6 ms·

Edward Snowden Explains How to Reclaim Privacy

170 points by etiam 11y ago

privacy101 11y ago
What I don't get about Tor is that if your adversary can see all Internet packets, all the time, wouldn't it be trivial for them to find the real source and destination of a Tor packet using it's meta-data (size,timestamp,etc...)? For example, a packet of size X was sent from host 1 to host 2 and immediately after, a similarly sized packet was sent from host 2 to host 3, etc... I think of Tor more like a tool to avoid a specific server from finding who you are, and not the government.
- Menge 11y ago
  I didn't look specifically at Tor, but even early p2p anonymizer proposals had each node aggregate groups of standard size newly encapsulated chunks that were only sent out when there's enough to send similar bundles to all its next hops. This made simple observation at each hop pretty worthless, though I think someone has since proposed a statistical attack that could narrow the client down eventually if given a long enough connection with certain behaviors.
- Kristine1975 11y ago
  This is called a timing attack and no, Tor doesn't seem to protect you against it: http://tor.stackexchange.com/q/737 http://tor.stackexchange.com/q/737
- teddyh 11y ago
  You are assuming not only that an attacker can see all packets all the time, but also at all points in the network, which is unlikely in practice.
  - pyvpx 11y ago
    if your attacker isn't apart of the Five Eyes, sure.
    - omginternets 11y ago
      I don't know that the Five Eyes have the kind of temporal resolution in their measures that would be needed to conduct these kinds of attacks. In fact, it's very likely that they don't.
      - privong 11y ago
        > I don't know that the Five Eyes have the kind of temporal resolution in their measures that would be needed to conduct these kinds of attacks. In fact, it's very likely that they don't. Why is it unlikely for them to have that kind of temporal resolution? I would assume the opposite. It seems like it would be trivial to save timing information along with packets. And the timing data must be relatively small compared to whatever data they're saving on the packets, so the added storage requirement is not really a concern.
        omginternets 11y ago
        Because it's unlikely that they're saving every packet. I suspect they're down-sampling somewhere, given the sheer volume of data. This isn't to say they couldn't specifically target an endpoint for monitoring, however. Perhaps I was unclear about that.
        privong 11y ago
        One way around that limitation could be real-time analysis with some data buffering. In that way, the timing attack could be done and only those packets saved. I don't really have a feel for what kind of processing this would require, though. Presumably one would also need a low-latency link to the nodes of interest.
        FLUX-YOU 11y ago
        GCHQ were doing full takes of the internet for 3 days, Tor traffic is nothing compared to that [0]http://www.spiegel.de/media/media-34103.pdf http://www.spiegel.de/media/media-34103.pdf
- hiq 11y ago
  There is always a trade-off between usability / efficiency and security, and this trade-off has to take into account the attacker model. Tor is a low-latency network by design, so right from the start it gives up some security to be more usable instead. That probably still works against many attackers, including some state agencies, although not the most powerful. We should also keep the bigger picture in mind. Sure, if the NSA really wants to know everything about you, it's going to keep a record of your outgoing packets, and match it with packets from exit nodes to have all your metadata. But how much is it going to cost? How does it scale? I think we can assume that if everyone were to use Tor, mass surveillance would be at least far more costly. Each new user adds noise in the correlation measures. I can also argue that if you use Tor from your home or any location that is associated to you in any way, you're not really trying to avoid target surveillance by your government.
  - imglorp 11y ago
    It's everyone's civic duty to contribute to the noise and to increase the expense to all state actors.
    - programmarchy 11y ago
      Is it also our civic duty to pay the taxes to these state actors? Asking because this tactic seems a bit like striking at the branches, rather than the root.
      - deleted 11y ago
        [deleted]
        knodi123 11y ago
        He wasn't sent to prison for asking questions any more than drug dealers are sent to prison for "asking" whether the US has a rational policy for drug enforcement.
      - pdkl95 11y ago
        > rather than the root So run for office. I would certainly vote for someone who was against this crap. > It's everyone's civic duty to contribute to the noise That's a tactic. While it may be useful, a strategy that works to gain political influence is better in the long-run.
- ionised 11y ago
  As the Tor developers themselves say, Tor should be only one tool in your overall privacy/security toolbox. Relying on Tor alone to keep you anonymous, especially against nation state actors is probably not a great idea.
- dandelion_lover 11y ago
  One solution against such timing attack is to use i2p, which uses garlic routing instead of onion routing. As a downside i2p is less reliable.
  - privacy101 11y ago
    Apparently i2p is better protected against this type of attack but it might not be perfect. "This sort of attack is powerful, but its applicability to I2P is non obvious" [1] "Without protocol scrubbing or higher latency, global active adversaries can gain substantial information. As such, people concerned with these attacks could increase the latency (using nontrivial delays or batching strategies), include protocol scrubbing, or other advanced tunnel routing techniques, but these are unimplemented in I2P." [1] [1] https://geti2p.net/en/docs/how/threat-model#timing https://geti2p.net/en/docs/how/threat-model#timing
- omginternets 11y ago
  My understanding is that Tor is designed to prevent you from being a suspect in the first place.
  - sorokod 11y ago
    Such a systems might (your geography dependent) make you a suspect immediately
    - omginternets 11y ago
      Well that's sort of the point. Tor is special in that it helps avoid this problem, i.e.: given and endpoint, it's (for all intents and purposes) impossible to determine whence the traffic comes. At the same time, Tor can be used in such a way that nobody will know it's being used.
- GTP 11y ago
  Uhm, not so sure: usually packets have fixed size and through a tor node can pass lots of them from different sources. And if timestamp can be a problem a tor node could randomly delay them.
  - sfilipov 11y ago
    And relay them out of order i.e. a Tor node receives a packet from A, then from B, then resends packet from B, then from A.
oneJob 11y ago
"Edward Snowden Explains How to Fix the Internet" Much love for Snowden. He is a personal hero of mine. I think he should be a personal hero of yours. I think we should have statues of the guy. Just as Snowden didn't want the story to be about him, to be a personality piece, when he released the trove of information which shook the privacy world to its core, I think he'd agree that any response to this new information should not be focused on or directed toward what he personally endorses by virtue of him as a 'personality'. Unfortunately, the conversation has largely focused on the technical/technology dimension, while the policy and political dimensions have not seen the same engagement by their respective members. In fact, Snowden has been used by political parties as a proxy piece in disagreements regarding East-West relations. And if technology is the answer, then the general public, almost by definition, does not have a place in the discussion.
- bmelton 11y ago
  > I think we should have statues of the guy. We sort of had at least one, but then the New York Parks Department covered it up, and later removed it altogether. There's a certain irony in the picture of it happening, wherein the state worker steps on the eagle statue to put a muzzle over the Snowden statue. http://brokelyn.com/wp-content/uploads/2015/04/ed-snowden-statue.jpg http://brokelyn.com/wp-content/uploads/2015/04/ed-snowden-st...
arm 11y ago
Wholeheartedly agree with this section: “Lee: Do you think people should use adblock software? Snowden: Yes. Everybody should be running adblock software, if only from a safety perspective … We’ve seen internet providers like Comcast, AT&T, or whoever it is, insert their own ads into your plaintext http connections. … As long as service providers are serving ads with active content that require the use of Javascript to display, that have some kind of active content like Flash embedded in it, anything that can be a vector for attack in your web browser — you should be actively trying to block these. Because if the service provider is not working to protect the sanctity of the relationship between reader and publisher, you have not just a right but a duty to take every effort to protect yourself in response.” Not even just ads being injected by ISPs, but even ads as they’re being used by the website owners themselves (in general) are a vector for malware, as has been shown time and time again¹. ―――――― ¹ — https://news.ycombinator.com/item?id=10517932 https://news.ycombinator.com/item?id=10517932
SimplyUseless 11y ago
Summary of key discussions: ========================== If you're just an average user concerned about your privacy 1) Use Tor when browsing.You don't have to use Tor all the time (it does slow things down considerably and some sites will also block Tor traffic). But if you are looking at or for something that you feel is sensitive, then either set up your browser to work with Tor or use the Tor browser. 2) Use an ad-blocker. Says Snowden: "As long as service providers are serving ads with active content that require the use of Javascript to display, that have some kind of active content like Flash embedded in it, anything that can be a vector for attack in your web browser – you should be actively trying to block these." 3) Use a password manager. It doesn't matter how many surveys and reports come out that tell people to use different passwords and complex passwords, a huge percentage of us maintain borderline idiotic approaches. The simple answer is: get a password manager. It will protect you. 4) Use two-factor authentication. Many services such as Gmail, Twitter, Dropbox, Hotmail, and Facebook offer this now for no charge. So even if your password does get exposed, you still have a backup such as a text message to your phone to secure your information. 5) Use apps that protect your information. Snowden suggests the smartphone app Signal, which encrypts both your phone calls and texts. It's free and easy to use. Although of course, following a high-profile argument with the FBI, it would appear that Apple's messaging service is also pretty secure (although Snowden would probably have doubts). 6) Use the HTTPS Everywhere browser plug-in. This comes from the Electronic Frontier Foundation (EFF) and will try to force all browser communication to be encrypted. 7) Encrypt your hard drive. This is comparatively easy these days but you have to be careful to do two things: one, have a longish phrase to make it worthwhile; and two, make damn sure you remember that phrase. There will be a slowdown in performance but nothing too bad if you have a modern machine. 8) Be smart with your security questions. Stop using your mother's maiden name for everything. Likewise your first school. The key is to mix things up as much as possible so if someone does get into one of your accounts, they can't use the same information to get in everywhere else.

170 points by etiam 11y ago

What I don't get about Tor is that if your adversary can see all Internet packets, all the time, wouldn't it be trivial for them to find the real source and destination of a Tor packet using it's meta-data (size,timestamp,etc...)? For example, a packet of size X was sent from host 1 to host 2 and immediately after, a similarly sized packet was sent from host 2 to host 3, etc... I think of Tor more like a tool to avoid a specific server from finding who you are, and not the government.

Menge 11y ago
I didn't look specifically at Tor, but even early p2p anonymizer proposals had each node aggregate groups of standard size newly encapsulated chunks that were only sent out when there's enough to send similar bundles to all its next hops. This made simple observation at each hop pretty worthless, though I think someone has since proposed a statistical attack that could narrow the client down eventually if given a long enough connection with certain behaviors.
Kristine1975 11y ago
This is called a timing attack and no, Tor doesn't seem to protect you against it: http://tor.stackexchange.com/q/737 http://tor.stackexchange.com/q/737
teddyh 11y ago
You are assuming not only that an attacker can see all packets all the time, but also at all points in the network, which is unlikely in practice.
- pyvpx 11y ago
  if your attacker isn't apart of the Five Eyes, sure.
  - omginternets 11y ago
    I don't know that the Five Eyes have the kind of temporal resolution in their measures that would be needed to conduct these kinds of attacks. In fact, it's very likely that they don't.
    - privong 11y ago
      > I don't know that the Five Eyes have the kind of temporal resolution in their measures that would be needed to conduct these kinds of attacks. In fact, it's very likely that they don't. Why is it unlikely for them to have that kind of temporal resolution? I would assume the opposite. It seems like it would be trivial to save timing information along with packets. And the timing data must be relatively small compared to whatever data they're saving on the packets, so the added storage requirement is not really a concern.
      - omginternets 11y ago
        Because it's unlikely that they're saving every packet. I suspect they're down-sampling somewhere, given the sheer volume of data. This isn't to say they couldn't specifically target an endpoint for monitoring, however. Perhaps I was unclear about that.
        privong 11y ago
        One way around that limitation could be real-time analysis with some data buffering. In that way, the timing attack could be done and only those packets saved. I don't really have a feel for what kind of processing this would require, though. Presumably one would also need a low-latency link to the nodes of interest.
        FLUX-YOU 11y ago
        GCHQ were doing full takes of the internet for 3 days, Tor traffic is nothing compared to that [0]http://www.spiegel.de/media/media-34103.pdf http://www.spiegel.de/media/media-34103.pdf
hiq 11y ago
There is always a trade-off between usability / efficiency and security, and this trade-off has to take into account the attacker model. Tor is a low-latency network by design, so right from the start it gives up some security to be more usable instead. That probably still works against many attackers, including some state agencies, although not the most powerful. We should also keep the bigger picture in mind. Sure, if the NSA really wants to know everything about you, it's going to keep a record of your outgoing packets, and match it with packets from exit nodes to have all your metadata. But how much is it going to cost? How does it scale? I think we can assume that if everyone were to use Tor, mass surveillance would be at least far more costly. Each new user adds noise in the correlation measures. I can also argue that if you use Tor from your home or any location that is associated to you in any way, you're not really trying to avoid target surveillance by your government.
- imglorp 11y ago
  It's everyone's civic duty to contribute to the noise and to increase the expense to all state actors.
  - programmarchy 11y ago
    Is it also our civic duty to pay the taxes to these state actors? Asking because this tactic seems a bit like striking at the branches, rather than the root.
    - deleted 11y ago
      [deleted]
      - knodi123 11y ago
        He wasn't sent to prison for asking questions any more than drug dealers are sent to prison for "asking" whether the US has a rational policy for drug enforcement.
    - pdkl95 11y ago
      > rather than the root So run for office. I would certainly vote for someone who was against this crap. > It's everyone's civic duty to contribute to the noise That's a tactic. While it may be useful, a strategy that works to gain political influence is better in the long-run.
ionised 11y ago
As the Tor developers themselves say, Tor should be only one tool in your overall privacy/security toolbox. Relying on Tor alone to keep you anonymous, especially against nation state actors is probably not a great idea.
dandelion_lover 11y ago
One solution against such timing attack is to use i2p, which uses garlic routing instead of onion routing. As a downside i2p is less reliable.
- privacy101 11y ago
  Apparently i2p is better protected against this type of attack but it might not be perfect. "This sort of attack is powerful, but its applicability to I2P is non obvious" [1] "Without protocol scrubbing or higher latency, global active adversaries can gain substantial information. As such, people concerned with these attacks could increase the latency (using nontrivial delays or batching strategies), include protocol scrubbing, or other advanced tunnel routing techniques, but these are unimplemented in I2P." [1] [1] https://geti2p.net/en/docs/how/threat-model#timing https://geti2p.net/en/docs/how/threat-model#timing
omginternets 11y ago
My understanding is that Tor is designed to prevent you from being a suspect in the first place.
- sorokod 11y ago
  Such a systems might (your geography dependent) make you a suspect immediately
  - omginternets 11y ago
    Well that's sort of the point. Tor is special in that it helps avoid this problem, i.e.: given and endpoint, it's (for all intents and purposes) impossible to determine whence the traffic comes. At the same time, Tor can be used in such a way that nobody will know it's being used.
GTP 11y ago
Uhm, not so sure: usually packets have fixed size and through a tor node can pass lots of them from different sources. And if timestamp can be a problem a tor node could randomly delay them.
- sfilipov 11y ago
  And relay them out of order i.e. a Tor node receives a packet from A, then from B, then resends packet from B, then from A.

oneJob 11y ago

"Edward Snowden Explains How to Fix the Internet" Much love for Snowden. He is a personal hero of mine. I think he should be a personal hero of yours. I think we should have statues of the guy. Just as Snowden didn't want the story to be about him, to be a personality piece, when he released the trove of information which shook the privacy world to its core, I think he'd agree that any response to this new information should not be focused on or directed toward what he personally endorses by virtue of him as a 'personality'. Unfortunately, the conversation has largely focused on the technical/technology dimension, while the policy and political dimensions have not seen the same engagement by their respective members. In fact, Snowden has been used by political parties as a proxy piece in disagreements regarding East-West relations. And if technology is the answer, then the general public, almost by definition, does not have a place in the discussion.

bmelton 11y ago
> I think we should have statues of the guy. We sort of had at least one, but then the New York Parks Department covered it up, and later removed it altogether. There's a certain irony in the picture of it happening, wherein the state worker steps on the eagle statue to put a muzzle over the Snowden statue. http://brokelyn.com/wp-content/uploads/2015/04/ed-snowden-statue.jpg http://brokelyn.com/wp-content/uploads/2015/04/ed-snowden-st...

arm 11y ago

Wholeheartedly agree with this section: “Lee: Do you think people should use adblock software? Snowden: Yes. Everybody should be running adblock software, if only from a safety perspective … We’ve seen internet providers like Comcast, AT&T, or whoever it is, insert their own ads into your plaintext http connections. … As long as service providers are serving ads with active content that require the use of Javascript to display, that have some kind of active content like Flash embedded in it, anything that can be a vector for attack in your web browser — you should be actively trying to block these. Because if the service provider is not working to protect the sanctity of the relationship between reader and publisher, you have not just a right but a duty to take every effort to protect yourself in response.” Not even just ads being injected by ISPs, but even ads as they’re being used by the website owners themselves (in general) are a vector for malware, as has been shown time and time again¹. ―――――― ¹ — https://news.ycombinator.com/item?id=10517932 https://news.ycombinator.com/item?id=10517932

SimplyUseless 11y ago

Summary of key discussions: ========================== If you're just an average user concerned about your privacy 1) Use Tor when browsing.You don't have to use Tor all the time (it does slow things down considerably and some sites will also block Tor traffic). But if you are looking at or for something that you feel is sensitive, then either set up your browser to work with Tor or use the Tor browser. 2) Use an ad-blocker. Says Snowden: "As long as service providers are serving ads with active content that require the use of Javascript to display, that have some kind of active content like Flash embedded in it, anything that can be a vector for attack in your web browser – you should be actively trying to block these." 3) Use a password manager. It doesn't matter how many surveys and reports come out that tell people to use different passwords and complex passwords, a huge percentage of us maintain borderline idiotic approaches. The simple answer is: get a password manager. It will protect you. 4) Use two-factor authentication. Many services such as Gmail, Twitter, Dropbox, Hotmail, and Facebook offer this now for no charge. So even if your password does get exposed, you still have a backup such as a text message to your phone to secure your information. 5) Use apps that protect your information. Snowden suggests the smartphone app Signal, which encrypts both your phone calls and texts. It's free and easy to use. Although of course, following a high-profile argument with the FBI, it would appear that Apple's messaging service is also pretty secure (although Snowden would probably have doubts). 6) Use the HTTPS Everywhere browser plug-in. This comes from the Electronic Frontier Foundation (EFF) and will try to force all browser communication to be encrypted. 7) Encrypt your hard drive. This is comparatively easy these days but you have to be careful to do two things: one, have a longish phrase to make it worthwhile; and two, make damn sure you remember that phrase. There will be a slowdown in performance but nothing too bad if you have a modern machine. 8) Be smart with your security questions. Stop using your mother's maiden name for everything. Likewise your first school. The key is to mix things up as much as possible so if someone does get into one of your accounts, they can't use the same information to get in everywhere else.