Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is Tor still safe to use?

blog.torproject.org

Post reply on HN
Print view View original

351–360 of 602 posts

Re: Is Tor still safe to use?

#351

Post by 0points »

alfiedotwtf wrote: post #270
bragr wrote: post #222

Earlier quoted context omitted.

>This could cost less than $5000 for a month I ran a bunch of nodes for a couple years and that's optimistic by perhaps an order of magnitude. No $5 a month VPS provides enough bandwidth to sustain the monthly traffic of a Tor node, and nodes need to be continuously online and serving traffic for about 2-3 months[1] before they will be promoted to guard relays. Throttling traffic to stay in your bandwidth allocation…

If it’s that expensive to run Tor nodes, who is actually paying for them? I’ve heard individuals getting doors kicked in for participating in the network, so it’s not individuals. Corporates too wouldn’t want this type of burden… so is it really just spy-vs-spy

> I’ve heard individuals getting doors kicked in for participating in the network, so it’s not individuals.

It's individuals

Re: Is Tor still safe to use?

#352

Post by p4bl0 »

alfiedotwtf wrote: post #270
bragr wrote: post #222

Earlier quoted context omitted.

>This could cost less than $5000 for a month I ran a bunch of nodes for a couple years and that's optimistic by perhaps an order of magnitude. No $5 a month VPS provides enough bandwidth to sustain the monthly traffic of a Tor node, and nodes need to be continuously online and serving traffic for about 2-3 months[1] before they will be promoted to guard relays. Throttling traffic to stay in your bandwidth allocation…

If it’s that expensive to run Tor nodes, who is actually paying for them? I’ve heard individuals getting doors kicked in for participating in the network, so it’s not individuals. Corporates too wouldn’t want this type of burden… so is it really just spy-vs-spy

Many individuals contribute to running relays. And there are non-profit organizations collecting donations to operates Tor exit nodes:

- https://www.torservers.net/

- https://nos-oignons.net/

Re: Is Tor still safe to use?

#353

Post by hkt »

panarky wrote: post #271
ClumsyPilot wrote: post #244

Earlier quoted context omitted.

> could capture the sessions of 10,940 criminals in a given month Let’s say to do that, and now you have found 10k people accessing pirate bay in countries where it is blocked. Also you captured someone who lives in Siberia and watches illegal porn, now what? Many of these will not be actionable, like not criminals you would have interest in.

An autocratic regime of a large nation locks up its critics and other undesirables in camps. 100,000 activists who haven't been caught yet switch to Tor for anonymity. For $60,000, the regime monitors Tor for a year, identifies 6,500 activists, and marches them off to the camps. And by discrediting Tor the regime pushes the other 93,500 activists even farther underground, constraining their ability to recruit, limiti…

> reducing what they can publish about what's happening to their country.

To what audience? It isn't quite what you're getting at in your post but this is worth saying: graffiti, zines, contact with journalists, radio operations like pirate radio, all of it is much more established and less uncertain in risk profile than being online. Crucially it may also be more effective.

Re: Is Tor still safe to use?

#355

Post by akimbostrawman »

Imustaskforhelp wrote: post #329
voldacar wrote: post #320

Earlier quoted context omitted.

I'm not an exit node. You can buy a vps with xmr if you're worried about privacy from law enforcement.

most vps don't support xmr though. any suggestions to whom I can trust (I basically only trust hetzner in vps space)

>I basically only trust hetzner in vps space

https://notes.valdikss.org.ru/jabber.ru-mitm/

Re: Is Tor still safe to use?

#356

Post by akimbostrawman »

alfiedotwtf wrote: post #270
bragr wrote: post #222

Earlier quoted context omitted.

>This could cost less than $5000 for a month I ran a bunch of nodes for a couple years and that's optimistic by perhaps an order of magnitude. No $5 a month VPS provides enough bandwidth to sustain the monthly traffic of a Tor node, and nodes need to be continuously online and serving traffic for about 2-3 months[1] before they will be promoted to guard relays. Throttling traffic to stay in your bandwidth allocation…

If it’s that expensive to run Tor nodes, who is actually paying for them? I’ve heard individuals getting doors kicked in for participating in the network, so it’s not individuals. Corporates too wouldn’t want this type of burden… so is it really just spy-vs-spy

only exit nodes get there door kicked in and they are the minority and not needed for the tor network to function

Re: Is Tor still safe to use?

#357

Post by dijit »

UberFly wrote: post #325
dijit wrote: post #19

Earlier quoted context omitted.

Bitlocker, LUKS and FileVault are the new standard(s). Veracrypt is a curiousity, not beloved the way truecrypt was. I’d love to see hard numbers for this, just my outside impression. In fact, when trying to find old forums that I was part of during that era, I failed; and found only this: https://discuss.privacyguides.net/t/why-people-still-believe...

This is complete conjecture. Like Truecrypt, Veracrypt is open source, has been audited and has been actively maintained. Could it use another audit? Sure but so could Bitlocker but that isn't happening for even the first time any time soon.

I read this as intended to be some kind of rebuttal but… Where did I say it wasn't conjecture?

I was stating facts about the ecosystem. People didn't trust it at the time.

I never said there was a definite reason for that distrust.

Re: Is Tor still safe to use?

#358

Post by immibis »

arktos_ wrote: post #309
voldacar wrote: post #299

Earlier quoted context omitted.

I started a tor relay on a spare vps about a month ago and it got guard status around 2-3 weeks in, so that info seems to be out of date.

Pardon my ignorance, but I thought it fruitful to ask: Are there any issues that can arise by doing this on a VPS? I ask because I know of stories of law enforcement sending inquiries to owners of, say, exit nodes requiring certain information about given traffic. I don't know if this happens for middle-nodes (or whatever they're called). Moreover, are there any issues with associating a node to, you know, your name…

Non-exit nodes are generally considered safe to run. it's only exit nodes that system enforcement keeps trying to shut down.

Re: Is Tor still safe to use?

#359

Post by Edman274 »

system33- wrote: post #58
beeflet wrote: post #55

Earlier quoted context omitted.

Why not just have greater number of relays by default? Internet bandwidth tends to increase over time, and the odds of this correlation attack are roughly proportional to the attacker's share of relays to the power of the number of relays used. So latency issues permitting, you would expect the default number of relays to increase over time to accommodate increases in attacker sophistication. I don't think many would…

If you’re advocating for a bigger network… we need more relay operators. Can’t wave a magic wand. There’s like 8000 relays. Haven’t looked in a while. Or if you were arguing for increasing the number of relays in a circuit, that doesn’t increase security. It’s like one of the OG tor research papers deciding on 3. Bad guy just needs the first and the last. Middle irrelevant.

> we need more relay operators. Can’t wave a magic wand. There’s like 8000 relays. Haven’t looked in a while.

The reason that there are so few relays and exit nodes is that everyone that runs an exit node believes, for very good reason, that they'll be opening themselves up to subpoenas and arrest for operating one. You know who never has to worry about getting arrested? Surveillance agencies tasked with running exit nodes.

Consider the two classes of relay and exit operators:

1. People who operate relays and exit nodes long term, spending money to do so with no possibility or expectation of receiving money in return, and opening themselves up to legal liability for doing so, whose only tangible benefit comes from the gratification of contributing to an anonymous online network

2. Government agencies who operate relays and exit nodes long term, spending government allocated money to operate servers, with no material risk to the agencies and whose tangible benefit comes from deanonymizing anonymous users. Crucially, the agencies are specifically tasked with deanonymizing these users.

Now, I guess the question is whether or not you think the people in group 1 have more members and more material resources than the agencies in group 2. Do you believe that there are more people willing to spend money to run the risk of having equipment seized and arrest for no gain other than philosophical gratification than there are government computers running cost and risk free, deanonymizing traffic (which is their job to do)?

Re: Is Tor still safe to use?

#360

Post by immibis »

alfiedotwtf wrote: post #270
bragr wrote: post #222

Earlier quoted context omitted.

>This could cost less than $5000 for a month I ran a bunch of nodes for a couple years and that's optimistic by perhaps an order of magnitude. No $5 a month VPS provides enough bandwidth to sustain the monthly traffic of a Tor node, and nodes need to be continuously online and serving traffic for about 2-3 months[1] before they will be promoted to guard relays. Throttling traffic to stay in your bandwidth allocation…

If it’s that expensive to run Tor nodes, who is actually paying for them? I’ve heard individuals getting doors kicked in for participating in the network, so it’s not individuals. Corporates too wouldn’t want this type of burden… so is it really just spy-vs-spy

I run a non-exit node any time I have the spare resources. I2P too. This means they're on the same popular providers that have too many other nodes, though.

Sometimes I set it up as a bridge (hidden entry node) instead.

Post reply on HN