Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The FBI Identified a Tor User

vice.com

Post reply on HN
Print view View original

71–80 of 367 posts

Re: The FBI Identified a Tor User

#71

Post by [deleted] »

electroly wrote: post #19
Buffout wrote: post #13

Earlier quoted context omitted.

I don't think that is how timing analisis works. User can say to "entrance node" that it is also a node and that is how it can deny that it is originator. "Entrance node" doesn't know its position in a chain. Only Exit node knows its position.

I don't think that's totally true. At least, it's maybe superficially true but not in a real world sense. The entry node can see your IP by virtue of the incoming TCP connection and it's not hard to figure out if an IP is a Tor relay or not. The list of known relays is a list that you can just go and get. If it's not a relay, then it's a client, and you're the entry node.

[deleted]

Re: The FBI Identified a Tor User

#72

Post by ramesh31 »

wrycoder wrote: post #45
KingLancelot wrote: post #17

The feds run all the entrance and exit nodes. Tor was created by the feds for spies to use, then they made it public yo hide the traffic. This is the official story that everyone has evidently forgotten.

Well, not all the exit nodes by now. But many of them. Most people are probably leery of running an exit node, because its traffic is in the clear (modulo ssh) and often connects to disparate and shady servers.

This is what I've never understood about Tor. What possible incentive does anyone have to run an exit node? Seems like nothing but a liability for some extremely awful stuff.

Re: The FBI Identified a Tor User

#73

Post by GuB-42 »

paulluuk wrote: post #30
kmeisthax wrote: post #21

Earlier quoted context omitted.

I would not be surprised given that Tor was specifically created to anonymize the traffic of US spies. It was released to the public to give plausible deniability to the spies. A new protocol that ONLY spies used would be obvious to track down, no matter how much encryption it had. But if everyone is using it for different purposes then you have to actually have to break the encryption to know if someone's using Tor…

After reading Edward Snowden's autobiography (Permanent Record, great read), I feel like Tor, end-to-end encryption and similar solutions/products are basically a dagger through the heart of intelligence services. As such, I find it hard to believe that they knowingly gave the public such tools. And if they did, it sure as hell backfired on them.

It is not a "dagger to the heart", it is something they have to take into account.

What makes things harder for them makes it harder for the enemy, and vice-versa.

If anything, maybe it will help intelligence services realize that gathering intelligence is only half of the job, keeping secrets is the other half. Well, maybe they already realized it and we are not aware of that (it means it worked). But at the time of Snowden's leaks they failed big time. While most people focused on the content of the leaks and arguing about whether Snowden is a hero or a traitor, what I mostly saw is a guy who managed to break the security of the NSA. If a single guy can do that, what about trained spies backed by world power gouvernements? I guess countries like Russia and China already knew everything there was to know about the NSA. I could go for some "master plan" conspiracy theory, but my guess is just that the NSA is incompetent, or at least it was at the time of Snowden. Maybe that "dagger to the heart" is more like a wake up call, I hope for them.

Re: The FBI Identified a Tor User

#74

Post by from »

curiousllama wrote: post #36
generalizations wrote: post #4

I wonder if this is going to be confirmation that a large fraction of Tor nodes are in fact run by the FBI.

My favorite theory is that the US, China, NK, Russia, Israel, et al. are all running a large number of malicious servers, all of which adds up to a secure Tor network, since they'll never cooperate

I wish! But there most be some return on investment or they wouldn't be doing it. Tor is so much faster than it used to be so I think it is likely there is well resourced person who is up to something on Tor .

Re: The FBI Identified a Tor User

#76

Post by titaniumtown »

DarkmSparks wrote: post #39
nibbleshifter wrote: post #27

Sounds like his box was compromised, possibly by owning the site he visited first. The FBI has done this before - inject a browser exploit into a site they compromised to identify its users.

yep, this, I ran a tor webserver for discussing geopolitics with friends on a pi for a few months before finding it had been compromised. that was shortly after intel exchange had been taken down. Tor services just arent secure in any sense imho. especially not from the people who wrote them. sigh.

> for discussing geopolitics with friends on a pi for a few months before finding it had been compromised.

that's very suspicious

Re: The FBI Identified a Tor User

#77

Post by johnisgood »

jwilk wrote: post #64
archontes wrote: post #46

Earlier quoted context omitted.

Doesn't the tor browser disable javascript entirely?

https://support.torproject.org/tbb/tbb-34/ > We configure NoScript to allow JavaScript by default in Tor Browser because many websites will not work with JavaScript disabled. Most users would give up on Tor entirely if we disabled JavaScript by default because it would cause so many problems for them.

That said, popular websites on/for Tor are free of JavaScript and they have implemented everything (such as captchas, or the "JavaScript is enabled" warning, and so forth) using pure HTML and CSS. They do use OpenResty[1], too, which is NGINX + Lua. Good stuff.

[1] https://openresty.org/, https://github.com/openresty/lua-nginx-module

Re: The FBI Identified a Tor User

#78

Post by kibwen »

paulluuk wrote: post #30
kmeisthax wrote: post #21

Earlier quoted context omitted.

I would not be surprised given that Tor was specifically created to anonymize the traffic of US spies. It was released to the public to give plausible deniability to the spies. A new protocol that ONLY spies used would be obvious to track down, no matter how much encryption it had. But if everyone is using it for different purposes then you have to actually have to break the encryption to know if someone's using Tor…

After reading Edward Snowden's autobiography (Permanent Record, great read), I feel like Tor, end-to-end encryption and similar solutions/products are basically a dagger through the heart of intelligence services. As such, I find it hard to believe that they knowingly gave the public such tools. And if they did, it sure as hell backfired on them.

Tor was developed by the US Navy. The military understands how crucial encrypted messaging is, and doesn't particularly care whether or not it's a dagger through the heart of other TLAs. In a bureaucratic battle between the military and domestic intelligence agencies, the military wins.

Re: The FBI Identified a Tor User

#79

Post by seanw444 »

jwilk wrote: post #64
archontes wrote: post #46

Earlier quoted context omitted.

Doesn't the tor browser disable javascript entirely?

https://support.torproject.org/tbb/tbb-34/ > We configure NoScript to allow JavaScript by default in Tor Browser because many websites will not work with JavaScript disabled. Most users would give up on Tor entirely if we disabled JavaScript by default because it would cause so many problems for them.

Yikes. I thought the point of Tor was uncompromising security? This is going to bite some less-experienced people in the ass.

Re: The FBI Identified a Tor User

#80

Post by Scoundreller »

seanw444 wrote: post #79
jwilk wrote: post #64

Earlier quoted context omitted.

https://support.torproject.org/tbb/tbb-34/ > We configure NoScript to allow JavaScript by default in Tor Browser because many websites will not work with JavaScript disabled. Most users would give up on Tor entirely if we disabled JavaScript by default because it would cause so many problems for them.

Yikes. I thought the point of Tor was uncompromising security? This is going to bite some less-experienced people in the ass.

It has.

The NoScript approach is dumb because it easily supports temporary and permanent white-listing of sites, which is agreeable to many (but still problematic depending on what your risk profile).

With NoScript’s current approach, you get ruined when your JavaScript-free-optimized starts sending you nasty JavaScript.

Post reply on HN