51–60 of 115 posts
Tor is currently funded by the US government. Any list of things you should know about tor should include that.
It is a good thing the US government supports these things.
I'm probably going to take some flack for this, but I don't trust Tor. When you access Tor, you're masking your origin IP to the remote address by trusting one of a couple hundred volunteer exit nodes who raised their hands and said "Trust me! You can route all of your internet traffic through me and I promise I won't monitor or inject anything..." I think most Tor users don't have an adequate understanding of the th…
Credit card thieves in Comcast vs in TOR. Given the number of employees who has remote access to customers routers (ie support), sysadmins that has remote server access, and personale who has physical access to switching equipment, whats the risk that one of those people has a criminal record? This will always be non-zero, and one can never actually test it.
In TOR, this risk can be tested[1]. Exit note can be probed by sending unique credit card numbers or other profitable personal information, and then observed by seeing what the node owner does. If they act on the information, the node then get blocked. You can not do this with Comcast since your identity is known to the personal of Comcast.
The NSA threat, as talked about, is reduced by using TOR. Doing statistical analysis is in theory possible but in practice very hard. Out of all the Snowden leaks, not a single one present this as a ongoing work happening. Non-tor traffic analysis is however presented as business-as-usual and should be assumed to happen at every point in the network.
Last, the HTTPS Everywhere you mention is a direct answer to the SSLstrip for the most commonly used websites. Claiming it is implemented backwards because it uses a blacklist is a bit unfair, since blacklist and whitelist each has their own tradeoff in security. HTTPS Everywhere has no false positive and protect against the common threat, but will be vulnerable against uncommon ones. If they had gone with a HTTPS-only approach, it would have caused a extreme amount of false-positives, and users would have turned it off. This trade-off (security vs false positives) is commonly the distinction between user products and server products.
KB SSL Enforcer do not protect against sslstrip and MITM[2] for new installations. If the Tor Browser Bundle included KB SSL Enforcer, it would worsen the security of the Bundle compared to HTTPS Everywhere, and would be counter to the design. Rather than leaving no records of the sites you go to, KB SSL Enforcer have to record and permanent store it.
[1] http://www.slideshare.net/FreeLeaks/exposing-malicious-tor-e...
Earlier quoted context omitted.
I use Tor hidden services to punch through NATs (mostly for SSH); it's also useful in that only you can access the service (since only you know its address), so a hidden service + random port is a cheap "port knocking" implementation. I've also used Tor to debug firewalls. It's a good way of saying "put me in a random spot on the Internet." Outside of that, I use Tor for whatever I can: downloading RSS feeds, instant…
The onion addresses of hidden services are not themselves secret. The onion address is in fact well known, published in the directory. It's only your server's IP that a hidden service is hiding. So please, don't treat knowledge of the onion address itself as a secret! You still have to authenticate to your service in some way.
Would there be consequences in using Tor on HN?
How did the feds locate freedom hosting? How did the feds take down silk road? The "tor stinks" slide was over a year old when these events occurred. A lot can change in a year.
How did the feds locate freedom hosting? How did the feds take down silk road? The "tor stinks" slide was over a year old when these events occurred. A lot can change in a year.
Didn't the feds take down Silk Road because the owner paid a cop posing as a hitman to kill someone? Also, there is a problem where hidden services can be enumerated by scanning IPs. With IPv4, it is practical for a well connected entity to scan the entire internet and search for hidden services, making it possible to match to IPs. This is only an issue for people running hidden services, not Tor users.
I'm probably going to take some flack for this, but I don't trust Tor. When you access Tor, you're masking your origin IP to the remote address by trusting one of a couple hundred volunteer exit nodes who raised their hands and said "Trust me! You can route all of your internet traffic through me and I promise I won't monitor or inject anything..." I think most Tor users don't have an adequate understanding of the th…
a) The NSA collects first and targets later b) The NSA may control the exit node your traffic is going through vs the NSA collects all network traffic from everywhere. Using tor do add an additional anonymity layer.
I'm probably going to take some flack for this, but I don't trust Tor. When you access Tor, you're masking your origin IP to the remote address by trusting one of a couple hundred volunteer exit nodes who raised their hands and said "Trust me! You can route all of your internet traffic through me and I promise I won't monitor or inject anything..." I think most Tor users don't have an adequate understanding of the th…
Lets address your concern by talking about security and probability for each of those issues. Credit card thieves in Comcast vs in TOR. Given the number of employees who has remote access to customers routers (ie support), sysadmins that has remote server access, and personale who has physical access to switching equipment, whats the risk that one of those people has a criminal record? This will always be non-zero, a…
Earlier quoted context omitted.
Lets address your concern by talking about security and probability for each of those issues. Credit card thieves in Comcast vs in TOR. Given the number of employees who has remote access to customers routers (ie support), sysadmins that has remote server access, and personale who has physical access to switching equipment, whats the risk that one of those people has a criminal record? This will always be non-zero, a…
Are malicious exit nodes actively blocked by the project?
If you want to see nodes that are blocked, http://torstatus.blutmagie.de/ looks to be a good site. There has also been several research projects which has explored different avenues for finding bad nodes, and the TOR Project created a few years ago a python project which incorporated most those methods to automatically scan for malicious nodes (https://svn.torproject.org/svn/torflow/trunk/README).
Earlier quoted context omitted.
I use Tor hidden services to punch through NATs (mostly for SSH); it's also useful in that only you can access the service (since only you know its address), so a hidden service + random port is a cheap "port knocking" implementation. I've also used Tor to debug firewalls. It's a good way of saying "put me in a random spot on the Internet." Outside of that, I use Tor for whatever I can: downloading RSS feeds, instant…
The onion addresses of hidden services are not themselves secret. The onion address is in fact well known, published in the directory. It's only your server's IP that a hidden service is hiding. So please, don't treat knowledge of the onion address itself as a secret! You still have to authenticate to your service in some way.