Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor and HTTPS

eff.org

Post reply on HN
Print view View original

41–50 of 135 posts

Re: Tor and HTTPS

#41

Post by marvin »

doomrobo wrote: post #36
VexXtreme wrote: post #31

What happens if NSA starts operating a number of Tor exit nodes and eavesdropping on the outgoing traffic? What prevents them from doing so?

Nothing, but they would still not know where the traffic is coming from. The "Onion" defined in the Tor protocol is unwrapped layer by layer by each node. So the NSA has a choice where no option would help them too much: 1. Be the first node you access and be able to see your IP but not your traffic 2. Be the last node and be able to see your traffic but not your IP 3. Be a middle node and see neither

What happens if you are logged into one of the services where the NSA has "direct access to the servers"?

Re: Tor and HTTPS

#42

Post by derrida »

theboss wrote: post #39
VexXtreme wrote: post #31

What happens if NSA starts operating a number of Tor exit nodes and eavesdropping on the outgoing traffic? What prevents them from doing so?

Security professionals have hypothesized many attacks against the anonymity of the tor onion and what you describe is pretty close to one of them. If the NSA was to create tons Tor nodes (enter, exit, and relay), the onion may be broken. Tor is by no means perfect. It is only obfuscating. It is easy to see how this is broken if you click the TOR button on this thing and then imagine the TOR nodes say NSA on them. I t…

Run a node to stop this attack working!

Re: Tor and HTTPS

#43

Post by dllthomas »

sdfjkl wrote: post #37
doomrobo wrote: post #36

Earlier quoted context omitted.

Nothing, but they would still not know where the traffic is coming from. The "Onion" defined in the Tor protocol is unwrapped layer by layer by each node. So the NSA has a choice where no option would help them too much: 1. Be the first node you access and be able to see your IP but not your traffic 2. Be the last node and be able to see your traffic but not your IP 3. Be a middle node and see neither

Can't they do both 1 and 2 and correlate the information?

Yes. Which is why we need to keep a lot of nodes running, and part of why Tor hidden services are a good thing.

Re: Tor and HTTPS

#44

Post by dllthomas »

marvin wrote: post #41
doomrobo wrote: post #36

Earlier quoted context omitted.

Nothing, but they would still not know where the traffic is coming from. The "Onion" defined in the Tor protocol is unwrapped layer by layer by each node. So the NSA has a choice where no option would help them too much: 1. Be the first node you access and be able to see your IP but not your traffic 2. Be the last node and be able to see your traffic but not your IP 3. Be a middle node and see neither

What happens if you are logged into one of the services where the NSA has "direct access to the servers"?

That's covered in the diagram.

Re: Tor and HTTPS

#45

Post by dllthomas »

Splendor wrote: post #34
B0Z wrote: post #26

Maybe I'm misinformed, but I thought the big problem has less to do with data in transit than it does with the destinations (Google, Facebook, Microsoft, etc) working hand-in-hand with the NSA? What am I missing?

Yep. It doesn't matter how you securely you get your data to Company X if Company X is handing the data over to the NSA.

Tor hidden services could help, though.

Re: Tor and HTTPS

#46

Post by noerps »

theboywho wrote: post #23

How about using Tor > VPN (Note: Not VPN > Tor) ?

It could circumvent VPN censorship/supression or DPI since VPN is not a secure end to end communication.

That way you would obfuscate your endpoint against your vpn endpoint/provider.

It would add no further benefit to location obfuscation with Tor, since your VPN-provider will always snitch on you when opposed with lethal force.

Re: Tor and HTTPS

#49

Post by wyck »

The important part of the diagram for Tor is the first NSA character, as you can see it still shows "Location" before you are routed through the Tor relay.

With the location information it is possible to correlate the exit information via pattern matching, though it would take considerable analysis, this can be done by logging volume and timing information on the two sides. I am sure there are even better techniques to analyze exit/entry correlations, especially if you're not using a secure browser.

So having a private VPS doesn't really matter, in fact it can make matters worse because you are adding layers that can be "watched" before you hit an entry node, the more data that can be logged the easier it is to track.

You're best option is to choose random nodes, connect at random times and also look into using Tor bridges. If possible using several different IPS's or even better random wi-fi hotspots, though this is hardly convenient for most users.

Tor bridges: https://www.torproject.org/docs/bridges.html.en

Whitepaper on Tor passive logging attacks (pdf): http://people.cs.umass.edu/~mwright/papers/wright-passive.pd...

Re: Tor and HTTPS

#50

Post by doomrobo »

sdfjkl wrote: post #37
doomrobo wrote: post #36

Earlier quoted context omitted.

Nothing, but they would still not know where the traffic is coming from. The "Onion" defined in the Tor protocol is unwrapped layer by layer by each node. So the NSA has a choice where no option would help them too much: 1. Be the first node you access and be able to see your IP but not your traffic 2. Be the last node and be able to see your traffic but not your IP 3. Be a middle node and see neither

Can't they do both 1 and 2 and correlate the information?

I don't believe that's possible. If they have two nodes then they're still not a part of a defined path. For instance, someone can go through their entrance node and come out someone else's exit node and vice-versa. The NSA would have no idea who is going through where and shouldn't be able to correlate the data.
Post reply on HN