Interesting how everyone in the diagram except the user, the sysadmin, and the relay nodes have "evil eyes".
Yes. Undoubtedly sysadmins are responsible for some, if not most of the most egregious handoffs of data to outsiders (legal or illegal).
Tor and HTTPS
61–70 of 135 posts
Re: Tor and HTTPS
#62What happens if NSA starts operating a number of Tor exit nodes and eavesdropping on the outgoing traffic? What prevents them from doing so?
Frankly, I think you have to assume that the NSA is already doing this. I also think you have to assume they have the private keys for every major CA in the world.
Re: Tor and HTTPS
#63The problem of HTTPS is that you will need certification from some CAs which may be working with government agents.
Yeah, and even if you get a certificate from a CA which isn't, it doesn't matter, since any other CA can still issue a cert for your domain.
Re: Tor and HTTPS
#64The problem of HTTPS is that you will need certification from some CAs which may be working with government agents.
From a crypto/security approach there is no difference between a self-signed certificate and from an "offical" CA.
In terms of trust, your mileage may vary.
Re: Tor and HTTPS
#65How secure is ssl? Can't NSA fake a certificate?
Do they really need to fake it? It surely might be a part of the famous indirectly accessed data.
This has been my question in this whole mess, if we assume NSA can and does subpoena the keys and certs as opposed to the direct data (and the NSA were copying data en masse, which now seems likely) would that not make HTTPS essentially useless?
Re: Tor and HTTPS
#66How about using Tor > VPN (Note: Not VPN > Tor) ?
It could circumvent VPN censorship/supression or DPI since VPN is not a secure end to end communication. That way you would obfuscate your endpoint against your vpn endpoint/provider. It would add no further benefit to location obfuscation with Tor, since your VPN-provider will always snitch on you when opposed with lethal force.
They can know your location, but at least no one will know what you're doing.
Re: Tor and HTTPS
#67How legal is operating a Tor node? I'm thinking of putting up a machine (and a VPS) to just run a node. I just don't want to get into legal trouble for running a(n exit) node.
If you don't want to deal with possible legal issues running an exit node you could get servers using an anonymous prepaid credit card and made up contact info. If LE ever subpoenas your provider you can just shut the server down and abandon it.
(IANAL, may not be legal in all countries)
Re: Tor and HTTPS
#68How secure is ssl? Can't NSA fake a certificate?
If you're running secure site, you should use your certificate & signature. Even then NSA could well be capable of creating fake certificate, but it would be expensive. But that would stop others without huge computing capacity. Of course this requires that you're able to deliver your own CA information securely to your site users. Also end users should disable trust for any browser/OS build-in CAs.
Re: Tor and HTTPS
#69The important part of the diagram for Tor is the first NSA character, as you can see it still shows "Location" before you are routed through the Tor relay. With the location information it is possible to correlate the exit information via pattern matching, though it would take considerable analysis, this can be done by logging volume and timing information on the two sides. I am sure there are even better techniques…
> With the location information it is possible to correlate the exit information via pattern matching, though it would take considerable analysis, this can be done by logging volume and timing information on the two sides. I am sure there are even better techniques to analyze exit/entry correlations, especially if you're not using a secure browser.
I've thought the same. But I've also thought that if this is indeed possible, why does Silk Road still exist? Or does this analysis only apply Tor clients connecting to websites, and not Tor hidden services?
Re: Tor and HTTPS
#70I have problems even logging in on ycombinator with tor. Not to mention any site with anti-spam protection.