I have problems even logging in on ycombinator with tor. Not to mention any site with anti-spam protection.
[deleted]
Tor and HTTPS
71–80 of 135 posts
Re: Tor and HTTPS
#72The important part of the diagram for Tor is the first NSA character, as you can see it still shows "Location" before you are routed through the Tor relay. With the location information it is possible to correlate the exit information via pattern matching, though it would take considerable analysis, this can be done by logging volume and timing information on the two sides. I am sure there are even better techniques…
> With the location information it is possible to correlate the exit information via pattern matching, though it would take considerable analysis, this can be done by logging volume and timing information on the two sides. I am sure there are even better techniques to analyze exit/entry correlations, especially if you're not using a secure browser. I've thought the same. But I've also thought that if this is indeed p…
Hidden service routing works quite differently that regular exiting traffic. Twice the number of relays are involved, and the traffic is end-to-end encrypted instead of being visible to any relay (such as an exit node). Correlation attacks are always possible to a global passive adversary (which NSA may or may not be), but as far as I can tell, they seem much harder to pull off against hidden services.
Re: Tor and HTTPS
#73Earlier quoted context omitted.
Do they really need to fake it? It surely might be a part of the famous indirectly accessed data.
This has been my question in this whole mess, if we assume NSA can and does subpoena the keys and certs as opposed to the direct data (and the NSA were copying data en masse, which now seems likely) would that not make HTTPS essentially useless?
The NSA is not the average guy listening in on your wifi and then using your CC to buy stuff online. HTTPS protects against those, and it does so relatively efficiently.
Re: Tor and HTTPS
#74Why does the graphic portray police as mean angry people. Police are good people who provide a valuable service. They do a good thing. They are not the enemy.
Re: Tor and HTTPS
#75How about using Tor > VPN (Note: Not VPN > Tor) ?
I've tried that. It seems google tracks ip and forces users to change password.
Re: Tor and HTTPS
#76Why does the graphic portray police as mean angry people. Police are good people who provide a valuable service. They do a good thing. They are not the enemy.
No, they don't, they do a bad thing. In actual fact, all cops are bastards. Their primary function in society is to defend the property rights of the capitalist class against the working class, thus preserving inequality.
Re: Tor and HTTPS
#77Why does the graphic portray police as mean angry people. Police are good people who provide a valuable service. They do a good thing. They are not the enemy.
In general, yes, but, in the worst case, no.
Re: Tor and HTTPS
#78Earlier quoted context omitted.
Security professionals have hypothesized many attacks against the anonymity of the tor onion and what you describe is pretty close to one of them. If the NSA was to create tons Tor nodes (enter, exit, and relay), the onion may be broken. Tor is by no means perfect. It is only obfuscating. It is easy to see how this is broken if you click the TOR button on this thing and then imagine the TOR nodes say NSA on them. I t…
There isn't really such category as a tor 'enter' node. Any node can be the first node of the chain, but it has no idea whether it is the first or one in the middle of the chain. Essentially, it's as if the 'entrance node' is running on your computer. That means that no node knows the source of the traffic, and only the exit node knows the destination. For the NSA to effectively monitor Tor, they'd need to run a larg…
Do you have a link to said paper by any chance?
Re: Tor and HTTPS
#79Earlier quoted context omitted.
It could circumvent VPN censorship/supression or DPI since VPN is not a secure end to end communication. That way you would obfuscate your endpoint against your vpn endpoint/provider. It would add no further benefit to location obfuscation with Tor, since your VPN-provider will always snitch on you when opposed with lethal force.
They can know your location, but at least no one will know what you're doing.
Your VPN will become your new endpoint, it is a tor-vpn cascade.
Re: Tor and HTTPS
#80I have problems even logging in on ycombinator with tor. Not to mention any site with anti-spam protection.
[deleted]