13 ms·
The Tor Project: Building the Next Generation of Onion Services
- Santosh83 10y agoHow can/does Tor propose to handle government level subversion (which must surely be happening and continue to happen with ever-increasing depth) where "sponsored" computers begin to form a majority of worldwide exit and relay nodes, with modified Tor running on them that looks actively for attacks, and leaks of information?
- openasocket 10y agoCurrent evidence suggests it's doing OK for now. The slides from the Snowden leaks showed the NSA was unable to compromise the core infrastructure by controlling relay and exit nodes, excepting a few cases. However, there are attacks a government-level entity can mount that Tor explicitly does not protect against, such as large scale passive scanning for traffic confirmation. It is not believed to be possible to beat such monitoring without compromising latency.
- deleted 10y ago[deleted]
- fredley 10y agoThat evidence is a few years old now, how far they've come in that time is a complete unknown.
- neerdowell 10y agoThis is a textbook example of FUD.
- venomsnake 10y agoSince NSA core mission is being ahead of everyone else, a claim that capabilities have increased a lot in the last few years is not FUD.
- dimino 10y agoWithout any specific evidence, it's still FUD.
- Trill-I-Am 10y agoIs there a certain time period after which we can say it's not FUD? Like if we go 10 years without any additional clarification after the Snowden slides, is it still automatically FUD?
- dimino 10y agoI'm confused -- are you asking when an unsubstantiated claim is not FUD?
- Trill-I-Am 10y agoNot all educated guesses and reasoned estimations are FUD
- dimino 10y agoNone are, actually.
- detaro 10y agoWhat would specific evidence for "we don't know how much progress they have made since the last time we had concrete data about them" look like?
- dimino 10y agoThe FUD is implying they've made significant progress. You're right, "we don't know" isn't really a falsifiable statement, in this context.
- alsetmusic 10y agoNo claim of present NSA ability was stated. Noting the age of the data in question is a fact. Stating that an absence of new data creates a state of unknowing is a fact.
- RaleyField 10y agoAnd you just provided a textbook example of how the term FUD is usually applied.
- digler999 10y agoFear of an oppressive government hacking the connection and arrest you. Uncertainty of agencies' capabilities given that they operate under top-secret levels with unlimited budgets. Doubt that they would stop working on or advancing the state of the art at defeating the security.
- placeybordeaux 10y agoIt seems a little unreasonable how much you are being downvoted, the parent comment uses uncertainty to cast doubt on the idea that TOR is safe from the NSA. That can easily invoke fear. Unfortunately that is largely what we have to go off with the NSA.
- zatkin 10y agoMaybe the NSA was unable to compromise the core infrastructure, but the FBI was able to compromise enough to hack into a web forum and log the location data for its users, followed by subsequently impersonating the administration of said forum for two weeks or so, then arresting nearly 1,000 individuals.
- duozerk 10y agoThey did that by attacking the forum software/the server itself, not tor and the underlying transport layer in general. It's another layer entirely and does not give information about their capabilities in attacking tor itself (except maybe through the fact that if they had to do that, then yeah, tor is probably still relatively secure if used properly).
- y4mi 10y agocan TOR be considered to be on the transport layer though? i thought it worked with TCP, so it would need to be at least OSI level 5 iirc?
- lrem 10y agoOSI level is cute, especially once you start to interpret ip over https ;)
- duozerk 10y ago> so it would need to be at least OSI level 5 iirc You're right; actually tor reside in the application layer I think (above TLS). Although conceptually speaking it is itself a transport layer I guess.
- brobinson 10y agoTor is a layer 4 overlay network. Layer 5 would be HTTP, layer 6 would be the content (JPEG, MP4, etc.), and layer 7 would be the application serving or sending the HTTP requests/content.
- zmanian 10y agoThe combination of watering hole attacks and internet scale packet timing collection is pretty big problem for the security of Tor users. Fortunately Internet wide timing attacks are mostly a Five Eyes and domestic Chinese capability. Chaff, padding etc can help here. Compromising the servers of target services and using that a platform to distribute anonymity stripping malware is also a problem. The Firefox codebase that TBB is based isn't awesome from a security point of view. Hopefully the Firefox code base can catch up from a security perspective and give them something better to work with.
- vox_mollis 10y agoTiming correlation attacks would be much more difficult if Tor users were more willing to tolerate higher latency. But they're not. Everyone wants their cake and eat it too.
- alchemical 10y agoInternet scale packet timing collection only works when the traffic is not messed with when routing through TOR. It's quite a headache when {proxy}.appspot.com is used, or technical documents are exclusively routed through GoogleCache, or even CoralCDN for that matter. There's even users who configure BitTorrent to use TCP instead of UDP so that it's very difficult to write DPI rules to parse out the TOR traffic. Couple this with meek, VPNs and traffic shaping tools and it's quite bothersome for them.
- MoD411 10y agoI wonder if seif project's ideas could be helpful here: https://github.com/paypal/seifnode https://github.com/paypal/seifnode. I remember Crockford talking about using microphone and camera noise to generate random numbers.
- ikeboy 10y agoIf they're going to use random numbers to enhance security, they should make sure that at worst, if the numbers are predictable and controlled by an attacker, it's no worse than the current security. Does anyone know if their protocol does that?
- DSingularity 10y agoInteresting. Can you give an example of how a security enhancing protocol can be end up degrading security?
- nxzero 10y ago>> "RSA BSAFE is a FIPS 140-2 validated cryptography library offered by RSA Security. From 2004 to 2013 the default random number generator in the library contained an alleged kleptographic backdoor from the American National Security Agency (NSA), as part of its secret Bullrun program." https://en.m.wikipedia.org/wiki/RSA_BSAFE https://en.m.wikipedia.org/wiki/RSA_BSAFE
- JupiterMoon 10y agoA VPN or ssh accessed with a weak password.
- nxzero 10y agoGiven to my knowledge they still have no way to insure the exit nodes are not control by a single majority, no idea why this would be any different.
- feklar 10y agoTor's design document also warns a nation state level adversary who can view the whole network defeats any guarantees of anonymity. There's no way to know GCHQ/NSA aren't running 90%+ of bridges and exit relays either in addition to having a total network overview at the backbone level. Tor was designed for strong anonymity guarantees in nations that aren't 5 Eyes Alliance ie: China, Russia, ect.
- imaginenore 10y agoI don't understand why these TOR guys can't rent like 10-20 cheap VPSs all around the world and do their testing there. They are describing getting 11 nodes like some sort of struggle. VPSs are truly cheap now, you can get one for $3.52 per year: https://lowendbox.com/blog/i-83-100mbps-unmetered-openvz-nat-vps-starting-at-2-50year-resource-pools-in-usa-eu-and-asia/ https://lowendbox.com/blog/i-83-100mbps-unmetered-openvz-nat...
- Vendan 10y agoDidn't read that way to me. Read like they normally use VMs on their computer to have a "testing tor net", but decided to set up actual distributed nodes for testing this. More like, "Hey look, this is nifty", rather then "Ugh, it was so hard to set this up"
- nxzero 10y agoWhere would the funds to run the servers come from? Why do you believe these "cheap" servers would be secure?
- imaginenore 10y agoFunds? That's $35 for 10 nodes per year. I'm pretty sure a team of developers can handle that. And who cares if they are insecure? It's for testing only. The code is open source anyway.
- 1024core 10y agoWhere can you get a VPS for $3.50/year? Please tell us.
- imaginenore 10y agoRead the root comment in this chain.
- jimktrains2 10y agoCan you show me where I can get a $3.50 per year VPS.
- zmanian 10y agoI'm very excited about a number of innovations being deployed in next gen onion servers. The distributed random number generator is very cool. The blinded ed25519 public keys for the rendezvous servers are also super awesome. Funding tor not only protects people from surveillance but advances computer science.
- deleted 10y ago[deleted]
- sportytexas 10y agowow
- aakilfernandes 10y agoMy understanding of distributed commit/reveal RNGs is they need some sort of incentive mechanism. Otherwise, its trivial for an attacker to flood the network with lots of commits and only reveal the ones that give him a useful outcome. https://github.com/randao/randao https://github.com/randao/randao
- cyphar 10y agoAs far as I understand, the distributed randomness will only be distributed on the 11 trusted directory servers (where you get your node manifest from). So you don't need to worry about malicious nodes killing the randomness.
- deleted 10y ago[deleted]
- hotpockets 10y agoI can't access the website because it's using HSTS and my browser says their certificate is invalid. There is no option to bypass the browser security warning. I'm at a public library. Anyone know what's going on?
- Torgo 10y agoMaybe your clock is wrong, maybe they're man in the middling the connection for network surveillance reasons.
- thejosh 10y agoLooks fine here, maybe try archive.is?
- Buge 10y agoIt works for me. The cert is issued by DigiCert Inc and the sha1 fingerprint is DE:20:3D:46:FD:C3:68:EB:BA:40:56:39:F5:FA:FD:F5:4E:3A:1F:83
- dimino 10y agoI have a completely different cert, issued by Cisco Umbrella Secondary SubCA ash-SG: sha1 - 3B:AE:49:04:9E:6A:3D:BE:96:08:60:F0:9B:6B:2F:03:4F:E9:8C:43
- Buge 10y agoCisco Umbrella seems to be some type of security product for networks. Are you using a computer belonging to your employer or with employer software installed? They could be MITMing you. It seems odd that the Tor project would be using a Cisco product like that. What about the cert for Hacker News, or my website https://throwpass.com https://throwpass.com ?
- dimino 10y agoOther certs validate, it might be site-specific from my employer (I'm on my employer's network)?
- bunkydoo 10y agoI still really don't understand why people keep developing Tor over I2P - I2P is clearly the better protocol offering complete untraceable anonymity and a chance to secceed from the stigma of Tor...
- cyphar 10y agoI've heard that I2P tends to add experimental features that don't have any rigorous analysis of the privacy impact. So there's that.
- praptak 10y agoAnything that replaces Tor will get the stigma of Tor.
- arca_vorago 10y agoI think tor has more marketing and mindshare than I2P, and thats why you see tor more than it. I would like to see a more in depth comparison of the two, do you know of a good one?
- MajesticHobo 10y ago> offering complete untraceable anonymity Your argument falls apart the moment you claim this.
- zmanian 10y agoTor is a solution for both anonynmity & privacy and censorship evasion. I2P is oriented primarily towards anonymity and privacy. I2P has an attractive anonymous service design and can run applications like Bittorrent over it. But it also developed basically by 3 people in New Zealand. Tor has more funding b/c of censorship evasion features being attractive to funders. Successes in the anonynmity feature set like SecureDrop. A vibrant academic community with conferences etc. Lots and lots of review from the external crypto and security community. A deep well of technical talent.
- yurt3 10y agoHow does I2P defend against traffic analysis attacks?
- jontas 10y agoI was curious to see if it is possible to donate funds towards the operation of "safe" (eg, non government controlled) exit/bridge nodes. According to the donation faq for the tor project[1], it appears that funds are not used for infrastructure. If there were a way to fund exit nodes without running one myself I would definitely be interested in participating. If not, this might be a great idea for a crowdfunding campaign. [1] The Tor Project spends about $2.5 million annually. About 80% of the Tor Project's spending goes on staffing, mostly software engineers. About 10% goes towards administrative costs such as accounting and legal costs and bank fees. The remaining 10% is spent on travel, meetings and conferences, which are important for Tor because the Tor community is global. https://www.torproject.org/donate/donor-faq.html.en https://www.torproject.org/donate/donor-faq.html.en
- garrettr_ 10y agoIf you want to donate towards the operation of "safe" exit/bridge nodes, consider donating to NoiseTor: http://noisetor.net/ http://noisetor.net/.
- garrettgrimsley 10y agoIn addition to NoiseTor that @garrettr_ mentioned there is torservers.net [0]. Both are mentioned [1] as ways to support infrastructure by the Tor Project. [0] https://www.torservers.net/donate.html https://www.torservers.net/donate.html [1] https://blog.torproject.org/blog/support-tor-network-donate-exit-node-providers https://blog.torproject.org/blog/support-tor-network-donate-...
- ivarv 10y agoYou can support Riseup who run exit node(s). https://help.riseup.net/en/donate https://help.riseup.net/en/donate
- sandworm101 10y agoI think the Tor project would agree with me in saying that donations are all well and good, but the best way to contribute is to operate a high-capacity node.
- gravypod 10y agoWhat I think really needs to happen is for the Tor group to make setting up hidden services much simpler. Maybe I'm just stupid, but there didn't seem like an easy "type a command and we will set this all up for you" kind of way to do it. Getting it setup, getting it to run as a daemon, and getting the service to work on multiple ports (allowing you to serve :80 and :22 for web and ssh). It seemed like a nightmare to me. It's sad because I'm very interested in hosting a tor relay/service to make sure I can get to my important documents, even if I need to travel to another country that blocks services like dropbox and google docs.
- petertodd 10y agoThe Tor control port protocol let's applications setup a hidden service automatically; Bitcoin Core recently released support for this, automatically using hidden services for incoming connection to your Bitcoin Core nodes.
- gravypod 10y agoThat may work with a UI, but I'm running this on a server without X, without anything and I'd like to be able to manage it like I do ufw.
- wfn 10y agoYou may like https://stem.torproject.org/tutorials/over_the_river.html https://stem.torproject.org/tutorials/over_the_river.html , then! The sample code there can create permanent or ephemeral/short-lived hidden services. It uses the `stem` library (now named `nyx`, iirc).
- nullc 10y agoHm? Did you respond to the wrong comment? The functionality Peter Todd is talking about is totally transparent and involves no user interaction.
- gravypod 10y ago
- peterwwillis 10y agoDisclaimer: My knowledge of the Tor architecture is very rudimentary It would be nice to see some new tcp/ip protocols that handle point-to-point and cross-network communication more flexibly. Take a p2p router (let's say Gnutella2), but pared down to only do addressing and routing of traffic. Then another proto on top to do handle name resolution, secrets and tunnels. Then maybe tcp on top of that just to make tunneling arbitrary applications easy. Everything written with IPv6/ICMPv6 in mind as the parent protocol to be more future-proof. In this way, we can have both a reusable framework for p2p networks (the first layer) and a repurposeable protocol for doing name, auth and secret management/tunneling. I believe the second thing is already handled by tor, but I don't know if separating the secrecy from the routing exists currently. Those different layers could be reused for different purposes, while also being written with a "new Tor" use-case in mind.
- Pica_soO 10y agoRunning a Tor Node- should be a form of payment. A user having no talent, requesting help from a open source community, could "donate" his bandwith and machine in return. And this form of contract should come with ease of use.
- abricot 10y agoBandwidth and machine time is not the biggest hindrance for running a tor relay or exit node. The muddy legality in most countries is.