Hackers build a new Tor client designed to beat the NSA
1–10 of 32 posts
Re: Hackers build a new Tor client designed to beat the NSA
#2>>Astoria [is] both most effective and most usable when at its highest security level, the researchers say, so "Astoria is a usable substitute for the vanilla Tor client only in scenarios where security is a high priority."
I'm still working through the research paper[1] linked at the end of the article, but if Astoria is as good as described, wouldn't Tor either adopt the same node selection policies, or people shift over to Astoria wholesale?
[1] http://arxiv.org/pdf/1505.05173.pdf
EDIT: From the paper, quotes below provide much clearer context for the quote in the article:
"From our evaluation of Astoria, it is clear that the performance-security trade-off is favorable only in its higher security configurations. [...] However, at lower security configurations, the performance offered by Tor is clearly better, and its security, only slightly worse. Therefore, Astoria is a usable substitute for the vanilla Tor client only in scenarios where security is a high priority."
Re: Hackers build a new Tor client designed to beat the NSA
#3>>Astoria [is] both most effective and most usable when at its highest security level, the researchers say, so "Astoria is a usable substitute for the vanilla Tor client only in scenarios where security is a high priority." I'm still working through the research paper[1] linked at the end of the article, but if Astoria is as good as described, wouldn't Tor either adopt the same node selection policies, or people shif…
or provide patches against upstream instead of forking.
Re: Hackers build a new Tor client designed to beat the NSA
#4>>Astoria [is] both most effective and most usable when at its highest security level, the researchers say, so "Astoria is a usable substitute for the vanilla Tor client only in scenarios where security is a high priority." I'm still working through the research paper[1] linked at the end of the article, but if Astoria is as good as described, wouldn't Tor either adopt the same node selection policies, or people shif…
It would be interesting to see if this gets adopted in something like Tails where security is the priority focus.
Re: Hackers build a new Tor client designed to beat the NSA
#5"designed to beat" means better, not perfect. Imperfect means eventually it gets beat. The NSA might say what the IRA told Margaret Thatcher, "Today we were unlucky, but remember we only have to be lucky once. You will have to be lucky always."
Re: Hackers build a new Tor client designed to beat the NSA
#6"designed to beat" means better, not perfect. Imperfect means eventually it gets beat. The NSA might say what the IRA told Margaret Thatcher, "Today we were unlucky, but remember we only have to be lucky once. You will have to be lucky always."
as a friend reminded me, anonymity only buys you time; it does not buy anyone justice.
and david simon's recapitulation is more succinct and compelling: https://www.youtube.com/watch?v=E2Fv-nJCfrk
Re: Hackers build a new Tor client designed to beat the NSA
#7>> Astoria also opens multiple avenues for future work such as integrating realtime hijack and interception detection systems (to fully counter RAPTOR [18] attacks)
This is really interesting. I'm curious how that would work.
Re: Hackers build a new Tor client designed to beat the NSA
#8"designed to beat" means better, not perfect. Imperfect means eventually it gets beat. The NSA might say what the IRA told Margaret Thatcher, "Today we were unlucky, but remember we only have to be lucky once. You will have to be lucky always."
Do you have a specific weakness in the implementation you've found and would like to share? Vaguely pointing out that something is imperfect isn't very useful, indeed, it would be amazing if you told us something was perfect!
Re: Hackers build a new Tor client designed to beat the NSA
#9"designed to beat" means better, not perfect. Imperfect means eventually it gets beat. The NSA might say what the IRA told Margaret Thatcher, "Today we were unlucky, but remember we only have to be lucky once. You will have to be lucky always."
as a friend reminded me, anonymity only buys you time; it does not buy anyone justice. and david simon's recapitulation is more succinct and compelling: https://www.youtube.com/watch?v=E2Fv-nJCfrk
It might buy you enough time.
Note that almost every exercise in security is an exercise in buying time. Today's encryption will likely be broken tomorrow and by the time you've achieved your goal it no longer matters whether or not your communications are broken.
Of course if you plan to stay in business for a very long time you're gambling against really good odds of discovery and potentially not achieving your goal.
If you want to be a terrorist or miscreant you could extrapolate from that that fewer numbers is better and the first 'hit' should be your hardest and should not take too long to set up or require a lot of communication.
Fortunately for the rest of the world any plot that does real damage usually does not have those properties.
But beware of the lone wolf with access to technology.
Re: Hackers build a new Tor client designed to beat the NSA
#10"designed to beat" means better, not perfect. Imperfect means eventually it gets beat. The NSA might say what the IRA told Margaret Thatcher, "Today we were unlucky, but remember we only have to be lucky once. You will have to be lucky always."
I haven't heard that quote before. It is very good, if not quite scary.