5 ms·
Contrary to my usual opinion about the US Federal Government's "cyber-tactics," this actually seems like a good thing. I'd rather that fewer people understand
by rotrux 10y ago
Contrary to my usual opinion about the US Federal Government's "cyber-tactics," this actually seems like a good thing.
I'd rather that fewer people understand how to break tor, as opposed to more. There's a middle ground which may be better, but on the open-source/classified spectrum I'm a little right-leaning on this one. Thoughts?
- MaxfordAndSons 10y agoYea as a sibling indicated, the obvious better middle ground is the exploit just not existing any more. If the exploit were in the protocol itself then that might not have been viable, but the facts of the case suggest it's an implementation level exploit, in which case the FBI choosing to hoard it actually does increase the chance of more people (even outside of the American intel community) gaining access to the exploit.
- godgod 10y agoNot me. I'd rather have many people know how to break TOR so that it actually gets fixed. Having one entity with the knowledge of a vulnerability helps no one but themselves.
- SparkyMcUnicorn 10y agoIt should be patched. Am I wrong? The entire reasoning behind using tor is for anonymity, and we don't know what this exploit is exactly or how serious it is.
- rotrux 10y agoI remember reading an doctoral paper from MIT about it, and the general principal involved a combination of large swaths of man-in-the-middle tor nodes, combined with algorithms resembling physics formulas which use statistical mechanics to model fluid dynamics. If that's the case the exploit is intrinsically linked to the way tor works, and there may be no patching possible. I'ma need someone to fact-check me because I'm semi-busy right now and I don't have the article on-hand.
- schoen 10y agoThis is described as a Tor Browser exploit -- a vulnerability in the browser that people normally use with Tor -- rather than a vulnerability in the design of Tor or a way of performing traffic correlations. This vulnerability can probably be fixed permanently for all users with a tiny software patch.
- Miner49er 10y agoThe article indicated the vulnerability was in the Tor Browser, not Tor itself. A vulnerability in the Tor Browser can be patched, and it's likely present in Firefox as well.
- pizza 10y agoI'd very much like to read that paper, wow.
- ikeboy 10y agoThis was an exploit in Firefox, which may or may not have anything to do with Tor, but probably doesn't. Releasing it would almost certainly lead to it being fixed very soon.
- justinpombrio 10y ago> I'd rather that fewer people understand how to break tor, as opposed to more. Then you should be opposed to this! If the fbi shares the exploit, tor will patch it. As is, this vulnerability in tor puts its users at risk, both from the fbi and from anyone else who has found the exploit.
- simonbw 10y agoIf the FBI let people know what vulnerability is, the vulnerability could be fixed, which would result in fewer people understanding how to break tor. The FBI doesn't want the vulnerability to be fixed though, which is why they classified it.
- ashitlerferad 10y ago> I'd rather that fewer people understand how to break tor, as opposed to more. That is ridiculous. The more people who try to break Tor, succeed and tell the Tor Project how they did it, the safer Tor (and Firefox) become. The Tor Project relies on the security research community to find attacks on Tor so that they can be fixed. Same goes for all software in general.