or host tor nodes...

Re: Is Tor still safe to use?

#349

Post by itake »

avidiax wrote: post #229
itake wrote: post #210

Earlier quoted context omitted.

1/ if a user sends 10,000 requests, you're saying 14 of them might see 3 compromised nodes? 2/ Police can use parallel construction. Although, given enough time (in theory) parallel construction is eventually exposed.

> given enough time (in theory) parallel construction is eventually exposed. Parallel construction has existed for decades. It's even in "The Wire". It has never been tested in court, probably because it is nearly impossible to discover outside of being the agents that implement it.

The police used self-powered GPS devices[1] to track criminals. These devices are used in various situations, such as when someone violates parole. The police don’t need to report the violation immediately. Instead, they wait for the person to re-enter their jurisdiction, then catch and arrest them.

Parallel construction wasn't tested, but the means of them catching criminals this way was tested in court.

[0] - https://www.gps.gov/news/2012/01/supremecourt/

[1] - if the device got power from the vehicle, it would be considered "break and entering" and thus would require a warrant.

Re: Is Tor still safe to use?

#350

Post by hkt »

Imustaskforhelp wrote: post #331
amy-petrik-214 wrote: post #321

Earlier quoted context omitted.

TOR as it exists now is a honeypot simple as. Same as that documentary called "Benedict Cumberbniamnatch's Great Work" where they cracked the radio signals of the Frenchmen but they had to let the submarine sink so that they knew that the other guy doesn't know that they knew. NSA uses ROT which is TOR-inspired but takes the techniques and incognito aspects 7 or 8 steps ahead.

What? Tor is a honeypot? I don't think so. What do you instead expect me to use instead of tor?

I2P, possibly
Post reply on HN