4 ms·

If you wonder why Tor authors even feel they have to state that they are "clean" here is one article from 2014: http://www.whoishostingthis.com/blog/2014/11/17

by acqq 11y ago

If you wonder why Tor authors even feel they have to state that they are "clean" here is one article from 2014: http://www.whoishostingthis.com/blog/2014/11/17/who-funded-tor/ http://www.whoishostingthis.com/blog/2014/11/17/who-funded-t...

dewey 11y ago
Why is this always being brought up? It's transparently communicated on the Tor website and they have a bunch of blog posts explaining how things are and that they'd obviously prefer for it to not be that way.
- acqq 11y ago
  > Why is this always being brought up? Always? There are very good reasons why now: Because who doesn't know the context would not understand why Tor people attempt to assure the community "everything's all right" now or even "always was"? Also worth noting the names that appear there, like "SRI International," "International Broadcasting Bureau" (your tax money at work?) or even "Omidyar Network." It is very insightful to see so many players there and investigate their background too. Also worth noting, one of those involved in Tor development who also had access to some NSA files, Jacob Appelbaum, also wrote about what was being logged about the users of privacy tools, Tor included: http://daserste.ndr.de/panorama/aktuell/nsa230_page-1.html http://daserste.ndr.de/panorama/aktuell/nsa230_page-1.html "Among the NSA's targets is the Tor network funded primarily by the US government to aid democracy advocates in authoritarian states."
lazyjones 11y ago
This is widely known. What I find more suspicious is the fact that Tor still partly uses obsolete crypto (RSA-1024) that may specifically be open to attacks from governments. This was discussed in 2013 and apparently not fixed ("no time"...). Normally, such a situation would have devs hurrying to fix the issue immediately, as it makes the whole project potentially useless for a particularly important use case (evasion of government censorship/repression).
- acqq 11y ago
  It does matter where RSA-1024 is being actually used in Tor. As far as I understand, as long as it's not for some long-term keys, it still shouldn't be a problem. Please write if you know more on this subject.
  - lazyjones 11y ago
    I'm not an expert on Tor code, so I can only speculate and agree partly with you: it matters where it is used. But temporary keys do not necessarily help against an attacker who has access to all/most past Tor traffic. RSA-1024 is used in node identification and hidden services, the weaknesses are known: https://blog.torproject.org/blog/prism-vs-tor https://blog.torproject.org/blog/prism-vs-tor https://blog.torproject.org/blog/hidden-services-need-some-love https://blog.torproject.org/blog/hidden-services-need-some-l... (note: current state of affairs unknown to me since Tor doesn't seem to update these documents)

by acqq 11y ago

dewey 11y ago

Why is this always being brought up? It's transparently communicated on the Tor website and they have a bunch of blog posts explaining how things are and that they'd obviously prefer for it to not be that way.

acqq 11y ago
> Why is this always being brought up? Always? There are very good reasons why now: Because who doesn't know the context would not understand why Tor people attempt to assure the community "everything's all right" now or even "always was"? Also worth noting the names that appear there, like "SRI International," "International Broadcasting Bureau" (your tax money at work?) or even "Omidyar Network." It is very insightful to see so many players there and investigate their background too. Also worth noting, one of those involved in Tor development who also had access to some NSA files, Jacob Appelbaum, also wrote about what was being logged about the users of privacy tools, Tor included: http://daserste.ndr.de/panorama/aktuell/nsa230_page-1.html http://daserste.ndr.de/panorama/aktuell/nsa230_page-1.html "Among the NSA's targets is the Tor network funded primarily by the US government to aid democracy advocates in authoritarian states."

lazyjones 11y ago

This is widely known. What I find more suspicious is the fact that Tor still partly uses obsolete crypto (RSA-1024) that may specifically be open to attacks from governments. This was discussed in 2013 and apparently not fixed ("no time"...). Normally, such a situation would have devs hurrying to fix the issue immediately, as it makes the whole project potentially useless for a particularly important use case (evasion of government censorship/repression).

acqq 11y ago
It does matter where RSA-1024 is being actually used in Tor. As far as I understand, as long as it's not for some long-term keys, it still shouldn't be a problem. Please write if you know more on this subject.
- lazyjones 11y ago
  I'm not an expert on Tor code, so I can only speculate and agree partly with you: it matters where it is used. But temporary keys do not necessarily help against an attacker who has access to all/most past Tor traffic. RSA-1024 is used in node identification and hidden services, the weaknesses are known: https://blog.torproject.org/blog/prism-vs-tor https://blog.torproject.org/blog/prism-vs-tor https://blog.torproject.org/blog/hidden-services-need-some-love https://blog.torproject.org/blog/hidden-services-need-some-l... (note: current state of affairs unknown to me since Tor doesn't seem to update these documents)