Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Secure is Tor? Not secure at all

csam-bib.github.io

Post reply on HN
Print view View original

11–20 of 57 posts

Re: How Secure is Tor? Not secure at all

#11

Post by bnl_umass »

ranger_danger wrote: post #3

> Why has the Tor Project created a network used extensively for child sexual abuse Hottest take of the week right there. Why do they seem to imply that Tor was somehow created explicitly with this purpose in mind? That's like saying only criminals use the Internet, just because it can be used to commit crimes. I think they are taking Tor's words and applying it to a much broader scope than they originally intended.…

My apologies. I don’t believe that was their intent to create a network for csam. But after decades of it being used extensively for csam, why would they take no corrective action?

Re: How Secure is Tor? Not secure at all

#12

Post by ranger_danger »

bnl_umass wrote: post #11
ranger_danger wrote: post #3

> Why has the Tor Project created a network used extensively for child sexual abuse Hottest take of the week right there. Why do they seem to imply that Tor was somehow created explicitly with this purpose in mind? That's like saying only criminals use the Internet, just because it can be used to commit crimes. I think they are taking Tor's words and applying it to a much broader scope than they originally intended.…

My apologies. I don’t believe that was their intent to create a network for csam. But after decades of it being used extensively for csam, why would they take no corrective action?

Maybe because there isn't a known solution?

CSAM is still distributed on the clearnet too... why isn't there a "solution" for that too?

So far the only solutions people seem to have come up with is mass surveillance, and that's not an option.

Re: How Secure is Tor? Not secure at all

#13

Post by bnl_umass »

leakycap wrote: post #6

I'm not here to defend Tor But the calculator states that if the investigating party has $150,000 a month budget for all targets they have a 100% certainty of getting your IP address... obviously this is false, so what else has the author claimed that is also not true?

The math and the code is all there. I’d love to have a discussion about what the real value is. Further, why hasn’t the Tor Project provided this calculation? Why hasn’t anyone? I think it’s necessary.

Re: How Secure is Tor? Not secure at all

#14

Post by bnl_umass »

saithound wrote: post #9
leakycap wrote: post #6

I'm not here to defend Tor But the calculator states that if the investigating party has $150,000 a month budget for all targets they have a 100% certainty of getting your IP address... obviously this is false, so what else has the author claimed that is also not true?

Pretty much everything claimed on this site is false or grossly misleading.

Really? Tell me why.

Re: How Secure is Tor? Not secure at all

#15

Post by _alternator_ »

datadrivenangel wrote: post #10

If an adversary is spending tens or hundreds of thousands of dollars to find you, that's a lift that most threat actors won't be able to do. Especially if they have to host a significant number of exit nodes for a lengthy period, which often means serving unlawful content which is very awkward for law enforcement. It's definitely better than regular browsing for security, but it's not perfect.

Unfortunately, the money isn't just to find "you". You rent arbitrary exit nodes, and if you spend ~$30k / month, you'll be able to deanonimize >50% of users using Tor each month.

Re: How Secure is Tor? Not secure at all

#16

Post by bnl_umass »

ranger_danger wrote: post #12
bnl_umass wrote: post #11

Earlier quoted context omitted.

My apologies. I don’t believe that was their intent to create a network for csam. But after decades of it being used extensively for csam, why would they take no corrective action?

Maybe because there isn't a known solution? CSAM is still distributed on the clearnet too... why isn't there a "solution" for that too? So far the only solutions people seem to have come up with is mass surveillance, and that's not an option.

There is a known solution.

Did you know that the Tor Project allows exit nodes to filter based on the clear internet IP. So filtering is ok.

However, if a relay refuses to service an onion site directory look up, it will be banned by the Directory Authority. They could allow this today. But they don’t. That’s the simple solution. No surveillance. Not back door. No less privacy for everyone else.

edit: This is easy to confirm. I’m not asking anyone to trust me.

Re: How Secure is Tor? Not secure at all

#17

Post by superfishy »

"The small set of people that centrally control Tor software and centrally manage the Tor network have the power to act to stop this abuse without lessening their (weak) protections."

That the author has received funding from the DOJ makes me wonder what their proposed solution is.

Re: How Secure is Tor? Not secure at all

#18

Post by neutered_knot »

datadrivenangel wrote: post #10

If an adversary is spending tens or hundreds of thousands of dollars to find you, that's a lift that most threat actors won't be able to do. Especially if they have to host a significant number of exit nodes for a lengthy period, which often means serving unlawful content which is very awkward for law enforcement. It's definitely better than regular browsing for security, but it's not perfect.

It’s a drop in the bucket for state actors who might want to find TORs target user base of dissidents, whistleblowers, and journalists.

Re: How Secure is Tor? Not secure at all

#19

Post by janci »

bnl_umass wrote: post #13
leakycap wrote: post #6

I'm not here to defend Tor But the calculator states that if the investigating party has $150,000 a month budget for all targets they have a 100% certainty of getting your IP address... obviously this is false, so what else has the author claimed that is also not true?

The math and the code is all there. I’d love to have a discussion about what the real value is. Further, why hasn’t the Tor Project provided this calculation? Why hasn’t anyone? I think it’s necessary.

The assumption is the adversary controls x of N nodes. When x=N the probability of discovering the onion service IP is 1. But the adversary can not achieve this situation as he only controls the additional nodes. The existing nodes still stay in the network, they do not disappear. The ratio is not x/N but x/(x+N).

The formula is wrong and it all falls apart.

Re: How Secure is Tor? Not secure at all

#20

Post by bnl_umass »

giantg2 wrote: post #7

"As C3P will tell you: CSAM distribution on Tor onion services is not inevitable." Lol, are we using the regular internet as an example of preventing all CSAM? We've known for years that owning enough nodes results in the compromise of privacy and that it's likely the NSA has achieved this. Although there is some question around how that plays out if adversaries like China are also competing for similar node share pe…

There is no question about that. The site makes use of current statistics from the Tor Project.
Post reply on HN