Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Attacking Tor: How the NSA targets users' online anonymity

theguardian.com

Post reply on HN
Print view View original

71–80 of 184 posts

Re: Attacking Tor: How the NSA targets users' online anonymity

#71

Post by psn »

shawn-furyan wrote: post #37

One heartening aspect of the Snowden revelations as a whole is that they have pretty much just confirmed that the things we thought were strong (public crypto research, tor) are in fact strong and the things that we thought were iffy are in fact iffy(Certificate Authorities, Unvetted Crypto, Cloud Services, The Wires, Implementations). This bodes well for the prospect of navigating out of this whole mess successfully…

I agree with your post generally, but has Snowden said anything about CAs? I did expect to hear that at least one has signed anything the NSA put in front of them, but I don't recall Snowden providing "proof"* of this.

* I'm in no position to verify anything Snowden leaks.

Re: Attacking Tor: How the NSA targets users' online anonymity

#72

Post by bcoates »

twoodfin wrote: post #19
elwin wrote: post #13

The more we learn about the NSA's capabilities, the more it seems like the Manhattan Project. They are developing the "cyberwarfare" equivalents of weapons of mass destruction. This exploit delivery network goes so far beyond any legitimate purpose it might serve that it belongs in the same moral category as hydrogen bombs. EDIT: The above is somewhat hyperbolic and unclear. The NSA's capabilities may have legitimate…

I think that's a pretty serious exaggeration. Designing tools to let you spy on Tor traffic has to be in a separate category from designing bombs that could kill millions. Besides, are there no ends that could justify these means? I think the means are altogether reasonable given the ends. Put aside whether you think the NSA is genuinely pursuing its national security mission: If it were, wouldn't it make perfect sen…

The Stasi and the Gestapo were genuinely pursuing a national security mission. They also did more self-inflicted harm to Germany than the A-bomb did to Japan from the outside. He's not exaggerating the amount of damage an intelligence agency can do.

Re: Attacking Tor: How the NSA targets users' online anonymity

#74

Post by shawn-furyan »

psn wrote: post #71
shawn-furyan wrote: post #37

One heartening aspect of the Snowden revelations as a whole is that they have pretty much just confirmed that the things we thought were strong (public crypto research, tor) are in fact strong and the things that we thought were iffy are in fact iffy(Certificate Authorities, Unvetted Crypto, Cloud Services, The Wires, Implementations). This bodes well for the prospect of navigating out of this whole mess successfully…

I agree with your post generally, but has Snowden said anything about CAs? I did expect to hear that at least one has signed anything the NSA put in front of them, but I don't recall Snowden providing "proof"* of this. * I'm in no position to verify anything Snowden leaks.

The main thing is that CAs are centralized proxies for trust combined with the revelations that confirm that the NSA directly targets such central entities. There was a lot of general uneasiness about the reliance on CAs before the Snowden revelations, and I think the fact that NSA documents show that it leans on such central entities confirms the wisdom of that unease.

Re: Attacking Tor: How the NSA targets users' online anonymity

#75

Post by jlgreco »

anologwintermut wrote: post #70
shawn-furyan wrote: post #37

One heartening aspect of the Snowden revelations as a whole is that they have pretty much just confirmed that the things we thought were strong (public crypto research, tor) are in fact strong and the things that we thought were iffy are in fact iffy(Certificate Authorities, Unvetted Crypto, Cloud Services, The Wires, Implementations). This bodes well for the prospect of navigating out of this whole mess successfully…

Prior to this one should not have (and arguably should sill not) assumed Tor is safe against the NSA. Tor was explicitly not designed to protect against a global passive adversary. That's the price it pays for low latency. With the amount of network data the NSA has, they probably constitute such an adversary. It is actually rather surprising that Tor gives them this much trouble.

> It is actually rather surprising that Tor gives them this much trouble.

I am not really convinced that what we have seen demonstrates conclusively that it does. There is the possibility that we are looking at parallel construction, or that these attacks are genuine but they are sitting on more dramatic capabilities for targets they think are worth it (perhaps because the Chinese continuing to trust and use Tor is a better situation for the NSA to be in than the Chinese doing everything the old fashioned way with microfilm and dead-drops).

The best way to go forward is to continue to assume that Tor does not present any significant difficulty to the NSA.

Re: Attacking Tor: How the NSA targets users' online anonymity

#76

Post by jlgreco »

twoodfin wrote: post #8
tptacek wrote: post #7

Metacommentary: I've taken a jaundiced view of "liberation tech" efforts in the past and this is as good an illustration as any of why. Among "amateur" libtech projects, Tor is about as good as you get --- an active community, extremely widespread use, technical people with their heads screwed on right and as much humility as you can reasonably expect of people whose projects are (candidly) intended to thwart world g…

here, there's a subtext that Tor actually made NSA's job easier Are you reading anything from that subtext beyond, "Tor has a high concentration of the kind of users we're interested in, so let's keep it a juicy target rather than squeezing too hard?"

I don't know that it really is subtext here, but I suspect that Tor has many people communicating electronically where they would otherwise refuse to do so at all. In other words, "Normally I would refuse to talk about this on the internet and would meet you in the back of the bar instead, but I trust Tor so let's discuss this now."

It therefore puts communications that previously would not have been available to the NSA into the realm of things that the NSA can access.

Re: Attacking Tor: How the NSA targets users' online anonymity

#77

Post by andyjohnson0 »

pyre wrote: post #57
sitkack wrote: post #47

Earlier quoted context omitted.

The malware would have to escape the virtual machine. The VM needs to be firewalled off from the host and NOT have the host guest tools installed.

Ok. So what you're talking about is a VM that is only able to route to the internet via Tor, so it would be impossible for it to make a non-Tor connection (thereby compromising anonymity). - If the host guest tools are installed on the guest host, then it would be possible for the malware to install them itself. - If the host guest tools can't be enabled/disabled on a per-VM basis, then that could be an issue, as you…

Something like Qubes [1] and its concept of security domains might help here.

[1] http://qubes-os.org/trac

Re: Attacking Tor: How the NSA targets users' online anonymity

#78

Post by jjoonathan »

kilroy123 wrote: post #56
chakalakasp wrote: post #48

Earlier quoted context omitted.

If you are doing something that would make the NSA interested in you (and I would highly highly discourage that), you'd need to focus more on tradecraft. Get the laptop from a source that can't be traced to you, like a thrift store in a city where you don't live or normally frequent. Disguise yourself, pay in cash, and either make sure there are no security cameras or wait a good year before you do whatever you are g…

I'm glad I have no reason be that anonymous. Sounds stressful. :) Still, I completely agree with you.

Yes, you do have a reason: the practice and preparation to be anonymous takes months/years. I don't care if you're Bruce Schneier and Richard Stallman rolled into one, you will slip up the first time you try. 100% guaranteed.

The standard for needing this kind of anonymity is anticipation of a use case. By the time the use case is at your door, it is too late and if you are unprepared your best bet is to bend over / run away (as the situation permits).

Re: Attacking Tor: How the NSA targets users' online anonymity

#80

Post by shawn-furyan »

anologwintermut wrote: post #70
shawn-furyan wrote: post #37

One heartening aspect of the Snowden revelations as a whole is that they have pretty much just confirmed that the things we thought were strong (public crypto research, tor) are in fact strong and the things that we thought were iffy are in fact iffy(Certificate Authorities, Unvetted Crypto, Cloud Services, The Wires, Implementations). This bodes well for the prospect of navigating out of this whole mess successfully…

Prior to this one should not have (and arguably should sill not) assumed Tor is safe against the NSA. Tor was explicitly not designed to protect against a global passive adversary. That's the price it pays for low latency. With the amount of network data the NSA has, they probably constitute such an adversary. It is actually rather surprising that Tor gives them this much trouble.

It's a question of opportunity cost. The NSA has extensive resources, but it's unlikely that they can employ overwhelming resources (such as would be theoretically necessary to break tor) for every situation where overwhelming resources specifically directed are a theoretical weakness. At the moment, implementations are a much easier target, and so I don't necessarily think that it's surprising that they do have trouble with strong but imperfect systems like tor.

Perhaps once all implementation issues are removed from the security equation (I'll hold my breath while I wait...) it will be necessary to think up better systems. But right now, what's hard for us is hard for the NSA, and so that should be the guiding principle for strengthening current systems and developing new ones. I find that an empowering idea.

Post reply on HN