Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is Tor still safe to use?

blog.torproject.org

Post reply on HN
Print view View original

551–560 of 602 posts

Re: Is Tor still safe to use?

#551

Post by alphan0n »

dunghill wrote: post #392
alphan0n wrote: post #304

Earlier quoted context omitted.

This entirely ignores the fact that traffic to and from onion sites never leaves the Tor network, never utilizes an exit node. It doesn’t matter if a bad actor has control of every exit node if your communications are within the network unless the underlying encryption protocols have been compromised.

But not all traffic goes to onion sites.

Right, you shouldn't expect traffic that goes outside the onion network to be secure and anonymous. That's the entire point of onion sites.

Re: Is Tor still safe to use?

#552

Post by jandrese »

takeda wrote: post #536
jandrese wrote: post #500

Earlier quoted context omitted.

I wish the people back in the 90s understood this when trying to set up encrypted email.

As someone who used Internet in the 90s I don't follow. There was almost nothing encrypted. SSL/TLS was introduced for POP3/IMAP, but I don't think that was bad.

The 90s had the opportunity to deploy something like PGP widely, but because there was no perfectly safe way to distribute the keys it never went anywhere. The most practical solution the crypto nerds could accept was the web of trust, where you were supposed to physically meet everyone you wanted to communicate with so you could physically exchange the keys, which was never going to scale.

Email to this day is unencrypted at rest and completely transparent to whomever is running your mail server. You don't think Google runs GMail out of the goodness of their heart do you?

Re: Is Tor still safe to use?

#553

Post by dumbo-octopus »

alphan0n wrote: post #550
dumbo-octopus wrote: post #340

Earlier quoted context omitted.

Hook, line, and sinker. https://www.sciencedirect.com/science/article/pii/S266729522... https://www.usenix.org/system/files/raid2019-iacovazzi.pdf https://www.ndss-symposium.org/ndss-paper/flow-correlation-a...

This: https://www.sciencedirect.com/science/article/pii/S266729522... Uses a dataset created from aggregation of logs from all nodes in a simulated Tor environment to train a model that can identify the onion server's IP based on fingerprints created from that model. >We ran the modified Tor software in the Shadow simulation environment to obtain a large amount of circuits for analysis. Shadow is a discrete-event net…

Ok so you admit we can identify onion services, and it’s common knowledge that the NSA knows your personal traffic patterns. If you think they can’t correlate the two, I have a bridge to sell you.

Re: Is Tor still safe to use?

#554

Post by ranger_danger »

halJordan wrote: post #541
ranger_danger wrote: post #442

Earlier quoted context omitted.

Considering multiple world governments have already shown in leaked documents that this is exactly what they do, I personally wouldn't trust my secrets with tor.

But and God forbid you read TFA, those leaked techniques were all done before the latest mitigations that the Tor Project is writing the blog about.

There's not much technique involved in running tons of nodes.

Re: Is Tor still safe to use?

#556

Post by alphan0n »

dumbo-octopus wrote: post #553
alphan0n wrote: post #550

Earlier quoted context omitted.

This: https://www.sciencedirect.com/science/article/pii/S266729522... Uses a dataset created from aggregation of logs from all nodes in a simulated Tor environment to train a model that can identify the onion server's IP based on fingerprints created from that model. >We ran the modified Tor software in the Shadow simulation environment to obtain a large amount of circuits for analysis. Shadow is a discrete-event net…

Ok so you admit we can identify onion services, and it’s common knowledge that the NSA knows your personal traffic patterns. If you think they can’t correlate the two, I have a bridge to sell you.

[flagged]

Re: Is Tor still safe to use?

#557

Post by keepamovin »

sangnoir wrote: post #506
keepamovin wrote: post #490

Earlier quoted context omitted.

What you’re claiming is not necessarily correct, but it’s an avenue of interesting speculation. Nevertheless, let’s clarify a few of your possible misunderstandings or points of confusion: I’m not saying TOR is weak, nor that the reason for its concealment is to project a false sense of government strength. What I am saying—and what you seem to have misunderstood—is that the TOR network is most likely used, precisely…

> What I am saying—and what you seem to have misunderstood—is that the TOR network is most likely used, precisely because of its strength, for highly sensitive clandestine operations. Tor seems to be a poster child of the "Nobody But Us"[1] principle the NSA likes so much: it's strong when used by American spooks, but weak when used against them. If a country developed body armor that's impervious to all rounds excep…

I guess i don't necessarily disagree with your NOBUS assessment of TOR strength, it's hard to say without confirmed facts tho. Funny I always think of crypto algorithms as the examples of NOBUS: the NIST ones, etc. Again, no confirmed facts but that would be a source and method you really wouldn't want to confirm and burn.

What do you mean by parallel constructions? Is that where LE discovers evidence through extralegal means, then needs to rebuild the narrative through a legally valid chain? Could be, but then again there's probably a lot of TOR identities that are completely out of reach for LE, leaving them with only legal construction. Wouldn't you say?

I sometimes wonder about something, too: you know those "small" cases with huge human cost, like missing child, or murder in a backwoods area? I always imagine that classified capabilities could be used to solve them. The fact they are not, is painful, and I think must be "moral trauma" for LE/IC people involved. Even more so that they can't talk to anyone about it except their organizational therapists if then.

Re: Is Tor still safe to use?

#558

Post by takeda »

jandrese wrote: post #552
takeda wrote: post #536

Earlier quoted context omitted.

As someone who used Internet in the 90s I don't follow. There was almost nothing encrypted. SSL/TLS was introduced for POP3/IMAP, but I don't think that was bad.

The 90s had the opportunity to deploy something like PGP widely, but because there was no perfectly safe way to distribute the keys it never went anywhere. The most practical solution the crypto nerds could accept was the web of trust, where you were supposed to physically meet everyone you wanted to communicate with so you could physically exchange the keys, which was never going to scale. Email to this day is unenc…

There is S/MIME, but probably biggest thing that stopped its adoption was popularity of web mail (so yes, Google and others).

Re: Is Tor still safe to use?

#559

Post by immibis »

ranger_danger wrote: post #443
INTPenis wrote: post #413

Earlier quoted context omitted.

I ran tor exit nodes on Linode and Digitalocean for years. No real issues, but you will get regular abuse complaints. The support teams always understood once I explained it was a tor exit node. I co-operated with the Cloud provider and added any IP-address that requested it to my list of exempt addresses.

> The support teams always understood But they don't have to. It could also be against their ToS, and many other providers would not have been ok with it. Accounts and domains have been taken away for much less.

Not to mention, armed police raiding your home, especially if you live in Germany.

Re: Is Tor still safe to use?

#560

Post by immibis »

HDThoreaun wrote: post #548
DrillShopper wrote: post #435

Earlier quoted context omitted.

Servers in the public cloud are a lot easier to do traffic analysis on.

Each server is only used by a single operative though, how do you even find which IP to analyze? The story with Tor and espionage is that if an asset connected to cia website the gov which monitors internet access would know they went to the site. Even if its not a public site they just need to have one operative defect and tell them the site and they can catch all the other operatives who use it. But if everyone con…

Then you know every time that IP was accessed, the same operative was there.
Post reply on HN