Tor trip report to an FBI conference • Hacker News Board

Re: Tor trip report to an FBI conference

#51

Post by derrida » Mon, Dec 17, 2012, 4:03 AM UTC

dbrian wrote: post #17

Xylakant wrote: post #10

Earlier quoted context omitted.

The problem with PGP is that while it keeps the content of your mail exchange secret, it does not protect the information that two persons exchanged emails. So if the investigators have a lead to person A that sells drugs and see that he's communicating with person B that accepts payments, the might just guess what relationship the two have.

Right, that's why you use Tor. PGP provides privacy and accountability. Tor provides anonymity. Just remember you have to trust the security of the receiving party as well. Make sure not to reveal yourself with the contents of your emails since the other party might not be as disciplined with their tor and pgp use as you are.

Tor doesn't anonomise email :-/ If you want that, look for mixminion or mixmaster. Tor is a low latency mixnet for TCP streams (aka web browsing).

Re: Tor trip report to an FBI conference

#52

Post by derrida » Mon, Dec 17, 2012, 4:39 AM UTC

voltagex_ wrote: post #41

derrida wrote: post #14

Earlier quoted context omitted.

Law enforcement have for decades been anonymous, wearing plain clothes & hiding behind false identities in efforts to catch criminals. Tor just gives them digital plain clothes. If they were going through an open HTTP proxy, that box better have a decently network facing attack surface (unlikely). Sure, it's the same deal with Tor, except you have to pwn about 2/3rd of the network (4000+ boxes) before you know about…

I don't have the bandwidth available, but I'm willing to ship a Raspberry Pi to someone who does. Someone should start the TorPiDo project :P

Maybe that someone is you? Join the tor-talk list and just do it :-)

Re: Tor trip report to an FBI conference

#53

Post by dbrian » Mon, Dec 17, 2012, 5:31 AM UTC

derrida wrote: post #51

dbrian wrote: post #17

Earlier quoted context omitted.

Right, that's why you use Tor. PGP provides privacy and accountability. Tor provides anonymity. Just remember you have to trust the security of the receiving party as well. Make sure not to reveal yourself with the contents of your emails since the other party might not be as disciplined with their tor and pgp use as you are.

Tor doesn't anonomise email :-/ If you want that, look for mixminion or mixmaster. Tor is a low latency mixnet for TCP streams (aka web browsing).

SMTP uses TCP and works over tor just fine. But you can always just use a free web mail account somewhere.

Re: Tor trip report to an FBI conference

#54

Post by napoleond » Mon, Dec 17, 2012, 5:36 AM UTC

noibl wrote: post #50

napoleond wrote: post #48

Earlier quoted context omitted.

The realities of the browser environment make it impossible to do what you describe. It's been possible with native clients for a long time, but has always been pretty cumbersome for non-geeks--I've been working on a native client solution that would be easy for non-geeks to use and provide a few different levels of security (which come with varying levels of convenience) that are all better than the "plain-text ever…

> http://parley.co Excellent writeup. It really helps when the conversation is steered away from terms like 'amendment', 'advertisers', 'enforcement', 'criminality' and steered back to the central idea of recovering and safeguarding an intuitive and traditional idea of privacy in personal communication (postcard analogy). Lots of people, many with vested interests, insist that this isn't possible, that the genie is o…

Thanks noibl, that's very generous of you. Besides being as self-conscious as anyone might be when publishing a bit of writing, I knew that I was writing for two separately critical audiences (computer security experts and those who would tend to brush off most privacy advocates as unnecessarily alarmist) which made it considerably more daunting. You put it quite well yourself, though: let's at least try. The defeatist attitude many people take toward privacy (and I'll be the first to admit, I do it too sometimes) is at least as concerning to me as the privacy challenges themselves, but I really do believe we stand a fighting chance on both fronts.

My exchange with jmillikin didn't continue, unfortunately, but I really do want to discuss exactly what we're building with anyone who will listen--there will be more information on the website soon enough but I would love for anyone who reads this to email me any time. My email is in my profile.

Re: Tor trip report to an FBI conference

#55

Post by belorn » Mon, Dec 17, 2012, 7:59 AM UTC

Create wrote: post #44

derrida wrote: post #25

Earlier quoted context omitted.

> One author exposed how becoming an exit node for Tor allowed all the traffic on the Tor network to pass right through your machine. Becoming an exit node was the same as performing a Man-In-The-Middle attack. This is de-contextualised scaremongering. What the poster is referring to is that when you leave the Tor network, the connection is as it would have been before. This is by design. So if you were not using TLS…

The host part is the transport layer-dependent permanent hidden service ID. For Tor, which is the primary transport layer supported by cables communication, it is a 16-character Base32 representation of a half of Tor's hidden service RSA-1024 public key fingerprint (an 80-bit part of SHA-1 cryptographic hash), with an .onion domain suffix. For I2P, it is a 52-character Base32 encoding of eepSite's ElGamal-2048 public…

For the claim that NSA/CSS can break RSA 1024, it should be mentioned that the highest public known break of an RSA key is to a RSA 768, and above that, cash prizes has been given up to $175 000, with $75 000 at the RSA 896 point.

So if someone think they can put together a FPG'a or graphic cards system for less than $175 000, and that the system then will break RSA 1024, you can earn some "easy" money.

Anyway, the real question about the actually security concerning key-size is, how secure is recorded traffic. If the only protection here is the AES-128, than that is the thing to be concerned about.

Re: Tor trip report to an FBI conference

#56

Post by derrida » Mon, Dec 17, 2012, 8:15 AM UTC

dbrian wrote: post #53

derrida wrote: post #51

Earlier quoted context omitted.

Tor doesn't anonomise email :-/ If you want that, look for mixminion or mixmaster. Tor is a low latency mixnet for TCP streams (aka web browsing).

SMTP uses TCP and works over tor just fine. But you can always just use a free web mail account somewhere.

Yes, that's to fetch mail from a server. TorBirdy for instance is a plug in for Thunderbird.

But! If you want to send a message alice@domain.com to bob@otherdomain.com that is not anonymous, unless you take other measures.

Re: Tor trip report to an FBI conference

#57

Post by derrida » Mon, Dec 17, 2012, 8:21 AM UTC

Create wrote: post #44

derrida wrote: post #25

Earlier quoted context omitted.

> One author exposed how becoming an exit node for Tor allowed all the traffic on the Tor network to pass right through your machine. Becoming an exit node was the same as performing a Man-In-The-Middle attack. This is de-contextualised scaremongering. What the poster is referring to is that when you leave the Tor network, the connection is as it would have been before. This is by design. So if you were not using TLS…

The host part is the transport layer-dependent permanent hidden service ID. For Tor, which is the primary transport layer supported by cables communication, it is a 16-character Base32 representation of a half of Tor's hidden service RSA-1024 public key fingerprint (an 80-bit part of SHA-1 cryptographic hash), with an .onion domain suffix. For I2P, it is a 52-character Base32 encoding of eepSite's ElGamal-2048 public…

If you're interested, Tor is looking at a Cipher suite upgrade. There are obviously compatibility issues when you are rolling out to a network that has 500,000+ daily users. If you look around the Tor proposals you should be able to find it https://gitweb.torproject.org/torspec.git?a=tree;hb=HEAD;f=p...