Live data from Hacker News

Is Tor still safe to use?

blog.torproject.org

381–390 of 602 posts

Re: Is Tor still safe to use?

#381

Earlier quoted context omitted.

TOR as it exists now is a honeypot simple as. Same as that documentary called "Benedict Cumberbniamnatch's Great Work" where they cracked the radio signals of the Frenchmen but they had to let the submarine sink so that they knew that the other guy doesn't know that they knew. NSA uses ROT which is TOR-inspired but takes the techniques and incognito aspects 7 or 8 steps ahead.

You do know Hitler was the German Reichskanzler, not French?

I'm assuming the "documentary" was the movie The Imitation Game staring Benedict Cumberbatch. If that's an intentional mistake, I'd guess by "French" they meant Austrian (as Hitler was born in Austria).

Re: Is Tor still safe to use?

#382
post #357

Earlier quoted context omitted.

This is complete conjecture. Like Truecrypt, Veracrypt is open source, has been audited and has been actively maintained. Could it use another audit? Sure but so could Bitlocker but that isn't happening for even the first time any time soon.

I read this as intended to be some kind of rebuttal but… Where did I say it wasn't conjecture? I was stating facts about the ecosystem. People didn't trust it at the time. I never said there was a definite reason for that distrust.

Never heard of any credible reasons to distrust Veracrypt. Don't know who these "people" are either, none of the comments named anything more concrete than what sounds like online rumors.

Re: Is Tor still safe to use?

#383
post #222

Here is what I don't understand: Let's say I as a private individual fund 1000 tor nodes (guard and exit nodes included) and have them all log everything. This could cost less than $5000 for a month, with some time needed to get guard node status. I want to find a certain kind of person so I look for people that access a specific hidden service or clearnet url. Surely eventually I'm going to get a hit where all three…

>This could cost less than $5000 for a month I ran a bunch of nodes for a couple years and that's optimistic by perhaps an order of magnitude. No $5 a month VPS provides enough bandwidth to sustain the monthly traffic of a Tor node, and nodes need to be continuously online and serving traffic for about 2-3 months[1] before they will be promoted to guard relays. Throttling traffic to stay in your bandwidth allocation…

These costs explain why most of the nodes are probably run by the FBI.

Re: Is Tor still safe to use?

#384

Earlier quoted context omitted.

>Surely eventually I'm going to get a hit where all three nodes in the circuit are my nodes that are logging everything? The word "eventually" is doing a lot of heavy lifting here. Let's say you actually manage to add 1000 servers to the tor network somehow without getting detected. The network currently sits at just under 8000 nodes. For simplicity, lets also ignore that there are different types of nodes and geogra…

75% [0] of all Tor nodes are hosted within 14 Eyes [1] countries, so it would actually be quite trivial for the NSA to de-anonymize a Tor user. It baffles me that Tor Browser doesn't provide an easy way to blacklist relays in those countries. [0] Here, you can do the math yourself: https://metrics.torproject.org/rs.html#aggregate/all [1] https://en.wikipedia.org/wiki/Five_Eyes#Fourteen_Eyes > Edit: For all the cynics…

The original purpose of TOR was to provide agents and handlers with a means of secure communication, allowing them to organize subversive or espionage activities. It was created by the Department of Defense to propagate their interests and spread democracy around the world using these secure capabilities. Given this context, it's not unreasonable to assume that TOR is still being used in a similar manner today.

Because of its origins, access to the identities of users on the TOR network—even if they could be de-anonymized—would likely be extremely restricted, compartmentalized, and classified. This would make it much more difficult for such information to be used in law enforcement proceedings. Perhaps that, rather than a technical limitation, is the reason most high-profile arrests related to TOR involve criminals making some other mistake, rather than the security of the network itself being compromised.

Additionally, it’s interesting to speculate that some of the secure private defense and intelligence networks—parallel or classified world internets—could themselves be implemented as possibly enhanced forms of TOR. It would make sense that nation-states, through shell companies and other disguises, might run and control many seemingly innocuous machines acting as secure relays in these parallel networks. While I have no data to back this up, it seems logical, given that TOR was originally created by the DoD and then open-sourced.

Why wouldn’t they keep something that works, build on it, and enhance it as a means to secure their own global communications?

Re: Is Tor still safe to use?

#385

If enough governmental bodies can get behind running Tor nodes then couldn't we theoretically protect the bulk of humanity from spying on Internet access? Truly an advance in the Internet technology. It's kind of like if a single nation does it they control everything, but once all the nations compete then everyone wins. But at planetary scale would Tor scale in an environmentally friendly way?

Most governments value their law enforcement obligations and/or desire for surveillance more strongly than an Internet that is protected from spying, so good luck with that.

Re: Is Tor still safe to use?

#386
post #31

It depends, are you dealing with Mossad or not Mossad?

You’re leaving out one very important class of actors, which I will call the NSA: The NSA, and others like them, unlike Mossad, are not after you personally, in that they don't want to do anything to you. Not immediately. Not now. They simply want to get to know you better. They are gathering information. All the information. What you do, what you buy, how you vote, what you think. And they want to do this to everybody, all the time. This might or not bite you in the future. You seems to imply that since nothing immediately bad is happening by using slightly bad security, then it’s OK and we shouldn’t worry about it, since Mossad is not after us. I think that we should have a slightly longer view of what allowing NSA (et al.) to know everything about everybody would mean, and who NSA could some day give this information to, and what those people could do with the information. You have to think a few steps ahead to realize the danger.

(This has been a partial repost of a comment written four years ago: https://news.ycombinator.com/item?id=23572778>)

Re: Is Tor still safe to use?

#387

Earlier quoted context omitted.

Specifically what I chose US (allies implied), China, and Russia. These should be three competing factions.

Russia and China are allies. And I'm not sure if Beijing would even be interested in spying on TOR users since it's blocked so thoroughly it's basically unusable for Chinese residents.

I don't know they are that aligned to be sharing bulk data like that. I don't think the are considered formal allies.

Re: Is Tor still safe to use?

#388

Earlier quoted context omitted.

Tor does have padding defenses to protect against that. Also, according to their latest blog post on their finances, while it is true they have money from the US Government, that was only ~50% of their income (I think that was 2023). For the FUD part of that comment, see the "U.S. Government Support" section of https://blog.torproject.org/transparency-openness-and-our-20...

“Only half” is hilarious. Thanks for that. And if you trust the NSA can’t overcome correlation in the presence of “padding defenses”, then sure: TOR is secure.

I wonder how many tor users actually know this. tor would probably not exist in the same capacity without that funding

Re: Is Tor still safe to use?

#389

Earlier quoted context omitted.

Specifically what I chose US (allies implied), China, and Russia. These should be three competing factions.

I think even Russia and the US still do intelligence sharing on a lot of stuff - and that's before you consider that the US seems to be in everybody's networks anyhow, so non-sharing is probably just sharing with a bit more skullduggery.

I don't think they share on the bulk data. I would highly doubt they routinely cooperate on cyber crimes given Russia's stance on the matter (basically encouraging it).
Post reply on HN