Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Attacking Tor: How the NSA targets users' online anonymity

theguardian.com

Post reply on HN
Print view View original

91–100 of 184 posts

Re: Attacking Tor: How the NSA targets users' online anonymity

#91

Post by jlgreco »

DanBC wrote: post #83
jlgreco wrote: post #76

Earlier quoted context omitted.

I don't know that it really is subtext here, but I suspect that Tor has many people communicating electronically where they would otherwise refuse to do so at all. In other words, "Normally I would refuse to talk about this on the internet and would meet you in the back of the bar instead, but I trust Tor so let's discuss this now." It therefore puts communications that previously would not have been available to the…

Wouldn't those people have used encrypted communications over Usenet[1] or burner cell phones? Or sometimes even anonymous remailers? And all those are just as tricky. De-anonymizing alt.anonymous.messages ( http://ritter.vg/blog-deanonymizing_amm.html )

Certainly, many would. Would as many though?

Re: Attacking Tor: How the NSA targets users' online anonymity

#92

Post by twoodfin »

nostrademons wrote: post #90
bcoates wrote: post #72

Earlier quoted context omitted.

The Stasi and the Gestapo were genuinely pursuing a national security mission. They also did more self-inflicted harm to Germany than the A-bomb did to Japan from the outside. He's not exaggerating the amount of damage an intelligence agency can do.

I feel like you've just invoked Godwin's Law, and yet in this case the comparison actually seems apt...

How is it apt? If the genuine national security aims pursued by the NSA can be aptly compared to those of the Gestapo, we're well past the point where it makes any difference exactly what techniques they're using to achieve those aims. If their aims are more reasonable, then, again, what's wrong with a spy agency trying to spy?

In other words, the U.S.A.'s national security interests bear little resemblance to those of Nazi Germany (I can't believe I have to type that).

Re: Attacking Tor: How the NSA targets users' online anonymity

#93

Post by Nimi »

tptacek wrote: post #34
cmiles74 wrote: post #11

Earlier quoted context omitted.

I didn't read it that way at all, in fact, it sounds like Tor is sufficiently robust that a good number of NSA employees were tasked with finding exploits. In terms of the exploits found, it looks like all were against the browser. Tor is a well-designed and robust anonymity tool, and successfully attacking it is difficult. The NSA attacks we found individually target Tor users by exploiting vulnerabilities in their…

Tor enabled them to filter down Internet traffic to a subset, and then they simply violated the security premise behind real-world Tor usage (that the rest of the stack was secure) to pierce the veil completely. I'm not indicting Tor. The opposite. But in Iran, China, or Belarus, you don't get to call a foul ball when your libtech stack breaks somewhere you weren't working on. And again, my concern isn't Tor, but the…

tptacek, I'm not sure I understand: do these new revelations really indicate indie developers don't have a fighting chance against Iran?

U.S. - absolutely, no fighting chance.

China - chances look slim.

Iran, Belarus - are you familiar with the technical achievements of their NSA equivalents, and so came to the conclusion they're likely as good as the NSA? Or maybe what the NSA did is just generally easy to do in your opinion?

Re: Attacking Tor: How the NSA targets users' online anonymity

#94

Post by gjulianm »

rz2k wrote: post #30
twoodfin wrote: post #8

Earlier quoted context omitted.

here, there's a subtext that Tor actually made NSA's job easier Are you reading anything from that subtext beyond, "Tor has a high concentration of the kind of users we're interested in, so let's keep it a juicy target rather than squeezing too hard?"

As I understand it, which admittedly isn't well, it made surveillance jobs easier when its users mistook anonymity and privacy. That is, sending something through the tor network means that it's more likely that your traffic is going through a node belonging to a group that records everything than if your traffic randomly found a point to point route across the internet. I don't see how using the Tor network could ma…

Side note: no intermediate node in the Tor network can see your traffic in clear. They just see the encrypted data. The only node that could see what are you sending is the exit node, but that can be solved easily using HTTPS.

Re: Attacking Tor: How the NSA targets users' online anonymity

#97

Post by g8oz »

frank_boyd wrote: post #73

I remember somebody from Mozilla thinking out loud "we should integrate Tor in Firefox". Glad that didn't get done.

I'm more glad that they didn't do it the other way around - considering how confident the NSA is about being able to keep finding new vulnerabilities in Firefox.

Re: Attacking Tor: How the NSA targets users' online anonymity

#98

Post by subdane »

return0 wrote: post #86
shawn-furyan wrote: post #37

One heartening aspect of the Snowden revelations as a whole is that they have pretty much just confirmed that the things we thought were strong (public crypto research, tor) are in fact strong and the things that we thought were iffy are in fact iffy(Certificate Authorities, Unvetted Crypto, Cloud Services, The Wires, Implementations). This bodes well for the prospect of navigating out of this whole mess successfully…

The disheartening things is, though, we don't really have novel technologies (quantum crypto?) to guarantee security anymore and the existing ones will soon be exploitable on a mass scale. This is bad for internet commerce, and for internet itself as a medium. In the eyes of the layman, the internet is untrustworthy. I won't be surprised if in the future we will see closed, privately owned physical networks that guar…

I think Facebook proves definitively that the layman doesn't care about "trustworthiness of the internet".

Re: Attacking Tor: How the NSA targets users' online anonymity

#99

Post by nostrademons »

twoodfin wrote: post #92
nostrademons wrote: post #90

Earlier quoted context omitted.

I feel like you've just invoked Godwin's Law, and yet in this case the comparison actually seems apt...

How is it apt? If the genuine national security aims pursued by the NSA can be aptly compared to those of the Gestapo, we're well past the point where it makes any difference exactly what techniques they're using to achieve those aims. If their aims are more reasonable, then, again, what's wrong with a spy agency trying to spy? In other words, the U.S.A.'s national security interests bear little resemblance to those…

I think a lot of that depends on exactly who's being targeted, and for what reasons. Those revelations haven't made it out yet. The only information we have is the NSA director answering "Not intentionally, no" when asked if the NSA ever spied on American citizens, along with Snowden's allegations that there are no checks and balances if an employee of the NSA believed that they did, and Russ Tice's claim that the NSA spied on Obama.

It's often forgotten that there were many people in Nazi Germany or Stalinist Russia or Communist China or North Korea that believe those countries are completely justified in their actions as well. The reason they are widely reviled is because they lost: people outside of their culture came in, beat them down either economically or militarily, and said "That's not okay what you do to your own citizens."

If I look at the facts of what the Nazis did in the 1930s (before the gas chambers and concentration camps), it was that they turned a large portion of their state security apparatus inward and devoted it to controlling a portion of their population that the ruling class deemed undesirable. I don't know whether the same thing goes on at the NSA; I hope it doesn't. I do know that there should be checks & balances to make sure that it doesn't, because it can become an awfully slippery slope.

Re: Attacking Tor: How the NSA targets users' online anonymity

#100

Post by jlgreco »

nostrademons wrote: post #90
bcoates wrote: post #72

Earlier quoted context omitted.

The Stasi and the Gestapo were genuinely pursuing a national security mission. They also did more self-inflicted harm to Germany than the A-bomb did to Japan from the outside. He's not exaggerating the amount of damage an intelligence agency can do.

I feel like you've just invoked Godwin's Law, and yet in this case the comparison actually seems apt...

It is important to realize that all useful comparisons to the Holocaust will be made against situations that are not as dire as the Holocaust.

If there is a situation as dire as the Holocaust, then rhetoric about things being as bad as the Holocaust is no longer useful. Useful points made in a situation that horrifically dire are made with machine guns and bombs, not rhetoric. The proper time for rhetoric is well before the situation ever evolves that far.

We should therefore consider carefully whether a comparison to the Holocaust is out of line or not. Blanket judgement about such comparisons (such as the standard interpretation of "Godwin's Law") are not useful.

Post reply on HN