7 ms·

Tor Wars: The Signal Awakens

108 points by vishnuks 11y ago

mark_l_watson 11y ago
An important point the article makes is how important it is for a large number of people to use Tor, even if only occasionally. I try to use Tor at least once or twice a week for general web browsing. I also donated money to them. It is really important for people to also support groups like the EFF and ACLU financially: a good investment in future freedom. History shows that large empires tend to get tough on their citizens as the empires wane. We live in an era right now where the current large empire is waning.
- tete 11y ago
  I actually switched to using Tor whenever I go on wild hunts about stuff that I find interesting. Basically that means whenever I visit Wikipedia, because I can waste hours there, going over the weirdest topics. Usually I get drawn in by stuff like history and end up on things like Soviet Union, Nazi Germany, Japan in WW2, etc. or stuff like Ku Klux Klan, the "Islamic State". If there is some surveillance system it will probably be thinking I am into each and every kind of extremism. And since extreme groups like the Nazis have the wildest conspiracy theories that also is something I don't want to identified with. Using Tor by using the Tor Browser is actually pretty nice and pretty fast, both to set up and when browsing. Years ago Tor used to be rather slow. That totally changed. The are a few annoyances though. Some websites seem to have weird rules such as "block Tor completely". Come on, your website can still be exploited. You will not really stop anyone that way. Then there is the problem of websites usually requiring JavaScript for everything. The latter is weird, cause it's like people use "front end frameworks" for stuff where it doesn't really make sense and even slows down the page a lot. I am not saying JavaScript is evil, but I think people overuse them these days. Of course you might decide to enable JavaScript and unless you set the Tor Browser to highest security at least HTTPS sites will deliver and execute JavaScript. Another major annoyance is CloudFlare. They require you to enter a CAPTCHA (which for some time didn't work), when accessing a website via Tor. The only way to disable it is for the website owner to completely disable security. I mean I get that they probably want to prevent some script kiddies from "hacking" unpatched Wordpress or so, but maybe this can be enhanced. Cause like I said above. The approach of filtering certain IPs isn't really enhancing actual security and nobody is going to DDOS you via Tor. ;)
  - hellofunk 11y ago
    Some of these points are partly why I chose to go with a commercial VPN regularly rather than Tor. There is also no change at all in my bandwidth with the VPN, and I can seamlessly use high bandwidth tools like Netflix, streaming audio/video, etc. Maybe Tor has improved lately to allow this kind of behavior easily also?
    - fredsted 11y ago
      The problem with these VPNs is that they can log your traffic. Even if they say they don't, what's to stop them?
      - noondip 11y ago
        Moreover, VPNs are juicy targets for surveillance corps since so many do use them to conduct illegal or questionable activities. My personal strategy is to use Tor with a private obfuscating bridge rotated frequently between hosting providers.
        hellofunk 11y ago
        Do you mean you use Tor with VPN together?
        noondip 11y ago
        Not quite, I'm referring to https://www.torproject.org/docs/pluggable-transports.html https://www.torproject.org/docs/pluggable-transports.html My favorites are obfs4 and StegoTorus, running on a private machine in some "cloud".
    - tete 11y ago
      For certain kinds of streaming it might be nicer to use a VPN, even though, like others already pointed out it might still be used invade your privacy. Not just that your provider might just log your actions, but VPNs are usually not trying to avoid various passive attacks, simply because VPNs are there to provide an encrypted connection, nothing more. For ISPs (of the VPN) and others it's rather simple to look at where and how you enter and therefor an attack where people look at the (amount of) traffic that goes there, what the server on the VPN side requests. It's not impossible with Tor, but way, way harder. In addition to VPNs usually being centralized and therefor easier to attack in such a manner your VPN also is likely to have fewer users than Tor, so it's way easier to look at it and draw conclusions. Also VPNs tend to be better suited for (semi)targeted attacks.
- StavrosK 11y ago
  My Tomato router has Tor built in. I can enable it and route some traffic through sometimes, but does anyone know if it will consume bandwidth if I leave it open but not use it? Is every Tor node a potential relay node?
  - xena 11y ago
    You are only a relay router in Tor if you elect to be a relay router.
- tete 11y ago
  About donations. Other than EFF and the Tor Project this is also a good way to help: https://oniontip.com/ https://oniontip.com/ There is also organizations that host Tor servers and while I think they can be trusted and a donation certainly is worthwhile it also leads to a form of centralization. Oniontip is likely far from covering any costs, but I guess it helps the operators a bit.
- Sir_Cmpwn 11y ago
  I configure things that I don't need to be fast to run over Tor. IRC and email are examples.
  - imrehg 11y ago
    Regarding IRC, I just wish Freenode hadn't blocked Tor and discontinued previous Tor access methods[0], so can't really be used at all. [0]: https://freenode.net/irc_servers.shtml#tor https://freenode.net/irc_servers.shtml#tor
deleted 11y ago
[deleted]
deleted 11y ago
[deleted]
hackuser 11y ago
I don't agree with this statement from the article: This, and Tor’s history of US government sponsorship, has led to series of really embarrassing conspiracy theories from the likes of PandoDaily. This is why non-technical journalists should not write about technical subjects. If you’re going to suggest that open-source software has dark ulterior vulnerabilities, you need to point at exactly where they are in the code (or deployment process), or you will quite rightly be laughed out of the room. Funding and relationships are not unimportant — and I’m sure Pando will now write me off as part of the shadowy conspiracy, as Tor developer Jacob Appelbaum is an old friend — but it’s the running code that actually matters. Sadly, non-engineers don’t seem to understand this, or how laughably ridiculous they look as a result. The author, Jon Evans, seems to imply this is a widely accepted standard, which is not my experience. It also doesn't seem realistic: While it's great that open source software's source code is available, it's not possible to review it all much less to catch subtle exploits that might have been introduced by security agencies - we can't even catch many unintentional exploits. Also, we know from leaks that security agencies have tried and have succeeded at times. Realistically it comes down to trust. Think of it this way: How many HN readers, a sophisticated population, have reviewed Tor's code? How many feel they have no choice but to choose either to trust them or not? Also, how many open source projects have had security audits performed by anyone?
- rodgerd 11y ago
  > it's not possible to review it all much less to catch subtle exploits that might have been introduced by security agencies - we can't even catch many unintentional exploits Precisely. In the wake of Shellshock and Heartbleed the sneering tone of the passage you've cited should profoundly embarrass the author. It does not accord well with the facts.
  - moxie 11y ago
    People tend to cite heartbleed as an example of how "open source" has no intrinsic security value. While I agree that something being "open source" does not automatically make it secure, I think that it does allow us to gauge the security of the project. In the case of heartbleed, anyone who has ever spent more than 30 seconds looking at OpenSSL can tell you that it is not secure software and never will be. We can't identify and remedy every possible vulnerability, but we do have enough information to know that events like heartbleed will happen again and again.

108 points by vishnuks 11y ago

An important point the article makes is how important it is for a large number of people to use Tor, even if only occasionally. I try to use Tor at least once or twice a week for general web browsing. I also donated money to them. It is really important for people to also support groups like the EFF and ACLU financially: a good investment in future freedom. History shows that large empires tend to get tough on their citizens as the empires wane. We live in an era right now where the current large empire is waning.

tete 11y ago
I actually switched to using Tor whenever I go on wild hunts about stuff that I find interesting. Basically that means whenever I visit Wikipedia, because I can waste hours there, going over the weirdest topics. Usually I get drawn in by stuff like history and end up on things like Soviet Union, Nazi Germany, Japan in WW2, etc. or stuff like Ku Klux Klan, the "Islamic State". If there is some surveillance system it will probably be thinking I am into each and every kind of extremism. And since extreme groups like the Nazis have the wildest conspiracy theories that also is something I don't want to identified with. Using Tor by using the Tor Browser is actually pretty nice and pretty fast, both to set up and when browsing. Years ago Tor used to be rather slow. That totally changed. The are a few annoyances though. Some websites seem to have weird rules such as "block Tor completely". Come on, your website can still be exploited. You will not really stop anyone that way. Then there is the problem of websites usually requiring JavaScript for everything. The latter is weird, cause it's like people use "front end frameworks" for stuff where it doesn't really make sense and even slows down the page a lot. I am not saying JavaScript is evil, but I think people overuse them these days. Of course you might decide to enable JavaScript and unless you set the Tor Browser to highest security at least HTTPS sites will deliver and execute JavaScript. Another major annoyance is CloudFlare. They require you to enter a CAPTCHA (which for some time didn't work), when accessing a website via Tor. The only way to disable it is for the website owner to completely disable security. I mean I get that they probably want to prevent some script kiddies from "hacking" unpatched Wordpress or so, but maybe this can be enhanced. Cause like I said above. The approach of filtering certain IPs isn't really enhancing actual security and nobody is going to DDOS you via Tor. ;)
- hellofunk 11y ago
  Some of these points are partly why I chose to go with a commercial VPN regularly rather than Tor. There is also no change at all in my bandwidth with the VPN, and I can seamlessly use high bandwidth tools like Netflix, streaming audio/video, etc. Maybe Tor has improved lately to allow this kind of behavior easily also?
  - fredsted 11y ago
    The problem with these VPNs is that they can log your traffic. Even if they say they don't, what's to stop them?
    - noondip 11y ago
      Moreover, VPNs are juicy targets for surveillance corps since so many do use them to conduct illegal or questionable activities. My personal strategy is to use Tor with a private obfuscating bridge rotated frequently between hosting providers.
      - hellofunk 11y ago
        Do you mean you use Tor with VPN together?
        noondip 11y ago
        Not quite, I'm referring to https://www.torproject.org/docs/pluggable-transports.html https://www.torproject.org/docs/pluggable-transports.html My favorites are obfs4 and StegoTorus, running on a private machine in some "cloud".
  - tete 11y ago
    For certain kinds of streaming it might be nicer to use a VPN, even though, like others already pointed out it might still be used invade your privacy. Not just that your provider might just log your actions, but VPNs are usually not trying to avoid various passive attacks, simply because VPNs are there to provide an encrypted connection, nothing more. For ISPs (of the VPN) and others it's rather simple to look at where and how you enter and therefor an attack where people look at the (amount of) traffic that goes there, what the server on the VPN side requests. It's not impossible with Tor, but way, way harder. In addition to VPNs usually being centralized and therefor easier to attack in such a manner your VPN also is likely to have fewer users than Tor, so it's way easier to look at it and draw conclusions. Also VPNs tend to be better suited for (semi)targeted attacks.
StavrosK 11y ago
My Tomato router has Tor built in. I can enable it and route some traffic through sometimes, but does anyone know if it will consume bandwidth if I leave it open but not use it? Is every Tor node a potential relay node?
- xena 11y ago
  You are only a relay router in Tor if you elect to be a relay router.
tete 11y ago
About donations. Other than EFF and the Tor Project this is also a good way to help: https://oniontip.com/ https://oniontip.com/ There is also organizations that host Tor servers and while I think they can be trusted and a donation certainly is worthwhile it also leads to a form of centralization. Oniontip is likely far from covering any costs, but I guess it helps the operators a bit.
Sir_Cmpwn 11y ago
I configure things that I don't need to be fast to run over Tor. IRC and email are examples.
- imrehg 11y ago
  Regarding IRC, I just wish Freenode hadn't blocked Tor and discontinued previous Tor access methods[0], so can't really be used at all. [0]: https://freenode.net/irc_servers.shtml#tor https://freenode.net/irc_servers.shtml#tor

deleted 11y ago

[deleted]

deleted 11y ago

[deleted]

hackuser 11y ago

I don't agree with this statement from the article: This, and Tor’s history of US government sponsorship, has led to series of really embarrassing conspiracy theories from the likes of PandoDaily. This is why non-technical journalists should not write about technical subjects. If you’re going to suggest that open-source software has dark ulterior vulnerabilities, you need to point at exactly where they are in the code (or deployment process), or you will quite rightly be laughed out of the room. Funding and relationships are not unimportant — and I’m sure Pando will now write me off as part of the shadowy conspiracy, as Tor developer Jacob Appelbaum is an old friend — but it’s the running code that actually matters. Sadly, non-engineers don’t seem to understand this, or how laughably ridiculous they look as a result. The author, Jon Evans, seems to imply this is a widely accepted standard, which is not my experience. It also doesn't seem realistic: While it's great that open source software's source code is available, it's not possible to review it all much less to catch subtle exploits that might have been introduced by security agencies - we can't even catch many unintentional exploits. Also, we know from leaks that security agencies have tried and have succeeded at times. Realistically it comes down to trust. Think of it this way: How many HN readers, a sophisticated population, have reviewed Tor's code? How many feel they have no choice but to choose either to trust them or not? Also, how many open source projects have had security audits performed by anyone?

rodgerd 11y ago
> it's not possible to review it all much less to catch subtle exploits that might have been introduced by security agencies - we can't even catch many unintentional exploits Precisely. In the wake of Shellshock and Heartbleed the sneering tone of the passage you've cited should profoundly embarrass the author. It does not accord well with the facts.
- moxie 11y ago
  People tend to cite heartbleed as an example of how "open source" has no intrinsic security value. While I agree that something being "open source" does not automatically make it secure, I think that it does allow us to gauge the security of the project. In the case of heartbleed, anyone who has ever spent more than 30 seconds looking at OpenSSL can tell you that it is not secure software and never will be. We can't identify and remedy every possible vulnerability, but we do have enough information to know that events like heartbleed will happen again and again.