Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor Exit Nodes Mapped and Located

hackertarget.com

Post reply on HN
Print view View original

31–40 of 63 posts

Re: Tor Exit Nodes Mapped and Located

#31

Post by jcr »

JonnieCache wrote: post #26
jcr wrote: post #24

Earlier quoted context omitted.

Casting doubts and aspersions when you don't know anything and haven't bothered to read up on what they do is extremely unfair. They do some very impressive cryptographic deduplication. Essentially it's a method to deduplicate already encrypted data reliably. If you don't realize how amazingly cool that is, you need to do some reading. It's a really tough problem, and it solves a major pain point for anyone with larg…

"cryptographic deduplication" How is that even possible? Surely a custom crypto scheme is needed?

I wish I could tell you. I understand some of the parts involved but do not understand the method completely, so it's best for everyone that I don't speculate blindly. The Ciphertite web site is a far better reference than I could ever be.

I'll go to the top of the building and light up the tptacek bat signal.

Re: Tor Exit Nodes Mapped and Located

#32

Post by sp332 »

JonnieCache wrote: post #26
jcr wrote: post #24

Earlier quoted context omitted.

Casting doubts and aspersions when you don't know anything and haven't bothered to read up on what they do is extremely unfair. They do some very impressive cryptographic deduplication. Essentially it's a method to deduplicate already encrypted data reliably. If you don't realize how amazingly cool that is, you need to do some reading. It's a really tough problem, and it solves a major pain point for anyone with larg…

"cryptographic deduplication" How is that even possible? Surely a custom crypto scheme is needed?

Yes, it's possible with certain kinds of algorithms. A while back IBM found a way to do general computation on data without decrypting it, like adding encrypted dollar amounts together etc. But it's about a million times slower than normal data processing.

Re: Tor Exit Nodes Mapped and Located

#33

Post by Surio »

jcr wrote: post #23
Wilya wrote: post #6

Any background on who "Conformal Systems" are and why they would operate exit nodes ? I'm not really familiar with who they are and what they do, but they seem to be the only one in the top-25 that isn't either a hosting company or a residential ISP. (apart from Formless Networking, but that one is a bit more well known) Not that it's not nice of them, but it seems a bit out of place.

Conformal is a startup run by a group of former OpenBSD developers including Marco Peereboom (marco@), Owain Ainsworth (oga@), and others. I've met most of them in person, and I've interacted with them on mailing lists for nearly a decade and a half. They are all good people in my book, and they're very talented. On many occasions, both Marco and Owain have helped me debug problems while adding support for new hardwa…

Very nice answer. Qualified, thoughtful with no loose ends.

Re: Tor Exit Nodes Mapped and Located

#34

Post by tych0 »

hkmurakami wrote: post #29
tych0 wrote: post #12

Earlier quoted context omitted.

It's worth noting that the statistics may be skewed because e.g. of US-based operators run their nodes at foreign ISPs due to fear of US law enforcement. Countries with more "liberal" policies probably have more nodes because of this, but it doesn't necessarily mean there are more operators based in those countries.

I'm curious: what are the specific laws that we should be concerned about? (Obviously the US has many draconian laws regarding cyber-anything, but I'm curious what specific lines we cross with Tor Exit Node operation. Does it include something like ownership and responsibility of the data that passes through a node that we operate?)

Yes, exactly. There's never been any case law on the issue, but in the ideal theoretical world, exit node operators would get the same protections from what their users do that ISPs do.

Unfortunately, since we're often a single guy with no legal entity, we are not afforded such protections by default. I've been running an exit node since 2005, and I've had to switch ISPs numerous times because of abuse coming out of the node. I've even had my hardware physically confiscated when network administrators couldn't figure out what kind of traffic was coming out of it.

While I believe in the goals of the Tor project, I am not really interested in being the guy who has to set the precedent here, so I don't run my exit node in the US any more. If history is any indication it would be a long legal battle to set such a precedent.

See https://www.torproject.org/eff/tor-legal-faq.html.en for more discussion on the topic.

Re: Tor Exit Nodes Mapped and Located

#35

Post by jcr »

Surio wrote: post #33
jcr wrote: post #23

Earlier quoted context omitted.

Conformal is a startup run by a group of former OpenBSD developers including Marco Peereboom (marco@), Owain Ainsworth (oga@), and others. I've met most of them in person, and I've interacted with them on mailing lists for nearly a decade and a half. They are all good people in my book, and they're very talented. On many occasions, both Marco and Owain have helped me debug problems while adding support for new hardwa…

Very nice answer. Qualified, thoughtful with no loose ends.

Heck, he knows I can't outrun him, and he knows where I live, so it had better be a nice answer. ;-)

Re: Tor Exit Nodes Mapped and Located

#37

Post by betterunix »

sp332 wrote: post #32
JonnieCache wrote: post #26

Earlier quoted context omitted.

"cryptographic deduplication" How is that even possible? Surely a custom crypto scheme is needed?

Yes, it's possible with certain kinds of algorithms. A while back IBM found a way to do general computation on data without decrypting it, like adding encrypted dollar amounts together etc. But it's about a million times slower than normal data processing.

General computation on encrypted data was discovered by a graduate student at Stanford named Craig Gentry. He now works for IBM, and has been pretty active in that field, along with a handful of other experts. It's very slow, sure, but over the past 4 years speeds have increased to the point where it is reasonable to start talking about practical applications.

It is also worth pointing out that systems supported restricted classes of functions preceded Gentry's work. If you are willing to limit yourself to NC1 functions (i.e. those that can be represented as boolean circuits with depth that is the logarithm of the input size), you can use oblivious transfer or the SYY construction (cannot recall their names off the top of my head). If you only need products in certain groups, you can use ElGamal. If you only need an XOR, you can use the Goldwasser-Micali system.

Also, there are garbled circuits, which date back to the 1980s. That is a somewhat different notion of computing on encrypted data, since it requires messages to be sent every time the computation is performed. Garbled circuits are substantially faster than FHE right now, although that may change due to FHE's low communication overhead and the rate at which FHE speeds have been improving. Also in this category are multiparty protocols that use arithmetic circuits, which have seen at least one major real-world use:

http://fc09.ifca.ai/papers/15_Secure_MPC_goes_live.pdf

Re: Tor Exit Nodes Mapped and Located

#38

Post by conformal »

jcr wrote: post #23
Wilya wrote: post #6

Any background on who "Conformal Systems" are and why they would operate exit nodes ? I'm not really familiar with who they are and what they do, but they seem to be the only one in the top-25 that isn't either a hosting company or a residential ISP. (apart from Formless Networking, but that one is a bit more well known) Not that it's not nice of them, but it seems a bit out of place.

Conformal is a startup run by a group of former OpenBSD developers including Marco Peereboom (marco@), Owain Ainsworth (oga@), and others. I've met most of them in person, and I've interacted with them on mailing lists for nearly a decade and a half. They are all good people in my book, and they're very talented. On many occasions, both Marco and Owain have helped me debug problems while adding support for new hardwa…

hi there jcr, this is jy-p, thanks for the kind words :)

Re: Tor Exit Nodes Mapped and Located

#39

Post by conformal »

EwanG wrote: post #11
Wilya wrote: post #6

Any background on who "Conformal Systems" are and why they would operate exit nodes ? I'm not really familiar with who they are and what they do, but they seem to be the only one in the top-25 that isn't either a hosting company or a residential ISP. (apart from Formless Networking, but that one is a bit more well known) Not that it's not nice of them, but it seems a bit out of place.

Government contractor. Feel free to guess what they're being paid to do...

that's a pretty definite statement that is definitely false. Conformal Systems LLC has no government contracts at this time.

Re: Tor Exit Nodes Mapped and Located

#40

Post by conformal »

JonnieCache wrote: post #26
jcr wrote: post #24

Earlier quoted context omitted.

Casting doubts and aspersions when you don't know anything and haven't bothered to read up on what they do is extremely unfair. They do some very impressive cryptographic deduplication. Essentially it's a method to deduplicate already encrypted data reliably. If you don't realize how amazingly cool that is, you need to do some reading. It's a really tough problem, and it solves a major pain point for anyone with larg…

"cryptographic deduplication" How is that even possible? Surely a custom crypto scheme is needed?

cyphertite uses a private (per-user) deduplication pool, not a global deduplication pool like dropbox and many other online storage providers.

Example 1 - user1 uploads file1, then at a later time user1 tries to upload file1 again. the 2nd occurrence of the data in file1 is recognized as a duplicate of what has already been stored, so the service does not re-upload the bulk data of file1. this saves bandwidth, time, cpu cycles etc.

Example 2 - user1 uploads file1, then at a later time user2 uploads file1. in a private (per-user) deduplication pool, both user1 and user2 would need to separately upload a copy of file1, but in a global deduplication pool, user2 would not need to actually upload the bulk file data since it can reference data that user1 uploaded earlier.

the upshot here is that each user has their own separate crypto keys that are used client-side, similar to spideroak, tarsnap, etc.

i could get into the details here, but it's pretty well summarized in our infographic and crypto whitepaper

https://www.cyphertite.com/papers/CT_InfoGraphic.pdf https://www.cyphertite.com/papers/WP_Crypto.pdf

Post reply on HN