4 ms·

Oh please, not this FUD spreader again. The Tor Project finances and IRS Form 990 are openly and publicly available: https://www.torproject.org/about/financial

Oh please, not this FUD spreader again. The Tor Project finances and IRS Form 990 are openly and publicly available: https://www.torproject.org/about/financials.html.en https://www.torproject.org/about/financials.html.en Yes, a sizeable portion comes from the US government, and from the NSF, from the Open Technology Fund (OTF) ..et cetera and over the years the number of donations that they receive has been increasing, especially with the campaign last year where Mozilla matched donations: https://blog.torproject.org/powering-digital-resistance-help-mozilla https://blog.torproject.org/powering-digital-resistance-help... (they reached 400k$ with Mozilla grants IRC) The way it works is that there's a set of deliverables or goals that must be fulfilled and that get a funding from Sponsor X. And there's a wiki page with all the Sponsors and the set of deliverables https://trac.torproject.org/projects/tor/wiki/org/sponsors https://trac.torproject.org/projects/tor/wiki/org/sponsors For example for SponsorV https://trac.torproject.org/projects/tor/wiki/org/sponsors/SponsorV https://trac.torproject.org/projects/tor/wiki/org/sponsors/S... > Timeline > October 2015 - September 2018 (...) > Overview > Joint project with Georgetown and NRL focusing on research about resilience to attacks that reduce anonymity or that deny service. > The grant also includes a "transition to practice" component, which means we should not only help with the research side, but also build and deploy the more promising solutions. > Deliverables > + Produce research papers > + Release software (e.g. Tor) that includes fixes based on the research papers > + Work with Micah Sherr and Rob Jansen THIS IS ALL PUBLICLY AVAILABLE. WHAT THE HELL IS SPOOKY ABOUT THIS? DO YOU KNOW OF AN OPEN SOURCE ORGANIZATION THAT IS AS TRANSPARENT AS THE TOR PROJECT? To Mr. Yasha Levine: Please point to a single alternative that offers the same low-latency anonymity as Tor if you're serious. And yes, Mr. Yasha Levine has a big history of pushing smears like this on the Tor Project, see this for example: https://micahflee.com/2014/12/fact-checking-pandos-smears-against-tor/ https://micahflee.com/2014/12/fact-checking-pandos-smears-ag...

Passthepeas 9y ago
Simple, there aren't any. Never, EVER, assume anonymity on the internet. Also I'll add the fact that if you even so much as download Tor, you have made it on a watch list; also exit nodes are a massive vulnerability. With those two things plus government involvement, it is unwise to assume Tor is anything but a honeypot. You want anonymity? Keep a low profile and try to hide in plain sight, maybe check out some add-ons recommended on privacytools.io
- jerheinze 9y ago
  > Simple, there aren't any. Never, EVER, assume anonymity on the internet. Please read my question again: "Please point to a single alternative that offers the same low-latency anonymity as Tor if you're serious." > You want anonymity? Keep a low profile and try to hide in plain sight, Your IP will be linked to all of your traffic, nice solution! > maybe check out some add-ons recommended on privacytools.io No amount of addons there will protect you against traffic analysis. Heh... FWIW privacytools.io recommends the Tor Browser, OnionShare, Tails, Qubes+Whonix ... from the Tor ecosystem, maybe you may want to check out those since you're so interested in their recommendations :)
  - saas_co_de 9y ago
    Nobody else has millions of dollars in US military/intelligence cash to build and advertise their alternatives ... so the lack of non MI funded alternatives proves nothing.
    - jerheinze 9y ago
      > Nobody else has millions of dollars in US military/intelligence cash to build and advertise their alternatives .. You don't need millions of dollars to build an anonymity system, just look at how much funding projects like I2PD receive.
- paulie_a 9y ago
  If you really think you will end up on a watchlist for downloading Tor it sounds like a good reason to download Tor. The more the better.
- mtgx 9y ago
  That's some bad advice all around. If everyone thought like that we wouldn't even have HTTPS because "why would you want to hide your internet traffic?!" "Hiding in plain sight" doesn't work. At all. The NSA has automatic systems that classify everything you do online and then it issues alerts if enough "signals" are gathered. That also means that the more stuff you do in "plain sight" the better it will know what you're doing, as the data will have very high accuracy rates.
detaro 9y ago
That Tor is funded by the US gov is well known, yes, but a close look at that is warranted. I have neither the time nor knowledge to judge the details for now, but claims like "passing on security reports to government contacts" (https://surveillancevalley.com/blog/claim-tor-does-not-provide-backdoors-to-the-u-s-government https://surveillancevalley.com/blog/claim-tor-does-not-provi...) at least look bad if the the claim is that Tor merely profits from the relationship to build the best tool possible, even if the author presents it a bit over-sensational. Let's wait what they'll extract from the documents and judge that instead of immediately claiming it as FUD.
- jerheinze 9y ago
  > Let's wait what they'll extract from the documents and judge that instead of immediately claiming it as FUD. It's FUD, let me explain: before the coming of pluggable transports it was easy to distinguish Tor traffic from TLS, which made blocking by censors (like China and Iran) easy since they didn't need to find all bridges addresses but could instead fingerprint Tor traffic to block it. As you can see from the documents Dr. Steven Murdoch outlined a roadmap for working on that, since that item ("TLS Normalization") was one of the deliverables for the sponsor > One of the Oct 1 deliverables is a roadmap for TLS normalization. I have a draft of this for your preusal Where's the problem in this? Mr. Yasha interprets this as meaning "They reported to the spooky agents security vulnerability!" when the fact that Tor traffic doesn't look like TLS was a known problem to everyone that had the slightest knowledge on how Tor works. Now can anyone explain how this isn't deliberate FUD spreading and an insult to the very people who were working on making Tor more censorship resistant, i.e. Dr. Steven Murdoch and Dr. Roger Dingledine? (FWIW I talked to Roger on irc once and he was very offended by the smears that were spread by Pando like this one)
  - detaro 9y ago
    After looking at the timeline in more detail you are right, they frame this completely misleading. Some of the comments then seem odd, but the meat of the argument just doesn't make any sense.
    - 9y ago
crdoconnor 9y ago
It's also publicly available information that tor doesn't even attempt to protect against deanonymization (e.g. timing) attacks from nation-state adversaries that control entry and exit nodes. It's not exactly well advertised though. It's not like it would be impossible to put in protections either - it could be done at the expense of latency and bandwidth. The idea that it is being run as a honeypot is not exactly far fetched given the security model and funding sources.
- ohmygodel 9y ago
  The problem seems well-advertised to me. From the Tor FAQ (https://www.torproject.org/docs/faq.html.en#AttacksOnOnionRouting https://www.torproject.org/docs/faq.html.en#AttacksOnOnionRo...): "it is possible for an observer who can view both you and either the destination website or your Tor exit node to correlate timings of your traffic as it enters the Tor network and also as it exits. Tor does not defend against such a threat model." I think that Tor does already implement some padding protections, specifically against correlation via NetFlow records. See the spec at <https://gitweb.torproject.org/torspec.git/tree/padding-spec.txt> https://gitweb.torproject.org/torspec.git/tree/padding-spec.... and an implentation history at <https://trac.torproject.org/projects/tor/ticket/16861> https://trac.torproject.org/projects/tor/ticket/16861>. The effectiveness of further padding protections aren't clear unless you go to full padding, which is very expensive (probably impossible for mobile clients, for example). Tor is successful, in my opinion, because it understands that reducing performance reduces users and thus actually harms anonymity.
sndean 9y ago
Yeah I don't really see how this is surprising to anyone. Tor was created at the NRL [0] and they're pretty proud of it (you see things like this hanging on walls/doors [1]). Successful projects will always continue to receive funding. [0] https://www.nrl.navy.mil/itd/chacs/dingledine-tor-second-generation-onion-router https://www.nrl.navy.mil/itd/chacs/dingledine-tor-second-gen... [1] https://media.torproject.org/image/official-images/Tor_Poster-001-1024.png https://media.torproject.org/image/official-images/Tor_Poste...
- jerheinze 9y ago
  > Tor was created at the NRL [0] The implementation was created by Roger independently of the NRL.
  - compsciphd 9y ago
    http://www2.technologyreview.com/tr35/profile.aspx?TRID=583 http://www2.technologyreview.com/tr35/profile.aspx?TRID=583 "Computer scientist Roger Dingledine developed Tor under a contract with the U.S. Naval Research Lab; today, the software is distributed by the Tor Project, under the fiscal sponsorship of the Electronic Frontier Foundation."
    - jerheinze 9y ago
      I can't find a source right now, but that refers to his work with Nick and Paul in that famous paper, and as far as I can remember he did code it himself in its first version (whether that was included in the NRL contract is something else).
bpchaps 9y ago
From your post: "These sort of things happen a lot, and they will continue to happen a lot. Like plane crashes, we can study and learn from them each time to make them less likely to happen in the future. Tor continues to improve, and to make these attacks harder, more expensive, or impossible to pull off." This really doesn't give me any confidence.
- jerheinze 9y ago
  Sorry where did you find that exactly? And how is being realistic about Tor's current shortcomings making you lose confidence? By the way for some context on the work of mentioned there see this paper by Paul Syverson https://www.nrl.navy.mil/itd/chacs/sites/edit-www.nrl.navy.mil.itd.chacs/files/pdfs/17-1231-2218.pdf https://www.nrl.navy.mil/itd/chacs/sites/edit-www.nrl.navy.m...
  - bpchaps 9y ago
    It was in the article you posted at the end. /shrug. If your threat model includes state actors, then Tor's current shortcomings are non-trivial and should be treated as such.
    - jerheinze 9y ago
      Oh, well here's what he was talking about, > The Harvard kid who was the only Tor user on Harvard’s network at the time that he sent his bomb threat. > The Freedom Hosting and Silk Road hacks (problems with the web apps that were hosted as Tor hidden services, not with Tor itself). > Exit node sniffing (an issue with people using plaintext protocols on the internet; people are just as vulnerable when using airport wifi, though perhaps they’re less likely to have an attacker on their network than to be using a malicious exit node). As you can see those are problems that Tor can't solve. Micah wasn't talking about some inherent flaws in Tor's design. > If your threat model includes state actors, then Tor's current shortcomings are non-trivial and should be treated as such. Doesn't change the fact that Tor is the best low-latency anonymity system currently and using it is better than not.

Passthepeas 9y ago

Simple, there aren't any. Never, EVER, assume anonymity on the internet. Also I'll add the fact that if you even so much as download Tor, you have made it on a watch list; also exit nodes are a massive vulnerability. With those two things plus government involvement, it is unwise to assume Tor is anything but a honeypot. You want anonymity? Keep a low profile and try to hide in plain sight, maybe check out some add-ons recommended on privacytools.io

jerheinze 9y ago
> Simple, there aren't any. Never, EVER, assume anonymity on the internet. Please read my question again: "Please point to a single alternative that offers the same low-latency anonymity as Tor if you're serious." > You want anonymity? Keep a low profile and try to hide in plain sight, Your IP will be linked to all of your traffic, nice solution! > maybe check out some add-ons recommended on privacytools.io No amount of addons there will protect you against traffic analysis. Heh... FWIW privacytools.io recommends the Tor Browser, OnionShare, Tails, Qubes+Whonix ... from the Tor ecosystem, maybe you may want to check out those since you're so interested in their recommendations :)
- saas_co_de 9y ago
  Nobody else has millions of dollars in US military/intelligence cash to build and advertise their alternatives ... so the lack of non MI funded alternatives proves nothing.
  - jerheinze 9y ago
    > Nobody else has millions of dollars in US military/intelligence cash to build and advertise their alternatives .. You don't need millions of dollars to build an anonymity system, just look at how much funding projects like I2PD receive.
paulie_a 9y ago
If you really think you will end up on a watchlist for downloading Tor it sounds like a good reason to download Tor. The more the better.
mtgx 9y ago
That's some bad advice all around. If everyone thought like that we wouldn't even have HTTPS because "why would you want to hide your internet traffic?!" "Hiding in plain sight" doesn't work. At all. The NSA has automatic systems that classify everything you do online and then it issues alerts if enough "signals" are gathered. That also means that the more stuff you do in "plain sight" the better it will know what you're doing, as the data will have very high accuracy rates.

detaro 9y ago

That Tor is funded by the US gov is well known, yes, but a close look at that is warranted. I have neither the time nor knowledge to judge the details for now, but claims like "passing on security reports to government contacts" (https://surveillancevalley.com/blog/claim-tor-does-not-provide-backdoors-to-the-u-s-government https://surveillancevalley.com/blog/claim-tor-does-not-provi...) at least look bad if the the claim is that Tor merely profits from the relationship to build the best tool possible, even if the author presents it a bit over-sensational. Let's wait what they'll extract from the documents and judge that instead of immediately claiming it as FUD.

jerheinze 9y ago
> Let's wait what they'll extract from the documents and judge that instead of immediately claiming it as FUD. It's FUD, let me explain: before the coming of pluggable transports it was easy to distinguish Tor traffic from TLS, which made blocking by censors (like China and Iran) easy since they didn't need to find all bridges addresses but could instead fingerprint Tor traffic to block it. As you can see from the documents Dr. Steven Murdoch outlined a roadmap for working on that, since that item ("TLS Normalization") was one of the deliverables for the sponsor > One of the Oct 1 deliverables is a roadmap for TLS normalization. I have a draft of this for your preusal Where's the problem in this? Mr. Yasha interprets this as meaning "They reported to the spooky agents security vulnerability!" when the fact that Tor traffic doesn't look like TLS was a known problem to everyone that had the slightest knowledge on how Tor works. Now can anyone explain how this isn't deliberate FUD spreading and an insult to the very people who were working on making Tor more censorship resistant, i.e. Dr. Steven Murdoch and Dr. Roger Dingledine? (FWIW I talked to Roger on irc once and he was very offended by the smears that were spread by Pando like this one)
- detaro 9y ago
  After looking at the timeline in more detail you are right, they frame this completely misleading. Some of the comments then seem odd, but the meat of the argument just doesn't make any sense.
  - 9y ago

crdoconnor 9y ago

It's also publicly available information that tor doesn't even attempt to protect against deanonymization (e.g. timing) attacks from nation-state adversaries that control entry and exit nodes. It's not exactly well advertised though. It's not like it would be impossible to put in protections either - it could be done at the expense of latency and bandwidth. The idea that it is being run as a honeypot is not exactly far fetched given the security model and funding sources.

ohmygodel 9y ago
The problem seems well-advertised to me. From the Tor FAQ (https://www.torproject.org/docs/faq.html.en#AttacksOnOnionRouting https://www.torproject.org/docs/faq.html.en#AttacksOnOnionRo...): "it is possible for an observer who can view both you and either the destination website or your Tor exit node to correlate timings of your traffic as it enters the Tor network and also as it exits. Tor does not defend against such a threat model." I think that Tor does already implement some padding protections, specifically against correlation via NetFlow records. See the spec at <https://gitweb.torproject.org/torspec.git/tree/padding-spec.txt> https://gitweb.torproject.org/torspec.git/tree/padding-spec.... and an implentation history at <https://trac.torproject.org/projects/tor/ticket/16861> https://trac.torproject.org/projects/tor/ticket/16861>. The effectiveness of further padding protections aren't clear unless you go to full padding, which is very expensive (probably impossible for mobile clients, for example). Tor is successful, in my opinion, because it understands that reducing performance reduces users and thus actually harms anonymity.

sndean 9y ago

Yeah I don't really see how this is surprising to anyone. Tor was created at the NRL [0] and they're pretty proud of it (you see things like this hanging on walls/doors [1]). Successful projects will always continue to receive funding. [0] https://www.nrl.navy.mil/itd/chacs/dingledine-tor-second-generation-onion-router https://www.nrl.navy.mil/itd/chacs/dingledine-tor-second-gen... [1] https://media.torproject.org/image/official-images/Tor_Poster-001-1024.png https://media.torproject.org/image/official-images/Tor_Poste...

jerheinze 9y ago
> Tor was created at the NRL [0] The implementation was created by Roger independently of the NRL.
- compsciphd 9y ago
  http://www2.technologyreview.com/tr35/profile.aspx?TRID=583 http://www2.technologyreview.com/tr35/profile.aspx?TRID=583 "Computer scientist Roger Dingledine developed Tor under a contract with the U.S. Naval Research Lab; today, the software is distributed by the Tor Project, under the fiscal sponsorship of the Electronic Frontier Foundation."
  - jerheinze 9y ago
    I can't find a source right now, but that refers to his work with Nick and Paul in that famous paper, and as far as I can remember he did code it himself in its first version (whether that was included in the NRL contract is something else).

bpchaps 9y ago

From your post: "These sort of things happen a lot, and they will continue to happen a lot. Like plane crashes, we can study and learn from them each time to make them less likely to happen in the future. Tor continues to improve, and to make these attacks harder, more expensive, or impossible to pull off." This really doesn't give me any confidence.

jerheinze 9y ago
Sorry where did you find that exactly? And how is being realistic about Tor's current shortcomings making you lose confidence? By the way for some context on the work of mentioned there see this paper by Paul Syverson https://www.nrl.navy.mil/itd/chacs/sites/edit-www.nrl.navy.mil.itd.chacs/files/pdfs/17-1231-2218.pdf https://www.nrl.navy.mil/itd/chacs/sites/edit-www.nrl.navy.m...
- bpchaps 9y ago
  It was in the article you posted at the end. /shrug. If your threat model includes state actors, then Tor's current shortcomings are non-trivial and should be treated as such.
  - jerheinze 9y ago
    Oh, well here's what he was talking about, > The Harvard kid who was the only Tor user on Harvard’s network at the time that he sent his bomb threat. > The Freedom Hosting and Silk Road hacks (problems with the web apps that were hosted as Tor hidden services, not with Tor itself). > Exit node sniffing (an issue with people using plaintext protocols on the internet; people are just as vulnerable when using airport wifi, though perhaps they’re less likely to have an attacker on their network than to be using a malicious exit node). As you can see those are problems that Tor can't solve. Micah wasn't talking about some inherent flaws in Tor's design. > If your threat model includes state actors, then Tor's current shortcomings are non-trivial and should be treated as such. Doesn't change the fact that Tor is the best low-latency anonymity system currently and using it is better than not.