4 ms·

Would it be fair to say that the Tor browser and Tails OS are being specifically targeted? It seems to me using these tools is enough in to provide a suspicion

by mouzogu 10y ago

Would it be fair to say that the Tor browser and Tails OS are being specifically targeted? It seems to me using these tools is enough in to provide a suspicion and thereby having the opposite effect than what they are intended for. So essentially, using Chrome on Windows, though perhaps less secure makes you less likely to be targeted than using Tor on Windows or on Tails.

pdkl95 10y ago
> using these tools is enough in to provide a suspicion Philip Zimmermann was talking[1] about encryption in general, but the same idea also applies to anonymity tools. What if everyone believed that law-abiding citizens should use postcards for their mail? If a nonconformist tried to assert his privacy by using an envelope for his mail, it would draw suspicion. Perhaps the authorities would open his mail to see what he's hiding. Fortunately, we don't live in that kind of world, because everyone protects most of their mail with envelopes. So no one draws suspicion by asserting their privacy with an envelope. There's safety in numbers. Analogously, it would be nice if everyone routinely used encryption for all their email, innocent or not, so that no one drew suspicion by asserting their email privacy with encryption. Think of it as a form of solidarity. If we use Tor only when we are doing something that needs to be anonymous, using Tor is suspicious. Instead, if Tor is used regularly, using Tor doesn't reveal anything. Security and privacy tools and technologies need to be used by default, if you want them to be available when in the (hopefully) rare situations where you do need them. [1] https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html
- mouzogu 10y ago
  Thanks. I hope encryption can be better integrated into mass market tools. For example the https://adnauseam.io/ https://adnauseam.io/ browser extension which can be added to Chrome and used to dilute all the data collected by making it contradictory and meaningless. I considered using Tor as my default browser but it felt like I was putting a big red target mark on myself even though I am not doing anything illegal. I would like encryption and obfuscation to be the status quo as mentioned in your quote - so it would be more of a passive protection and therefore less suspicious.
- nxzero 10y ago
  This logic is true, yet flawed in the sense that more traffic would make it more security against network analysis, but the issue is it would also make it a more attractive target due to the trust based on popularity and volume of users. Tor itself says that it is not secure against advanced attackers with the state-level resources. Do NOT use Tor if you're a state-level target unless it is on a system that's not sensitive and used for counter intelligence.
  - walrus01 10y ago
    If you're a state level target, expect physical things like bugging, hardware keystroke loggers, RATs installed in windows bootloaders on your laptop, and other physically intrusive "sneak and peek" measures taken on any electronics when you're not present.
    - syngrog66 10y ago
      also expect rubber hose cryptanalysis
- superuser2 10y ago
  Tor is just too slow to be the default, and asking thousands of people to treat it as the default will only make it worse.
wepple 10y ago
Absolutely. For starters, LEA are aware that if you're using tails/TBB there is an increased chance you're doing something they'd like to be aware of, over say a standard windows/chrome combination. Secondly, the tails/TBB setup has a very unfortunate side-effect: it gives LEA a specific target they can aim for in terms of hunting for vulnerabilities and writing exploits. The situation is made significantly worse by the fact that firefox hasn't yet fully implemented a sandbox - hence why FF is rarely seen in pwn2own style hacking challenges; it's just not a difficult target.
mtgx 10y ago
That's why Tor should be integrated into "private modes" of browsers, and why end-to-end encryption should be defacto in all messengers. We need to make it common.

by mouzogu 10y ago

pdkl95 10y ago

> using these tools is enough in to provide a suspicion Philip Zimmermann was talking[1] about encryption in general, but the same idea also applies to anonymity tools. What if everyone believed that law-abiding citizens should use postcards for their mail? If a nonconformist tried to assert his privacy by using an envelope for his mail, it would draw suspicion. Perhaps the authorities would open his mail to see what he's hiding. Fortunately, we don't live in that kind of world, because everyone protects most of their mail with envelopes. So no one draws suspicion by asserting their privacy with an envelope. There's safety in numbers. Analogously, it would be nice if everyone routinely used encryption for all their email, innocent or not, so that no one drew suspicion by asserting their email privacy with encryption. Think of it as a form of solidarity. If we use Tor only when we are doing something that needs to be anonymous, using Tor is suspicious. Instead, if Tor is used regularly, using Tor doesn't reveal anything. Security and privacy tools and technologies need to be used by default, if you want them to be available when in the (hopefully) rare situations where you do need them. [1] https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html

mouzogu 10y ago
Thanks. I hope encryption can be better integrated into mass market tools. For example the https://adnauseam.io/ https://adnauseam.io/ browser extension which can be added to Chrome and used to dilute all the data collected by making it contradictory and meaningless. I considered using Tor as my default browser but it felt like I was putting a big red target mark on myself even though I am not doing anything illegal. I would like encryption and obfuscation to be the status quo as mentioned in your quote - so it would be more of a passive protection and therefore less suspicious.
nxzero 10y ago
This logic is true, yet flawed in the sense that more traffic would make it more security against network analysis, but the issue is it would also make it a more attractive target due to the trust based on popularity and volume of users. Tor itself says that it is not secure against advanced attackers with the state-level resources. Do NOT use Tor if you're a state-level target unless it is on a system that's not sensitive and used for counter intelligence.
- walrus01 10y ago
  If you're a state level target, expect physical things like bugging, hardware keystroke loggers, RATs installed in windows bootloaders on your laptop, and other physically intrusive "sneak and peek" measures taken on any electronics when you're not present.
  - syngrog66 10y ago
    also expect rubber hose cryptanalysis
superuser2 10y ago
Tor is just too slow to be the default, and asking thousands of people to treat it as the default will only make it worse.

wepple 10y ago

Absolutely. For starters, LEA are aware that if you're using tails/TBB there is an increased chance you're doing something they'd like to be aware of, over say a standard windows/chrome combination. Secondly, the tails/TBB setup has a very unfortunate side-effect: it gives LEA a specific target they can aim for in terms of hunting for vulnerabilities and writing exploits. The situation is made significantly worse by the fact that firefox hasn't yet fully implemented a sandbox - hence why FF is rarely seen in pwn2own style hacking challenges; it's just not a difficult target.

mtgx 10y ago

That's why Tor should be integrated into "private modes" of browsers, and why end-to-end encryption should be defacto in all messengers. We need to make it common.