27 ms·

Tor’s Branding Pivot Is Going to Get Someone Killed

235 points by tshtf 10y ago

Freak_NL 10y ago
From the article: > You propose running a Tor node or using Tor internally. Before, this was just something you could do. After Tor’s pivot, you now have to justify why the company should explicitly associate itself with banned HR activism and draw the government’s ire. Using Tor is now an additional mild liability for all of its non-HR users. Using Tor already marks you as suspicious depending on who's looking, regardless of why you use it. The ideals or mission statement of the Tor project don't change this. Tor suffers from the same impediment as the Bittorrent protocol; it is used a lot for illegal purposes, so a stigma of illegality surrounds the tool itself. By focusing on the legitimate use of Tor (e.g., as a human rights facilitating tool) the Tor project might actually improve adoption rather than frustrate it.
- JumpCrisscross 10y ago
  > Using Tor already marks you as suspicious depending on who's looking, regardless of why you use it Is this based on experience or assumption? I've had minor issues with Tor and VPNs abroad, when questioned about them. Brushing them off as a "security tool" usually worked. A "human rights" tool, on the other hand, makes Tor dangerous to be caught using in many parts of East Asia. I find most Westerners (myself included until recently) don't understand the cultural and political sensitivity around the term in certain countries. OP's analogy to the Western treatment of anything rhyming with drugs is spot on.
- subway 10y ago
  Sure, Tor traffic has always been suspicious, but that suspicious traffic has traditionally been without an attached political label. By branding Tor as a tool specifically for HR campaigns, you risk drawing additional ire from regimes considered to have a poor HR record.
  - Freak_NL 10y ago
    Wouldn't a regime with a poor human rights track record consider any use of technology which hides who you are communicating with as warranting further investigation regardless of the ideals behind it? I don't think they are that naive.
    - ryanlol 10y ago
      Have you ever been to China? There's a plenty of people who work there and have to use various proxies to do so, is the Chinese government cracking down on them? Nah, they'll just mess with those connections a little to keep up appearances. But hey, if you decide to use a proxy that screams "I'M A POLITICAL DISSIDENT" with every packet you send they might just get interested. It's really not as naive as you think.
      - romanpoet 10y ago
        > But hey, if you decide to use a proxy that screams "I'M A POLITICAL DISSIDENT" with every packet you send they might just get interested. Hit the nail on the head my good sir.
  - lern_too_spel 10y ago
    That was the author's argument, that Singapore is against the Western view of human rights, so running human rights software would be seen as subversive by the government. He then undermines his argument to instead promote the privacy aspect of Tor by saying that the Singaporean government is fanatically anti-corruption. Privacy hides corruption, so promoting that aspect of the tool doesn't make sense either.
    - romanpoet 10y ago
      Author here. In short, Singapore authorities view Privacy as a double-edged sword. They recognize it's power for anti-corruption (which they love), but dislike the human-rights angle and possibility for breaking the law. Realistically they'll do a balancing act. As long as one can convincing argue that weight of the things they like about Tor exceed the weight of the things they dislike about Tor, you're good. Tor's pivot to emphasize human rights makes that comparison much harder to win.
- rhizome 10y ago
  Using Tor already marks you as suspicious depending on who's looking, regardless of why you use it. This is a curious construction, one that I can't pin down to any kind of secondary-language issues. "Using Tor" is not the subject of that sentence, "who's looking" is. So, some people see Tor as suspicious. Who are those people, and why is it a problem? Law enforcement...anybody else? What does it mean for Tor traffic to be demeaned by law enforcement (or $chosen_group) as by-default suspicious, and is this a good use of their time and resources? Is it a good way to solve crimes? History tells us that law enforcement, and by extension the government, will use bigotry to effect prosecutorial goals at least as readily as they will shoe-leather investigation. Defining Tor as suspicious-with-exceptions operates in the same sphere as asset forfeitture: prove you ain't. Point being, I think it's important to be clear what is happening with Tor as a character in the wider world of politics and policy, and "using Tor" is something that I don't think needs to be justified. Passive voice also elides these serious issues by pinning results on nebulous activity.
  - firethief 10y ago
    > "Using Tor" is not the subject of that sentence, "who's looking" is. "Using [Tor]" actually is the subject of that sentence. "Who's looking" is not the subject even of the dependent clause in which it occurs; "depending on" is introducing an adverbial clause, in which "who" is the subject, "is" is the verb, and "looking" is the predicate. > Passive voice also elides these serious issues by pinning results on nebulous activity. The passive voice is not used in the sentence quoted. I recommend preferring rhetorical techniques other than grammatical analysis; even for someone with a solid understanding of a language's grammar, picking apart the way something is said tends not to advance the discussion as well as repling to content would, however dubiously it may be expressed.
  - Sniffnoy 10y ago
    > This is a curious construction, one that I can't pin down to any kind of secondary-language issues. "Using Tor" is not the subject of that sentence, "who's looking" is. > Passive voice also elides these serious issues by pinning results on nebulous activity. No, no, no. Firethief has already largely covered this, but: "Subject" and "passive voice" are grammatical terms. They have to do with the syntax of a sentence. Not with who performed an action, or whether that agency was clearly expressed in the sentence. There is nothing necessarily agency-hiding about the passive voice; conversely, one can hide agency quite well without using it. Basically, go read some Language Log, they talk about this all the time. Hell, they've got a whole category for people complaining about the passive voice while not actually being able to identify when a sentence uses it: http://languagelog.ldc.upenn.edu/nll/?cat=54 http://languagelog.ldc.upenn.edu/nll/?cat=54 (Edit: One particular post on the subject I should point out, I think -- http://languagelog.ldc.upenn.edu/nll/?p=1227 http://languagelog.ldc.upenn.edu/nll/?p=1227 ) Or here's a whole paper by Geoff Pullum on the subject, with more examples than you can shake a stick at in section 3: http://www.lel.ed.ac.uk/~gpullum/passive_loathing.pdf http://www.lel.ed.ac.uk/~gpullum/passive_loathing.pdf
- 1ris 10y ago
  In the west tor was (or is) seen as a tool access child pornography. I had to explain multiple times why i would support such a evil thing. This is a very high social cost in the west, and you can't pose with a tor t-shirt (like the dude in the photo) if that the narrative. You will be expelled from your students union instead of celebrated for supporting it. So, a typical westener tor-supporter does not want this image. But the typical westener is no the person that needs tor mosts. Such a label in east asia would probably help. If the Singaporean police would assume that all tor users a looking for child porn (or just porn, that's illegal there) uses would fall in the vast bin various criminals. But not a political opponents, that are targeted with much more energy. The social cost of consuming (child) porn might be lower than being a dissident. And the prosecution might be less serve.
  - csydas 10y ago
    > This is a very high social cost in the west, and you can't pose with a tor t-shirt (like the dude in the photo) if that the narrative. You will be expelled from your students union instead of celebrated for supporting it. So, a typical westener tor-supporter does not want this image. I suggest this is overstated, at least as far as Tor is concerned. While there are occasionally news reports about various crimes that utilized Tor as part of the process, more often the generic term "encryption" or "anonymizing software" is used in news reports. I think the general reaction to anyone wearing a Tor T-shirt would be indifference, save maybe one or two curious talkative parties. I will admit this is anecdotal, but overwhelmingly when Tor has been brought up in the past in my workplace or during discussions, overwhelmingly the response has either been "what's Tor" or "oh Tor. I've heard of that. What is that exactly?". The idea of "expelled from student union" for being a Tor Supporter is completely outside of my understanding of what people in the US even know about Tor. Even so much as having a casual two-way conversation with a non-tech person about Tor seems like a foreign concept. Tor might catch headlines once in awhile, but when it comes to things like online privacy and anonymity, I don't think this is what the lay person thinks of. I mean, just page through news.google a bit searching for "Tor". The news outlets covering it are pretty much tech-oriented; going just a few pages deep, only politico really mentioned Tor, and that was literally only to say it was used by the hackers during the Clinton email breach, calling it an anonymity tool. I just don't think there's enough evidence to really say that the general public or even law enforcement really knows what Tor is, much less form an aggressive opinion towards supporters.
shiven 10y ago
Anyone trusting Tor for anything anymore is asking for trouble. Their new branding and associated bravado is just weak-sauce attempts at projecting technical soundness in the face of getting their tech butt-torn by the CMU hack. You can google the details of the hack yourself. Anyone, with even an iota of self-preservation in them, is best served staying away from this identity-leaking crapware. There is no gentle way of putting it. Tor is fundamentally and practically compromisable, do not trust it for guarding your anonymity against a determined adversary. No. I don't have any suggestions for alternatives either.
sschueller 10y ago
I keep saying this but we need a working implementation of riffle sooner than later. From what I understand it solves some of the shortcomings of tor. http://news.mit.edu/2016/stay-anonymous-online-0711 http://news.mit.edu/2016/stay-anonymous-online-0711
zmanian 10y ago
Virgil seems to be willfully ignorant. Tor needs greater political support in the West because of second crypto wars. Tor also needs more funding that is available for work on privacy and anonymity to support use cases like Securedrop. Too much of Tor's current funding is tied to censorship resistance applications of Tor.
- Sniffnoy 10y ago
  People can be wrong without being willfully ignorant. There's no reason to assume bad faith. You could make a perfectly good argument along the lines of what you say without that accusation. Why add it in? (Note that you haven't actually fully made that argument. We have multiple competing concerns here (as we always do[0]). Virgil has made an argument based on one; you are trying to make an argument based on another. The question then is, which one outweighs the other? Since neither of you are actually responding to the other's arguments, merely expressing different concerns, it is impossible to tell from your arguments alone. (To put it another way, in pg's "Hierarchy of Disagreement"[1], you're purely counterarguing with no attempt at refutation.) Calling Virgil "willfully ignorant" makes it sound like his argument carries no weight or has already been refuted, but this is not the case.) [0] http://lesswrong.com/lw/gz/policy_debates_should_not_appear_onesided/ http://lesswrong.com/lw/gz/policy_debates_should_not_appear_... [1] http://paulgraham.com/disagree.html http://paulgraham.com/disagree.html
- romanpoet 10y ago
  Okay, if Tor decides they'd pare back of the rest of the world to "focus at home", that would be a perfectly fine thing, logically consistent thing to do However, this argument doesn't generate any virtue points. My sole claims about Tor are (1) they've pivoted and (2) their short-sightedness. They want to be rah-rah human-rights, but their angle of pursuit of human-rights is, ironically, notably counter-productive.
ryanlol 10y ago
https://lists.torproject.org/pipermail/tor-project/2016-July/000582.html https://lists.torproject.org/pipermail/tor-project/2016-July... This attitude from someone representing the Tor project is, to put it mildly, terrifying. But I guess fundraising matters more than lives of actual real human beings.[1] [1] I'm inclined to believe the author slightly exaggerates the risk, but the reply completely neglects to address that issue. Trying to shift blame on local governments is hardly an option when those are the ones you're trying to defy.
cclements 10y ago
There may be good arguments why not to use Tor, but this doesn't seem to be one of them.
- criddell 10y ago
  I'd never thought of it in the terms that the article author presents, but I think he has a point. If you are a reporter, you have a very good reason to use Tor. When searched at a border or by some police force, having tools made for privacy and security is going to be expected. Having tools for human rights activists is going to cause trouble.
ajamesm 10y ago
> Imagine Tor published a policy document stating: “The Tor Project proudly advances drug-use by creating and deploying usable anonymity and privacy technologies so people around the world can circumvent local drug laws.” "Imagine"? If you think this is hypothetical, bub, I have some bad news for you about the current perception of Tor. When I think "Tor user" I think of illicit pornography, black market drugs, and human rights activists. Those are pretty much your options. What nation is okay with the first two, but not the third? "Oh shit, we knew he was moving $2m USD in heroin, but we had no idea he was documenting human rights abuses! Apprehend him!" Please.
- timmytokyo 10y ago
  That may indeed be the public perception of Tor, but the project never publicly aligned itself with the distribution of child porn or illicit drugs. The author's point is that the explicit public alignment with Western notions of human rights is likely to harm the Tor project in countries where "human rights" are perceived as Western imperialism. The extent to which Tor's adoption of the human rights marquee might make a difference in the way these countries treat Tor is unclear, but it is at least a valid concern. Frankly, there are a lot of better reasons -- mostly technical -- to doubt the efficacy and long-term future of Tor. But the recent politicization and drama certainly doesn't help it.
  - mikeash 10y ago
    Those countries aren't stupid. Surely they already know of Tor's applications here. Certainly China puts significant effort into blocking it, for one example I'm familiar with.
    - timmytokyo 10y ago
      I agree with you. But I was surprised that the author was able to run a Tor relay in Singapore without significant interference. That tells me that at least one authoritarian country was willing to turn a blind eye on Tor and some of its shadier uses. Will the new greater emphasis on human rights cause Singapore's authorities to give it greater scrutiny? Maybe, maybe not. But it certainly won't help.
nxzero 10y ago
Quick review of weaknesses listed on the Wikipedia page for Tor make it pretty obvious that Tor is a threat to majority of users that if discovered be face serious, if not life threatening, responses. Why do people continue to use it? https://en.wikipedia.org/wiki/Tor_(anonymity_network) https://en.wikipedia.org/wiki/Tor_(anonymity_network)
- Karunamon 10y ago
  Most of those weaknesses are well known and easy to deal with. In particular: * Use a separate system for Tor traffic, never use that system for anything else * Don't use BitTorrent (which you shouldn't be doing anyways - the network wasn't built for it!) * Don't touch non-TLS sites, the exit node could be hostile * Javascript off
- htns 10y ago
  It's common for people to have too much trust in technical solutions, even when the solution includes stark warnings on its download page. It's even worse with VPNs and 'secure' email providers. Tor can still be useful as a building block of the next thing, but people should start demanding something better than Tor.
  - zipwitch 10y ago
    How terrifying would status quo power holders find a free, universally available and readily usable software tool that provided real and uncrackable anonymity for anyone?
aw3c2 10y ago
I long for the good old, tech-first days of Tor. This invasion of talkers and lobbyists (even if for the good cause) is ruining it.
- mintplant 10y ago
  Jacob Appelbaum, the guy they kicked out, was already more a talker than a technologist.
  - syshum 10y ago
    They kicked or forced out more than Jacob Appelbaum.
    - mintplant 10y ago
      Who else was kicked or forced out?
      - syshum 10y ago
        The entire governing board. Multiple Major Exit Node operators The old bridge node operator Those are just the people that have spoken publicly about their exit. Many others (given the nature of Tor) are not going to come forward publicly. They simply stop contributing and disappear. Jacob was a distraction and excuse. A Distraction so people would focus on that instead of what was happening with the project A excuse to implement massive Social Justice and what I believe to be long term Pro Government reforms/policies within the project.
  - aw3c2 10y ago
    To be honest, when the "inspirational" hipster speeches started, I stopped going to the Tor talks at conferences. Roger was the perfect spokesman, nerdy but giving very understandable presentations, more concerned with transporting information than wearing the right scarf to tight pants.
- cm3 10y ago
iuguy 10y ago
I hope Tor Project Inc can resolve the issues it faces. After a bumpy start, Rotorproject[1] is starting to iron out a plan. It's my hope that Rotorproject can help Tor Inc resolve it's issues while simultaneously providing alternatives to the current (technical) monoculture in terms of easily usable anonymity. I think advancing human rights are a reasonable goal, but when I've seen political activism as a specific project goal, I've yet to see long term success. [1] - https://phab.rotorproject.org/w/general_project_information/ https://phab.rotorproject.org/w/general_project_information/
- timmytokyo 10y ago
  It's also managed by someone who thinks RC4 is a reasonable choice for a modern crypto application. No thanks.
  - urgerestraint 10y ago
    May as well be using ROT13...
sneak 10y ago
fwiw, that fork started specifically because of a group's anger that the Tor organization kicked out a rapist. https://twitter.com/jmprcx/status/768839381746651136 https://twitter.com/jmprcx/status/768839381746651136
- sctb 10y ago
  We detached this subthread from https://news.ycombinator.com/item?id=12425906 https://news.ycombinator.com/item?id=12425906 and marked it off-topic.
  - sneak 10y ago
    I am becoming increasingly convinced that you are over-moderating the site.
    - dang 10y ago
      If you have concerns about HN moderation you're welcome to email us at hn@ycombinator.com and make your case, but please don't take potshots like this on the site.
      - sneak 10y ago
        Understood.
- smnscu 10y ago
  Having read a whole bunch of blog posts from the people involved in that scandal, I'm really curious why you're convinced that it was indeed rape.
  - sneak 10y ago
    Because I read the posts from the multiple women he raped and I have no reason to doubt their credibility. My question is why do you think we should default to not believing rape victims?
yuja_wang 10y ago
These types of issues come up a lot in well-meaning organizations. What they don't realize is: "You an include the most people by having the narrowest platform." So if you're a "privacy technology" group, anything not related to privacy technology should not be part of your focus. Ever Civil War, for example, has two (or more sides). Now the Tor group has to pick one. If they were simply interested in privacy technology, they wouldn't have to. You see a similar thing with Codes of Conduct, or "inclusiveness" initiatives. Why can't a Python conference be about Python and only about Python?
- dleslie 10y ago
  Because human beings write Python code and attend Python conferences.
  - deleted 10y ago
    [deleted]
syshum 10y ago
It is sad to watch the Tor Project implode. While it in no way impacts the project as I was a very very very very minor user of Tor in the first place, I have removed any and all installations of Tor from my systems, and will no longer donate to or support them in any way Tor has lost their mission, which should have been Privacy above all else. Today they seem to be more focused on Social Justice, and less about privacy.
- colemickens 10y ago
  Kicking out a serial abuser from their ranks = Social Justice?
  - mwfunk 10y ago
    Sad, isn't it? It's even sadder that there are people who use terms like "social justice" as epithets. I don't know that I've ever met one of these "SJWs" in real life (and I live in the Bay Area FFS) but I've met so many effing people who have somehow convinced themselves that not only do these people exist, but they exist in such large numbers as to have an influence on what other people are or are not allowed to say. At this point I'm 99% sure that (a) SJW backlash is some form of mass hysteria where large groups of people have convinced themselves and each other that these people exist in vastly greater numbers than they actually do (I'm talking multiple orders of magnitude) and (b) many of the most vocal anti-SJW warriors (let's call them ASJWWs) are simply people who at some point in their lives had experiences where they were being a-holes (probably without realizing it), and somebody called them out on it, but rather than learning from the experience and feeling slightly guilty about being a jerk, they decided it was all a big conspiracy against courageous truth-tellers such as themselves. All based on anecdotal evidence of course, but I'm old enough (and have lived in every corner of the US, around pretty much every demographic there is) to have accumulated an embarrassing amount of anecdotal evidence on this topic.
    - syshum 10y ago
      There are 3 possibilities here 1. You do not get out much 2. You are very young thus do not have a frame of reference of the time before SJW was a large scale movement 3. You are a Social Justice Warrior, and are infact surrounded by them because of this you believe that is normal. Take your pick
bahjoite 10y ago
The author's argument that the Tor Project is throwing its users under a bus isn't convincing. The Tor tools and the reasons to use them haven't changed with the introduction of the Tor Project's new mission statement and social contract. The profile of a Tor user hasn't changed and nor has the meaning of Tor's traffic on the network. A Tor user confronted by the Authorities is still able to give "privacy" as their reason for its use. An at risk Tor user is still at risk and it is far from clear that the Tor Project's stated mission increases their risk. I think the author conflates the risk to Tor users with the risk to Tor Project members and volunteers. It may well be true that the latter groups are at greater risk.
- tankenmate 10y ago
  And yet some mid level autocratic bureaucrats in various totalitarian countries will now label Tor as a threat to state control and hence will treat any users with suspicion regardless of what said users claim to be using Tor for. Mid level bureaucrats largely don't understand the nuances of technology and cryptography but they certainly understand a political statement when they see one. And so while it might be click bait to say that this will wind up killing someone but at the same time you can say that it is far from impossible.
- romanpoet 10y ago
  Tor operators are the main ones at increased risk. But the key point that there's no good reason for any of them to be at increased risk at all.
ramblenode 10y ago
This is an interesting point I hadn't considered but I'm skeptical the rebranding will substantially change anything for people living in repressive countries. Governments that flag someone as suspicious or arrest someone for using Tor would have done so before the rebranding. These governments don't need to convince a jury or an impartial judge that Tor is a dissident network. They are already well aware of how Tor is used to circumvent the government firewall both by commoners who just want to watch YouTube videos and by activists to communicate.
- JumpCrisscross 10y ago
  I've been advised to cease using Tor when travelling to certain places. Previously, I could have a reasonable conversation around "securing sensitive but non-threatening communications". The rebrand makes the tool dangerous to be caught using. The OP's comparison between Western treatment of anything drug related and certain cultures' reactions to the term "human rights" is spot on.
trendia 10y ago
Tor is no longer secure; the U.S. government paid Carnegie Mellon (CMU) to research ways of de-anonymizing users by inserting specially designed packets into Tor user data at controlled nodes. [1] Nearly a year-and-a-half after CMU canceled a Black Hat presentation, hints were dropped that CMU's Tor-related efforts may not have been for research purposes only. An anonymous tipster claimed the FBI had paid CMU $1 million to unmask Tor users. A quasi-confirmation popped up during the DOJ's prosecution of Brian Ferrell, who was allegedly assisting Blake Benthall in running Silk Road 2.0. Ferrell and Benthall were both swept up in the wake of a Tor-related FBI raid known as "Operation Onymous," which began a few months after the hastily-cancelled Black Hat talk. Included in the information handed over to Farrell's legal representative was the following: On October 13, 2015, the government provided defense counsel a letter indicating that Mr. Farrell’s involvement with Silk Road 2.0 was identified based on information obtained by a “university-based research institute” that operated its own computers on the anonymous network used by Silk Road 2.0. [1] https://www.techdirt.com/articles/20160225/07295633707/silk-road-20-court-docs-show-us-government-paid-carnegie-mellon-researchers-to-unmask-tor-users.shtml https://www.techdirt.com/articles/20160225/07295633707/silk-...
- zmanian 10y ago
  The CMU attack required setting up a very large number of malicious relays on the Tor network. It was bad that Tor didn't notice the large number of new relays joining the network but greater vigilance is being shown. Tor is effective against many threat models and yet many attacks are known. Further work is required.
  - pyre 10y ago
    People do pay attention to these things: https://www.profwoodward.org/2016/02/what-just-happened-on-tor-network.html https://www.profwoodward.org/2016/02/what-just-happened-on-t...
- atdt 10y ago
  This was covered by Motherboard[1]. The Tor Project put out the following statement in response: "the Tor network is secure and has only rarely been compromised. The Software Engineering Institute ("SEI") of Carnegie Mellon University (CMU) compromised the network in early 2014 by operating relays and tampering with user traffic. That vulnerability, like all other vulnerabilities, was patched as soon as we learned about it. The Tor network remains the best way for users to protect their privacy and security when communicating online." [1] http://motherboard.vice.com/en_au/read/carnegie-mellon-university-attacked-tor-was-subpoenaed-by-feds http://motherboard.vice.com/en_au/read/carnegie-mellon-unive...
jbmorgado 10y ago
There is something that baffles me in these kind of posts. Why do you act like it's the west obligation to solve your social problems? TOR was created in the west, its main contributors are from the west and now - and very rightly so - the people in front of TOR identified the eroding of personal privacy as an eroding of our human rights in the west and they want to change that. It's good for the west, is good for the TOR creators and main contributors. If it's not good in the Orient or middle East, then instead of complaining you should be creating and contributing to projects that help your purposes and your social advancement.
- romanpoet 10y ago
  That's a perfectly fine response, and it's completely logical. However, Tor self-righteously insists it is improving human rights, especially for improving human rights outside the west.
nstj 10y ago
I missed the part in the article where it describes how the change in branding will result in someone's death?
tptacek 10y ago
Potentially getting people killed shouldn't be news to anyone who's been involved with Tor over the past decade.
vacri 10y ago
> For example, say you’re a sysadmin at a local business wishing to further secure its comms. You propose running a Tor node or using Tor internally. I had to stifle a giggle at this 'example'. I have to wonder how many 'local businesses' so value their comms that they want to hide their origin at the expense of significantly downgrading their bandwidth... and what do these 'local businesses' look like?
ashitlerferad 10y ago
Tor's response: https://medium.com/@virgilgr/tors-branding-pivot-is-going-to-get-someone-killed-6ee45313b559#.z1vs8xyjz https://medium.com/@virgilgr/tors-branding-pivot-is-going-to...

235 points by tshtf 10y ago

From the article: > You propose running a Tor node or using Tor internally. Before, this was just something you could do. After Tor’s pivot, you now have to justify why the company should explicitly associate itself with banned HR activism and draw the government’s ire. Using Tor is now an additional mild liability for all of its non-HR users. Using Tor already marks you as suspicious depending on who's looking, regardless of why you use it. The ideals or mission statement of the Tor project don't change this. Tor suffers from the same impediment as the Bittorrent protocol; it is used a lot for illegal purposes, so a stigma of illegality surrounds the tool itself. By focusing on the legitimate use of Tor (e.g., as a human rights facilitating tool) the Tor project might actually improve adoption rather than frustrate it.

JumpCrisscross 10y ago
> Using Tor already marks you as suspicious depending on who's looking, regardless of why you use it Is this based on experience or assumption? I've had minor issues with Tor and VPNs abroad, when questioned about them. Brushing them off as a "security tool" usually worked. A "human rights" tool, on the other hand, makes Tor dangerous to be caught using in many parts of East Asia. I find most Westerners (myself included until recently) don't understand the cultural and political sensitivity around the term in certain countries. OP's analogy to the Western treatment of anything rhyming with drugs is spot on.
subway 10y ago
Sure, Tor traffic has always been suspicious, but that suspicious traffic has traditionally been without an attached political label. By branding Tor as a tool specifically for HR campaigns, you risk drawing additional ire from regimes considered to have a poor HR record.
- Freak_NL 10y ago
  Wouldn't a regime with a poor human rights track record consider any use of technology which hides who you are communicating with as warranting further investigation regardless of the ideals behind it? I don't think they are that naive.
  - ryanlol 10y ago
    Have you ever been to China? There's a plenty of people who work there and have to use various proxies to do so, is the Chinese government cracking down on them? Nah, they'll just mess with those connections a little to keep up appearances. But hey, if you decide to use a proxy that screams "I'M A POLITICAL DISSIDENT" with every packet you send they might just get interested. It's really not as naive as you think.
    - romanpoet 10y ago
      > But hey, if you decide to use a proxy that screams "I'M A POLITICAL DISSIDENT" with every packet you send they might just get interested. Hit the nail on the head my good sir.
- lern_too_spel 10y ago
  That was the author's argument, that Singapore is against the Western view of human rights, so running human rights software would be seen as subversive by the government. He then undermines his argument to instead promote the privacy aspect of Tor by saying that the Singaporean government is fanatically anti-corruption. Privacy hides corruption, so promoting that aspect of the tool doesn't make sense either.
  - romanpoet 10y ago
    Author here. In short, Singapore authorities view Privacy as a double-edged sword. They recognize it's power for anti-corruption (which they love), but dislike the human-rights angle and possibility for breaking the law. Realistically they'll do a balancing act. As long as one can convincing argue that weight of the things they like about Tor exceed the weight of the things they dislike about Tor, you're good. Tor's pivot to emphasize human rights makes that comparison much harder to win.
rhizome 10y ago
Using Tor already marks you as suspicious depending on who's looking, regardless of why you use it. This is a curious construction, one that I can't pin down to any kind of secondary-language issues. "Using Tor" is not the subject of that sentence, "who's looking" is. So, some people see Tor as suspicious. Who are those people, and why is it a problem? Law enforcement...anybody else? What does it mean for Tor traffic to be demeaned by law enforcement (or $chosen_group) as by-default suspicious, and is this a good use of their time and resources? Is it a good way to solve crimes? History tells us that law enforcement, and by extension the government, will use bigotry to effect prosecutorial goals at least as readily as they will shoe-leather investigation. Defining Tor as suspicious-with-exceptions operates in the same sphere as asset forfeitture: prove you ain't. Point being, I think it's important to be clear what is happening with Tor as a character in the wider world of politics and policy, and "using Tor" is something that I don't think needs to be justified. Passive voice also elides these serious issues by pinning results on nebulous activity.
- firethief 10y ago
  > "Using Tor" is not the subject of that sentence, "who's looking" is. "Using [Tor]" actually is the subject of that sentence. "Who's looking" is not the subject even of the dependent clause in which it occurs; "depending on" is introducing an adverbial clause, in which "who" is the subject, "is" is the verb, and "looking" is the predicate. > Passive voice also elides these serious issues by pinning results on nebulous activity. The passive voice is not used in the sentence quoted. I recommend preferring rhetorical techniques other than grammatical analysis; even for someone with a solid understanding of a language's grammar, picking apart the way something is said tends not to advance the discussion as well as repling to content would, however dubiously it may be expressed.
- Sniffnoy 10y ago
  > This is a curious construction, one that I can't pin down to any kind of secondary-language issues. "Using Tor" is not the subject of that sentence, "who's looking" is. > Passive voice also elides these serious issues by pinning results on nebulous activity. No, no, no. Firethief has already largely covered this, but: "Subject" and "passive voice" are grammatical terms. They have to do with the syntax of a sentence. Not with who performed an action, or whether that agency was clearly expressed in the sentence. There is nothing necessarily agency-hiding about the passive voice; conversely, one can hide agency quite well without using it. Basically, go read some Language Log, they talk about this all the time. Hell, they've got a whole category for people complaining about the passive voice while not actually being able to identify when a sentence uses it: http://languagelog.ldc.upenn.edu/nll/?cat=54 http://languagelog.ldc.upenn.edu/nll/?cat=54 (Edit: One particular post on the subject I should point out, I think -- http://languagelog.ldc.upenn.edu/nll/?p=1227 http://languagelog.ldc.upenn.edu/nll/?p=1227 ) Or here's a whole paper by Geoff Pullum on the subject, with more examples than you can shake a stick at in section 3: http://www.lel.ed.ac.uk/~gpullum/passive_loathing.pdf http://www.lel.ed.ac.uk/~gpullum/passive_loathing.pdf
1ris 10y ago
In the west tor was (or is) seen as a tool access child pornography. I had to explain multiple times why i would support such a evil thing. This is a very high social cost in the west, and you can't pose with a tor t-shirt (like the dude in the photo) if that the narrative. You will be expelled from your students union instead of celebrated for supporting it. So, a typical westener tor-supporter does not want this image. But the typical westener is no the person that needs tor mosts. Such a label in east asia would probably help. If the Singaporean police would assume that all tor users a looking for child porn (or just porn, that's illegal there) uses would fall in the vast bin various criminals. But not a political opponents, that are targeted with much more energy. The social cost of consuming (child) porn might be lower than being a dissident. And the prosecution might be less serve.
- csydas 10y ago
  > This is a very high social cost in the west, and you can't pose with a tor t-shirt (like the dude in the photo) if that the narrative. You will be expelled from your students union instead of celebrated for supporting it. So, a typical westener tor-supporter does not want this image. I suggest this is overstated, at least as far as Tor is concerned. While there are occasionally news reports about various crimes that utilized Tor as part of the process, more often the generic term "encryption" or "anonymizing software" is used in news reports. I think the general reaction to anyone wearing a Tor T-shirt would be indifference, save maybe one or two curious talkative parties. I will admit this is anecdotal, but overwhelmingly when Tor has been brought up in the past in my workplace or during discussions, overwhelmingly the response has either been "what's Tor" or "oh Tor. I've heard of that. What is that exactly?". The idea of "expelled from student union" for being a Tor Supporter is completely outside of my understanding of what people in the US even know about Tor. Even so much as having a casual two-way conversation with a non-tech person about Tor seems like a foreign concept. Tor might catch headlines once in awhile, but when it comes to things like online privacy and anonymity, I don't think this is what the lay person thinks of. I mean, just page through news.google a bit searching for "Tor". The news outlets covering it are pretty much tech-oriented; going just a few pages deep, only politico really mentioned Tor, and that was literally only to say it was used by the hackers during the Clinton email breach, calling it an anonymity tool. I just don't think there's enough evidence to really say that the general public or even law enforcement really knows what Tor is, much less form an aggressive opinion towards supporters.

shiven 10y ago

Anyone trusting Tor for anything anymore is asking for trouble. Their new branding and associated bravado is just weak-sauce attempts at projecting technical soundness in the face of getting their tech butt-torn by the CMU hack. You can google the details of the hack yourself. Anyone, with even an iota of self-preservation in them, is best served staying away from this identity-leaking crapware. There is no gentle way of putting it. Tor is fundamentally and practically compromisable, do not trust it for guarding your anonymity against a determined adversary. No. I don't have any suggestions for alternatives either.

sschueller 10y ago

I keep saying this but we need a working implementation of riffle sooner than later. From what I understand it solves some of the shortcomings of tor. http://news.mit.edu/2016/stay-anonymous-online-0711 http://news.mit.edu/2016/stay-anonymous-online-0711

zmanian 10y ago

Virgil seems to be willfully ignorant. Tor needs greater political support in the West because of second crypto wars. Tor also needs more funding that is available for work on privacy and anonymity to support use cases like Securedrop. Too much of Tor's current funding is tied to censorship resistance applications of Tor.

Sniffnoy 10y ago
People can be wrong without being willfully ignorant. There's no reason to assume bad faith. You could make a perfectly good argument along the lines of what you say without that accusation. Why add it in? (Note that you haven't actually fully made that argument. We have multiple competing concerns here (as we always do[0]). Virgil has made an argument based on one; you are trying to make an argument based on another. The question then is, which one outweighs the other? Since neither of you are actually responding to the other's arguments, merely expressing different concerns, it is impossible to tell from your arguments alone. (To put it another way, in pg's "Hierarchy of Disagreement"[1], you're purely counterarguing with no attempt at refutation.) Calling Virgil "willfully ignorant" makes it sound like his argument carries no weight or has already been refuted, but this is not the case.) [0] http://lesswrong.com/lw/gz/policy_debates_should_not_appear_onesided/ http://lesswrong.com/lw/gz/policy_debates_should_not_appear_... [1] http://paulgraham.com/disagree.html http://paulgraham.com/disagree.html
romanpoet 10y ago
Okay, if Tor decides they'd pare back of the rest of the world to "focus at home", that would be a perfectly fine thing, logically consistent thing to do However, this argument doesn't generate any virtue points. My sole claims about Tor are (1) they've pivoted and (2) their short-sightedness. They want to be rah-rah human-rights, but their angle of pursuit of human-rights is, ironically, notably counter-productive.

ryanlol 10y ago

https://lists.torproject.org/pipermail/tor-project/2016-July/000582.html https://lists.torproject.org/pipermail/tor-project/2016-July... This attitude from someone representing the Tor project is, to put it mildly, terrifying. But I guess fundraising matters more than lives of actual real human beings.[1] [1] I'm inclined to believe the author slightly exaggerates the risk, but the reply completely neglects to address that issue. Trying to shift blame on local governments is hardly an option when those are the ones you're trying to defy.

cclements 10y ago

There may be good arguments why not to use Tor, but this doesn't seem to be one of them.

criddell 10y ago
I'd never thought of it in the terms that the article author presents, but I think he has a point. If you are a reporter, you have a very good reason to use Tor. When searched at a border or by some police force, having tools made for privacy and security is going to be expected. Having tools for human rights activists is going to cause trouble.

ajamesm 10y ago

> Imagine Tor published a policy document stating: “The Tor Project proudly advances drug-use by creating and deploying usable anonymity and privacy technologies so people around the world can circumvent local drug laws.” "Imagine"? If you think this is hypothetical, bub, I have some bad news for you about the current perception of Tor. When I think "Tor user" I think of illicit pornography, black market drugs, and human rights activists. Those are pretty much your options. What nation is okay with the first two, but not the third? "Oh shit, we knew he was moving $2m USD in heroin, but we had no idea he was documenting human rights abuses! Apprehend him!" Please.

timmytokyo 10y ago
That may indeed be the public perception of Tor, but the project never publicly aligned itself with the distribution of child porn or illicit drugs. The author's point is that the explicit public alignment with Western notions of human rights is likely to harm the Tor project in countries where "human rights" are perceived as Western imperialism. The extent to which Tor's adoption of the human rights marquee might make a difference in the way these countries treat Tor is unclear, but it is at least a valid concern. Frankly, there are a lot of better reasons -- mostly technical -- to doubt the efficacy and long-term future of Tor. But the recent politicization and drama certainly doesn't help it.
- mikeash 10y ago
  Those countries aren't stupid. Surely they already know of Tor's applications here. Certainly China puts significant effort into blocking it, for one example I'm familiar with.
  - timmytokyo 10y ago
    I agree with you. But I was surprised that the author was able to run a Tor relay in Singapore without significant interference. That tells me that at least one authoritarian country was willing to turn a blind eye on Tor and some of its shadier uses. Will the new greater emphasis on human rights cause Singapore's authorities to give it greater scrutiny? Maybe, maybe not. But it certainly won't help.

nxzero 10y ago

Quick review of weaknesses listed on the Wikipedia page for Tor make it pretty obvious that Tor is a threat to majority of users that if discovered be face serious, if not life threatening, responses. Why do people continue to use it? https://en.wikipedia.org/wiki/Tor_(anonymity_network) https://en.wikipedia.org/wiki/Tor_(anonymity_network)

Karunamon 10y ago
Most of those weaknesses are well known and easy to deal with. In particular: * Use a separate system for Tor traffic, never use that system for anything else * Don't use BitTorrent (which you shouldn't be doing anyways - the network wasn't built for it!) * Don't touch non-TLS sites, the exit node could be hostile * Javascript off
htns 10y ago
It's common for people to have too much trust in technical solutions, even when the solution includes stark warnings on its download page. It's even worse with VPNs and 'secure' email providers. Tor can still be useful as a building block of the next thing, but people should start demanding something better than Tor.
- zipwitch 10y ago
  How terrifying would status quo power holders find a free, universally available and readily usable software tool that provided real and uncrackable anonymity for anyone?

aw3c2 10y ago

I long for the good old, tech-first days of Tor. This invasion of talkers and lobbyists (even if for the good cause) is ruining it.

mintplant 10y ago
Jacob Appelbaum, the guy they kicked out, was already more a talker than a technologist.
- syshum 10y ago
  They kicked or forced out more than Jacob Appelbaum.
  - mintplant 10y ago
    Who else was kicked or forced out?
    - syshum 10y ago
      The entire governing board. Multiple Major Exit Node operators The old bridge node operator Those are just the people that have spoken publicly about their exit. Many others (given the nature of Tor) are not going to come forward publicly. They simply stop contributing and disappear. Jacob was a distraction and excuse. A Distraction so people would focus on that instead of what was happening with the project A excuse to implement massive Social Justice and what I believe to be long term Pro Government reforms/policies within the project.
- aw3c2 10y ago
  To be honest, when the "inspirational" hipster speeches started, I stopped going to the Tor talks at conferences. Roger was the perfect spokesman, nerdy but giving very understandable presentations, more concerned with transporting information than wearing the right scarf to tight pants.
cm3 10y ago

iuguy 10y ago

I hope Tor Project Inc can resolve the issues it faces. After a bumpy start, Rotorproject[1] is starting to iron out a plan. It's my hope that Rotorproject can help Tor Inc resolve it's issues while simultaneously providing alternatives to the current (technical) monoculture in terms of easily usable anonymity. I think advancing human rights are a reasonable goal, but when I've seen political activism as a specific project goal, I've yet to see long term success. [1] - https://phab.rotorproject.org/w/general_project_information/ https://phab.rotorproject.org/w/general_project_information/

timmytokyo 10y ago
It's also managed by someone who thinks RC4 is a reasonable choice for a modern crypto application. No thanks.
- urgerestraint 10y ago
  May as well be using ROT13...

sneak 10y ago

fwiw, that fork started specifically because of a group's anger that the Tor organization kicked out a rapist. https://twitter.com/jmprcx/status/768839381746651136 https://twitter.com/jmprcx/status/768839381746651136

sctb 10y ago
We detached this subthread from https://news.ycombinator.com/item?id=12425906 https://news.ycombinator.com/item?id=12425906 and marked it off-topic.
- sneak 10y ago
  I am becoming increasingly convinced that you are over-moderating the site.
  - dang 10y ago
    If you have concerns about HN moderation you're welcome to email us at hn@ycombinator.com and make your case, but please don't take potshots like this on the site.
    - sneak 10y ago
      Understood.
smnscu 10y ago
Having read a whole bunch of blog posts from the people involved in that scandal, I'm really curious why you're convinced that it was indeed rape.
- sneak 10y ago
  Because I read the posts from the multiple women he raped and I have no reason to doubt their credibility. My question is why do you think we should default to not believing rape victims?

yuja_wang 10y ago

These types of issues come up a lot in well-meaning organizations. What they don't realize is: "You an include the most people by having the narrowest platform." So if you're a "privacy technology" group, anything not related to privacy technology should not be part of your focus. Ever Civil War, for example, has two (or more sides). Now the Tor group has to pick one. If they were simply interested in privacy technology, they wouldn't have to. You see a similar thing with Codes of Conduct, or "inclusiveness" initiatives. Why can't a Python conference be about Python and only about Python?

dleslie 10y ago
Because human beings write Python code and attend Python conferences.
- deleted 10y ago
  [deleted]

syshum 10y ago

It is sad to watch the Tor Project implode. While it in no way impacts the project as I was a very very very very minor user of Tor in the first place, I have removed any and all installations of Tor from my systems, and will no longer donate to or support them in any way Tor has lost their mission, which should have been Privacy above all else. Today they seem to be more focused on Social Justice, and less about privacy.

colemickens 10y ago
Kicking out a serial abuser from their ranks = Social Justice?
- mwfunk 10y ago
  Sad, isn't it? It's even sadder that there are people who use terms like "social justice" as epithets. I don't know that I've ever met one of these "SJWs" in real life (and I live in the Bay Area FFS) but I've met so many effing people who have somehow convinced themselves that not only do these people exist, but they exist in such large numbers as to have an influence on what other people are or are not allowed to say. At this point I'm 99% sure that (a) SJW backlash is some form of mass hysteria where large groups of people have convinced themselves and each other that these people exist in vastly greater numbers than they actually do (I'm talking multiple orders of magnitude) and (b) many of the most vocal anti-SJW warriors (let's call them ASJWWs) are simply people who at some point in their lives had experiences where they were being a-holes (probably without realizing it), and somebody called them out on it, but rather than learning from the experience and feeling slightly guilty about being a jerk, they decided it was all a big conspiracy against courageous truth-tellers such as themselves. All based on anecdotal evidence of course, but I'm old enough (and have lived in every corner of the US, around pretty much every demographic there is) to have accumulated an embarrassing amount of anecdotal evidence on this topic.
  - syshum 10y ago
    There are 3 possibilities here 1. You do not get out much 2. You are very young thus do not have a frame of reference of the time before SJW was a large scale movement 3. You are a Social Justice Warrior, and are infact surrounded by them because of this you believe that is normal. Take your pick

bahjoite 10y ago

The author's argument that the Tor Project is throwing its users under a bus isn't convincing. The Tor tools and the reasons to use them haven't changed with the introduction of the Tor Project's new mission statement and social contract. The profile of a Tor user hasn't changed and nor has the meaning of Tor's traffic on the network. A Tor user confronted by the Authorities is still able to give "privacy" as their reason for its use. An at risk Tor user is still at risk and it is far from clear that the Tor Project's stated mission increases their risk. I think the author conflates the risk to Tor users with the risk to Tor Project members and volunteers. It may well be true that the latter groups are at greater risk.

tankenmate 10y ago
And yet some mid level autocratic bureaucrats in various totalitarian countries will now label Tor as a threat to state control and hence will treat any users with suspicion regardless of what said users claim to be using Tor for. Mid level bureaucrats largely don't understand the nuances of technology and cryptography but they certainly understand a political statement when they see one. And so while it might be click bait to say that this will wind up killing someone but at the same time you can say that it is far from impossible.
romanpoet 10y ago
Tor operators are the main ones at increased risk. But the key point that there's no good reason for any of them to be at increased risk at all.

ramblenode 10y ago

This is an interesting point I hadn't considered but I'm skeptical the rebranding will substantially change anything for people living in repressive countries. Governments that flag someone as suspicious or arrest someone for using Tor would have done so before the rebranding. These governments don't need to convince a jury or an impartial judge that Tor is a dissident network. They are already well aware of how Tor is used to circumvent the government firewall both by commoners who just want to watch YouTube videos and by activists to communicate.

JumpCrisscross 10y ago
I've been advised to cease using Tor when travelling to certain places. Previously, I could have a reasonable conversation around "securing sensitive but non-threatening communications". The rebrand makes the tool dangerous to be caught using. The OP's comparison between Western treatment of anything drug related and certain cultures' reactions to the term "human rights" is spot on.

trendia 10y ago

Tor is no longer secure; the U.S. government paid Carnegie Mellon (CMU) to research ways of de-anonymizing users by inserting specially designed packets into Tor user data at controlled nodes. [1] Nearly a year-and-a-half after CMU canceled a Black Hat presentation, hints were dropped that CMU's Tor-related efforts may not have been for research purposes only. An anonymous tipster claimed the FBI had paid CMU $1 million to unmask Tor users. A quasi-confirmation popped up during the DOJ's prosecution of Brian Ferrell, who was allegedly assisting Blake Benthall in running Silk Road 2.0. Ferrell and Benthall were both swept up in the wake of a Tor-related FBI raid known as "Operation Onymous," which began a few months after the hastily-cancelled Black Hat talk. Included in the information handed over to Farrell's legal representative was the following: On October 13, 2015, the government provided defense counsel a letter indicating that Mr. Farrell’s involvement with Silk Road 2.0 was identified based on information obtained by a “university-based research institute” that operated its own computers on the anonymous network used by Silk Road 2.0. [1] https://www.techdirt.com/articles/20160225/07295633707/silk-road-20-court-docs-show-us-government-paid-carnegie-mellon-researchers-to-unmask-tor-users.shtml https://www.techdirt.com/articles/20160225/07295633707/silk-...

zmanian 10y ago
The CMU attack required setting up a very large number of malicious relays on the Tor network. It was bad that Tor didn't notice the large number of new relays joining the network but greater vigilance is being shown. Tor is effective against many threat models and yet many attacks are known. Further work is required.
- pyre 10y ago
  People do pay attention to these things: https://www.profwoodward.org/2016/02/what-just-happened-on-tor-network.html https://www.profwoodward.org/2016/02/what-just-happened-on-t...
atdt 10y ago
This was covered by Motherboard[1]. The Tor Project put out the following statement in response: "the Tor network is secure and has only rarely been compromised. The Software Engineering Institute ("SEI") of Carnegie Mellon University (CMU) compromised the network in early 2014 by operating relays and tampering with user traffic. That vulnerability, like all other vulnerabilities, was patched as soon as we learned about it. The Tor network remains the best way for users to protect their privacy and security when communicating online." [1] http://motherboard.vice.com/en_au/read/carnegie-mellon-university-attacked-tor-was-subpoenaed-by-feds http://motherboard.vice.com/en_au/read/carnegie-mellon-unive...

jbmorgado 10y ago

There is something that baffles me in these kind of posts. Why do you act like it's the west obligation to solve your social problems? TOR was created in the west, its main contributors are from the west and now - and very rightly so - the people in front of TOR identified the eroding of personal privacy as an eroding of our human rights in the west and they want to change that. It's good for the west, is good for the TOR creators and main contributors. If it's not good in the Orient or middle East, then instead of complaining you should be creating and contributing to projects that help your purposes and your social advancement.

romanpoet 10y ago
That's a perfectly fine response, and it's completely logical. However, Tor self-righteously insists it is improving human rights, especially for improving human rights outside the west.

nstj 10y ago

I missed the part in the article where it describes how the change in branding will result in someone's death?

tptacek 10y ago

Potentially getting people killed shouldn't be news to anyone who's been involved with Tor over the past decade.

vacri 10y ago

> For example, say you’re a sysadmin at a local business wishing to further secure its comms. You propose running a Tor node or using Tor internally. I had to stifle a giggle at this 'example'. I have to wonder how many 'local businesses' so value their comms that they want to hide their origin at the expense of significantly downgrading their bandwidth... and what do these 'local businesses' look like?

ashitlerferad 10y ago

Tor's response: https://medium.com/@virgilgr/tors-branding-pivot-is-going-to-get-someone-killed-6ee45313b559#.z1vs8xyjz https://medium.com/@virgilgr/tors-branding-pivot-is-going-to...