31–40 of 52 posts
Speakers drop out all the time. Or maybe someone didn't want to compromise Tor in public until the Tor project had a chance to address the issues.
>>> Or maybe someone didn't want to compromise Tor in public until the Tor project had a chance to address the issues. To some degree, isn't this what the Black Hat conference is all about?
At this point it is not really a good idea to use Tor anyways, given that you are then automatically targeted by the NSA and at the same time potentially provide cover for covert operations of several countries. What is really needed is political action to limit the capabilities of security agencies to indiscriminantly monitor web traffic.
True, but if everyone were to use Tor all the time, everyone would be suspicious all the time, and therefore no one would be suspicious ever. I'd like to see a pay-per-install Tor browser program materialize, one that would incentivize retailers and ISP techs to install Tor browser on customer devices. Every device should be connected to Tor from the moment it is powered on. Then we could at least go back to having f…
Or do you view envelopes with this same paranoia? https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html
Earlier quoted context omitted.
I don't see who is in a position to even want to stop this talk A government agency that wants to stay a step ahead of the competition or of its targets?
Or a University who doesn't want to get sued / get bad publicity for screwing with a tool used by government agencies...
What about the political dissidents who use Tor? They could be at risk of certain death if caught by the authoritarian regimes they live under. Without coordinated disclosure, the "researchers" might as well have been signing death warrants.
Speakers drop out all the time. Or maybe someone didn't want to compromise Tor in public until the Tor project had a chance to address the issues.
>>> Or maybe someone didn't want to compromise Tor in public until the Tor project had a chance to address the issues. To some degree, isn't this what the Black Hat conference is all about?
What these "researchers" were doing was just reckless. When it comes to Tor, lives are on the line. This kind of irresponsible disclosure is abhorrent, at best.
Earlier quoted context omitted.
Or a University who doesn't want to get sued / get bad publicity for screwing with a tool used by government agencies...
Legality aside, I'm surprised this wasn't pulled on ethical grounds. Does Black Hat not require "researchers" to follow responsible/coordinated disclosure? What about the political dissidents who use Tor? They could be at risk of certain death if caught by the authoritarian regimes they live under. Without coordinated disclosure, the "researchers" might as well have been signing death warrants.
In fact: I'm not aware of a vulnerability research conference that does get nosy about this stuff. I even reviewed for Usenix WOOT one year, and we didn't vet research for "coordinated disclosure". Not even Usenix works the way you want BH to.
Earlier quoted context omitted.
True, but if everyone were to use Tor all the time, everyone would be suspicious all the time, and therefore no one would be suspicious ever. I'd like to see a pay-per-install Tor browser program materialize, one that would incentivize retailers and ISP techs to install Tor browser on customer devices. Every device should be connected to Tor from the moment it is powered on. Then we could at least go back to having f…
"...suspiciuous all the time"? What nonsense. When Everyone uses Tor (or anything else), by definition that is "normal". Or do you view envelopes with this same paranoia? https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html
Earlier quoted context omitted.
>>> Or maybe someone didn't want to compromise Tor in public until the Tor project had a chance to address the issues. To some degree, isn't this what the Black Hat conference is all about?
No, to some degree BH is about compromising X in public after X has been repeatedly contacted with the necessary details AND given ample time to address the issues. What these "researchers" were doing was just reckless. When it comes to Tor, lives are on the line. This kind of irresponsible disclosure is abhorrent, at best.
Earlier quoted context omitted.
Well Tor is obviously not the answer, it introduces too much latency and at the moment very few nodes mostly located in the US bear the majority of all traffic. No technical solution will prevent governments from monitoring all important network hubs. It seems impossible to prevent them to gather at least metainformation there. If enough routers in an onion routing scheme are compromised the same is true. If there wo…
Yes, Tor is not the answer. I can think of a hypothetical technical solution to the problem, however. If everyone used an onion-routing protocol where everyone also acts as an exit node, you could create a situation where even meta-information would be unobtainable.
A Black Hat spokeswoman told Reuters that the talk had been canceled at the request of lawyers for Carnegie-Mellon University, where the speakers work as researchers. A CMU spokesman had no immediate comment. Source: http://www.reuters.com/article/2014/07/21/cybercrime-confere...
Thank you for the information packetlss! http://www.qatar.cmu.edu/iliano/svc/meetings/PX/2004-09-21/s... http://www.cmu.edu/silicon-valley/research/tech-showcase/pdf...
Earlier quoted context omitted.
> The only way to prevent security agencies from indiscriminately monitor web traffic is to make it technically impossible. The vast majority of people do not want that Internet. See, for example, the popularity of Facebook. (About 1.2bn users per month). You need technical measures, and law, and effective oversight.
Privacy or "oversight," pick one. With strong croup and deniability privacy is absolute, unless you want torture to be a law enforcement tactic. If you can't handle that, you might as well communicate in the clear.
Oversight is a legal measure applied to police and security agencies to ensure that they are obeying the law, not something you do to the general public.