It depends, are you dealing with Mossad or not Mossad?
Is Tor still safe to use?
31–40 of 602 posts
Re: Is Tor still safe to use?
#32Federal agencies operate enough exit nodes to make Tor use risky at best. I have no idea if they have since implemented some feature to prevent this but if not I would stay far away from Tor if you're planning to do illegal things. There's also the risk of trusting service operators to secure any PII you expose on marketplaces. Not that I think the Fed's would blow their cover to hunt down people buying drugs but sti…
“The western governments run most of the exits” is one of those things everybody “knows” but rarely backs up.
The list of all relays is public knowledge by design. There’s contact information attached to relays. The big operators are known individuals and organizations. They contribute. Interact.
Which ones are actually the governments doing bad things against their citizens? It’s hard to tell? Then why do you make such claims?
Relays that observably do bad things are removed from the network all the time. Are those ones the government? Tor seemingly has a reasonable handle on the situation if that’s the case.
If the fed is doing correlation attacks, why would they run relays at all? “Just” tap the IXPs near major hubs of relays. Or heck, get data from the taps you already had. Silent and more widespread.
Pushing people away from tor potentially makes it even easier to deanonymize them, depending on the adversary model assumed.
Re: Is Tor still safe to use?
#33[flagged]
Re: Is Tor still safe to use?
#34Federal agencies operate enough exit nodes to make Tor use risky at best. I have no idea if they have since implemented some feature to prevent this but if not I would stay far away from Tor if you're planning to do illegal things. There's also the risk of trusting service operators to secure any PII you expose on marketplaces. Not that I think the Fed's would blow their cover to hunt down people buying drugs but sti…
Monitoring exit nodes does not necessarily reveal hidden services, though. Edit: Never does, exit nodes are not part of the circuit, thanks to commenter below.
Monitoring exits is completely irrelevant to onion services, in fact.
Completely.
Exits aren’t a part of the circuit. Ever.
Re: Is Tor still safe to use?
#35Here is what I don't understand: Let's say I as a private individual fund 1000 tor nodes (guard and exit nodes included) and have them all log everything. This could cost less than $5000 for a month, with some time needed to get guard node status.
I want to find a certain kind of person so I look for people that access a specific hidden service or clearnet url.
Surely eventually I'm going to get a hit where all three nodes in the circuit are my nodes that are logging everything? It will take a long time, and I can't target a specific person, but eventually I can find someone who has all three bounces through tor nodes I control, no?
Re: Is Tor still safe to use?
#36Federal agencies operate enough exit nodes to make Tor use risky at best. I have no idea if they have since implemented some feature to prevent this but if not I would stay far away from Tor if you're planning to do illegal things. There's also the risk of trusting service operators to secure any PII you expose on marketplaces. Not that I think the Fed's would blow their cover to hunt down people buying drugs but sti…
If they run just the exit node they still can’t de-anonymize you right?
Depends on the content of your traffic.
If “deanonymize” strictly means perform a timing attack using info you have from the beginning and end of the circuit, then by definition you’re correct.
But if you visit an identifying set of websites and/or ignore TLS errors or … they can still deanonymize you.
Re: Is Tor still safe to use?
#37The best attack against Tor is convincing people not to use it. If anyone tries to convince you Tor is not safe, ask yourself: cui bono?
I'll ask the inverse: if Tor is unsafe, who benefits from telling you to use it?
Re: Is Tor still safe to use?
#38The best attack against Tor is convincing people not to use it. If anyone tries to convince you Tor is not safe, ask yourself: cui bono?
After the Snowden revelations regarding FOXACID and QUANTUM going largely undressed in the tor project, people have every right to feel sketched out with using ToR for anything. "We're still helping people" just isn't a good enough argument for most people. https://www.schneier.com/blog/archives/2013/10/how_the_nsa_a... https://blog.torproject.org/yes-we-know-about-guardian-artic...
Wonder what has replaced “Xkeyscore” given the wide adoption of TLS. I know ISPs, especially national ISPs like AT&T (see: titanpointe - 33 thomas st, nyc) would feed data to NSA since traffic at the time was mostly via http (rather than https). I suppose the unencrypted dns queries are still useful (although DNSSEC is supposed to defend against snooping/deep packet inspection)
Re: Is Tor still safe to use?
#39Here is what I don't understand: Let's say I as a private individual fund 1000 tor nodes (guard and exit nodes included) and have them all log everything. This could cost less than $5000 for a month, with some time needed to get guard node status. I want to find a certain kind of person so I look for people that access a specific hidden service or clearnet url. Surely eventually I'm going to get a hit where all three…
Tor Project has a team that looks at relays and checks if relays are engaging in bad practices or any suspicious activity like a lot of nodes run by one operator.
Re: Is Tor still safe to use?
#40Here is what I don't understand: Let's say I as a private individual fund 1000 tor nodes (guard and exit nodes included) and have them all log everything. This could cost less than $5000 for a month, with some time needed to get guard node status. I want to find a certain kind of person so I look for people that access a specific hidden service or clearnet url. Surely eventually I'm going to get a hit where all three…
Yes, there aren’t that many tor nodes. It’s not the safe haven protocol or transport suite people make it out to be.