Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is Tor still safe to use?

blog.torproject.org

Post reply on HN
Print view View original

581–590 of 602 posts

Re: Is Tor still safe to use?

#581

Post by sureIy »

botanical76 wrote: post #578
lifeisstillgood wrote: post #564

Earlier quoted context omitted.

Why is that any different to my neighbour leering over the fence and saying he could hear me and my wife last night “having a good time” I mean he probably could hear it, and I hope no one on HN who heard their neighbour would bring it up on the street ! We do not have secrecy. We have privacy which is merely the politeness of our neighbours (which is of course a social construct of behaviour). The internet has given…

This is a bizarre take. Of course, no person is completely unknown to other individuals. While my neighbour may have access to that which allows him to make crude comments in the street, this is a physical limitation. It is not at all desirable that my house has information leakage. If it were feasible/cost effective to make my house completely soundproof I likely would. The internet is different. There are trade off…

This is it. It’s like comparing “being seen by others at a nudist beach” vs “being recorded for the whole world to watch forever.” Not the same.

Also a lot of people wouldn’t appreciate their neighbor talking (or even hearing) about them having sex.

Re: Is Tor still safe to use?

#582

Post by AnthonyMouse »

jboy55 wrote: post #580
AnthonyMouse wrote: post #576

Earlier quoted context omitted.

The trouble is that the alternative is worse. They come to your house, you don't have Tor installed and then, because you haven't been using Tor, they pull your search history and trawl through it looking for things to take out of context. Why did you do multiple searches for std::vector? Are you worried about sharing needles? You also read an article about caffeine, which is often used as a cutting agent. You've bee…

Yes, all good. My point was that you aren't being charged with having Tor in the scenario that was described. The existence of Tor on your computer might work as connecting the user to a drug sale.

And what I'm getting at is that in that circumstance, not using Tor is worse, because at that point they have a weak case but are now searching your residence to backfill their case with whatever circumstantial innuendo they can dredge up from a fishing expedition. If you've actually been using Tor then they get less of your browser history and are deprived of material to take out of context. Instead they're left with only the rhetorical argument you propose, which is still weak.

Re: Is Tor still safe to use?

#583

Post by posterboy »

immibis wrote: post #570
posterboy wrote: post #489

Earlier quoted context omitted.

technicly this is the only comment in this chain that is relevant to the featured article, but it's technicly so incomplete that it's almost wrong, I can tell from having read the thread and knowing next to nothing else about how TOR works. They don't have plausible evidence to subpoena the guard node if a middle node only sees encrypted traffic. They would also need to control the exit nodes which communicate with t…

Because the victim was an onion server, they could make it generate new connections at will. They used timing correlation to determine their node was the middle node for their connection.

assuming the guard node connects to the host when the host communicates with the client, this makes a little more sense. If I understand correctly you are saying that they did not seize a boat load of unrelated nodes and have rather fluxcompensated it with "timing correlation" and infinite funds.

Ad hominem: your username spells out MIB, Men in Black, surely you are joking.

Re: Is Tor still safe to use?

#584

Post by tylervigen »

akimbostrawman wrote: post #561
zerd wrote: post #507

Earlier quoted context omitted.

They are pretty essential, without them you can only access onion services.

exit nodes aren't used for the onion services. only when interacting with the clearnet.

You are both saying the same thing, you just differ on the degree to which you see that as a problem.

Re: Is Tor still safe to use?

#585

Post by runamuck »

cookiengineer wrote: post #425
runamuck wrote: post #414

Earlier quoted context omitted.

Would an Ethernet cable plugged into your ISP router defend against the above mentioned surveillance (i.e., no WiFi snooping)? Or did the FBI PCAP at the ISP?

The problem is also that different network stack implementations have different MTU values and different TCP headers. There's a lot of tools available that can fingerprint different applications pretty well these days. For example, Firefox and TOR Browser can be fingerprinted because of their custom network library that's OS independent. It gets worse if you use a DSL2 connection with scaling because that will unique…

Wow! Thank you for that comprehensive and considerate answer.

Re: Is Tor still safe to use?

#586

Post by Imustaskforhelp »

akimbostrawman wrote: post #355
Imustaskforhelp wrote: post #329

Earlier quoted context omitted.

most vps don't support xmr though. any suggestions to whom I can trust (I basically only trust hetzner in vps space)

>I basically only trust hetzner in vps space https://notes.valdikss.org.ru/jabber.ru-mitm/

interesting.

I am kind of shocked because I really got positive feedback of hetzner from what I heard from people.

I need to post about this on r/vps and hear about people's opinion.

Re: Is Tor still safe to use?

#587

Post by instagib »

alasdair_ wrote: post #35

Here is what I don't understand: Let's say I as a private individual fund 1000 tor nodes (guard and exit nodes included) and have them all log everything. This could cost less than $5000 for a month, with some time needed to get guard node status. I want to find a certain kind of person so I look for people that access a specific hidden service or clearnet url. Surely eventually I'm going to get a hit where all three…

They have systems in place to eliminate large nodes coming online at the same time. There is some discussion about it in the blog post comments.

Re: Is Tor still safe to use?

#588

Post by valianteffort »

system33- wrote: post #32
valianteffort wrote: post #24

Federal agencies operate enough exit nodes to make Tor use risky at best. I have no idea if they have since implemented some feature to prevent this but if not I would stay far away from Tor if you're planning to do illegal things. There's also the risk of trusting service operators to secure any PII you expose on marketplaces. Not that I think the Fed's would blow their cover to hunt down people buying drugs but sti…

“The western governments run most of the exits” is one of those things everybody “knows” but rarely backs up. The list of all relays is public knowledge by design. There’s contact information attached to relays. The big operators are known individuals and organizations. They contribute. Interact. Which ones are actually the governments doing bad things against their citizens? It’s hard to tell? Then why do you make s…

Meanwhile you have ignored all other potential attack vectors. Fingerprinting (remarkable how little entropy it takes to identify an individual), zero-days that escape Tor's sandbox, etc. Why does Tor browser even ship with javascript enabled? Why aren't major fingerprinting features disabled a la carte?

The point is if you cannot assure anonymity with 100% certainty, you are simply setting people up.

Re: Is Tor still safe to use?

#589

Post by giancarlostoro »

digging wrote: post #527
giancarlostoro wrote: post #427

Earlier quoted context omitted.

Is it sad that when someone else gives me a video with an si parameter or similar, I keep it on when passing it forward, in my eyes, this feeds garbage to their backend.

> this feeds garbage to their backend How is a timestamped chain of communication between persons interested in a particular topic "garbage"?

We don't know that its just a timestamp, look up Discord Snowflake, which is a unique user ID with a timestamp to boot.

Re: Is Tor still safe to use?

#590

Post by immibis »

posterboy wrote: post #583
immibis wrote: post #570

Earlier quoted context omitted.

Because the victim was an onion server, they could make it generate new connections at will. They used timing correlation to determine their node was the middle node for their connection.

assuming the guard node connects to the host when the host communicates with the client, this makes a little more sense. If I understand correctly you are saying that they did not seize a boat load of unrelated nodes and have rather fluxcompensated it with "timing correlation" and infinite funds. Ad hominem: your username spells out MIB, Men in Black, surely you are joking.

The server connects to the guard node and tells it to connect to the middle node and tells the middle node to connect to the final node and tells the final node to connect to the rendezvous point, which already has a connection in the other direction from the client and splices them together at this point.

All Tor hosts use a small set of "guard" nodes as their first hops, because it's considered that directly connecting to a compromised node immediately reveals your IP address, in most cases. Using a small set of first hops reduces the probability that at least one of them is compromised. In older versions of Tor, the middle node is completely random, which means sometimes it is compromised. The German government is thought to have used statistical methods to identify when their compromised node was the middle node, and log the address of the node before it - the guard node. Then, they used legal methods to sniff the traffic on the guard node to find the server's IP address.

In newer versions of Tor, this is more difficult because onion servers use two layers of guard nodes - they use a small infrequently-rotated set of entry guard nodes, and a larger more-frequently-rotated set of middle guard nodes, and the third is still random.

Post reply on HN