Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is Tor still safe to use?

blog.torproject.org

Post reply on HN
Print view View original

121–130 of 602 posts

Re: Is Tor still safe to use?

#121

Post by echoangle »

oconnore wrote: post #111
sigmoid10 wrote: post #64

Earlier quoted context omitted.

>Surely eventually I'm going to get a hit where all three nodes in the circuit are my nodes that are logging everything? The word "eventually" is doing a lot of heavy lifting here. Let's say you actually manage to add 1000 servers to the tor network somehow without getting detected. The network currently sits at just under 8000 nodes. For simplicity, lets also ignore that there are different types of nodes and geogra…

> Could someone like the NSA with limitless resources do it? Quite probably, sure. If you're not worried about a fairly well-resourced government agency uncovering whatever network activity you believe needs to be anonymized, why would you be using Tor at all?

Depends on what you’re doing. The NSA isn’t going to expose themselves by tipping off law enforcement about small time drug deals. If you’re sharing CSAM or planning terrorist attacks, it might be different.

Re: Is Tor still safe to use?

#123

Post by krunck »

alasdair_ wrote: post #84
gaba wrote: post #39

Earlier quoted context omitted.

Tor Project has a team that looks at relays and checks if relays are engaging in bad practices or any suspicious activity like a lot of nodes run by one operator. https://community.torproject.org/relay/governance/

Iran probably has enough money that it could pay a thousand different isps in a thousand different ways with a thousand different os versions and tor versions. This could all be automated pretty easily.

When you think about countries that have the resources to "pay a thousand different isps in a thousand different ways with a thousand different os versions and tor versions" your first thought was Iran?

Re: Is Tor still safe to use?

#125

Post by lcnPylGDnU4H9OF »

system33- wrote: post #32
valianteffort wrote: post #24

Federal agencies operate enough exit nodes to make Tor use risky at best. I have no idea if they have since implemented some feature to prevent this but if not I would stay far away from Tor if you're planning to do illegal things. There's also the risk of trusting service operators to secure any PII you expose on marketplaces. Not that I think the Fed's would blow their cover to hunt down people buying drugs but sti…

“The western governments run most of the exits” is one of those things everybody “knows” but rarely backs up. The list of all relays is public knowledge by design. There’s contact information attached to relays. The big operators are known individuals and organizations. They contribute. Interact. Which ones are actually the governments doing bad things against their citizens? It’s hard to tell? Then why do you make s…

> “The western governments run most of the exits” is one of those things everybody “knows” but rarely backs up.

Thanks for pointing this out. Seems obvious in retrospect but I don't really recall seeing a lot of evidence for this despite seeing the claim quite commonly. That said, the use of "rarely" makes me wonder what evidence has been presented in such rare instances. Just curious. (Of course it's also fine if the phrasing was just communication style.)

Re: Is Tor still safe to use?

#126

Post by ziddoap »

AndyMcConachie wrote: post #117
sigmoid10 wrote: post #87

Earlier quoted context omitted.

That assumes you could run thousands of malicious tor nodes for several years without being detected. Unless you have vast resources and time, this is unlikely.

What detection? A malicious node is only different from a non-malicious node because all the traffic is being logged. If that's our definition of a malicious node in this case then there is no way to detect one.

>What detection?

Not speaking to the effectiveness of the detection (it's hard!), but there's information available, for example:

https://blog.torproject.org/malicious-relays-health-tor-netw...

https://gitlab.torproject.org/tpo/network-health/team/-/wiki...

https://gitlab.torproject.org/tpo/network-health/team/-/wiki...

Re: Is Tor still safe to use?

#127

Post by system33- »

beeflet wrote: post #62
system33- wrote: post #58

Earlier quoted context omitted.

If you’re advocating for a bigger network… we need more relay operators. Can’t wave a magic wand. There’s like 8000 relays. Haven’t looked in a while. Or if you were arguing for increasing the number of relays in a circuit, that doesn’t increase security. It’s like one of the OG tor research papers deciding on 3. Bad guy just needs the first and the last. Middle irrelevant.

>Or if you were arguing for increasing the number of relays in a circuit, that doesn’t increase security. It’s like one of the OG tor research papers deciding on 3. Bad guy just needs the first and the last. Middle irrelevant. Because of timing attacks? There are ways to mitigate timing attacks if you are patient (but I think clearnet webservers are not very patient and my drop your connection)

Yes timing attacks.

And yeah mitigation gets you into a huge body of research that’s inconclusive on practical usability. Eg so much overhead that it’s too slow and 10 people can use a 1000 relay network and still get just 1 Mbps goodput each. Contrived example.

People need to actually be able to use the network, and the more people the better for the individual.

There’s minor things tor does, but more should somehow be done. Somehow…

Re: Is Tor still safe to use?

#129

Post by whimsicalism »

sigmoid10 wrote: post #79
whimsicalism wrote: post #71

Earlier quoted context omitted.

> Could someone like the NSA with limitless resources do it? Sure Yes, this is obviously the sort of adversary we would be discussing. > , lets also ignore that there are different types of nodes causing your number to be an underestimate > The answer is less than 0.14%. So almost certainly thousands of people

>Yes, this is obviously the sort of adversary we would be discussing. OP explicitly asked about himself, not some government organisation. >causing your number to be an underestimate Not necessarily. It might even be an overestimate if the attacker fails to supply enough nodes of the right kind. >So almost certainly thousands of people We're talking about a targeted attack. Of course the statistics game works better…

> We're talking about a targeted attack

From OP: " I can't target a specific person, but eventually I can find someone who has all three bounces through tor nodes I control, no"

> Not necessarily. It might even be an overestimate if the attacker fails to supply enough nodes of the right kind.

Assuming they match the existing distribution of nodes, they will only have better results.

Re: Is Tor still safe to use?

#130

Post by londons_explore »

alasdair_ wrote: post #35

Here is what I don't understand: Let's say I as a private individual fund 1000 tor nodes (guard and exit nodes included) and have them all log everything. This could cost less than $5000 for a month, with some time needed to get guard node status. I want to find a certain kind of person so I look for people that access a specific hidden service or clearnet url. Surely eventually I'm going to get a hit where all three…

You only need to control the entry and exit node - since you know the next and previous hop for all traffic you touch, and default chains are 3 long. With circuits changing every 10 mins, within a few days you would have deanonymized at least some percentage of traffic for nearly every user.

I'd call tor broken against any adversary with a little technical skill and willingness to spend $5000.

I'm 80% sure Tor is designed as a US supported project to focus those needing anonymity into a service only governments with global security apparatus (who can grab a good chunk of internet traffic) can access.

Post reply on HN