Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is Tor still safe to use?

blog.torproject.org

Post reply on HN
Print view View original

191–200 of 602 posts

Re: Is Tor still safe to use?

#191

Post by donmcronald »

alasdair_ wrote: post #138
donmcronald wrote: post #116

Earlier quoted context omitted.

Say there are only 2 sites on Tor. Site 'A' is plain text and has no pages over 1KB. You know this because it's public and you can go look at it. Site 'B' hosts memes which are mostly .GIFs that are 1MB+. You know this because it's also a public site. If I was browsing one of those sites for an hour and you were my guard, do you think you could make a good guess which site I'm visiting? I'm asking why that concept do…

The point is that there aren't only two sites available on the clearnet. Is the idea that you find a unique file size across every single site on the internet? My understanding (that may be totally wrong) is that there is some padding added to requests so as to not be able to correlate exact packet sizes.

> Is the idea that you find a unique file size across every single site on the internet?

Not really. I'm thinking more along the lines of a total page load. I probably don't understand it well enough, but consider something like connecting to facebook.com. It takes 46 HTTP requests.

Say (this is made up) 35 of those are async and contain 2MB of data total, the 36th is consistently a slow blocking request, 37-42 are synchronous requests of 17KB, 4KB, 10KB, 23KB, 2KB, 7KB, and 43-46 are async (after 42) sending back 100KB total.

If that synchronous block ends up being 6 synchronous TCP connections, I feel like that's a pretty distinct pattern if there isn't a lot of padding, especially if you can combine it with a rule that says it needs to be preceded by a burst of about 35 connections that transfer 2MB in total and succeeded by a burst of 4 connections that transfer 100KB combined.

I've always assumed there's the potential to fingerprint connections like that, regardless of whether or not they're encrypted. For regular HTTPS traffic, if you built a visual of the above for a few different sites, you could probably make a good guess which one people are visiting just by looking at it.

Dynamic content getting mixed in might be enough obfuscation, but for things like hidden services I think you'd be better off if everything got coalesced and chunked into a uniform size so that all guards and relays see is a stream of (ex:) 100KB blocks. Then you could let the side building the circuit demand an arbitrary amount of padding from each relay.

Again, I probably just don't understand how it works, so don't read too much into my reply.

Re: Is Tor still safe to use?

#192

Post by fragmede »

judge2020 wrote: post #183
fragmede wrote: post #155

Earlier quoted context omitted.

The point ranking on comments, which is private, would be of interest to parties training an LLM and want the data annotated, but your point stands.

I’m not sure how much more useful that is than just using HN’s automatic ranking for comments, at least outside of parent comments on posts; As far as I can tell, child comments are always ORDER BY score DESC. Even for top level comments, HN’s algorithm for ranking is pretty useful for assigning “worth”

On posts there's an attempt to suface later comments (with fewer points) so the comment section isn't dominated by earlier posts.

Ordering by score DESC only gives you relative point information, not absolute. Theres additional signal if the top comment has 100 points vs only having 3 (and the bottom post also having 100 vs 1).

Re: Is Tor still safe to use?

#193

Post by throwing_away »

adamrezich wrote: post #187
throwme0827349 wrote: post #182

Earlier quoted context omitted.

Respectfully, a large number of people rightfully fear for their lives, safety, and freedom due to being stalked or abused by a current or former partner. I have personally known several. Using victims' devices and communications in order to locate, and then harass, trap, or attack them, is commonplace for stalkers.

How many of these people are justified (by evidence, not merely paranoia) in thinking that Tor would circumvent whatever communications interception may or may not have been put in place? And of those people, how many people have ever even heard of Tor, let alone know how to use it?

I think you just unintentionally highlighted the need for the tor project and outreach to inform people about it.

Re: Is Tor still safe to use?

#194

Post by bri3d »

dylan604 wrote: post #48
bri3d wrote: post #28

Earlier quoted context omitted.

Being able to sniff a key as it transits a local bus is a very different kind of compromise of "trust" than believing that something is preemptively backdoored by a threat actor. It is deeply mysterious that Microsoft don't simply use TPM encrypted sessions to prevent this, though.

Isn't this yet another example of if they have your physical machine, it's already game over?

No? Any modern disk encryption system with a strong passphrase (basically, anything but default-BitLocker) is very effective against "they have your physical machine and it's off" for any known, current adversary. And, the basic cryptography in use is common, robust, and proven enough that this is probably true even if your tinfoil hat is balled quite tightly.

Where modern research effort goes is into protecting against "they HAD your physical machine and they gave it back to you" or "they got your machine while it was on/running" - these are much more difficult problems to solve, and are where TEE, TPM, Secure Boot, memory encryption, DMA hardening, etc. come into play.

Re: Is Tor still safe to use?

#195

Post by _rdvw »

no-dr-onboard wrote: post #47
xenophonf wrote: post #45

Earlier quoted context omitted.

DNSSEC is an authentication mechanism. It does not encrypt queries or responses. You might be thinking of DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT). There's also DNSCurve. https://en.wikipedia.org/wiki/DNSCurve

DoH and DNSSEC don't use ECH (encrypted client hello) From what I remember, only DoT uses ECH https://media.ccc.de/v/chaoscolloquium-1-dns-privacy-securit...

ECH can be used regardless of DoT, DoH, dnscrypt, or plain as long as your resolver passes HTTPS queries.

You can easily test this: dig @8.8.8.8 https pq.cloudflareresearch.com

Re: Is Tor still safe to use?

#196

Post by yieldcrv »

qwery wrote: post #83
yieldcrv wrote: post #5

This isn't written in the most confidence inspiring way But the things that do inspire confidence: Tor is updated against vulnerabilities pre-emptively, years before the vulnerability is known to be leveraged Tor Project happens to be investigating the attack vector of the specific tor client, which is years outdated They should have just said “we fixed that vulnerability in 2022” with a separate article about the ol…

> confidence inspiring I don't want them to try to sell me something. If they were making bold claims as you suggest I would be more concerned.

The truth isn't confidence inspiring, the truth can be even without selling something, its not here.

There is a risk that the network is compromised at any moment and cannot be relied upon, except for your own personal risk tolerance on the activity you are interested in.

Re: Is Tor still safe to use?

#197

Post by theonionrouter »

cainxinth wrote: post #21
jstanley wrote: post #13

The best attack against Tor is convincing people not to use it. If anyone tries to convince you Tor is not safe, ask yourself: cui bono?

The best attack against Tor is creating entrance and exit nodes that monitor traffic. That was the biggest risk factor when Tor was invented and it still is today.

How does that work technically, if I am connecting with SSL?

The only thing I see is seeing which IP addresses are using Tor, when, and how much traffic exchanged, but mostly it will be a bunch of reused residential IPs? If you know who you are looking for anyway better to work with their ISP?

With the exit nodes, you know which IP addresses are being looked up. You might get an exit node IP when investigating a crime say. Raid that person, but can you find anything more?

This isn't an argument, but a question.

Re: Is Tor still safe to use?

#198

Post by sophacles »

yupyupyups wrote: post #85
xyst wrote: post #38

Earlier quoted context omitted.

Wonder what has replaced “Xkeyscore” given the wide adoption of TLS. I know ISPs, especially national ISPs like AT&T (see: titanpointe - 33 thomas st, nyc) would feed data to NSA since traffic at the time was mostly via http (rather than https). I suppose the unencrypted dns queries are still useful (although DNSSEC is supposed to defend against snooping/deep packet inspection)

>Wonder what has replaced “Xkeyscore” given the wide adoption of TLS. Cloudflare is a US-based company that does MITM attacks on all traffic of the websites that it protects. It's part of how their DDoS mitigation works. Many people still use large US-based mail providers such as Outlook or Gmail. Many large services use AWS, GCP or Azure. Perhaps there are ways for the NSA to access customers' virtual storage or MIT…

It is MITM, but is it an attack? Literally the website owner hires Cloudflare explicity to decrypt and filter the traffic. Attack implies that it's unwanted behavior, yet the reality seems to imply that its wanted behavior by the site owner at a minimum, although continued use of the site by visitors also suggests that they want that behavior (or they'd go elsewhere).

Re: Is Tor still safe to use?

#199

Post by donmcronald »

whimsicalism wrote: post #139
donmcronald wrote: post #93

Earlier quoted context omitted.

If I visit facebook.com it's about 45 requests and 2.5MB of data. Are you saying that if I did that via Tor I would get a different circuit for each request or each individual packet? Eventually the guard has to send the whole payload to me, right? Wouldn't that look similar every time if there's no obfuscation?

you mean inferring the website based on packet traffic pattern if you are the guard? yeah maybe possible, not sure how distinct each website footprint would be in practice seems like it would also be challenging to hold up in actual legal proceedings

> you mean inferring the website based on packet traffic pattern if you are the guard?

Yeah, basically, but I was thinking that if you're analyzing a pattern going to the client, all you'd need is any point between the guard and the client (ie: an ISP).

Post reply on HN