How Tor Works • Hacker News Board

Re: How Tor Works

#11

Post by jahnu » Fri, Sep 02, 2016, 7:19 AM UTC

kbart wrote: post #6

deltaprotocol wrote: post #4

When I see articles about security related topics I immediately expect them to be served over HTTPS and get frustrated when they are not. It makes me think if HN should perhaps make a stand and either display some sort of lock icon next to secure links or make it harder for insecure links to show in the front page. Where is the right place to discuss this?

Why do you need https for text only page? Sure, somebody could do deep packet inspection, but they would not find anything they couldn't find going to the domain (that won't be hidden by https anyway) directly. EDIT: previously incorrectly stated 'url' instead of 'domain'.

But URLs are encrypted as it's the TCP connection that's encrypted, isn't it?!

Re: How Tor Works

#12

Post by justinlardinois » Fri, Sep 02, 2016, 7:38 AM UTC

niftich wrote: post #7

kbart wrote: post #6

Earlier quoted context omitted.

Why do you need https for text only page? Sure, somebody could do deep packet inspection, but they would not find anything they couldn't find going to the domain (that won't be hidden by https anyway) directly. EDIT: previously incorrectly stated 'url' instead of 'domain'.

For integrity, ie. tamper-resistance and knowing if MitM tampering was done.

What's the end game for our hypothetical man in the middle? To edit the article to be subtly incorrect, so you'll misunderstand how Tor works?

Re: How Tor Works

#13

Post by beardog » Fri, Sep 02, 2016, 7:50 AM UTC

deltaprotocol wrote: post #9

kbart wrote: post #6

Earlier quoted context omitted.

Why do you need https for text only page? Sure, somebody could do deep packet inspection, but they would not find anything they couldn't find going to the domain (that won't be hidden by https anyway) directly. EDIT: previously incorrectly stated 'url' instead of 'domain'.

I don't know what is on a page until I visit it, so to make a stand myself in favor of a less insecure internet, I use HTTPS Everywhere in strict mode, which blocks HTTP. I have found that mostly I can live with it, and wish for the community (HN audience is a good part of it) to keep pushing (through a bit of pressure perhaps) towards an HTTPS only internet.

The problem with this is that it makes it very difficult to do network/isp level caching, this is especially problematic in areas where internet connectivity is slow, expensive, and limited.

Re: How Tor Works

#14

Post by beardog » Fri, Sep 02, 2016, 7:51 AM UTC

jahnu wrote: post #11

kbart wrote: post #6

Earlier quoted context omitted.

Why do you need https for text only page? Sure, somebody could do deep packet inspection, but they would not find anything they couldn't find going to the domain (that won't be hidden by https anyway) directly. EDIT: previously incorrectly stated 'url' instead of 'domain'.

But URLs are encrypted as it's the TCP connection that's encrypted, isn't it?!

Yes, snoopers can only see the domain you visit (not the full url). (although they can make good educated guesses based on file sizes)

Re: How Tor Works

#15

Post by beardog » Fri, Sep 02, 2016, 7:53 AM UTC

justinlardinois wrote: post #12

niftich wrote: post #7

Earlier quoted context omitted.

For integrity, ie. tamper-resistance and knowing if MitM tampering was done.

What's the end game for our hypothetical man in the middle? To edit the article to be subtly incorrect, so you'll misunderstand how Tor works?

Redirect to another website, push malware, show shock material, exploit a vulnerability in your browser.

Re: How Tor Works

#16

Post by x0137294744532 » Fri, Sep 02, 2016, 7:53 AM UTC

justinlardinois wrote: post #12

niftich wrote: post #7

Earlier quoted context omitted.

For integrity, ie. tamper-resistance and knowing if MitM tampering was done.

What's the end game for our hypothetical man in the middle? To edit the article to be subtly incorrect, so you'll misunderstand how Tor works?

Spy on our country's citizens with deep packet inspection and put anyone on a list that reads anything related to Tor. With HTTPS, the visit of this website would seem 'innocent'.

Re: How Tor Works

#17

Post by beardog » Fri, Sep 02, 2016, 7:54 AM UTC

mirimir wrote: post #8

It would also be useful to point out limitations and vulnerabilities. Tor browser has no protection against malware that hits the Internet directly, bypassing Tor circuits. But Tor Project does not prominently warn users about that on its website. While Tor Project does acknowledge Tor's vulnerability to global adversaries, there's also no prominent warning about that. If you run Tor in a terminal, you see "This is e…

Even worse is that javascript is default enabled, making the security as strong as the Firefox sandbox.

Re: How Tor Works

#18

Post by niftich » Fri, Sep 02, 2016, 7:55 AM UTC

justinlardinois wrote: post #12

niftich wrote: post #7

Earlier quoted context omitted.

For integrity, ie. tamper-resistance and knowing if MitM tampering was done.

What's the end game for our hypothetical man in the middle? To edit the article to be subtly incorrect, so you'll misunderstand how Tor works?

That's one possibility -- to misinform or give incorrect instructions. This may be more of a risk with this type of content than your run-of-the-mill personal blog.

A more frequent one is injection of ads or tracking scripts, or 'web accelerators' that recompress images. Certain ISPs have been known to do these.

Re: How Tor Works

#19

Post by yoo1I » Fri, Sep 02, 2016, 8:01 AM UTC

kbart wrote: post #6

deltaprotocol wrote: post #4

When I see articles about security related topics I immediately expect them to be served over HTTPS and get frustrated when they are not. It makes me think if HN should perhaps make a stand and either display some sort of lock icon next to secure links or make it harder for insecure links to show in the front page. Where is the right place to discuss this?

Why do you need https for text only page? Sure, somebody could do deep packet inspection, but they would not find anything they couldn't find going to the domain (that won't be hidden by https anyway) directly. EDIT: previously incorrectly stated 'url' instead of 'domain'.