5 ms·

The incentives to develop Tor exploits, target Tor users, and the attack surface of the browser could seem to make using it at all an exercise of poor judgement

The incentives to develop Tor exploits, target Tor users, and the attack surface of the browser could seem to make using it at all an exercise of poor judgement. You basically add some anonymity but change your threat model to include an extremely high likelihood of injection attacks, and practically provoke every state level agency to monitor you, where they might have previously ignored you. This was the pgp problem in the 90s where you would essentially be sending a tracer round across the network saying, "hey everyone, these two people are using encryption!" Tor is a great effort and it gets people involved in privacy, but onion routing to exit nodes on the internet has diminishing efficacy, and I think everyone needs a clearer articulation of what and whose problem it solves.

yjftsjthsd-h 8y ago
Disagree: Exploits in the browser bundle would affect stock Firefox or bypass security measure not present in stock. NSA monitors all traffic anyways; they certainly don't ignore normal users.
- dagenix 8y ago
  > NSA monitors all traffic Source for this claim? I don't doubt they monitor what they can - but the sheer volume of internet traffic makes it unlikely that they are able to monitor everything and instead must target specific things to monitor. They have a lot of money and a lot of smart people, but they don't have wizard magic.
  - polshaw 8y ago
    The UK was doing a full take of every packet in 2013, the US are definitely able to. https://en.wikipedia.org/wiki/Tempora https://en.wikipedia.org/wiki/Tempora >The Guardian claims that no distinction is made in the gathering of data between public citizens and targeted suspects.
    - stordoff 8y ago
      After going through volume reduction, so maybe not _strictly_ every packet: > The processing centres apply a series of sophisticated computer programmes in order to filter the material through what is known as MVR – massive volume reduction. The first filter immediately rejects high-volume, low-value traffic, such as peer-to-peer downloads, which reduces the volume by about 30%. They have access, but it isn't necessarily analysed or kept.
  - sdf43543t345 8y ago
    Are you living in 2012? Since 2013 and the snowden revelations, the allegation that IC does at least 30 days full take 100% of internet data traffic (and much longer for encrypted or interesting traffic) is an established fact. Why do you think https penetration is so high today? In 2018, and that big giant data center in Utah, its likely much greater than 30 days. It truly is wizard magic.
  - deleted 8y ago
    [deleted]
  - agumonkey 8y ago
    Some ex NSA tech lead (Bill Binney-something, who quit because of absurd spying) they were drowning in data and were mostly interested into listening more (an easy reason to get more budget iirc). Now they can't inspect everything close, but they do grab the data.
LMYahooTFY 8y ago
I think there is something inherent difficult/impossible about what you propose. From the data presented by the tor project, it seems clear that tor services many people in nations where they're likely to be targeted by the state or other organizations for online activity. With that said, I think defining what and whose problem it solves has a limit imposed by the nature of what we're doing, which is giving people the option to be anonymous and connect to the internet. The more details you articulate, the less effective this system becomes.
- motohagiography 8y ago
  >The more details you articulate, the less effective this system becomes. That statement is the insight that was missing for me. It's correct, but for someone of the belief that things that work magically, necessarily also fail magically, it's hard to place faith in. If Tor depends on a "Tinkerbell effect," I would hope its uses get the quality of scrutiny that ciphers and protocols do.
- deleted 8y ago
  [deleted]
kodablah 8y ago
> onion routing to exit nodes on the internet has diminishing efficacy How about onion routing to peers? Tor provides a great backbone to do this yet so few applications employ it. I have ideas of course, but in general, it's very easy to have a desktop app on your home computer that fires up an onion service you can access from anywhere including mobile. Why more apps that don't have high bandwidth requirements don't use it I'll never know.
- nyolfen 8y ago
  a big a-ha moment for me was understanding tor’s simple utility for punching through nat. it really has a lot of cool uses beyond the usual
  - kodablah 8y ago
    Yup. Here's a few Go lines to serve a dir over http via an onion service: https://github.com/cretz/bine#example https://github.com/cretz/bine#example. Takes a few seconds to setup the service or even less if you set the option to use v3 onion services. Client auth can be configured and it's part of the protocol. Fire it up and serve your at-home photo catalog and view it via something like Orfox on your mobile device.
    - SahAssar 8y ago
      > "a few Go lines" That makes it sound like it is simple, but without looking at the dependencies code it might just be a simple interface to a implementation of a complex protocol.
      - kodablah 8y ago
        Well, sure. That goes with everything, you aren't implementing your own TCP stack for making a simple HTTP server response. The claimed simplicity is in dev time, not in protocol implementation for all layers.
        8y ago
nyolfen 8y ago
“when they might have previously ignored you”, until they have reason to pay attention, when they can query metadata about all of your previous unanonymized traffic
- 21 8y ago
  We know for a fact that NSA has a special interest in tor users: https://motherboard.vice.com/en_us/article/d73yd7/how-the-nsa-targets-tor-users https://motherboard.vice.com/en_us/article/d73yd7/how-the-ns...
  - girvo 8y ago
    Of course, but the parents comment point was that not using Tor has even wider ramifications if you ever draw the ire of some large foe.
solarkraft 8y ago
This is why more people need to use it for everyday stuff. (I do occasionally, but it's a bit slow for some things)

yjftsjthsd-h 8y ago

Disagree: Exploits in the browser bundle would affect stock Firefox or bypass security measure not present in stock. NSA monitors all traffic anyways; they certainly don't ignore normal users.

dagenix 8y ago
> NSA monitors all traffic Source for this claim? I don't doubt they monitor what they can - but the sheer volume of internet traffic makes it unlikely that they are able to monitor everything and instead must target specific things to monitor. They have a lot of money and a lot of smart people, but they don't have wizard magic.
- polshaw 8y ago
  The UK was doing a full take of every packet in 2013, the US are definitely able to. https://en.wikipedia.org/wiki/Tempora https://en.wikipedia.org/wiki/Tempora >The Guardian claims that no distinction is made in the gathering of data between public citizens and targeted suspects.
  - stordoff 8y ago
    After going through volume reduction, so maybe not _strictly_ every packet: > The processing centres apply a series of sophisticated computer programmes in order to filter the material through what is known as MVR – massive volume reduction. The first filter immediately rejects high-volume, low-value traffic, such as peer-to-peer downloads, which reduces the volume by about 30%. They have access, but it isn't necessarily analysed or kept.
- sdf43543t345 8y ago
  Are you living in 2012? Since 2013 and the snowden revelations, the allegation that IC does at least 30 days full take 100% of internet data traffic (and much longer for encrypted or interesting traffic) is an established fact. Why do you think https penetration is so high today? In 2018, and that big giant data center in Utah, its likely much greater than 30 days. It truly is wizard magic.
- deleted 8y ago
  [deleted]
- agumonkey 8y ago
  Some ex NSA tech lead (Bill Binney-something, who quit because of absurd spying) they were drowning in data and were mostly interested into listening more (an easy reason to get more budget iirc). Now they can't inspect everything close, but they do grab the data.

LMYahooTFY 8y ago

I think there is something inherent difficult/impossible about what you propose. From the data presented by the tor project, it seems clear that tor services many people in nations where they're likely to be targeted by the state or other organizations for online activity. With that said, I think defining what and whose problem it solves has a limit imposed by the nature of what we're doing, which is giving people the option to be anonymous and connect to the internet. The more details you articulate, the less effective this system becomes.

motohagiography 8y ago
>The more details you articulate, the less effective this system becomes. That statement is the insight that was missing for me. It's correct, but for someone of the belief that things that work magically, necessarily also fail magically, it's hard to place faith in. If Tor depends on a "Tinkerbell effect," I would hope its uses get the quality of scrutiny that ciphers and protocols do.
deleted 8y ago
[deleted]

kodablah 8y ago

> onion routing to exit nodes on the internet has diminishing efficacy How about onion routing to peers? Tor provides a great backbone to do this yet so few applications employ it. I have ideas of course, but in general, it's very easy to have a desktop app on your home computer that fires up an onion service you can access from anywhere including mobile. Why more apps that don't have high bandwidth requirements don't use it I'll never know.

nyolfen 8y ago
a big a-ha moment for me was understanding tor’s simple utility for punching through nat. it really has a lot of cool uses beyond the usual
- kodablah 8y ago
  Yup. Here's a few Go lines to serve a dir over http via an onion service: https://github.com/cretz/bine#example https://github.com/cretz/bine#example. Takes a few seconds to setup the service or even less if you set the option to use v3 onion services. Client auth can be configured and it's part of the protocol. Fire it up and serve your at-home photo catalog and view it via something like Orfox on your mobile device.
  - SahAssar 8y ago
    > "a few Go lines" That makes it sound like it is simple, but without looking at the dependencies code it might just be a simple interface to a implementation of a complex protocol.
    - kodablah 8y ago
      Well, sure. That goes with everything, you aren't implementing your own TCP stack for making a simple HTTP server response. The claimed simplicity is in dev time, not in protocol implementation for all layers.
      - 8y ago

nyolfen 8y ago

“when they might have previously ignored you”, until they have reason to pay attention, when they can query metadata about all of your previous unanonymized traffic

21 8y ago
We know for a fact that NSA has a special interest in tor users: https://motherboard.vice.com/en_us/article/d73yd7/how-the-nsa-targets-tor-users https://motherboard.vice.com/en_us/article/d73yd7/how-the-ns...
- girvo 8y ago
  Of course, but the parents comment point was that not using Tor has even wider ramifications if you ever draw the ire of some large foe.

solarkraft 8y ago

This is why more people need to use it for everyday stuff. (I do occasionally, but it's a bit slow for some things)