Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is Tor still safe to use?

blog.torproject.org

Post reply on HN
Print view View original

461–470 of 602 posts

Re: Is Tor still safe to use?

#461

Post by layer8 »

ranger_danger wrote: post #443
INTPenis wrote: post #413

Earlier quoted context omitted.

I ran tor exit nodes on Linode and Digitalocean for years. No real issues, but you will get regular abuse complaints. The support teams always understood once I explained it was a tor exit node. I co-operated with the Cloud provider and added any IP-address that requested it to my list of exempt addresses.

> The support teams always understood But they don't have to. It could also be against their ToS, and many other providers would not have been ok with it. Accounts and domains have been taken away for much less.

So read the ToS and ask support beforehand?

Re: Is Tor still safe to use?

#462

Post by jrochkind1 »

sigmoid10 wrote: post #64
alasdair_ wrote: post #35

Here is what I don't understand: Let's say I as a private individual fund 1000 tor nodes (guard and exit nodes included) and have them all log everything. This could cost less than $5000 for a month, with some time needed to get guard node status. I want to find a certain kind of person so I look for people that access a specific hidden service or clearnet url. Surely eventually I'm going to get a hit where all three…

>Surely eventually I'm going to get a hit where all three nodes in the circuit are my nodes that are logging everything? The word "eventually" is doing a lot of heavy lifting here. Let's say you actually manage to add 1000 servers to the tor network somehow without getting detected. The network currently sits at just under 8000 nodes. For simplicity, lets also ignore that there are different types of nodes and geogra…

What you say is reasonable and I agree and hold that position.

> Tor has been around for a long time, but there has never been an uptick in arrests that could be correlated to cracking the core anonymity service.

If I were an intelligence agency that had "cracked" tor -- I'd probably make sure nobody would notice I had access, so I could keep eavesdropping. Not do anything that could expose my access.

It certainly could be happening. Nothing is 100%. Nothing. Just a fact. Tor is probably pretty good at what it does.

(and keep in mind, for what we're talking about in this kind of attack, all I get access to is network contacts, not the actual messages, right?)

Re: Is Tor still safe to use?

#464

Post by WHA8m »

maxrecursion wrote: post #440
WHA8m wrote: post #405

Earlier quoted context omitted.

Just a quick note on the Youtube channel you mention: I follow his videos for a while and it seems to me, that he's half a shill. My impression is, that he re-models popular HN threads into Youtube videos. Just watch the latest video on the MrBeast topic and you'll basically get the same info as all the popular 'root' comments (was on HN front page last week). Not the first time I noticed a suspicious connection.

While that is a crappy thing to do, I bet tons of YouTubers are doing just that. Hell, most political YouTubers just read articles and make stupid comments about them. It would be impossible to create daily content if you weren't just rehashing, or taking, information from somewhere. Again, not defending it at all, just saying it's probably a very common thing. Like how some crappy news articles are just a bunch of r…

Agreed. Extra: I'd generally say, that comments on HN are often interesting and insightful (that's why we're here, no?). With the current state of social media, I'd wish for a little more HN flavor. But at least credit your source. The information you provide doesn't get less valuable only because someone else did the work.

Re: Is Tor still safe to use?

#465

Post by yencabulator »

treebeard901 wrote: post #341
ARandomerDude wrote: post #317

Earlier quoted context omitted.

Start an NSA cutout called Cloudflare. Configure sites to use an SSL/TLS connection to Cloudflare, then a separate SSL/TLS connection from Cloudflare to your actual machine. Then have the marketing team call it "Strict" encryption. Make it free so everyone uses it.

It is also a lot easier since ceetificate pinning has fallen out of favor. Many sites use LetsEncrypt. The Certificate Authority system itself is not reliable. In a way it is the perfect solution from a Govt perspective. Other countries have systems at this scale and larger. China for example.

What makes the CA system reliable is browsers insisting on Certificate Transparency before trusting a cert. If an attacker creates an evil cert by stealing the ACME verification traffic, there's a permanent record of it. Big corps can monitor the ledger to see what certs have been handed out to their domains.

Re: Is Tor still safe to use?

#466

Post by GunlogAlm »

friendzis wrote: post #459
flufluflufluffy wrote: post #449

As knowledgeable users of the Internet in 2024, we would do well to assume that nothing is 100% “safe” (I.e. there’s no such thing as perfect security/privacy). However, some things, like Tor, can make your use of the Internet safer . If all you’re doing is arguing that Tor shouldn’t be used because it isn’t/was never “safe”, then you might as well not use the Internet at all.

But that's half the point. If someone has an intention to undergo some illegal activities with full intention not to be caught, only 100% "safe" solution works for them. Normally we talk about risk tolerance, but this particular use case is a bit special.

There are no "100% safe" solutions. There will always be weaknesses and vulnerabilities in any system. The sort of criminal who requires or expects 100% safety is quickly going to be caught due to being a dullard. Knowing you're never truly "safe" is what good criminals are keenly aware of at all times: you can plan and prepare for certain eventualities. Once you think you're "safe", it's the beginning of the end.

Re: Is Tor still safe to use?

#467

Post by rvba »

snowwrestler wrote: post #334
firen777 wrote: post #279

Earlier quoted context omitted.

> It provides a channel for operatives to exfiltrate data out of non-NATO countries very easily. I'm not convinced this is the case. For example China's gfw has been very effective at blocking TOR traffic, and any TOR connection in other countries is like announcing to the government that you are suspicious.

It’s a little silly to say “for example” and then intentionally pick what is widely known as the most sophisticated and pervasive system for controlling Internet traffic ever created. The parent said “non-NATO countries”… there are 162 of those that are not China. (It’s also a little silly to specify “non-NATO” since U.S. intelligence services have to exfiltrate data from NATO countries too…) To get data out of China…

If weight it by population and importance then China is probably in the top though.

I bet western spies spend more time on China than some micro island in the middle of the ocean. Same for Chinese spies probably focus on USA first.

Also realistically probably everyone spies everyone and they spy on those micro islands too. But priorities are clear...

Re: Is Tor still safe to use?

#468

Post by noirscape »

iancarroll wrote: post #238
londons_explore wrote: post #189

Earlier quoted context omitted.

I ran an exit node for a while, and found myself auto-banned from so many services that I stopped running the node and threw away my IP range (which now would be worth $$$ - oh well!)

I ran Tor nodes, had a bunch of blacklisted IPs, and just stopped running them and it was fine? Blacklisting Tor nodes requires updating the data often, so it falls off pretty quickly. To discard an entire /24 would be pretty funny over that!

Most people just use a DNSBL to block Tor exit nodes. They're pretty trivial to find online and presumably, very easy to set up because the list of Tor exit nodes is publicly available.

This also means the expiry time is usually tied to however long a Tor exit node stays on the DNSBL + 3 or so days (depends on how long the software is configured, but 3 days is typically the assumed default for IPs that tend to get mixed up with automated spam, of which Tor is also a massive purveyor.)

Re: Is Tor still safe to use?

#469

Post by gspencley »

maxrecursion wrote: post #440
WHA8m wrote: post #405

Earlier quoted context omitted.

Just a quick note on the Youtube channel you mention: I follow his videos for a while and it seems to me, that he's half a shill. My impression is, that he re-models popular HN threads into Youtube videos. Just watch the latest video on the MrBeast topic and you'll basically get the same info as all the popular 'root' comments (was on HN front page last week). Not the first time I noticed a suspicious connection.

While that is a crappy thing to do, I bet tons of YouTubers are doing just that. Hell, most political YouTubers just read articles and make stupid comments about them. It would be impossible to create daily content if you weren't just rehashing, or taking, information from somewhere. Again, not defending it at all, just saying it's probably a very common thing. Like how some crappy news articles are just a bunch of r…

> While that is a crappy thing to do,

I haven't watched this particular channel so maybe it's obviously shady, but I'm curious: why is this conceptually a crappy thing to do?

I mean, if you take the IP of others and redistribute it verbatim then I definitely see the ethical issue. So if the claim is that he's reading peoples' comments or posts verbatim without credit then yeah that's crappy. Don't get me wrong.

But if all we're talking about is "mining" websites like HN for topics and then creating original content that covers those topics in a different format for a different audience... where's the issue?

A few years ago I was feeling pretty burned out in the tech industry and created a tongue in cheek "luddite" channel called TechPhobe where I took an overly pessimistic view of the industry. At the time Elizabeth Holmes was on trial and a lot my videos involved me reading ArsTechnica articles on the subject (credited) while offering my personal opinions on the matter. While not successful, those videos got more views than anything else I ever created. Was that a crappy thing to do? I didn't think so at the time and I don't think so now.

I didn't stick with the channel because I realized pretty quickly that if I'm dealing with burnout the last thing I should be doing in my spare time is focusing on tech content lol

Re: Is Tor still safe to use?

#470

Post by habinero »

chiefalchemist wrote: post #268
verbify wrote: post #219

Earlier quoted context omitted.

> Edit: For all the cynics and doomsayers here, consider this: Tor has been around for a long time, but there has never been an uptick in arrests that could be correlated to cracking the core anonymity service. If you look closely at the actual high profile cases where people got busted despite using tor, these people always made other mistakes that led authorities to them. During WW2, the British cracked the German…

> these people always made other mistakes that led authorities to them. Says who? The intelligent community entity that busted them? If they're using a tool to discover X or Y they're not to let anyone know that. For example, I live in the NYC area. A couple of times per year there's a drug bust on the New Jersey Turnpike of a car headed to NYC. The story is always a "random" police stop ends up in a drug bust. Rando…

You're ironically vastly overestimating the cops. It's not that they have good intel, it's that it's copaganda.

They'll just make something up for publicity if they don't get something useful.

Post reply on HN