5 ms·
Just out of curiosity: How is Tor looking these days, security-wise? Does someone have a recent analysis of the attacks Tor is facing from state-level attackers
by Asdfbla 10y ago
Just out of curiosity: How is Tor looking these days, security-wise? Does someone have a recent analysis of the attacks Tor is facing from state-level attackers currently? Just wondering if any new threats to Tor have come up in the recent years that hadn't been considered before stuff like Snowden happened.
- nilved 10y agoTor isn't safe from state-level attackers, as demonstrated by the Sybil attack launched by Carnegie Mellon the other year.
- omginternets 10y agoDo you have a link to the paper? "Sybil attack" is a rather large category of attacks and I'm curious about the specifics of this particular one. In particular, certain vulnerabilities can still be prohibitively expensive for use in dragnet-surveillance.
- saycheese 10y agoIt was never released: http://motherboard.vice.com/read/carnegie-mellon-university-attacked-tor-was-subpoenaed-by-feds http://motherboard.vice.com/read/carnegie-mellon-university-...
- omginternets 10y agoInteresting and concerning. Thanks.
- baseio 10y agoIt's not concerning. The flaw was 1) only about hidden services, 2) was patched the next day it was released 3) The Tor Project have been doing some extraordinary work on creating a stronger and secure onion service infrastructure which will be deployed by hopefully mid-2017.
- omginternets 10y agoIt's concerning that the paper was never released.
- saycheese 10y agoTor's FAQs address some: https://www.torproject.org/docs/faq.html.en#AttacksOnOnionRouting https://www.torproject.org/docs/faq.html.en#AttacksOnOnionRo...
- tga_d 10y agoMy impressions from the research community have been that the consensus is 1. Using Tor is more private (and possibly more secure) than a VPN or nothing at all, 2. Tor will not protect you from a targeted attack by a well-funded, state-level adversary, 3. It may or may not defend you against more dragnet types of attacks, depending on the state of the cat-and-mouse between offense and defense (it most likely will protect you on any particular session, but the more you use Tor, the more likely you'll use it while an attack is viable in the wild). So far though, the overwhelming majority of attacks on Tor users comes from things that aren't Tor itself --- e.g. Firefox vulnerabilities, timing side-channels on when the user was home, etc. Additionally, if you're not doing anything illegal, you're less likely to be targeted on Tor. Not that this is to say "if you're not doing something illegal you have nothing to hide!", just that your adversaries are likely not powerful or motivated enough to target you on Tor if what you're doing isn't illegal. Even in places like China, where every attempt to block Tor is made, they typically don't spend much effort in targeting those who do try to use Tor. This means if your motivation for Tor is to do things like stop web site trackers, it's not only a good option, it's probably the best available.
- Asdfbla 10y agoThanks for the detailed reply, that was kinda what I was interested in.
- lorenzhs 10y agoMalicious exit nodes still seem to be an issue one should be aware of, especially for unencrypted connections (http).