Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is Tor still safe to use?

blog.torproject.org

Post reply on HN
Print view View original

51–60 of 602 posts

Re: Is Tor still safe to use?

#51

Post by ObsidianBreaks »

alasdair_ wrote: post #35

Here is what I don't understand: Let's say I as a private individual fund 1000 tor nodes (guard and exit nodes included) and have them all log everything. This could cost less than $5000 for a month, with some time needed to get guard node status. I want to find a certain kind of person so I look for people that access a specific hidden service or clearnet url. Surely eventually I'm going to get a hit where all three…

I wholeheartedly agree, the 'dragnet' methodology is already documented and well-known and that should factor into your security assessments.

Re: Is Tor still safe to use?

#53

Post by mass_and_energy »

2OEH8eoCRo0 wrote: post #42

It's safe if you ain't a pedo or terrorist. Sometimes I wonder wtf y'all are doing with such crazy security expectations and paranoia.

The implication of the right to privacy being unnecessary because you have nothing to hide is akin to declaring the right to free speech unnecessary because you have nothing to say.

The ability to maintain privacy and anonymity is not for today, it's for tomorrow.

Re: Is Tor still safe to use?

#54

Post by scraptor »

alasdair_ wrote: post #35

Here is what I don't understand: Let's say I as a private individual fund 1000 tor nodes (guard and exit nodes included) and have them all log everything. This could cost less than $5000 for a month, with some time needed to get guard node status. I want to find a certain kind of person so I look for people that access a specific hidden service or clearnet url. Surely eventually I'm going to get a hit where all three…

If your nodes disclose their affiliation that's fine but the client will avoid using multiple. If you try to do this in secret the tor project will attempt to catch you by looking for suspicious nodes that use the same isp and update their tor version at the same time and things like that, to questionable success.

Re: Is Tor still safe to use?

#55

Post by beeflet »

system33- wrote: post #44
_5hxt wrote: post #40

Earlier quoted context omitted.

Yes, there aren’t that many tor nodes. It’s not the safe haven protocol or transport suite people make it out to be.

It’s then best we’ve got for achieving actually meaningful privacy and anonymity. It has a huge body of research behind it that is regularly ignored by those coming up with sexy or off-the-cuff alternatives. It’s the most popular so it gets the most attention: from academics, criminals, law enforcement, journalists, …

Why not just have greater number of relays by default? Internet bandwidth tends to increase over time, and the odds of this correlation attack are roughly proportional to the attacker's share of relays to the power of the number of relays used.

So latency issues permitting, you would expect the default number of relays to increase over time to accommodate increases in attacker sophistication. I don't think many would mind waiting for a page to load for a minute if it increased privacy by 100x or 1000x.

Re: Is Tor still safe to use?

#56

Post by Yawrehto »

smileson2 wrote: post #29

Depends on your risk, if are are trying to avoid censorship and political repression in say Iran or china you are probably fine If you are an enemy of the United States you probably aren’t but that’s a high bar

Maybe. I think the real distinction is reach. Are you consuming content passively, or are you creating content for many people? If you're creating content on torture China's doing, they absolutely will track you down. If you're in North Korea and revealing what life is really like in South Korea, or in Russia exposing the realities of the Ukraine war, Tor is probably unsafe.

But there is also an element of resources. Even if you're sowing distrust in, say, the Comorian government, I don't think they have the resources to go after you unless you are truly destabilizing and not just annoying.

Re: Is Tor still safe to use?

#57

Post by pushupentry1219 »

scraptor wrote: post #54
alasdair_ wrote: post #35

Here is what I don't understand: Let's say I as a private individual fund 1000 tor nodes (guard and exit nodes included) and have them all log everything. This could cost less than $5000 for a month, with some time needed to get guard node status. I want to find a certain kind of person so I look for people that access a specific hidden service or clearnet url. Surely eventually I'm going to get a hit where all three…

If your nodes disclose their affiliation that's fine but the client will avoid using multiple. If you try to do this in secret the tor project will attempt to catch you by looking for suspicious nodes that use the same isp and update their tor version at the same time and things like that, to questionable success.

But an adversary with enough money could just buy servers from multiple ISPs, right?

Re: Is Tor still safe to use?

#58

Post by system33- »

beeflet wrote: post #55
system33- wrote: post #44

Earlier quoted context omitted.

It’s then best we’ve got for achieving actually meaningful privacy and anonymity. It has a huge body of research behind it that is regularly ignored by those coming up with sexy or off-the-cuff alternatives. It’s the most popular so it gets the most attention: from academics, criminals, law enforcement, journalists, …

Why not just have greater number of relays by default? Internet bandwidth tends to increase over time, and the odds of this correlation attack are roughly proportional to the attacker's share of relays to the power of the number of relays used. So latency issues permitting, you would expect the default number of relays to increase over time to accommodate increases in attacker sophistication. I don't think many would…

If you’re advocating for a bigger network… we need more relay operators. Can’t wave a magic wand. There’s like 8000 relays. Haven’t looked in a while.

Or if you were arguing for increasing the number of relays in a circuit, that doesn’t increase security. It’s like one of the OG tor research papers deciding on 3. Bad guy just needs the first and the last. Middle irrelevant.

Re: Is Tor still safe to use?

#59

Post by Nathanael_M »

system33- wrote: post #50
Spooky23 wrote: post #43

Earlier quoted context omitted.

Tor was literally developed by the intelligence community. I’m sure there are a variety of means to gather actionable intelligence from it, with or without the cooperation of the exit node volunteers. Beyond a principled stance re communications, I can’t think of a reason to use it. If you’re planning to resist some regime that controls telecom infrastructure, the fact that you’re using it is both uncommon and notabl…

Tor was literally developed by the Naval Research Lab. Not a part of the IC. I know because I work there. AMA (edit: about tor. Because people say a lot about it without actually knowing much. But now I should put my phone down so… too late!) To protect our most sensitive communications and vulnerable communities , Tor usage should be normalized so it is common and not notable.

Unrelated to Tor, what was your favourite project to work on that you're allowed to talk about? That must be a fascinating job.

Re: Is Tor still safe to use?

#60

Post by yupyupyups »

system33- wrote: post #44
_5hxt wrote: post #40

Earlier quoted context omitted.

Yes, there aren’t that many tor nodes. It’s not the safe haven protocol or transport suite people make it out to be.

It’s then best we’ve got for achieving actually meaningful privacy and anonymity. It has a huge body of research behind it that is regularly ignored by those coming up with sexy or off-the-cuff alternatives. It’s the most popular so it gets the most attention: from academics, criminals, law enforcement, journalists, …

>It’s then best we’ve got for achieving actually meaningful privacy and anonymity

...while being practical.

One could argue that there is i2p. But i2p is slow, a little bit harder to use, and from what I can remember, doesn't allow you to easily browse the clearnet (regular websites).

Post reply on HN