Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Partnering with Mozilla

blog.torproject.org

Post reply on HN
Print view View original

51–60 of 104 posts

Re: Partnering with Mozilla

#51

Post by hyperbovine »

zobzu wrote: post #47
01Michael10 wrote: post #45

Earlier quoted context omitted.

Guns are NOT defensive weapons... You could be standing in the Starbucks line with any weapon of your choosing and I can just walk up to you and pull out a pistol and splatter your brains across the counter. No problem... EDIT - Why is my off-topic comment with an argument being down-voted in a reply to a off-topic statement with no argument is not? There must be a lot of gun lovers on Hacker News...

Because your argument makes no sense at all to the majority (me included). A tool is a tool. Its how you use it that makes it good or bad. I tend to believe that people who see a tool as one that can only be used in one direction, to be the ones most likely to use it in that direction.

A tool that is designed to kill people is different from a garden trowel. Give me a break.

Re: Partnering with Mozilla

#52

Post by higherpurpose »

ryan-c wrote: post #26
hackuser wrote: post #8

One major challenge: Using Tor, end users can easily and unintentionally compromise their confidentiality by disclosing information explicitly (e.g., their email logon) or implicitly (habits, browser fingerprints, and other identifiers); it takes discipline to remain anonymous on Tor and even technically skilled hidden service operators, with reason to be paranoid about illegal businesses, fail to do it. Also, leaked…

Routing all Firefox users through Tor relays by default would be madness. * It would make Firefox slow. * It would place a tremendous load on the Tor network. * It would defeat content filtering (which includes blocking malware) on enterprise networks. * It would expose users to traffic interception and manipulation who wouldn't otherwise be so exposed.

Here's what could help - turning all users into (exit) relays. That strategy has worked for torrents very well - all downloaders are also seeders (I think it's a similar situation).

This solves multiple things:

1) makes it much harder to do traffic analysis

2) makes it almost impossible to "go after relays". Sure, they'll still try to arrest some here and there, just like they try to arrest people who torrent movies, and even with the mass copyright laws they couldn't stop piracy. There were just many more who did it, making the hunted down but a tiny percentage.

3) should make the legal defense case even stronger than it is now for relays. You can say today that "you don't know what's happening through your relay", however you still have to choose to become a relay. I think that says something. It may not be a huge case in the prosecutor's favor, but it may convince the judge to be against you in some cases. But if everyone is a relay and you can use the defense that "this is just how Tor/Firefox works", I think that would work a little better

4) should improve speed since relays can't be choked anymore

5) I'm not sure about this one, but I think it should make it much harder to DDoS Tor users/hidden services as well?

I think having the way Tor works currently is a design flaw in Tor. Tor should be "fully distributed" in a way.

As for the argument "but then no one will use Tor if they are forced to be relays!" - I just don't buy it. I think there may be some that will get scared in the short term, but then see Tor actually gets more secure this way in the long term, and will return. I also believe Tor will get more new users in the long term this way.

EDIT: What I'm referring to is turning everyone into exit relays/nodes. My arguments remain the same. If it's not illegal for people to have an exit node in US (as Tor claims [1]), then it shouldn't be illegal for millions to do it either. In fact it could be a sort of stronger civil disobedience thing.

Plus, even if it is illegal, so is piracy. That hasn't stopped millions from doing it. Just like "being gay", what's legal and what's illegal is a matter of how we shape our laws. To change those laws, first you need someone to break them and change the society in a different direction. If you didn't have anyone to break a law in a certain direction, then laws would never need to be changed.

[1] - https://www.torproject.org/eff/tor-legal-faq.html.en

Re: Partnering with Mozilla

#53

Post by hackuser »

navyrain wrote: post #40
hackuser wrote: post #8

One major challenge: Using Tor, end users can easily and unintentionally compromise their confidentiality by disclosing information explicitly (e.g., their email logon) or implicitly (habits, browser fingerprints, and other identifiers); it takes discipline to remain anonymous on Tor and even technically skilled hidden service operators, with reason to be paranoid about illegal businesses, fail to do it. Also, leaked…

It is a tricky issue, but I can see a good argument for increasing the amount of traffic going through TOR, even if much of it was from users without proper OPSEC. As with all security, it is an education issue; just as "Private Mode" warns users that they might be tracked by ISPs or other agents, "Super-private mode" would have to warn users that supplying identifying information would jeopardize their privacy.

> it is an education issue; just as "Private Mode" warns users that they might be tracked by ISPs or other agents

I wonder what percentage of users understand that. How many read the fine print, grasp its meaning, and act on it?

It would be interesting if Mozilla has studied this security training in particular or if someone has studied security training in general. That is, test how many users read the information, retain it, understand it, and act on it? What works and what doesn't?

Re: Partnering with Mozilla

#55

Post by stingraycharles »

higherpurpose wrote: post #52
ryan-c wrote: post #26

Earlier quoted context omitted.

Routing all Firefox users through Tor relays by default would be madness. * It would make Firefox slow. * It would place a tremendous load on the Tor network. * It would defeat content filtering (which includes blocking malware) on enterprise networks. * It would expose users to traffic interception and manipulation who wouldn't otherwise be so exposed.

Here's what could help - turning all users into (exit) relays. That strategy has worked for torrents very well - all downloaders are also seeders (I think it's a similar situation). This solves multiple things: 1) makes it much harder to do traffic analysis 2) makes it almost impossible to "go after relays". Sure, they'll still try to arrest some here and there, just like they try to arrest people who torrent movies,…

The problem is that you do not make the distinction between a regular relay and an exit node. There are enough regular relays in the tor network, but people hesitate running exit nodes because of the legal liabilities: many ISPs do not want you to run a tor exit node, because of the nature of some traffic coming through the tor network (illegal marketplaces, child porn, etc -- as you can read in the article, even Mozilla doesn't want to host exit relays).

If you make this the default, you're opening a can of worms legal-wise. If you make only non-exit relays the default, your whole plan defeats its purpose, because then exit nodes remain the weakest link (as they are now).

Re: Partnering with Mozilla

#56

Post by higherpurpose »

mccr8 wrote: post #20
navyrain wrote: post #6

This sort of this is pretty exciting. Now that users are aware of NSA hijinks, and are familiar with the Privacy modes of their current browsers, I'd like to see Mozilla move towards a "Super Privacy" mode where they route over a built-in Tor client. Of course, the dream would be to have all Firefox clients run Tor relay nodes out of the box, backed by Mozilla-supported exit nodes.

As hackuser says elsewhere, Tor is not really a fire-and-forget security solution. My understanding is that in order to use it without compromising yourself you need to have a fairly sophisticated understanding of its limitations.

But isn't that the point of Incognito mode in the first place? To only use it in certain situations when you need extra privacy? I doubt too many try to login through Facebook using the Incognito mode, or at least they wouldn't use their real accounts.

Mozilla just needs to enhance Incognito mode (or create a new mode) with Tor.

Re: Partnering with Mozilla

#57

Post by bigiain »

hackuser wrote: post #8

One major challenge: Using Tor, end users can easily and unintentionally compromise their confidentiality by disclosing information explicitly (e.g., their email logon) or implicitly (habits, browser fingerprints, and other identifiers); it takes discipline to remain anonymous on Tor and even technically skilled hidden service operators, with reason to be paranoid about illegal businesses, fail to do it. Also, leaked…

FWIW, I _intentionally_ de-anonymize myself over TOR as often as I remember to. I make a point of browsing things like local council and government websites using TOR, including logging in or providing details in contact forms, while doing mundane and ordinary stuff like booking extra garbage collections.

Re: Partnering with Mozilla

#58

Post by teekert »

hackuser wrote: post #8

One major challenge: Using Tor, end users can easily and unintentionally compromise their confidentiality by disclosing information explicitly (e.g., their email logon) or implicitly (habits, browser fingerprints, and other identifiers); it takes discipline to remain anonymous on Tor and even technically skilled hidden service operators, with reason to be paranoid about illegal businesses, fail to do it. Also, leaked…

I think this solves itself: How is the NSA going to keep track of ever increasing piles of data-to-be-decrypted? They will be swamped, eventually red-flagging so many people that the red flag becomes meaningless.

Re: Partnering with Mozilla

#59

Post by tempestn »

This is great. Even if not all changes in the Tor Browser fork are appropriate to be merged back into Firefox (and certainly not all will be), for every one that they can merge, it both makes Firefox more secure and frees up Tor developers from maintaining those differences. Sounds like a win all around.

Re: Partnering with Mozilla

#60

Post by annnnd »

bigiain wrote: post #57
hackuser wrote: post #8

One major challenge: Using Tor, end users can easily and unintentionally compromise their confidentiality by disclosing information explicitly (e.g., their email logon) or implicitly (habits, browser fingerprints, and other identifiers); it takes discipline to remain anonymous on Tor and even technically skilled hidden service operators, with reason to be paranoid about illegal businesses, fail to do it. Also, leaked…

FWIW, I _intentionally_ de-anonymize myself over TOR as often as I remember to. I make a point of browsing things like local council and government websites using TOR, including logging in or providing details in contact forms, while doing mundane and ordinary stuff like booking extra garbage collections.

Interesting - care to elaborate on the reasons?
Post reply on HN