Metacommentary: I've taken a jaundiced view of "liberation tech" efforts in the past and this is as good an illustration as any of why. Among "amateur" libtech projects, Tor is about as good as you get --- an active community, extremely widespread use, technical people with their heads screwed on right and as much humility as you can reasonably expect of people whose projects are (candidly) intended to thwart world g…
>(here, there's a subtext that Tor actually made NSA's job easier) I'm not sure how you reached that conclusion. The slides mention that Tor is: * Very difficult to identify on the network-level, since Tor-tls traffic is indistinguishable from Apache-tls traffic as of 2011 * Impossible to fully deanonymize * Only exploitable via a handful of browser exploits. Further, later in the "Tor is the King" slide deck, there'…
Attacking Tor: How the NSA targets users' online anonymity
101–110 of 184 posts
Re: Attacking Tor: How the NSA targets users' online anonymity
#102Earlier quoted context omitted.
I feel like you've just invoked Godwin's Law, and yet in this case the comparison actually seems apt...
It is important to realize that all useful comparisons to the Holocaust will be made against situations that are not as dire as the Holocaust. If there is a situation as dire as the Holocaust, then rhetoric about things being as bad as the Holocaust is no longer useful. Useful points made in a situation that horrifically dire are made with machine guns and bombs, not rhetoric. The proper time for rhetoric is well bef…
Yeah, that's my point. That there's a widespread convention that a thread is over once a comparison to Nazis is made because, well, where do you go from there? - and yet in this case, the comparison is factually very similar to where the Nazis were in the early 1930s, before guns and bombs became necessary. And yet we got the Holocaust and WW2 because nobody intervened back when it was "just" a surveillance state and a bunch of economically disenfranchised people looking for a scapegoat.
Re: Attacking Tor: How the NSA targets users' online anonymity
#103Earlier quoted context omitted.
The disheartening things is, though, we don't really have novel technologies (quantum crypto?) to guarantee security anymore and the existing ones will soon be exploitable on a mass scale. This is bad for internet commerce, and for internet itself as a medium. In the eyes of the layman, the internet is untrustworthy. I won't be surprised if in the future we will see closed, privately owned physical networks that guar…
I think Facebook proves definitively that the layman doesn't care about "trustworthiness of the internet".
They do for anything that requires money and beyond. That's why banks etc. try hard to persuade people they have high security standards.
Re: Attacking Tor: How the NSA targets users' online anonymity
#104Earlier quoted context omitted.
I feel like you've just invoked Godwin's Law, and yet in this case the comparison actually seems apt...
How is it apt? If the genuine national security aims pursued by the NSA can be aptly compared to those of the Gestapo, we're well past the point where it makes any difference exactly what techniques they're using to achieve those aims. If their aims are more reasonable, then, again, what's wrong with a spy agency trying to spy? In other words, the U.S.A.'s national security interests bear little resemblance to those…
In other words, the U.S.A.'s national security interests bear little resemblance to those of Nazi Germany (I can't believe I have to type that).
Fine, I'll concede the singular moral uniqueness of the government of Germany from 1933 to 1945.
How about the Stasi? The KGB? The COINTELPRO-era FBI? The Star Chamber? These were all arms of governments as legitimate as mine or any other, and their aims were exactly that of every other internal security agency. The harm they did was not some sort of moral corruption, it can't be cured by being the good guys or on the side of the good guys.
These were evil organizations consisting of evil people because of what they did, not why they did it. An East German government without the Stasi is just yet another poorly run postwar client state. The Soviet Union without the KGB (and a few other atrocities) is just a large developing country with some ill-considered economic policies.
Post Church Commission America is just a better version of America. When the children of ex-NSA employees lie to their friends that their father left when they were young because the truth would be embarrassing, it will be a better America still.
Re: Attacking Tor: How the NSA targets users' online anonymity
#105One heartening aspect of the Snowden revelations as a whole is that they have pretty much just confirmed that the things we thought were strong (public crypto research, tor) are in fact strong and the things that we thought were iffy are in fact iffy(Certificate Authorities, Unvetted Crypto, Cloud Services, The Wires, Implementations). This bodes well for the prospect of navigating out of this whole mess successfully…
not to be a downer but I do feel these systems and exploits are designed by us the hackers we so much want to belive are good, but it looks like most hackers have a price and probably derive joy from designing these systems for the government.
we know what is trustworthy we know how to build and do the right thing. yet look there is tens of thousands of brilliant minds working for the nsa against everybody else.
Re: Attacking Tor: How the NSA targets users' online anonymity
#106I've been playing with vagrant and ansible to create a new server in a snap. Here is a good weekend project:
Instead of having just an Tor/browser bundle, build a vagrant machine specification that installs the Tor bundle. This virtual machine would be destroyed and recreated from time to time. Now put the machine specification in GitHub and let anyone use it.
Re: Attacking Tor: How the NSA targets users' online anonymity
#107Earlier quoted context omitted.
A better chance than one would think from that phrasing, as there are a lot of highly motivated and intelligent people working on privacy tech.
It doesn't matter. Protecting privacy is too big a goal. In the end, why does the NSA do what it does? To get specific, actionable intelligence. Everyone in the world's privacy is just collateral damage. But, turn that around. Protecting your privacy (never mind anyone else's) is too big a goal. It's too easily breached. Instead, think of what specific information you feel you need to keep private, and how you might…
Thats why we all should keep as much privacy as possible, if not for the sake of feeling a need for it ourselves, but to help out those who feel so. It is easier for them to hide among the mass of encrypted traffic and privacy-aware activities rather than stand out there on their own, shining like a light bulb to the NSA and other adversaries.
Boycott surveillance, encrypt everything.
Re: Attacking Tor: How the NSA targets users' online anonymity
#108Earlier quoted context omitted.
Tor enabled them to filter down Internet traffic to a subset, and then they simply violated the security premise behind real-world Tor usage (that the rest of the stack was secure) to pierce the veil completely. I'm not indicting Tor. The opposite. But in Iran, China, or Belarus, you don't get to call a foul ball when your libtech stack breaks somewhere you weren't working on. And again, my concern isn't Tor, but the…
tptacek, I'm not sure I understand: do these new revelations really indicate indie developers don't have a fighting chance against Iran ? U.S. - absolutely, no fighting chance. China - chances look slim. Iran, Belarus - are you familiar with the technical achievements of their NSA equivalents, and so came to the conclusion they're likely as good as the NSA? Or maybe what the NSA did is just generally easy to do in yo…
Iran spends ~10bn/yr for the "on the books" part of their military. How much vulnerability research do you think $500MM buys? Answer: a lot.
Re: Attacking Tor: How the NSA targets users' online anonymity
#109Earlier quoted context omitted.
I feel like you've just invoked Godwin's Law, and yet in this case the comparison actually seems apt...
It is important to realize that all useful comparisons to the Holocaust will be made against situations that are not as dire as the Holocaust. If there is a situation as dire as the Holocaust, then rhetoric about things being as bad as the Holocaust is no longer useful. Useful points made in a situation that horrifically dire are made with machine guns and bombs, not rhetoric. The proper time for rhetoric is well bef…
To think about that a bit:
Actually, there have been several pretty brutal genocidal events in history that have points of comparison to the Holocaust. In no particular order, it is instructive to look at the Holodomr of Ukraine, Pol Pot, Stalin's purges, the Hutu-Tutsi conflict.
There's no sense in calling forum moderators nazis in general, which is why Godwin came about. But when considering large-scale genocide and surveillance societies, comparisons to Nazi Germany do become relevant.
Re: Attacking Tor: How the NSA targets users' online anonymity
#110One heartening aspect of the Snowden revelations as a whole is that they have pretty much just confirmed that the things we thought were strong (public crypto research, tor) are in fact strong and the things that we thought were iffy are in fact iffy(Certificate Authorities, Unvetted Crypto, Cloud Services, The Wires, Implementations). This bodes well for the prospect of navigating out of this whole mess successfully…
The weak point as usual are the endpoints. The attack vector described in these documents is JavaScript via some library called E4X. Makes me wonder why Tor bundle doesn't come with NoScript enabled by default.