16 ms·

The New York Times Is Now Available as a Tor Onion Service

878 points by alecmuffett 9y ago

Bishonen88 9y ago
So is it now "guaranteed", that TOR is secure? And how many "guarantees" does one need in order to be "guaranteed" security whilst browsing? [...]and they provide additional guarantees that readers are connected securely to our website.[...]
- gipp 9y ago
  Are you just nitpicking the difference between the phrase "provide additional guarantees" and the verb "guarantee"? Why? > So is it now "guaranteed", that TOR is secure? Your quote does not imply that
- alecmuffett 9y ago
  Tor crypto guarantees an E2E connection to an entity possessing a key which matches the onion address which you sought to access. That's a benefit over DNS/TCP/BGP :-)
- socceroos 9y ago
  Disable Javascript. Enabling it makes you traceable. Run a Temporary profile in Firefox - otherwise cached images will make you traceable. Connect from your neighbors wifi (the further from your home the better, really) with a spoofed MAC address running from a write-locked USB live distro - this ensures you're protected from the unknown unknowns.
  - aeorgnoieang 9y ago
    > Run a Temporary profile in Firefox What're the equivalent or similar features in other browsers (e.g. Chrome)? Incognito mode?
  - jerheinze 9y ago
    Or just use the Tor Browser - ideally with the High security setting. Other browsers don't have the same anti fingerprinting and first party isolation defenses.
  - pvdebbe 9y ago
    Then again, with JS disabled your browser fingerprint gets a lot more specific unless your UA is a scrawler bot.
- gressquel 9y ago
  Its not secure. "Everyone" knows that. Everytime a drug market is taken down or a pedophile ring is busted, the investigators from FBI always claim it was some dubious mistake from the admin whic lead to it. But we all know they have discovered a vulnurability in the TOR protocol but won't disclose it. Safe browsing guys //edit: if you want extra security. Launch TOR from a remote desktop. And I am not talking about the ones you buy from known VPN providers like NordicVPN or amazon web services.
  - typon 9y ago
    > But we all know they have discovered a vulnurability in the TOR protocol but won't disclose it. Can you provide evidence for this claim? I'm a huge conspiracy nut, this has me excited.
    - nobodyorother 9y ago
      You don't need anything that isn't already publicly available: see every security bug reported on the mailing list, and reliable hop tracing via coordinated parties recording traffic (Tor's version of Bitcoin's 51% problem). That said, it's still the most reliable limited-anonymity provider I know of.
  - staticassertion 9y ago
    I guess I'm not everyone. I'd bet that the majority of the 'busts' are due to: a) Infiltrating chats where people are more likely to share sensitive information / trust the people they're talking to b) Poor configurations/ setups on either the client or server (client browser bundle has noscript, but it's not on the strictest settings, js is enabled iirc) c) Exploitation of client or server due to out of date versions, things like that Historically I think it's always fallen into one of these cases - and not just what the FBI etc say publicly but we've seen these exploits ITW. I wouldn't be surprised if the NSA and other agencies have the power to deanonymize TOR users but if it were trivial why is the majority of TOR traffic still going towards illegal content? Last I read (a paper a year ago) TOR is still primarily all about drugs, followed by child pornography (mostly drugs though iirc). If they can track all of these people by breaking TOR completely... why don't they?
- jstanley 9y ago
  Using Tor is more secure than not using Tor, no matter how much FUD people try to spread about it.
jameskegel 9y ago
This may not be the whole solution but it is a step in the right direction. Kudos to NYT for attention to this subset of readers.
- belorn 9y ago
  It is. Overlay networks has a very expensive overhead, but it is one of the few ways that networks can be updated to modern views on security threats and privacy without getting ISP to change their hardware and software. I am in particular hopeful that we might see a future where tor will simply be a available tool in the general network stack, enabling private end-to-end without exist nodes.
  - jerheinze 9y ago
    > Overlay networks has a very expensive overhead Single onion services are a thing now for quiet some time actually: https://web.archive.org/web/20161219230314/https://blog.torproject.org/blog/whats-new-tor-0298 https://web.archive.org/web/20161219230314/https://blog.torp... (had to use archive.org since images are broken on their blog currently)
- ryanlol 9y ago
  Why is this a step in the right direction? Having a .onion service provides essentially zero benefit without a hidden backend. People wanting to access NYT site via Tor, can just navigate to https://www.nytimes.com/ https://www.nytimes.com/ and it'll be significantly faster than the .onion equivalent.
  - jerheinze 9y ago
    > People wanting to access NYT site via Tor, can just navigate to https://www.nytimes.com/ https://www.nytimes.com/ and it'll be significantly faster than the .onion equivalent. This isn't true, exits are currently in short supply. And onion services don't use exits, so it will result in a faster speed, especially since they may have made it as a single onion service[1]. [1] : https://web.archive.org/web/20161219230314/https://blog.torproject.org/blog/whats-new-tor-0298 https://web.archive.org/web/20161219230314/https://blog.torp...
mrarjonny 9y ago
On one hand it can be appreciated to see a movement of mainstream media making itself accessible to anyone anywhere. Preserving and enhancing the global flow of information is of utmost importance. On the other hand, who on earth wants to read the New York Times?
deleted 9y ago
[deleted]
nottorp 9y ago
Hmm don't you have to pay to access the full newspaper? How does that mix with Tor anonymity?
- greiskul 9y ago
  Haven't tested to see how they are doing, but that's kinda orthogonal to using tor. Standard cryptography like https uses is meant so any eavesdroppers don't know WHAT you are talking about. But they still know that Alice is talking with Bob. Onion routing, that tor uses, is meant to so eavesdroppers also don't know who is talking to whom. But that's on the eavesdroppers part. If Alice and Bob are talking completely privately, it's completely fine if they are exchanging all the information they want between themselves. The big idea is that attackers don't know what you are doing. Tor can also hide where Bob's servers are, but not sure if the New York Times would need that bit.
  - nottorp 9y ago
    Ah right - i was thinking of hiding from the US government, which can get the identity of subscribers directly from NYT. I forgot there are other governments too... shame, I'm not even from the US.
- blfr 9y ago
  They show the countdown of remaining articles but they have virtually no way of identifying your browser over Tor so all you need is clear cookies and continue to browse anonymously.
  - underwoodley 9y ago
    I'm pretty sure you can clear your cookies on a normal browser and reset the number of remaining articles for the month.
- bertil 9y ago
  The two things are not directly dependent: for instance, Facebook allows you to connect to your account through Tor. You still have a separate individual authentication (email & password, 2FA) once the connection is established. I believe I have a paying NYT account so I might try if you are interested. It’s possible that Tor makes it harder to enforce the rule that you can’t read more than X articles per month (which I believe is enforced using cookies and your IP address) but at this early stage, I’m not sure that’s key: people who know how to use Tor generally can easily go around that limitation on https. If too many people use that loophole to read without a subscription, that means NYTimes would have been instrumental in making Tor mainstream. That would be a major achievement in itself. Enforcing similar consumption limits through Tor would probably be rather experimental, but sounds hardly difficult (especially with the goodwill NYTimes would have most likely gained from Tor developers & supporters).
AckSyn 9y ago
Any new services that utilize Tor so we don't have to use exit nodes is a step in the right direction.
blfr 9y ago
And they're using an Extended Validation certificate from DigiCert for it CN = nytimes3xbfgragh.onion OU = Technology O = The New York Times Company Object Identifier (2 5 4 15) = Private Organization along with some other addresses DNS Name: nytimes3xbfgragh.onion DNS Name: graylady3jvrrxbe.onion DNS Name: *.graylady3jvrrxbe.onion DNS Name: *.dev.graylady3jvrrxbe.onion DNS Name: *.stg.graylady3jvrrxbe.onion DNS Name: *.nytimes3xbfgragh.onion DNS Name: *.api.nytimes3xbfgragh.onion DNS Name: *.api.dev.nytimes3xbfgragh.onion DNS Name: *.api.stg.nytimes3xbfgragh.onion DNS Name: *.blogs.nytimes3xbfgragh.onion DNS Name: *.blogs.stg.nytimes3xbfgragh.onion DNS Name: *.blogs5.stg.nytimes3xbfgragh.onion DNS Name: *.dev.nytimes3xbfgragh.onion DNS Name: *.dev.blogs.nytimes3xbfgragh.onion DNS Name: *.newsdev.nytimes3xbfgragh.onion DNS Name: *.prd.nytimes3xbfgragh.onion DNS Name: *.sbx.nytimes3xbfgragh.onion DNS Name: *.stg.nytimes3xbfgragh.onion DNS Name: *.stg.blogs.nytimes3xbfgragh.onion DNS Name: *.stg.newsdev.nytimes3xbfgragh.onion DNS Name: www.bestsellers.nytimes3xbfgragh.onion DNS Name: www.homedelivery.nytimes3xbfgragh.onion
- Izmaki 9y ago
  What does this mean in regular human terms?
  - belorn 9y ago
    Extended Validation certificate is when a company go to a CA and provide a bunch of business documents and legal proof that they really own the company behind a name. Its not a technical aspect but human lawyer <-> human lawyer that establish a certificate. At the end if the validation is successful, the company get a technical signed document that in browsers shows up as a green lock and the name in green next to the URL.
    - colejohnson66 9y ago
      So in addition to knowing that your browser is connected to where you want, you now know that the website you want is actually who they say they are?
icc97 9y ago
This is a great thing. Tor wants to encourage people to use tor as a normal browser so it's harder to track individuals using tor. Handy graph for anyone curious about the benefits of Tor [0] [0]: https://www.eff.org/pages/tor-and-https https://www.eff.org/pages/tor-and-https
ape4 9y ago
The url is a bit hard to remember. https://www.nytimes3xbfgragh.onion/ https://www.nytimes3xbfgragh.onion/ Is there a directory of .onion sites? (with an easy .onion url)
- Gaelan 9y ago
  There are no “easy” onion URLs. They are essentially random (hash of a key iirc). It’s possible to generate random URLs until you get a prefix you like, but the time it takes increases exponentially with length of the desired prefix.
  - comboy 9y ago
    I wonder why namecoin addresses are not a part of the tor yet. Onion urls should be treated more like IPs.
    - jerheinze 9y ago
      It's in their works, see their proposal 279: https://gitweb.torproject.org/torspec.git/tree/proposals/279-naming-layer-api.txt https://gitweb.torproject.org/torspec.git/tree/proposals/279... As well as this blog post: https://blog.torproject.org/cooking-onions-names-your-onions https://blog.torproject.org/cooking-onions-names-your-onions See also this ticket for following the progress: https://trac.torproject.org/projects/tor/ticket/10747 https://trac.torproject.org/projects/tor/ticket/10747
  - ape4 9y ago
    I guess there could be a regular website that links to a .onion directory
- spyspy 9y ago
  I recall that Facebook brute forced their way into having an onion url that was easy to remember, by generating millions of them and then picking one that was simple.
  - 9y ago
ringaroundthetx 9y ago
Ah, so disagreement with an administration is what will make everyone eventually to TOR Nothing to hide except when the wrong guy gets in power then you feel naked
- matt4077 9y ago
  Do you _really_ think the NYT does this out of some specific fear? And if yes, does their adoption of https in 2014[0]\ then imply that they were equally suspicious of the previous administration? [0]: https://open.blogs.nytimes.com/2014/11/13/embracing-https/ https://open.blogs.nytimes.com/2014/11/13/embracing-https/
  - ringaroundthetx 9y ago
    Not the NYT itself, no
- Buttes 9y ago
  More likely for users in China etc.
cczomps 9y ago
Hello everyone,i would like to a help a friend who helped me get out of a dysfunctional and abusive relationship and helped me get proof of infidelity from my ex husband's devices.If you have a similar problem or you need to hack any device or website and you require 100% guarantee and anonymity, reach out to this computer guru via email with BLACKSPOTHACK @ GMAIL DOT COM
thatonechad 9y ago
Not a huge fan of the NYT but this is pretty cool!
- nathancahill 9y ago
  Careful, you'll cut yourself on that edge!
nobodyorother 9y ago
Does the onion service still serve the same advertisements their website and mobile app do? If so, they're leaving their users-who-want-to-stay-relatively-anonymous open to attack via the advertisement vector. Members of that group would be considered high-value targets simply due to their anonymity desires. I can't see the number of daily users being large enough that they'd lose significant profit by closing that attack vector. Hell, if there was a way to pay NYT enough to disable ads on all their services, I'd do it.
- ceejayoz 9y ago
  If you're using Tor surely you should be disabling third-party and non-onion assets and JavaScript?
  - nobodyorother 9y ago
    Not all entry points do the most paranoid thing, and not options are even available on all entry points. The Tor Browser Bundle (desktop) has different defaults than Orfox (phone), and I think both will connect to non-onion URLs when connecting to an onion site. Same for JS, ad-block, etc.
- reaperducer 9y ago
  Why not try it and let us know instead of simply making guesses?
  - nobodyorother 9y ago
    I was asking because I'm currently nowhere near a system that I'd trust for this purpose. I'll be near one later and, if you're interested, I'll update the question with my findings.
    - jstanley 9y ago
      There exists a system that you wouldn't trust to provide a good-enough answer to the question "Does the onion service still serve the same advertisements their website and mobile app do?" ? What do you think an untrustworthy system is doing that would make it give a not-good-enough answer?
Ajedi32 9y ago
Is there a search engine or other convenient discovery mechanism for Onion services? I know DuckDuckGo has their own hidden service, but it seems that site only returns results from the regular internet, not from other hidden services.
- zamber 9y ago
  > hidden services I think you responded to your own question. Besides that there are lists of onion services. Apparently there are also search services like https://ahmia.fi/ https://ahmia.fi/
  - Ajedi32 9y ago
    It's the real IP address of the service that's hidden, not necessarily its Onion address. In theory, there's no reason `.onion` links couldn't be crawled and indexed by search engines the same way any other website is.
  - nathancahill 9y ago
    Although there's a risk to using onion directories, since you have to trust that the hash they give you for the New York Times for example, is actually the real hash. It's easier to spoof onion hashes than domain names since domain names are more well known. You'd hopefully catch that you're connecting to nytim3s.com, not so much nytimes3xbfgra3h.onion.
    - Ajedi32 9y ago
      EV certs can help with this to some extent. For example, the New York Times is using an EV cert with the organization name "The New York Times Company" for their hidden service. So as long as you trust the CA system, you can be certain that you're talking to a server operated by The New York Times, and not just a copycat.
      - nathancahill 9y ago
        Yes, but EV isn't that common on Tor. How would I distinguish Dread Pirate Roberts' Silk Road from FBI's Silk Road in a Tor online directory?
Illniyar 9y ago
Err... does the tor site still have the 10 views a month for free limit? Are tor users supposed to subscribe to NYT - that will surely blow through any privacy you hope to achieve.
- detaro 9y ago
  See this subthread https://news.ycombinator.com/item?id=15567778 https://news.ycombinator.com/item?id=15567778
  - Illniyar 9y ago
    Thanks
- woodandsteel 9y ago
  I don't know about other browsers, but with Cliqz if I turn it off after 10 articles and turn it on, the NYT starts counting from 0 again.
spodek 9y ago
Does anyone know why they posted this story through Medium?
- Spivak 9y ago
  Because their own site is paywalled.
- deleted 9y ago
  [deleted]
- mattdotc 9y ago
  TimesOpen is an engineer-driven blog. Its previous incarnation was self-hosted on a WordPress stack (separate from our main CMS), but for various reasons it was decided to re-platform. There were many discussions before settling on Medium and alternatives were considered (such as dogfooding our own CMS). We have a lot of work in-flight to modernize and simplify our publishing stack, and the timing wasn't right to rely on internal tools to publish a new blog.
  - vintageseltzer 9y ago
    How widely is WordPress being used at NYT today? Seems like it was used a lot about five years ago but don’t see it much anymore.
    - deleted 9y ago
      [deleted]
  - nobodyorother 9y ago
    Could you thank the folks involved in this? The TOS is great news.
justinzollars 9y ago
Awesome!
sidcool 9y ago
What would be the advantage here?
- mileycyrusXOXO 9y ago
  From the /r/tor thread System33 posted a comment[0] originally by Alec Muffet explaining why Facebook set up a TOR service, which may answer some of your questions: Why would anyone run a legal onion service? Thanks Alec Muffett (OP) for the following summary copied from this comment Understandably folk tend to think "Anonymity!" when talking about Tor Onions, but in rolling out the Facebook onion we established several clear benefits: 1. better and safer experience for people accessing over Tor: no interference by exit nodes, no bandwidth-contention for exit nodes, no use of exit nodes at all. 2. "good neighbour" - reciprocally, popular sites can unload themselves from eating up scarce exit-node bandwidth. 3. "a peace offering" - people (continue to) use Facebook over Tor; 3 years ago we saw 500,000/month, more recently ~1 million. Overwhelmingly we found (through measurement and assessment) that people using Facebook over Tor were ordinary folk wanting to do ordinary things. especially in times of political crisis. Providing a metaphorical "olive branch" showed that we value their use of the site. 4. Discretion & Trust. Onion Sites are considered to be about "Anonymity", but really they offer two more features: Discretion (eg: your employer or ISP cannot see what you are browsing, not even what site) and trust (if you access facebookcorewwwi.onion you are definitely connected to Facebook, because of the nature of Onion addressing; no DNS or CA shenanigans are applicable.) [0]: https://www.reddit.com/r/TOR/comments/792mfr/the_new_york_times_is_now_available_as_a_tor/doymov3/ https://www.reddit.com/r/TOR/comments/792mfr/the_new_york_ti...
  - cJ0th 9y ago
    Is this mainly intended for people from non-western countries who need a channel for free speech? Because apart from that I see no point in FB offering an onion service. If anonymity, discretion and trust are what I am looking for than surely FB itself is one of the least appropriate platforms for me.
- eggpy 9y ago
  >The New York Times reports on stories all over the world, and our reporting is read by people around the world. Some readers choose to use Tor to access our journalism because they’re technically blocked from accessing our website; or because they worry about local network monitoring; or because they care about online privacy; or simply because that is the method that they prefer.
rayiner 9y ago
Comical attempt to give Street cred to the NYT.
- eggpy 9y ago
  Comical how? Check out their tech blog[0]. I'd venture a guess that they are the most technically adventurous news site, if not one of the more open corporations around in regards to trying new technology and writing about the experience. A lot of what they have to say is pretty interesting. [0] - https://open.nytimes.com/ https://open.nytimes.com/
  - b1gtuna 9y ago
    I agree. NYTimes has led with technical prowess the past a few years.
patrickaljord 9y ago
The NYT is so pro-establishment it is probably the last site on Earth that would have its domain taken away from them.
- juskrey 9y ago
  Virtue signalling
- matthewbauer 9y ago
  Trump would disagree.
  - patrickaljord 9y ago
    I don't think he would disagree they are pro-establishment. He'd love them to be taken down though there is no way he could make this happen.
    - juliangoldsmith 9y ago
      I think it's more that he'd prefer that the media didn't cite "unverified" dossiers that they sourced from Buzzfeed [0], which were produced by a source with ties to the DNC [1][2]. [0]: https://www.nytimes.com/2017/01/23/opinion/why-buzzfeed-news-published-the-dossier.html https://www.nytimes.com/2017/01/23/opinion/why-buzzfeed-news... [1]: https://www.nytimes.com/2017/01/11/us/politics/donald-trump-russia-intelligence.html https://www.nytimes.com/2017/01/11/us/politics/donald-trump-... [2]: http://www.washingtontimes.com/news/2017/oct/24/dnc-clinton-campaign-paid-fusion-gps-Trump-dossier/ http://www.washingtontimes.com/news/2017/oct/24/dnc-clinton-...
      - itsnewman 9y ago
        > I'd agree here. There's no reason to discuss politics on HN when there are numerous other places to do so. HN is a forum about technology and the startup world, let's keep it about that.
iandanforth 9y ago
Will this help people in China at all? From an article I ready a while back it seemed like Tor has been defeated there. (https://www.technologyreview.com/s/427413/how-china-blocks-the-tor-anonymity-network/ https://www.technologyreview.com/s/427413/how-china-blocks-t...)
- milofeynman 9y ago
  That article is from 2012. It's a constant battle, which has changed a LOT in 5 years. https://blog.torproject.org/breaking-through-censorship-barriers-even-when-tor-blocked https://blog.torproject.org/breaking-through-censorship-barr... https://www.torproject.org/docs/pluggable-transports https://www.torproject.org/docs/pluggable-transports
- jerheinze 9y ago
  Well there's meek-amazon[1] which seems to work there. Also I remember I talked last months to some guy on irc at #tor who was using some obfs4 bridges successfully in China. There's also another pluggable transport named Snowflake[2] where everyone can become a bridge by just running some JS in their browser, which may prove to be a good solution (it doesn't work yet in China since it uses Google for domain fronting). [1] : https://trac.torproject.org/projects/tor/wiki/doc/meek https://trac.torproject.org/projects/tor/wiki/doc/meek [2] : https://trac.torproject.org/projects/tor/wiki/doc/Snowflake https://trac.torproject.org/projects/tor/wiki/doc/Snowflake
schwag09 9y ago
Mozilla is also currently matching all Tor donations: https://donate.torproject.org/pdr https://donate.torproject.org/pdr Consider donating!
pbarnes_1 9y ago
Can someone explain... why?
- grzm 9y ago
  From the article: > "Some readers choose to use Tor to access our journalism because they’re technically blocked from accessing our website; or because they worry about local network monitoring; or because they care about online privacy; or simply because that is the method that they prefer."
  - cJ0th 9y ago
    That's still a bit of a non answer. More to the point: Why does a mainstream news outlet care about this small group of people?
    - grzm 9y ago
      What's your working definition of "mainstream news outlet"? I can't think of a reasonable one that precludes them from broadening their reach. And given their size, they are more likely to have the resources to do so. Also, there are large populations where network monitoring and/or content restrictions are part of everyday life. The New York Times experienced this directly with respect to their iOS app in China. https://www.nytimes.com/2017/01/04/business/media/new-york-times-apps-apple-china.html https://www.nytimes.com/2017/01/04/business/media/new-york-t... Edit to add: To turn it around, why shouldn't the NYT do this? That isn't snark: I'm interested in hearing substantial reasons for the skepticism implicit in 'pbarnes_1 original question. Granted, I haven't read all of the comments for this submission, I haven't seen any that convincingly argue this isn't a useful thing.
      - cJ0th 9y ago
        > What's your working definition of "mainstream news outlet"? A news outlet with a "one size fits most" attitude. That is, they offer a product which caters to people who could be described as "average". Typically companies focus their energy only on (potential) customers, not those who aren't a good fit for the product in the first place. There probably are more profit-promising people out there for the NYT than those who are somewhat crypto-nerds. They don't like clicking ads, some may even feel uneasy using typical payment methods to buy a subscription. > Also there are large populations where network monitoring and/or content restrictions are part of everyday life. yeah, that's reasonable.
jsfreedman 9y ago
For a publication that openly supported the Iraq war and all the suffering that entailed for innocent civilians, its kinda funny that they're suddenly all concerned about people's rights.
conductor 9y ago
What's the point of making it available in the Tor network if their onion site includes a script from www.googletagmanager.com (or an "iframe" if scripting is disabled) thus making it significantly less anonymous? Onion websites should be isolated and should not initiate any connections to vanilla internet. Edit: it also loads scripts from www.google.com, tags.bluekai.com, cdn.optimizely.com...
plg 9y ago
is it still paywalled on the onion service?
shell_scripter 9y ago
you can now get your daily dose of Two Minutes Hate on Tor.
forapurpose 9y ago
I'm seeing a different page at the Tor address than at the regular address. The layout is different: https://www.nytimes3xbfgragh.onion/ https://www.nytimes3xbfgragh.onion/ https://www.nytimes.com/ https://www.nytimes.com/
4684499 9y ago
I don't see the point. A hidden service is set for information can not be safely presented on the public Internet. Like what The Daily Stormer did. If one just wanted to bypass blocking or hide himself from evil third parties, he could just use tor browser to open NYT's regular domain instead of the hidden service domain, no?
- deleted 9y ago
  [deleted]
- Ajedi32 9y ago
  Onion services are faster on Tor, since you aren't limited by the bandwidth of the exit nodes. There are also some security benefits, since connections to hidden services are automatically encrypted and authenticated, no HTTPS or trust in Certificate Authorities required (though HTTPS with EV certs can still be useful for identification purposes).
- superkuh 9y ago
  You don't own a traditional domain. You are given temporary permission to use it. A tor onion address is something you can actually own.
RustyRussell 9y ago
Tried to show my support by subscribing over Tor, unf: This action is not supported over Onion yet, sorry. Which kind of makes sense, since you were probably about to ask my CC info, but still...

878 points by alecmuffett 9y ago

So is it now "guaranteed", that TOR is secure? And how many "guarantees" does one need in order to be "guaranteed" security whilst browsing? [...]and they provide additional guarantees that readers are connected securely to our website.[...]

gipp 9y ago
Are you just nitpicking the difference between the phrase "provide additional guarantees" and the verb "guarantee"? Why? > So is it now "guaranteed", that TOR is secure? Your quote does not imply that
alecmuffett 9y ago
Tor crypto guarantees an E2E connection to an entity possessing a key which matches the onion address which you sought to access. That's a benefit over DNS/TCP/BGP :-)
socceroos 9y ago
Disable Javascript. Enabling it makes you traceable. Run a Temporary profile in Firefox - otherwise cached images will make you traceable. Connect from your neighbors wifi (the further from your home the better, really) with a spoofed MAC address running from a write-locked USB live distro - this ensures you're protected from the unknown unknowns.
- aeorgnoieang 9y ago
  > Run a Temporary profile in Firefox What're the equivalent or similar features in other browsers (e.g. Chrome)? Incognito mode?
- jerheinze 9y ago
  Or just use the Tor Browser - ideally with the High security setting. Other browsers don't have the same anti fingerprinting and first party isolation defenses.
- pvdebbe 9y ago
  Then again, with JS disabled your browser fingerprint gets a lot more specific unless your UA is a scrawler bot.
gressquel 9y ago
Its not secure. "Everyone" knows that. Everytime a drug market is taken down or a pedophile ring is busted, the investigators from FBI always claim it was some dubious mistake from the admin whic lead to it. But we all know they have discovered a vulnurability in the TOR protocol but won't disclose it. Safe browsing guys //edit: if you want extra security. Launch TOR from a remote desktop. And I am not talking about the ones you buy from known VPN providers like NordicVPN or amazon web services.
- typon 9y ago
  > But we all know they have discovered a vulnurability in the TOR protocol but won't disclose it. Can you provide evidence for this claim? I'm a huge conspiracy nut, this has me excited.
  - nobodyorother 9y ago
    You don't need anything that isn't already publicly available: see every security bug reported on the mailing list, and reliable hop tracing via coordinated parties recording traffic (Tor's version of Bitcoin's 51% problem). That said, it's still the most reliable limited-anonymity provider I know of.
- staticassertion 9y ago
  I guess I'm not everyone. I'd bet that the majority of the 'busts' are due to: a) Infiltrating chats where people are more likely to share sensitive information / trust the people they're talking to b) Poor configurations/ setups on either the client or server (client browser bundle has noscript, but it's not on the strictest settings, js is enabled iirc) c) Exploitation of client or server due to out of date versions, things like that Historically I think it's always fallen into one of these cases - and not just what the FBI etc say publicly but we've seen these exploits ITW. I wouldn't be surprised if the NSA and other agencies have the power to deanonymize TOR users but if it were trivial why is the majority of TOR traffic still going towards illegal content? Last I read (a paper a year ago) TOR is still primarily all about drugs, followed by child pornography (mostly drugs though iirc). If they can track all of these people by breaking TOR completely... why don't they?
jstanley 9y ago
Using Tor is more secure than not using Tor, no matter how much FUD people try to spread about it.

jameskegel 9y ago

This may not be the whole solution but it is a step in the right direction. Kudos to NYT for attention to this subset of readers.

belorn 9y ago
It is. Overlay networks has a very expensive overhead, but it is one of the few ways that networks can be updated to modern views on security threats and privacy without getting ISP to change their hardware and software. I am in particular hopeful that we might see a future where tor will simply be a available tool in the general network stack, enabling private end-to-end without exist nodes.
- jerheinze 9y ago
  > Overlay networks has a very expensive overhead Single onion services are a thing now for quiet some time actually: https://web.archive.org/web/20161219230314/https://blog.torproject.org/blog/whats-new-tor-0298 https://web.archive.org/web/20161219230314/https://blog.torp... (had to use archive.org since images are broken on their blog currently)
ryanlol 9y ago
Why is this a step in the right direction? Having a .onion service provides essentially zero benefit without a hidden backend. People wanting to access NYT site via Tor, can just navigate to https://www.nytimes.com/ https://www.nytimes.com/ and it'll be significantly faster than the .onion equivalent.
- jerheinze 9y ago
  > People wanting to access NYT site via Tor, can just navigate to https://www.nytimes.com/ https://www.nytimes.com/ and it'll be significantly faster than the .onion equivalent. This isn't true, exits are currently in short supply. And onion services don't use exits, so it will result in a faster speed, especially since they may have made it as a single onion service[1]. [1] : https://web.archive.org/web/20161219230314/https://blog.torproject.org/blog/whats-new-tor-0298 https://web.archive.org/web/20161219230314/https://blog.torp...

mrarjonny 9y ago

On one hand it can be appreciated to see a movement of mainstream media making itself accessible to anyone anywhere. Preserving and enhancing the global flow of information is of utmost importance. On the other hand, who on earth wants to read the New York Times?

deleted 9y ago

[deleted]

nottorp 9y ago

Hmm don't you have to pay to access the full newspaper? How does that mix with Tor anonymity?

greiskul 9y ago
Haven't tested to see how they are doing, but that's kinda orthogonal to using tor. Standard cryptography like https uses is meant so any eavesdroppers don't know WHAT you are talking about. But they still know that Alice is talking with Bob. Onion routing, that tor uses, is meant to so eavesdroppers also don't know who is talking to whom. But that's on the eavesdroppers part. If Alice and Bob are talking completely privately, it's completely fine if they are exchanging all the information they want between themselves. The big idea is that attackers don't know what you are doing. Tor can also hide where Bob's servers are, but not sure if the New York Times would need that bit.
- nottorp 9y ago
  Ah right - i was thinking of hiding from the US government, which can get the identity of subscribers directly from NYT. I forgot there are other governments too... shame, I'm not even from the US.
blfr 9y ago
They show the countdown of remaining articles but they have virtually no way of identifying your browser over Tor so all you need is clear cookies and continue to browse anonymously.
- underwoodley 9y ago
  I'm pretty sure you can clear your cookies on a normal browser and reset the number of remaining articles for the month.
bertil 9y ago
The two things are not directly dependent: for instance, Facebook allows you to connect to your account through Tor. You still have a separate individual authentication (email & password, 2FA) once the connection is established. I believe I have a paying NYT account so I might try if you are interested. It’s possible that Tor makes it harder to enforce the rule that you can’t read more than X articles per month (which I believe is enforced using cookies and your IP address) but at this early stage, I’m not sure that’s key: people who know how to use Tor generally can easily go around that limitation on https. If too many people use that loophole to read without a subscription, that means NYTimes would have been instrumental in making Tor mainstream. That would be a major achievement in itself. Enforcing similar consumption limits through Tor would probably be rather experimental, but sounds hardly difficult (especially with the goodwill NYTimes would have most likely gained from Tor developers & supporters).

AckSyn 9y ago

Any new services that utilize Tor so we don't have to use exit nodes is a step in the right direction.

blfr 9y ago

And they're using an Extended Validation certificate from DigiCert for it CN = nytimes3xbfgragh.onion OU = Technology O = The New York Times Company Object Identifier (2 5 4 15) = Private Organization along with some other addresses DNS Name: nytimes3xbfgragh.onion DNS Name: graylady3jvrrxbe.onion DNS Name: *.graylady3jvrrxbe.onion DNS Name: *.dev.graylady3jvrrxbe.onion DNS Name: *.stg.graylady3jvrrxbe.onion DNS Name: *.nytimes3xbfgragh.onion DNS Name: *.api.nytimes3xbfgragh.onion DNS Name: *.api.dev.nytimes3xbfgragh.onion DNS Name: *.api.stg.nytimes3xbfgragh.onion DNS Name: *.blogs.nytimes3xbfgragh.onion DNS Name: *.blogs.stg.nytimes3xbfgragh.onion DNS Name: *.blogs5.stg.nytimes3xbfgragh.onion DNS Name: *.dev.nytimes3xbfgragh.onion DNS Name: *.dev.blogs.nytimes3xbfgragh.onion DNS Name: *.newsdev.nytimes3xbfgragh.onion DNS Name: *.prd.nytimes3xbfgragh.onion DNS Name: *.sbx.nytimes3xbfgragh.onion DNS Name: *.stg.nytimes3xbfgragh.onion DNS Name: *.stg.blogs.nytimes3xbfgragh.onion DNS Name: *.stg.newsdev.nytimes3xbfgragh.onion DNS Name: www.bestsellers.nytimes3xbfgragh.onion DNS Name: www.homedelivery.nytimes3xbfgragh.onion

Izmaki 9y ago
What does this mean in regular human terms?
- belorn 9y ago
  Extended Validation certificate is when a company go to a CA and provide a bunch of business documents and legal proof that they really own the company behind a name. Its not a technical aspect but human lawyer <-> human lawyer that establish a certificate. At the end if the validation is successful, the company get a technical signed document that in browsers shows up as a green lock and the name in green next to the URL.
  - colejohnson66 9y ago
    So in addition to knowing that your browser is connected to where you want, you now know that the website you want is actually who they say they are?

icc97 9y ago

This is a great thing. Tor wants to encourage people to use tor as a normal browser so it's harder to track individuals using tor. Handy graph for anyone curious about the benefits of Tor [0] [0]: https://www.eff.org/pages/tor-and-https https://www.eff.org/pages/tor-and-https

ape4 9y ago

The url is a bit hard to remember. https://www.nytimes3xbfgragh.onion/ https://www.nytimes3xbfgragh.onion/ Is there a directory of .onion sites? (with an easy .onion url)

Gaelan 9y ago
There are no “easy” onion URLs. They are essentially random (hash of a key iirc). It’s possible to generate random URLs until you get a prefix you like, but the time it takes increases exponentially with length of the desired prefix.
- comboy 9y ago
  I wonder why namecoin addresses are not a part of the tor yet. Onion urls should be treated more like IPs.
  - jerheinze 9y ago
    It's in their works, see their proposal 279: https://gitweb.torproject.org/torspec.git/tree/proposals/279-naming-layer-api.txt https://gitweb.torproject.org/torspec.git/tree/proposals/279... As well as this blog post: https://blog.torproject.org/cooking-onions-names-your-onions https://blog.torproject.org/cooking-onions-names-your-onions See also this ticket for following the progress: https://trac.torproject.org/projects/tor/ticket/10747 https://trac.torproject.org/projects/tor/ticket/10747
- ape4 9y ago
  I guess there could be a regular website that links to a .onion directory
spyspy 9y ago
I recall that Facebook brute forced their way into having an onion url that was easy to remember, by generating millions of them and then picking one that was simple.
- 9y ago

ringaroundthetx 9y ago

Ah, so disagreement with an administration is what will make everyone eventually to TOR Nothing to hide except when the wrong guy gets in power then you feel naked

matt4077 9y ago
Do you _really_ think the NYT does this out of some specific fear? And if yes, does their adoption of https in 2014[0]\ then imply that they were equally suspicious of the previous administration? [0]: https://open.blogs.nytimes.com/2014/11/13/embracing-https/ https://open.blogs.nytimes.com/2014/11/13/embracing-https/
- ringaroundthetx 9y ago
  Not the NYT itself, no
Buttes 9y ago
More likely for users in China etc.

cczomps 9y ago

Hello everyone,i would like to a help a friend who helped me get out of a dysfunctional and abusive relationship and helped me get proof of infidelity from my ex husband's devices.If you have a similar problem or you need to hack any device or website and you require 100% guarantee and anonymity, reach out to this computer guru via email with BLACKSPOTHACK @ GMAIL DOT COM

thatonechad 9y ago

Not a huge fan of the NYT but this is pretty cool!

nathancahill 9y ago
Careful, you'll cut yourself on that edge!

nobodyorother 9y ago

Does the onion service still serve the same advertisements their website and mobile app do? If so, they're leaving their users-who-want-to-stay-relatively-anonymous open to attack via the advertisement vector. Members of that group would be considered high-value targets simply due to their anonymity desires. I can't see the number of daily users being large enough that they'd lose significant profit by closing that attack vector. Hell, if there was a way to pay NYT enough to disable ads on all their services, I'd do it.

ceejayoz 9y ago
If you're using Tor surely you should be disabling third-party and non-onion assets and JavaScript?
- nobodyorother 9y ago
  Not all entry points do the most paranoid thing, and not options are even available on all entry points. The Tor Browser Bundle (desktop) has different defaults than Orfox (phone), and I think both will connect to non-onion URLs when connecting to an onion site. Same for JS, ad-block, etc.
reaperducer 9y ago
Why not try it and let us know instead of simply making guesses?
- nobodyorother 9y ago
  I was asking because I'm currently nowhere near a system that I'd trust for this purpose. I'll be near one later and, if you're interested, I'll update the question with my findings.
  - jstanley 9y ago
    There exists a system that you wouldn't trust to provide a good-enough answer to the question "Does the onion service still serve the same advertisements their website and mobile app do?" ? What do you think an untrustworthy system is doing that would make it give a not-good-enough answer?

Ajedi32 9y ago

Is there a search engine or other convenient discovery mechanism for Onion services? I know DuckDuckGo has their own hidden service, but it seems that site only returns results from the regular internet, not from other hidden services.

zamber 9y ago
> hidden services I think you responded to your own question. Besides that there are lists of onion services. Apparently there are also search services like https://ahmia.fi/ https://ahmia.fi/
- Ajedi32 9y ago
  It's the real IP address of the service that's hidden, not necessarily its Onion address. In theory, there's no reason `.onion` links couldn't be crawled and indexed by search engines the same way any other website is.
- nathancahill 9y ago
  Although there's a risk to using onion directories, since you have to trust that the hash they give you for the New York Times for example, is actually the real hash. It's easier to spoof onion hashes than domain names since domain names are more well known. You'd hopefully catch that you're connecting to nytim3s.com, not so much nytimes3xbfgra3h.onion.
  - Ajedi32 9y ago
    EV certs can help with this to some extent. For example, the New York Times is using an EV cert with the organization name "The New York Times Company" for their hidden service. So as long as you trust the CA system, you can be certain that you're talking to a server operated by The New York Times, and not just a copycat.
    - nathancahill 9y ago
      Yes, but EV isn't that common on Tor. How would I distinguish Dread Pirate Roberts' Silk Road from FBI's Silk Road in a Tor online directory?

Illniyar 9y ago

Err... does the tor site still have the 10 views a month for free limit? Are tor users supposed to subscribe to NYT - that will surely blow through any privacy you hope to achieve.

detaro 9y ago
See this subthread https://news.ycombinator.com/item?id=15567778 https://news.ycombinator.com/item?id=15567778
- Illniyar 9y ago
  Thanks
woodandsteel 9y ago
I don't know about other browsers, but with Cliqz if I turn it off after 10 articles and turn it on, the NYT starts counting from 0 again.

spodek 9y ago

Does anyone know why they posted this story through Medium?

Spivak 9y ago
Because their own site is paywalled.
deleted 9y ago
[deleted]
mattdotc 9y ago
TimesOpen is an engineer-driven blog. Its previous incarnation was self-hosted on a WordPress stack (separate from our main CMS), but for various reasons it was decided to re-platform. There were many discussions before settling on Medium and alternatives were considered (such as dogfooding our own CMS). We have a lot of work in-flight to modernize and simplify our publishing stack, and the timing wasn't right to rely on internal tools to publish a new blog.
- vintageseltzer 9y ago
  How widely is WordPress being used at NYT today? Seems like it was used a lot about five years ago but don’t see it much anymore.
  - deleted 9y ago
    [deleted]
- nobodyorother 9y ago
  Could you thank the folks involved in this? The TOS is great news.

justinzollars 9y ago

Awesome!

sidcool 9y ago

What would be the advantage here?

mileycyrusXOXO 9y ago
From the /r/tor thread System33 posted a comment[0] originally by Alec Muffet explaining why Facebook set up a TOR service, which may answer some of your questions: Why would anyone run a legal onion service? Thanks Alec Muffett (OP) for the following summary copied from this comment Understandably folk tend to think "Anonymity!" when talking about Tor Onions, but in rolling out the Facebook onion we established several clear benefits: 1. better and safer experience for people accessing over Tor: no interference by exit nodes, no bandwidth-contention for exit nodes, no use of exit nodes at all. 2. "good neighbour" - reciprocally, popular sites can unload themselves from eating up scarce exit-node bandwidth. 3. "a peace offering" - people (continue to) use Facebook over Tor; 3 years ago we saw 500,000/month, more recently ~1 million. Overwhelmingly we found (through measurement and assessment) that people using Facebook over Tor were ordinary folk wanting to do ordinary things. especially in times of political crisis. Providing a metaphorical "olive branch" showed that we value their use of the site. 4. Discretion & Trust. Onion Sites are considered to be about "Anonymity", but really they offer two more features: Discretion (eg: your employer or ISP cannot see what you are browsing, not even what site) and trust (if you access facebookcorewwwi.onion you are definitely connected to Facebook, because of the nature of Onion addressing; no DNS or CA shenanigans are applicable.) [0]: https://www.reddit.com/r/TOR/comments/792mfr/the_new_york_times_is_now_available_as_a_tor/doymov3/ https://www.reddit.com/r/TOR/comments/792mfr/the_new_york_ti...
- cJ0th 9y ago
  Is this mainly intended for people from non-western countries who need a channel for free speech? Because apart from that I see no point in FB offering an onion service. If anonymity, discretion and trust are what I am looking for than surely FB itself is one of the least appropriate platforms for me.
eggpy 9y ago
>The New York Times reports on stories all over the world, and our reporting is read by people around the world. Some readers choose to use Tor to access our journalism because they’re technically blocked from accessing our website; or because they worry about local network monitoring; or because they care about online privacy; or simply because that is the method that they prefer.

rayiner 9y ago

Comical attempt to give Street cred to the NYT.

eggpy 9y ago
Comical how? Check out their tech blog[0]. I'd venture a guess that they are the most technically adventurous news site, if not one of the more open corporations around in regards to trying new technology and writing about the experience. A lot of what they have to say is pretty interesting. [0] - https://open.nytimes.com/ https://open.nytimes.com/
- b1gtuna 9y ago
  I agree. NYTimes has led with technical prowess the past a few years.

patrickaljord 9y ago

The NYT is so pro-establishment it is probably the last site on Earth that would have its domain taken away from them.

juskrey 9y ago
Virtue signalling
matthewbauer 9y ago
Trump would disagree.
- patrickaljord 9y ago
  I don't think he would disagree they are pro-establishment. He'd love them to be taken down though there is no way he could make this happen.
  - juliangoldsmith 9y ago
    I think it's more that he'd prefer that the media didn't cite "unverified" dossiers that they sourced from Buzzfeed [0], which were produced by a source with ties to the DNC [1][2]. [0]: https://www.nytimes.com/2017/01/23/opinion/why-buzzfeed-news-published-the-dossier.html https://www.nytimes.com/2017/01/23/opinion/why-buzzfeed-news... [1]: https://www.nytimes.com/2017/01/11/us/politics/donald-trump-russia-intelligence.html https://www.nytimes.com/2017/01/11/us/politics/donald-trump-... [2]: http://www.washingtontimes.com/news/2017/oct/24/dnc-clinton-campaign-paid-fusion-gps-Trump-dossier/ http://www.washingtontimes.com/news/2017/oct/24/dnc-clinton-...
    - itsnewman 9y ago
      > I'd agree here. There's no reason to discuss politics on HN when there are numerous other places to do so. HN is a forum about technology and the startup world, let's keep it about that.

iandanforth 9y ago

Will this help people in China at all? From an article I ready a while back it seemed like Tor has been defeated there. (https://www.technologyreview.com/s/427413/how-china-blocks-the-tor-anonymity-network/ https://www.technologyreview.com/s/427413/how-china-blocks-t...)

milofeynman 9y ago
That article is from 2012. It's a constant battle, which has changed a LOT in 5 years. https://blog.torproject.org/breaking-through-censorship-barriers-even-when-tor-blocked https://blog.torproject.org/breaking-through-censorship-barr... https://www.torproject.org/docs/pluggable-transports https://www.torproject.org/docs/pluggable-transports
jerheinze 9y ago
Well there's meek-amazon[1] which seems to work there. Also I remember I talked last months to some guy on irc at #tor who was using some obfs4 bridges successfully in China. There's also another pluggable transport named Snowflake[2] where everyone can become a bridge by just running some JS in their browser, which may prove to be a good solution (it doesn't work yet in China since it uses Google for domain fronting). [1] : https://trac.torproject.org/projects/tor/wiki/doc/meek https://trac.torproject.org/projects/tor/wiki/doc/meek [2] : https://trac.torproject.org/projects/tor/wiki/doc/Snowflake https://trac.torproject.org/projects/tor/wiki/doc/Snowflake

schwag09 9y ago

Mozilla is also currently matching all Tor donations: https://donate.torproject.org/pdr https://donate.torproject.org/pdr Consider donating!

pbarnes_1 9y ago

Can someone explain... why?

grzm 9y ago
From the article: > "Some readers choose to use Tor to access our journalism because they’re technically blocked from accessing our website; or because they worry about local network monitoring; or because they care about online privacy; or simply because that is the method that they prefer."
- cJ0th 9y ago
  That's still a bit of a non answer. More to the point: Why does a mainstream news outlet care about this small group of people?
  - grzm 9y ago
    What's your working definition of "mainstream news outlet"? I can't think of a reasonable one that precludes them from broadening their reach. And given their size, they are more likely to have the resources to do so. Also, there are large populations where network monitoring and/or content restrictions are part of everyday life. The New York Times experienced this directly with respect to their iOS app in China. https://www.nytimes.com/2017/01/04/business/media/new-york-times-apps-apple-china.html https://www.nytimes.com/2017/01/04/business/media/new-york-t... Edit to add: To turn it around, why shouldn't the NYT do this? That isn't snark: I'm interested in hearing substantial reasons for the skepticism implicit in 'pbarnes_1 original question. Granted, I haven't read all of the comments for this submission, I haven't seen any that convincingly argue this isn't a useful thing.
    - cJ0th 9y ago
      > What's your working definition of "mainstream news outlet"? A news outlet with a "one size fits most" attitude. That is, they offer a product which caters to people who could be described as "average". Typically companies focus their energy only on (potential) customers, not those who aren't a good fit for the product in the first place. There probably are more profit-promising people out there for the NYT than those who are somewhat crypto-nerds. They don't like clicking ads, some may even feel uneasy using typical payment methods to buy a subscription. > Also there are large populations where network monitoring and/or content restrictions are part of everyday life. yeah, that's reasonable.

jsfreedman 9y ago

For a publication that openly supported the Iraq war and all the suffering that entailed for innocent civilians, its kinda funny that they're suddenly all concerned about people's rights.

conductor 9y ago

What's the point of making it available in the Tor network if their onion site includes a script from www.googletagmanager.com (or an "iframe" if scripting is disabled) thus making it significantly less anonymous? Onion websites should be isolated and should not initiate any connections to vanilla internet. Edit: it also loads scripts from www.google.com, tags.bluekai.com, cdn.optimizely.com...

plg 9y ago

is it still paywalled on the onion service?

shell_scripter 9y ago

you can now get your daily dose of Two Minutes Hate on Tor.

forapurpose 9y ago

I'm seeing a different page at the Tor address than at the regular address. The layout is different: https://www.nytimes3xbfgragh.onion/ https://www.nytimes3xbfgragh.onion/ https://www.nytimes.com/ https://www.nytimes.com/

4684499 9y ago

I don't see the point. A hidden service is set for information can not be safely presented on the public Internet. Like what The Daily Stormer did. If one just wanted to bypass blocking or hide himself from evil third parties, he could just use tor browser to open NYT's regular domain instead of the hidden service domain, no?

deleted 9y ago
[deleted]
Ajedi32 9y ago
Onion services are faster on Tor, since you aren't limited by the bandwidth of the exit nodes. There are also some security benefits, since connections to hidden services are automatically encrypted and authenticated, no HTTPS or trust in Certificate Authorities required (though HTTPS with EV certs can still be useful for identification purposes).
superkuh 9y ago
You don't own a traditional domain. You are given temporary permission to use it. A tor onion address is something you can actually own.

RustyRussell 9y ago

Tried to show my support by subscribing over Tor, unf: This action is not supported over Onion yet, sorry. Which kind of makes sense, since you were probably about to ask my CC info, but still...