Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Things You Should Know About Tor

eff.org

Post reply on HN
Print view View original

91–100 of 115 posts

Re: Things You Should Know About Tor

#91

Post by FedRegister »

iamtew wrote: post #64
cottonseed wrote: post #25

I had been meaning to run a Tor relay for a while. The EFF Tor Challenge [0] motivated me to get it done. It was incredibly easy. If you have a VPS with unused bandwidth, please consider taking a few minutes to set up a Tor relay. [0] https://www.eff.org/torchallenge/

Keep in mind though when setting this up to take a close look at your exit policy settings, to ensure you only route the traffic you want and where you want it. I span up a relay at home to play around with, but just skimmed over the exit policy settings and ended up running an exit node. Not big deal really, as it was only advertised for about 14 hours before I noticed and disabled it. It was only after a few weeks…

As I recall, best practice for running an exit node at home (if you want to do it) is to have a separate Internet connection for it. That way you keep your traffic separate from the exit node traffic.

Re: Things You Should Know About Tor

#92

Post by untrothy »

iamtew wrote: post #64
cottonseed wrote: post #25

I had been meaning to run a Tor relay for a while. The EFF Tor Challenge [0] motivated me to get it done. It was incredibly easy. If you have a VPS with unused bandwidth, please consider taking a few minutes to set up a Tor relay. [0] https://www.eff.org/torchallenge/

Keep in mind though when setting this up to take a close look at your exit policy settings, to ensure you only route the traffic you want and where you want it. I span up a relay at home to play around with, but just skimmed over the exit policy settings and ended up running an exit node. Not big deal really, as it was only advertised for about 14 hours before I noticed and disabled it. It was only after a few weeks…

My distro's tor setup (arch in this case) should default to not being an exit node, relevant default lines in the torrc:

  ExitPolicy accept *:6660-6667,reject *:* # allow irc ports but no more
  ExitPolicy accept *:119 # accept nntp as well as default exit policy
  ExitPolicy reject *:* # no exits allowed
Installing via `pacman -S tor` and enabling via `systemctl enable tor.service` doesn't start an exit node / relay but a simple client.

Are you using linux, windows or osx?

Re: Things You Should Know About Tor

#93

Post by hackcasual »

frandroid wrote: post #35
hackcasual wrote: post #32

Earlier quoted context omitted.

I will say safeguards against tampering are getting better for newer browsers. I'm working on a software stack for PirateBox type systems but focused on security, so I get a pretty good glimpse at how a lot of sites handle incorrect certs, since it's an internetless portal and redirects everything to its hosted SSL page. Both gmail and hackernews will refuse to load at all, as they properly support HSTS. Well gmail "…

So how does Gmail do it with other browsers?

http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security#...

Re: Things You Should Know About Tor

#94

Post by [deleted] »

stephen_g wrote: post #49
cowbell wrote: post #45

How did the feds locate freedom hosting? How did the feds take down silk road? The "tor stinks" slide was over a year old when these events occurred. A lot can change in a year.

Didn't the feds take down Silk Road because the owner paid a cop posing as a hitman to kill someone? Also, there is a problem where hidden services can be enumerated by scanning IPs. With IPv4, it is practical for a well connected entity to scan the entire internet and search for hidden services, making it possible to match to IPs. This is only an issue for people running hidden services, not Tor users.

[deleted]

Re: Things You Should Know About Tor

#95

Post by walls »

belorn wrote: post #52
csandreasen wrote: post #27

I'm probably going to take some flack for this, but I don't trust Tor. When you access Tor, you're masking your origin IP to the remote address by trusting one of a couple hundred volunteer exit nodes who raised their hands and said "Trust me! You can route all of your internet traffic through me and I promise I won't monitor or inject anything..." I think most Tor users don't have an adequate understanding of the th…

Lets address your concern by talking about security and probability for each of those issues. Credit card thieves in Comcast vs in TOR. Given the number of employees who has remote access to customers routers (ie support), sysadmins that has remote server access, and personale who has physical access to switching equipment, whats the risk that one of those people has a criminal record? This will always be non-zero, a…

The Snowden leaks most definitely present this as ongoing work: http://www.theguardian.com/world/interactive/2013/oct/04/tor...

Re: Things You Should Know About Tor

#96

Post by cowbell »

cooperq wrote: post #55
cowbell wrote: post #45

How did the feds locate freedom hosting? How did the feds take down silk road? The "tor stinks" slide was over a year old when these events occurred. A lot can change in a year.

I specifically addressed this in the article. The feds located freedom hosting by using an exploit in Firefox which was able to deanonymize users. I don't know enough about the silk road case, but it seems probable that traffic correlation was used in that case. I agree that things can change in a year, but the essential point that Tor is not cryptographically broken is still true, IMO.

>The feds located freedom hosting by using an exploit in Firefox

That doesn't even make sense. Firefox is client software. How would I locate a hidden service, a server, via an exploit in Firefox? Servers don't generate websites with Firefox.

Re: Things You Should Know About Tor

#97

Post by lern_too_spel »

chopin wrote: post #63
lern_too_spel wrote: post #57

Earlier quoted context omitted.

This is incorrect and dangerously misleading. The NSA collects data that crosses the US border. An internet user in America is more likely to have their data cross a border if they use TOR. In this respect, TOR makes your data more likely to be collected unless you have reason to believe you're already being monitored anyway.

But only exit nodes are the problem here. Traffic between nodes is encrypted anyway. If the encryption is sound (and there is no reason to assume the contrary), they may collect as much as they want. There is anyway no guarantee at all, that non-TOR traffic doesn't cross borders. And you can't assume that any three letter agency acts within the (intended) legal boundaries. To be safe, only end-to-end encryption helps…

Sorry if I wasn't clear, but this is exactly my point. Most of your traffic as an American will stay within the country's borders because most of the services you access are in the US. By using TOR, your traffic will now appear to come from an exit node that has a greater than zero probability of being outside the US. The average American user thus has increased the likelihood of their data being analyzed by the NSA by using TOR. Under great-grandparent's particular threat model, the user is worse off.

Also, we can assume that the NSA operates within those bounds because that's what Snowden's leaked documents say in describing their systems. We have their internal documentation as proof.

Re: Things You Should Know About Tor

#98

Post by zargon »

One usually sees a list like this presented as debunking myths. The myths are given bold headings that state the opposite of what the author wants to say. This format is so much clearer because they state the position they are taking instead of the opposite of their position.

Re: Things You Should Know About Tor

#99

Post by tedks »

zaroth wrote: post #48
tedks wrote: post #17

Earlier quoted context omitted.

I use Tor hidden services to punch through NATs (mostly for SSH); it's also useful in that only you can access the service (since only you know its address), so a hidden service + random port is a cheap "port knocking" implementation. I've also used Tor to debug firewalls. It's a good way of saying "put me in a random spot on the Internet." Outside of that, I use Tor for whatever I can: downloading RSS feeds, instant…

The onion addresses of hidden services are not themselves secret. The onion address is in fact well known, published in the directory. It's only your server's IP that a hidden service is hiding. So please, don't treat knowledge of the onion address itself as a secret! You still have to authenticate to your service in some way.

It'd be pretty impossible to port-scan a .onion... I can't imagine one circuit lasting as long as you'd need to find some random SSH listener.

It's much harder to find than an IP on the Internet; I've never seen brute-force attacks coming from even a standard-port ssh hidden service.

Re: Things You Should Know About Tor

#100

Post by nanoscopic »

It is possible to de-anonymise any Tor user if they have JS enabled and you have passive listeners at their ISP. See http://webcache.googleusercontent.com/search?q=cache:kVKMeKx...

The described attack on Tor may not be well known, but at the very least I told the FBI how to do it myself, so they certainly know about it.

Post reply on HN