3 ms·

> Isn't it obvious by now that Tor is outdated and instead of trying to repair it, something next-gen should be devised? No, it's not obvious. All evidence I

> Isn't it obvious by now that Tor is outdated and instead of trying to repair it, something next-gen should be devised? No, it's not obvious. All evidence I know of indicates that compromises of anonymity have occurred at the web application layer (XSS, SQL injections causing servers to give out information they don't intend to share), the browser level (using HTTP instead of HTTPS, not disabling JavaScript, TorBrowser not patching vulnerabilities found in Firefox), or the human level (users giving out data that allows other people to figure out who they are). None of these breaches of anonymity are problems that Tor attempts to solve: Tor is only one part of an infrastructure that allows anonymity. > I am aware IPFS has limitations and that there are valid P2P attacks to which it either couldn't resist well (reduced capacity) or it could straight out give away its users IP addresses I don't know whether these problems with IPFS are real (I know little about it) but if it could straight out give away its users' IP addresses, it's completely useless as an alternative to Tor, to the point that I'm unsure why you're proposing it. > but hey, in my opinion Tor has been mostly compromised by authorities around the world and is currently widely used to persecute people Is this opinion based in any evidence? > Doesn't that mean that Tor has outlived its usefulness? You mentioned before "authorities around the world". I would not be surprised if some more technically capable governments (USA, Israel, China) have compromised Tor, but I would be extraordinarily surprised if even mid-level "authorities" even in those same countries has those capabilities. An exploit widely usable by many authorities would eventually become public knowledge. The fact that such an exploit has not become public knowledge leads me to believe that at least a significant number of the people you refer to as "authorities" don't have the capability to de-anonymize Tor. So maybe I don't trust Tor to protect me from the NSA, but there are a good many people I do trust it to protect me from. Especially since, like you, my reasons for using Tor are largely ideological rather than practical--I just don't want to be tracked, and Tor significantly decreases the number of actors capable of tracking me.

pdimitar 10y ago
I appreciate your response. The fact that Tor, or any other service that attempts to anonymize its user base, is hiding behind the "we can't promise you full anonymity" legal safety net, isn't helping any of us who want to be anonymous anyway. I understand they have legal issues to deal with and must use evasive language so as to be not eliminated easily by anyone disagreeing with them. Still, it doesn't help us the users either. As I pointed out, IPFS indeed has limitations, but same as Tor, if it doesn't get wider adoption, it won't ever become better. Being a programmer, I believe I can properly time the moment we should stop trying to repair something that looks like it's already working against us, and just start over. As a human being, I recognize I might be wrong and I agree with your counterpoint. I have no evidence that Tor is compromised, but if we're to believe what we're told via the official news, what another conclusion would you draw? It's an honest question, not an attempt to shift the burden of proof. Objectively speaking, I have no evidence or proof. If I had any, I think there's a reasonable chance I would be in prison because the FBI doesn't like citizens knowing how do they penetrate their cyber targets. Again, I agree with you. I know many possible malicious actors don't have the tech and/or the talent to deanonymize Tor users. But IMO the whole point is to make every single malicious actor powerless. In that regard, it seems Tor is failing a lot in the last 1 year.
- kerkeslager 10y ago
  > I appreciate your response. The fact that Tor, or any other service that attempts to anonymize its user base, is hiding behind the "we can't promise you full anonymity" legal safety net, isn't helping any of us who want to be anonymous anyway. I understand they have legal issues to deal with and must use evasive language so as to be not eliminated easily by anyone disagreeing with them. Still, it doesn't help us the users either. "We can't promise you full anonymity" isn't a legal safety net, it's just the truth. There is not and will never be a system that can let me use the internet but prevent me from posting "My name is David Kerkeslager" on Hacker News. And while that may be a contrived example, note that if I signed into this hacker news account over Tor or sent my address in cleartext to a seller on the Silk Road, that would expose my name as well. And Tor can't prevent programs on your computer, such as your browser, from posting information about you, either, because those programs need all the capabilities that a user has. Tor anonymizes your IP address and that's pretty much all it does. To fully anonymize yourself on the internet, you need to use a browser that doesn't leak other information about you and to not give out information that can de-anonymize you. That doesn't mean Tor isn't useful; you need to anonymize your IP in order to be anonymous on the internet, and Tor is by far the most thoroughly-tested tool for doing that. > As I pointed out, IPFS indeed has limitations, but same as Tor, if it doesn't get wider adoption, it won't ever become better. Being a programmer, I believe I can properly time the moment we should stop trying to repair something that looks like it's already working against us, and just start over. As a human being, I recognize I might be wrong and I agree with your counterpoint. I looked up IPFS and I'm still confused by you proposing it as an alternative to Tor. I don't see anything in my brief look that indicates that IPFS is even trying to provide anonymity--they're solving different problems. There are alternatives to Tor, like I2P or Freenet. The problem with rewrites, especially rewrites by people who don't understand the previous program, is that they make all the same mistakes that the previous program made. With Tor, thousands of highly-qualified people have tested and sifted through the source code and fixed many (hopefully, all) of those mistakes. If we discard Tor and start writing something from scratch, that's what will happen. And while we might be able to fix those mistakes again, > I have no evidence that Tor is compromised, but if we're to believe what we're told via the official news, what another conclusion would you draw? It's an honest question, not an attempt to shift the burden of proof. Objectively speaking, I have no evidence or proof. If I had any, I think there's a reasonable chance I would be in prison because the FBI doesn't like citizens knowing how do they penetrate their cyber targets. I think it's wise to acknowledge that there's some chance actors with extraordinary capabilities can de-anonymize Tor. However, I don't think we can draw any definite conclusion. And as I said earlier, there are still plenty of actors who almost definitely can't compromise Tor. > Again, I agree with you. I know many possible malicious actors don't have the tech and/or the talent to deanonymize Tor users. But IMO the whole point is to make every single malicious actor powerless. In that regard, it seems Tor is failing a lot in the last 1 year. I don't agree that the goal is to make every single malicious actor powerless. That's an entirely unrealistic goal. I believe the goal of Tor is something like, "Allow people to connect to computers over the internet without exposing their IP address to the computers they're connecting to." And as far as achieving that goal, I think Tor has a very strong track record.

pdimitar 10y ago

I appreciate your response. The fact that Tor, or any other service that attempts to anonymize its user base, is hiding behind the "we can't promise you full anonymity" legal safety net, isn't helping any of us who want to be anonymous anyway. I understand they have legal issues to deal with and must use evasive language so as to be not eliminated easily by anyone disagreeing with them. Still, it doesn't help us the users either. As I pointed out, IPFS indeed has limitations, but same as Tor, if it doesn't get wider adoption, it won't ever become better. Being a programmer, I believe I can properly time the moment we should stop trying to repair something that looks like it's already working against us, and just start over. As a human being, I recognize I might be wrong and I agree with your counterpoint. I have no evidence that Tor is compromised, but if we're to believe what we're told via the official news, what another conclusion would you draw? It's an honest question, not an attempt to shift the burden of proof. Objectively speaking, I have no evidence or proof. If I had any, I think there's a reasonable chance I would be in prison because the FBI doesn't like citizens knowing how do they penetrate their cyber targets. Again, I agree with you. I know many possible malicious actors don't have the tech and/or the talent to deanonymize Tor users. But IMO the whole point is to make every single malicious actor powerless. In that regard, it seems Tor is failing a lot in the last 1 year.

kerkeslager 10y ago
> I appreciate your response. The fact that Tor, or any other service that attempts to anonymize its user base, is hiding behind the "we can't promise you full anonymity" legal safety net, isn't helping any of us who want to be anonymous anyway. I understand they have legal issues to deal with and must use evasive language so as to be not eliminated easily by anyone disagreeing with them. Still, it doesn't help us the users either. "We can't promise you full anonymity" isn't a legal safety net, it's just the truth. There is not and will never be a system that can let me use the internet but prevent me from posting "My name is David Kerkeslager" on Hacker News. And while that may be a contrived example, note that if I signed into this hacker news account over Tor or sent my address in cleartext to a seller on the Silk Road, that would expose my name as well. And Tor can't prevent programs on your computer, such as your browser, from posting information about you, either, because those programs need all the capabilities that a user has. Tor anonymizes your IP address and that's pretty much all it does. To fully anonymize yourself on the internet, you need to use a browser that doesn't leak other information about you and to not give out information that can de-anonymize you. That doesn't mean Tor isn't useful; you need to anonymize your IP in order to be anonymous on the internet, and Tor is by far the most thoroughly-tested tool for doing that. > As I pointed out, IPFS indeed has limitations, but same as Tor, if it doesn't get wider adoption, it won't ever become better. Being a programmer, I believe I can properly time the moment we should stop trying to repair something that looks like it's already working against us, and just start over. As a human being, I recognize I might be wrong and I agree with your counterpoint. I looked up IPFS and I'm still confused by you proposing it as an alternative to Tor. I don't see anything in my brief look that indicates that IPFS is even trying to provide anonymity--they're solving different problems. There are alternatives to Tor, like I2P or Freenet. The problem with rewrites, especially rewrites by people who don't understand the previous program, is that they make all the same mistakes that the previous program made. With Tor, thousands of highly-qualified people have tested and sifted through the source code and fixed many (hopefully, all) of those mistakes. If we discard Tor and start writing something from scratch, that's what will happen. And while we might be able to fix those mistakes again, > I have no evidence that Tor is compromised, but if we're to believe what we're told via the official news, what another conclusion would you draw? It's an honest question, not an attempt to shift the burden of proof. Objectively speaking, I have no evidence or proof. If I had any, I think there's a reasonable chance I would be in prison because the FBI doesn't like citizens knowing how do they penetrate their cyber targets. I think it's wise to acknowledge that there's some chance actors with extraordinary capabilities can de-anonymize Tor. However, I don't think we can draw any definite conclusion. And as I said earlier, there are still plenty of actors who almost definitely can't compromise Tor. > Again, I agree with you. I know many possible malicious actors don't have the tech and/or the talent to deanonymize Tor users. But IMO the whole point is to make every single malicious actor powerless. In that regard, it seems Tor is failing a lot in the last 1 year. I don't agree that the goal is to make every single malicious actor powerless. That's an entirely unrealistic goal. I believe the goal of Tor is something like, "Allow people to connect to computers over the internet without exposing their IP address to the computers they're connecting to." And as far as achieving that goal, I think Tor has a very strong track record.