Was Tor ever safe to use? I don't think so.
Yes. Why wouldn't it be?
The fact that adversaries need to rely on zero-days, or people running massively outdated and unsupported software, strongly suggests the network is safe and robust.
Is Tor still safe to use?
401–410 of 602 posts
Re: Is Tor still safe to use?
#402From what little I've heard, de-anonymization of Tor users is largely done by targeting their devices with zero-day exploits. That is still a valid method, I wouldn't trust Tor personally, but I'm with the Tor project that there is no credible evidence of a large scale de-anonymization attack.
Why wouldn't you trust Tor? Do you mean you wouldn't trust it at all, or wouldn't trust it completely?
Re: Is Tor still safe to use?
#403Earlier quoted context omitted.
No! The client controls path selection, and each hop is verified using its encryption keys.
You're saying that if you modify the tor software, other clients will be able to tell before connecting to you? And you can't trick them into sending to a bad node?
It is not the node that chooses the next one, but the client. A bad node cannot "fake" a good node, because it cannot cryptographically authenticate to be the new node the client selected (the client knows the public key of the newly selected node).
Re: Is Tor still safe to use?
#404Old Ricochet used onion v2, that has stopped working long ago as far as I know, or I am missing something
You are right. The lack of details or time window when this happened make it difficult to know what the actual compromise was, or if it is still something that can be used. However, if they compromised a Ricochet user, then this attack was a long time ago, and from what Tor's blog says that client didn't have the defenses that would have prevented the attack they think it is. Without the actual details, it seems like…
We have a rough timeframe: "To the best of our knowledge, the attacks happened between 2019–2021."
The hidden service targeted[0] had completely ceased to exist by April 2021, so that time range makes sense.
[0]: https://www.ndr.de/fernsehen/sendungen/panorama/aktuell/Inve...
Re: Is Tor still safe to use?
#405Earlier quoted context omitted.
Pardon my ignorance, but I thought it fruitful to ask: Are there any issues that can arise by doing this on a VPS? I ask because I know of stories of law enforcement sending inquiries to owners of, say, exit nodes requiring certain information about given traffic. I don't know if this happens for middle-nodes (or whatever they're called). Moreover, are there any issues with associating a node to, you know, your name…
I never operated a TOR node, but as far as I know and heard from other sources, TOR realays don't get much attention from law enforcement, it any attention at all. Which makes sense: all they're doing is getting encrypted traffic in and giving encrypted traffic out. It would hard for them to link a relay node to a specific connection, and even if they do, you can't help them in any way: even you as the node operator…
Just a quick note on the Youtube channel you mention: I follow his videos for a while and it seems to me, that he's half a shill. My impression is, that he re-models popular HN threads into Youtube videos. Just watch the latest video on the MrBeast topic and you'll basically get the same info as all the popular 'root' comments (was on HN front page last week). Not the first time I noticed a suspicious connection.
Re: Is Tor still safe to use?
#406Earlier quoted context omitted.
I think you just unintentionally highlighted the need for the tor project and outreach to inform people about it.
Not to make too much light of a morbid topic but the idea of someone having a murderous yet tech-savvy ex who has methodically installed all sorts of elaborate digital surveillance measures in their former spouse's personal tech stack in service of premeditated homicide, sitting in a dark room somewhere, howling in anger upon realizing his murder plan has (somehow...?) been thwarted by said former spouse unexpectedly…
You are lucky to have not experienced stalking. It's not like some big nefarious plan, it's a relentless obsessed hunter who will use whatever the lowest-hanging fruit is to get to you. If they have IT savvy they will use that. If they are charming they will use that. If they are brutal they will use that. They don't need to be murderous obviously, just obsessed with you.
Knowing that there's one thing they can't get to you on is huge peace of mind. Not needing to think about your stalker, because there's no way for them to hunt you there.
Re: Is Tor still safe to use?
#407Earlier quoted context omitted.
>This could cost less than $5000 for a month I ran a bunch of nodes for a couple years and that's optimistic by perhaps an order of magnitude. No $5 a month VPS provides enough bandwidth to sustain the monthly traffic of a Tor node, and nodes need to be continuously online and serving traffic for about 2-3 months[1] before they will be promoted to guard relays. Throttling traffic to stay in your bandwidth allocation…
Now to add additional problems. 1000 tor nodes on a single platform would be very noticeable and geographically limited. Platforms also have different weight attached to them in the consensus, which adds further time requirements before a node is promoted. The developers do not want a single platform provider to be able to observe a large portion of all the traffic, so there are counter measures. The attacker could t…
Pagers and the next day handheld radios exploded on their users! This can be done.
Re: Is Tor still safe to use?
#408TOR critics like Len Sassaman said the same years ago, with traffic analysis it is possible to detect where the source is coming from. https://en.wikipedia.org/wiki/Len_Sassaman
Timing attacks are a well-known weakness. There's a lot of research into timing attacks and proposed countermeasures.
Also, it's just Tor – not 'TOR'.
>Note: even though it originally came from an acronym, Tor is not spelled "TOR". Only the first letter is capitalized. In fact, we can usually spot people who haven't read any of our website (and have instead learned everything they know about Tor from news articles) by the fact that they spell it wrong.
Re: Is Tor still safe to use?
#409[flagged]
Re: Is Tor still safe to use?
#410"Safe" doesn't have a meaning until you define your threat model.