5 ms·

I like to think that most people don't expect something like TOR to protect against a determined government. That doesn't make TOR useless, since I suspect that

I like to think that most people don't expect something like TOR to protect against a determined government. That doesn't make TOR useless, since I suspect that most people are not trying to be anonymous from intelligence agencies, only law enforcement agencies.

tptacek 10y ago
Hasn't Tor already demonstrably failed to protect people from US law enforcement? Tor is an important research project. But that's what it is.
- jimktrains2 10y ago
  Are you talking about the current FBI case? That was an exploit in the Tor Browser Bundle (could force the browser to make a request using the non-tor network), not in the Tor Network itself.
  - tptacek 10y ago
    No, I was referring to the FBI hidden service de-anonymization attack from last year.
    - deleted 10y ago
      [deleted]
    - belorn 10y ago
      You mean the Flash based NIT exploit, as part of Metasploit? Flash which is by default off in TBB and has really nothing to do with tor, is actively discouraged by the tor project, and is in strong decline world over? Or are the talking about the Carnegie Mellon attack that modifying Tor protocol headers? If so, is that fixed security bug enough to judge tor as failure and only usable for research? Even seatbelt, which has a fairly simple concept, had initial issues and are still being improved. On the topic of the Carnegie Mellon attack, the tor project both addressed the protocol header bug and changed their security practices. Strange activity in the tor network has in the past been deemed safe until proven harmful, but as a result of having an research university doing attacks on users of the network, that practice has been reversed and strange activity is now deemed harmful until proven safe.
- brians 10y ago
  Like most research projects that want to affect humans, eventually Tor moves to human trials. Proper trials require not just cypher punks, but actual people hiding from repressive governments. The Tor folks I've met have always been careful to say that Tor is not designed to work well against a global passive adversary, but it might be worth something against a local adversary.
- Aelinsaar 10y ago
  If you get the full attention of the FBI, you're screwed. A browser isn't going to change that.

tptacek 10y ago

Hasn't Tor already demonstrably failed to protect people from US law enforcement? Tor is an important research project. But that's what it is.

jimktrains2 10y ago
Are you talking about the current FBI case? That was an exploit in the Tor Browser Bundle (could force the browser to make a request using the non-tor network), not in the Tor Network itself.
- tptacek 10y ago
  No, I was referring to the FBI hidden service de-anonymization attack from last year.
  - deleted 10y ago
    [deleted]
  - belorn 10y ago
    You mean the Flash based NIT exploit, as part of Metasploit? Flash which is by default off in TBB and has really nothing to do with tor, is actively discouraged by the tor project, and is in strong decline world over? Or are the talking about the Carnegie Mellon attack that modifying Tor protocol headers? If so, is that fixed security bug enough to judge tor as failure and only usable for research? Even seatbelt, which has a fairly simple concept, had initial issues and are still being improved. On the topic of the Carnegie Mellon attack, the tor project both addressed the protocol header bug and changed their security practices. Strange activity in the tor network has in the past been deemed safe until proven harmful, but as a result of having an research university doing attacks on users of the network, that practice has been reversed and strange activity is now deemed harmful until proven safe.
brians 10y ago
Like most research projects that want to affect humans, eventually Tor moves to human trials. Proper trials require not just cypher punks, but actual people hiding from repressive governments. The Tor folks I've met have always been careful to say that Tor is not designed to work well against a global passive adversary, but it might be worth something against a local adversary.
Aelinsaar 10y ago
If you get the full attention of the FBI, you're screwed. A browser isn't going to change that.