Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zed Shaw: Why I Don't Use Tor

sheddingbikes.com

Post reply on HN
Print view View original

131–140 of 170 posts

Re: Zed Shaw: Why I Don't Use Tor

#131

Post by mfukar »

praptak wrote: post #12
zedshaw wrote: post #3

Earlier quoted context omitted.

I was curious about this, so I started googling for how to do this. Sure enough, it's a bitch and the only way to really do it easily is to use a GUI like Tork. Not to mention I can't seem to figure out how you find his nodes in order to BadExit them, and I very seriously doubt his nodes will get listed in anything official. Anyone got good instructions on how to actually BadExit his nodes? I want to post them so peo…

Why would you even want to BadExit his nodes? Using Tor you're vulnerable anyway. Any exit node can snoop on your traffic or even change it. Enumerating some bad nodes does not substantially improve this. The above can only be prevented by using something like SSL plus a trusted certificate on top of Tor.

It's up to the Tor user to encrypt her end-to-end traffic. If that's what she wants.

Re: Zed Shaw: Why I Don't Use Tor

#132

Post by gnosis »

tptacek wrote: post #111
gnosis wrote: post #107

Earlier quoted context omitted.

The more different types of traffic that messages could be hidden in, the better. But, personally, I think the best place to hide them right now is video streams. The thing about steganography is that the smaller your hidden message is and the larger the data it's hiding in is, the less of a chance there is of it being detected, and also the greater the cost of such detection will be. Think of it this way: How effect…

This is silly. You can programatically detect e.g. anomalous keyframes from traffic today. Anything you do to try and embed messages in any rich media format (audio, lossy images, video, &c) can be reversed and turned into a filter. The filters won't even need to be accurate; they'll baseline, wait for you to trip a threshold, and then send people to your door to collect your machine. I'm particularly amused by the c…

Two videos, X and Y, are uploaded to youtube.

X is a video of a completely featureless white screen.

Y is a video of a jungle canopy in the midst of a storm.

At some point in both videos, one pixel changes color slightly. Which video do you think it will be easier to spot the change in?

Of course, the amount of information that can be transmitted in the color change of one pixel is ridiculously small, so in a real life example more pixels (or perhaps some other data in the video) would need to be used to embed the message, but the video size can grow along with the size of the hidden message.

As for "anomaly detection", the thresholds at which such detectors function have to be tuned in such a way that they don't give too many false positives to make them useless.

And they're not magic. They can only detect certain types of anomalies, not any an all past or future steganographic techniques that could conceivably be used to hide the message.

Steganographic techniques can and have been designed to mimic expected statistical profiles. Take a look, for instance, at Peter Wayner's work on Mimic Functions:

http://en.wikipedia.org/wiki/Mimic_function

The other thing I should note is that even if it is (theoretically) possible to detect a message hidden via steganography, the cost of doing so goes up as the amount of data the message is hidden in increases.

Even detecting a message hidden with even the simplest steganographic technique will be much higher than detecting the use of bare encryption, which is already out in the open.

So widespread use of steganography in large datastreams like youtube videos and Skype will create a huge computational burden on the snoopers attempting steganalysis.

Re: Zed Shaw: Why I Don't Use Tor

#134

Post by Locke1689 »

cookiecaper wrote: post #106
dublinclontarf wrote: post #48

Earlier quoted context omitted.

True, but a good Friend to Friend darknet cannot be stopped as long as there is a network to run it on.

They could switch from a blacklist to a whitelist and then you would only be able to connect to other nodes if they were run surreptitiously on pre-approved networks.

It would be far too complex to do with human operators without destroying the primary benefits of the internet.

Re: Zed Shaw: Why I Don't Use Tor

#135

Post by mfukar »

zedshaw wrote: post #129
drats wrote: post #24

Ad Hominems are a-ok now are they? Well here's Zed's thought process: a) Read Greenwald Salon article accusing Wired of having shady connections. b) Roll that basic premise into a set of wild accusations and things we already know about Tor. c) Sit back and enjoy the whole chaos of the troll. When someone attacks bring out the usual sockpuppets and sycophants to say "but Zed does all this great coding", "Zed is not l…

Ad hominems are totally alright in my book, especially since everyone loves doing them to me and then bitching when they're done back. For example, your post doesn't have a single link giving counter evidence. You'd think you could bring some of that out but so far, in this entire thread, there hasn't been one link with counter evidence. There's been links to our twitter conversation, links to things supporting Tor i…

The burden of proof is on the accuser. Presumption of innocence, it's a bitch.

Re: Zed Shaw: Why I Don't Use Tor

#136

Post by Locke1689 »

flatline wrote: post #75
dublinclontarf wrote: post #48

Earlier quoted context omitted.

True, but a good Friend to Friend darknet cannot be stopped as long as there is a network to run it on.

If enough people were using it, I'd think that a) some of them would be government operatives and b) the traffic could be analyzed to identify and remove internet access from a large number of the participants. I don't know that much about darknets so maybe the traffic analysis is not so straightforward.

It isn't. You can use the analysis algorithms to hide your traffic in a bunch of garbage. If China banned encrypted traffic it would be easier though.

Re: Zed Shaw: Why I Don't Use Tor

#137

Post by poet »

dkarl wrote: post #118
poet wrote: post #113

Earlier quoted context omitted.

A comprised web browser or operating system gives the attacker your email credentials, which by proxy gives them the rest of your life. You're trying to argue that an untrustworthy browser/OS is not as significant as an untrustworthy Tor. There isn't such an argument to be made. Browsers and operating systems require trust.

No, all they require is being just as trustworthy as the other browsers and operating systems, even if that level is zero. Tor is an extra inconvenience and calls extra attention to you and therefore requires a credible claim of providing extra security to make up for the downside.

Nope. If the trustworthiness of all browsers was zero, people would do their banking in person. You're trying to get away with arguing only the relative and not absolute trust of browsers is the only thing that matters. Not gonna happen.

Re: Zed Shaw: Why I Don't Use Tor

#138

Post by gnosis »

poet wrote: post #124
gnosis wrote: post #116

Earlier quoted context omitted.

Sure, steganography and steganalysis are in an arms race, just like encryption and cryptanalysis. But if the existence of such an arms race doesn't stop someone from using encryption it shouldn't stop them from using steganography. Of course, you need to be prudent about it. Use the most secure techniques available, and don't use methods you know have been broken. Finally, know that you are taking a risk, that nothin…

The difference is that with cryptography the actors are nation states v. nation states. With steganography the actors are activists v. nation states. Also, what makes you think activists have the technical expertise available to know what the "most secure techniques available" are and what methods have been broken?

"The difference is that with cryptography the actors are nation states v. nation states. With steganography the actors are activists v. nation states."

I don't know where you got the idea that nation states are the only ones who use cryptography. Plenty of activists, along with other non-state actors do so all the time.

Plenty of cryptography is also designed by individuals not in the service of any nation state (as far as we know, anyway). In fact, some argue that such encryption is more trustworthy than encryption developed by nation states themselves.

"Also, what makes you think activists have the technical expertise available to know what the "most secure techniques available" are and what methods have been broken?"

I can't speak for any and all activists. It's really up to them to acquire such expertise or get advice from people who have such expertise.

That said, the problem here is no different from figuring out which encryption to use. So your criticism applies equally to encryption as it does to steganography.

Re: Zed Shaw: Why I Don't Use Tor

#139

Post by praptak »

zedshaw wrote: post #126
praptak wrote: post #6

Earlier quoted context omitted.

If Appelbaum actually works on Tor then just BadExit'ing his nodes is obviously not enough. Even a clean compile (for the paranoid: do you trust your compiler?) from a fully audited (do you have the resources?) source code is not enough. In order to use Tor you gotta trust the other nodes, including the code that runs there.

I doubt Jacob is hacking his own code, he'd have way too much to lose and I do believe he actually loves the project. If he were to do anything it'd be handing interesting traffic off various exit nodes he and friends control to Wikileaks. That'd be about all I or anyone else could allegedly claim.

Ok, but (if I understand how Tor works) then the fact that he works on Tor has nothing to do with his control of exit nodes. Anybody can run an exit node, whether or not they work on Tor.

Re: Zed Shaw: Why I Don't Use Tor

#140

Post by Locke1689 »

gnosis wrote: post #132
tptacek wrote: post #111

Earlier quoted context omitted.

This is silly. You can programatically detect e.g. anomalous keyframes from traffic today. Anything you do to try and embed messages in any rich media format (audio, lossy images, video, &c) can be reversed and turned into a filter. The filters won't even need to be accurate; they'll baseline, wait for you to trip a threshold, and then send people to your door to collect your machine. I'm particularly amused by the c…

Two videos, X and Y, are uploaded to youtube. X is a video of a completely featureless white screen. Y is a video of a jungle canopy in the midst of a storm. At some point in both videos, one pixel changes color slightly. Which video do you think it will be easier to spot the change in? Of course, the amount of information that can be transmitted in the color change of one pixel is ridiculously small, so in a real li…

Come back when you have such a peer reviewed algorithm actually implemented in software. Until then you're just talking about a "sufficiently advanced compiler."
Post reply on HN