Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor and HTTPS

eff.org

Post reply on HN
Print view View original

101–110 of 135 posts

Re: Tor and HTTPS

#101

Post by throwmeaway33 »

noerps wrote: post #51
csomar wrote: post #33

Earlier quoted context omitted.

Then, maybe, use Bitcoins for payment and Tor+HTTPS while signing up for the hosting provider?

Bitcoin transactions are chained, that may compromise you. But you could use an anon currency-exchange or currency-bridge like paysafecard.com to obtain some value and obtain bitcoin with that value and never use that bitcoin key again to avoid that.

Is there no system to swap ownership of coins?

If not there should be. You send X amount of bitcoins to a middle man who then gives you X amount back. Technically they will be different coins and they'll go to a different account #, so you can't trace anything.

Re: Tor and HTTPS

#102

Post by noerps »

tonfa wrote: post #83
icebraining wrote: post #63

Earlier quoted context omitted.

Yeah, and even if you get a certificate from a CA which isn't, it doesn't matter, since any other CA can still issue a cert for your domain.

Cert pinning and http://tools.ietf.org/html/rfc6962 would help for those cases.

Yay for a trust automaton, another level of complexity that won't solve anything.

Re: Tor and HTTPS

#103

Post by duairc »

unimpressive wrote: post #87
duairc wrote: post #76

Earlier quoted context omitted.

No, they don't, they do a bad thing. In actual fact, all cops are bastards. Their primary function in society is to defend the property rights of the capitalist class against the working class, thus preserving inequality.

Ignoring for a moment the validity of this statement, can I ask why you visit a site that is primarily about business news/Silicon Valley Hacker errata if you're not a fan of the 'bourgeois'?

Because it's Hacker News, not Bourgeois News. And I know this site is tied to an ideology that reimagines the "DIY" (for want of a better term) aspect of the hacker tradition as a kind of pro-capitalist (or at least "DIY capitalist") thing, but I don't think most hackers are capitalists, even on this site. For me, anti-authoritarianism has always been a central tenet of the hacker tradition, which for me goes hand-in-hand with anti-capitalism. I acknowledge that most hackers are not explicitly/consciously anti-capitalist.

Re: Tor and HTTPS

#104

Post by noerps »

throwmeaway33 wrote: post #101
noerps wrote: post #51

Earlier quoted context omitted.

Bitcoin transactions are chained, that may compromise you. But you could use an anon currency-exchange or currency-bridge like paysafecard.com to obtain some value and obtain bitcoin with that value and never use that bitcoin key again to avoid that.

Is there no system to swap ownership of coins? If not there should be. You send X amount of bitcoins to a middle man who then gives you X amount back. Technically they will be different coins and they'll go to a different account #, so you can't trace anything.

I am currently evaluating that.

Re: Tor and HTTPS

#105

Post by [deleted] »

frisco wrote: post #98

I think this is misleading. I now believe that the NSA has the private keys for substantially all SSL certs in use, and I expect that a non-trivial percentage of Tor nodes are run by the government. SSL certs require cooperation of a trusted registrar even for the biggest companies -- Google's is signed by Equifax, for example. Given what we've seen in the last few days, requesting keys from the root CAs is a no-brai…

[deleted]

Re: Tor and HTTPS

#106

Post by nbouscal »

noerps wrote: post #94
dgallagher wrote: post #91

What would be the highest level of anonymity one could achieve on the modern internet? How could you accomplish it?

There is no level on anonymity, either you are, or you are not. Addendum for achievement: Connect to Tor from a public accessible network/wifi that is free from surveillance using a pristine installation and never use that network-device again. Addendum 2: If you use the network device twice, you may achieve only pseudonymity.

Valid point that anonymity is a binary property, but, if you wanted to talk about levels you could perhaps measure the level of difficulty of finding your identity, or the likelihood of accurately doing so.

Re: Tor and HTTPS

#107

Post by MertsA »

frisco wrote: post #98

I think this is misleading. I now believe that the NSA has the private keys for substantially all SSL certs in use, and I expect that a non-trivial percentage of Tor nodes are run by the government. SSL certs require cooperation of a trusted registrar even for the biggest companies -- Google's is signed by Equifax, for example. Given what we've seen in the last few days, requesting keys from the root CAs is a no-brai…

A key thing to point out, all a root CA does is verify your public key. The NSA can't get Google's private key from Equifax and they can't even impersonate Google if the end user is using Chrome even if Equifax signed a cert for them. The reason is because Chrome basically checks to see if the cert matches up with a known good copy.

Also, if your platform supports it, Gmail has perfect forward secrecy meaning that even if the NSA records all HTTPS traffic to gmail and later demands Google's private key they can't decrypt any of that captured traffic.

Tor on the other hand is a problem. It has several fundamental flaws as you pointed out like by controlling some gateway nodes and a few others you can start breaking any sort of secrecy that you would get from Tor. Really the only good thing about Tor is that it's well known. I really wish Tor would just die and people would move over to something better like I2P where it's an anonymous network, not just a kludged together anonymous proxy with hidden services slapped on as an afterthought.

Re: Tor and HTTPS

#108

Post by Phlarp »

claudius wrote: post #73
Phlarp wrote: post #65

Earlier quoted context omitted.

This has been my question in this whole mess, if we assume NSA can and does subpoena the keys and certs as opposed to the direct data (and the NSA were copying data en masse, which now seems likely) would that not make HTTPS essentially useless?

The NSA is not the average guy listening in on your wifi and then using your CC to buy stuff online. HTTPS protects against those, and it does so relatively efficiently.

Sorry, I should have clarified that it negates HTTPS in the context of the NSA (and presumably other government actors around the world), still great protection from getting your facebook session hijacked over wifi.

What about protection from the average NSA sysadmin or analyst with slightly less moral fiber than Edward Snowden? (or gambling debt, or a mental disease, or an obsession with your significant other etc.)

Re: Tor and HTTPS

#109

Post by Phlarp »

MertsA wrote: post #107
frisco wrote: post #98

I think this is misleading. I now believe that the NSA has the private keys for substantially all SSL certs in use, and I expect that a non-trivial percentage of Tor nodes are run by the government. SSL certs require cooperation of a trusted registrar even for the biggest companies -- Google's is signed by Equifax, for example. Given what we've seen in the last few days, requesting keys from the root CAs is a no-brai…

A key thing to point out, all a root CA does is verify your public key. The NSA can't get Google's private key from Equifax and they can't even impersonate Google if the end user is using Chrome even if Equifax signed a cert for them. The reason is because Chrome basically checks to see if the cert matches up with a known good copy. Also, if your platform supports it, Gmail has perfect forward secrecy meaning that ev…

I was under the impression having the ability to subpoena a key or cert from either the CA or the company issued the cert would give the NSA carte blanche on decrypting any (encrypted) data they may have gathered by other means.

Since I don't seem to be understanding the associated technology as well as I thought I was, could you point me towards some relevant reading on this topic? How/Why are the current implementations of HTTPS considered to have perfect forward security?

Re: Tor and HTTPS

#110

Post by lurchpop »

mtgx wrote: post #28

Assuming the NSA is tapping ISP cables, and siphoning all unencrypted data of the web, and that they need to ask the big companies in the slides for the encrypted data, would EFF's "HTTPS Everywhere" help with all the websites that are not encrypted, like say Reddit?

reddit is encrypted: https://pay.reddit.com/. (the "pay" part doesn't mean you have to be a paying member.)
Post reply on HN