5 ms·

>they just route all your data through TOR which is actually a pretty poor thing to do from an OpSec perspective. Could you elaborate? (On the second half, i.e

>they just route all your data through TOR which is actually a pretty poor thing to do from an OpSec perspective. Could you elaborate? (On the second half, i.e. why you say so.)

Rjevski 8y ago
See my comment above. Basically they host the Tor bridge and so your traffic (before being Torified) is still visible to the upstream carrier.
- ryanlol 8y ago
  I'm sorry, but this is just completely wrong. Traffic is torified on localhost when it goes into the Tor daemon.
dogma1138 8y ago
Because TOR provides anonymity not privacy, privacy and anonymity are in principle opposites the more private something is the less anonymous it is and vise versa. Privacy is the agency you have over controlling your interactions and information, anonymity is the level of distance you have between a certain interaction and your identity. A private conversation cannot be anonymous because you need to be able to establish and verify the identity of the parties involved and have trust in them not to dessiminate that information further. TOR focuses on anonymity which means that if you use it to access things in private such as your gmail or bank account that anonymity goes out the window as you now can be tied to an identity. Pushing everything through TOR can also include services that are not anonymous by definition which can expose your identity.
- logicallee 8y ago
  I think this is an interesting perspective but I need more clarification. Let's take these cases: 1. I am the only user of my logicallee front-end on a server somewhere. Nobody knows who I am. I'm also a shitty admin and don't have ssl enabled properly, everyone between me and the server can see everything between us. 2. Same thing but now I'm a good admin and the conversation with the server is private and nobody can break. 3. Same as 1 except this time instead of being the only user, 1.2 billion other users use it too. Google is a shitty web admin and anyone can decrypt my gmail session. 4. Same thing as 3 except this time Google is a great sys admin and so people can't decrypt session info. Can you talk about the privacy and anonymity levels of these 4 scenarios? What about a scenario 5 where Google is the world's perfect possible admin and their servers are coded to be so secure, nobody at Google can access anyone's inbox or what mail they're sending in practice. Obviously they can in theory, but assume their practice is perfect and doesn't do that. Really interested in your answers.
  - rsync 8y ago
    "Can you talk about the privacy and anonymity levels of these 4 scenarios?" Your thinking is going in the right direction here, but you should consider some deeper analysis of your behavior ... In your example, 1.2B people access gmail - so far, so good. But how many people access gmail and HN ? How about gmail and HN and MeFi ? All during US timezone waking hours ? You can see where I am going with this. Now let's look at a different angle - you only visit gmail, so you're safely back in the 1.2B herd, right ? But how many people visit gmail with OSX ? With OSX vX.Y ? With your screen resolution, your enabled fonts, and your patch level? You might be very surprised at how unique your web hit really is.[1] The point being made here is that if you funnel all of your usage (traffic ?) everywhere, you create a usage "fingerprint" that can then be noticed or logged or tracked or correlated anywhere else you go. It's not hopeless - you could spin up a throwaway VM that you would only use for gmail and nothing else, but again - there are opsec considerations there that can sink the whole operation, just like above, if you aren't very, very careful. [1] https://panopticlick.eff.org/ https://panopticlick.eff.org/
    - logicallee 8y ago
      Are you specifically saying that if someone wants to post to "get you killed.com", the web site for "Exposés that'll probably get you killed. Have an exposé you want to post that'll probably get you killed? Post them here now! We're on tor, too" then out of these two versions: 1. Only log in to tor to visit "get you killed.com" once you're ready to post the stuff that'll get you killed. No other tor usage. 2. Do all your usage through tor, including making your "get you killed.com" post but everything else too. Then out of these two versions, the person who is doing (1) is safer than the person doing (2)?
  - dogma1138 8y ago
    I don’t exactly understand the question I think you are trying to take descrete elements that may be needed to ensure or support privacy such as confidentiality and generalizing them. Let’s think what privacy actually is, privacy in the broadest sense is your sovereignty over yourself. What does privacy means? Privacy means that you control how you interact with the environment, how you think who you interact with, what do you do etc. Let’s take the least private environment one can think of in the western world which is prisons. Now prisons dont have privacy not because they monitor your calls that’s just one part of it, they lack privacy because prison requires you to surrender nearly all of your agency to a higher power. Prisons take control over your entire daily routine, who you can talk to, when and how, what information you can access, anything you own can be searched and taken from you at any time and while you can still have confidential discussions with say a lawyer these discussion aren’t really private as they can only be had under predetermined conditions which you have no agency over. Now let’s take a descrete case for example communications what properties do they need to exhibit to ensure privacy? With email specifically you need to be able to establish an identity which is unique to you that can be used to establish trust with the party you communicate with. You need to be fairly certain that the provider would deliver your correspondence to the intended recipient. You need to be fairly certain that the email provider would not impersonate you or modify the contents of your correspondence. You need to be fairly certain that the email provider would not access your correspondence. You need to be fairly certain that the link betweeen you and your provider is secure and that 3rd parties can not intercept the communications between you and the email provider. Now there can be a bunch of more requirements extrapolated form this but this will be too long. Now again in the descrete case of email what are the technical controls needed to support these requirements? So for the first one it would be mainly account control the provider need to support registration, account security they shouldn’t recycle inactive addresses. The 2nd one is usually implied trust in the competency of the provider meaning that if you send an email to johnsmith@email.com it would go to that address and only to that address. The 3rd and 4th ones are more complicated this can be solved with an implicit trust in the provider or if that trust is not sufficient then through other means like using PGP for your emails. The 5th one is also “tricky” because it expands the model to involve more parties which some can be adversarial but in the most basic approach you need a private link between you and your provider if that private link is established over a public one for example the internet you need some sort of mechanism to validate the identity of your provider and ensure the confidentiality and integrity of the communications this is essentially what SSL/TLS does as it allows parties to prove that they are who they say they are and exchange keys securely. Now in nearly all your cases there was some sort of a technical failure that adversely affected the ability of the email provider to allow you to communicate in private with another party.
- jarfil 8y ago
  Privacy and anonymity are not opposites, you can establish anonymously an encrypted session which gives you both. However, privacy is often paired with authentication, which is the opposite of anonymity.
  - dogma1138 8y ago
    If you establish the session anonymously it cannot be private as you have no idea who you are talking too. Keep in mind that anonymity isn’t Eve not knowing that Alice is talking to Bob but that Alice doesn’t know that it’s Bob who is talking to her regardless of what Eve knows.
    - jarfil 8y ago
      If Alice only knows that Bob is the same one who talked to her a second ago, that on itself doesn't break the anonymity of not knowing which one of 7.5 billion people is Bob. It only becomes a problem if Alice can cross-reference that with some other data to narrow down Bob's identity.
      - dogma1138 8y ago
        Anonymity is when Bob wants to talk to Alice in a way she can’t know it’s Bob who is talking to her. If Bob wants to talk to Alice (regardless if it’s anonymous or not) but he doesn’t want Eve to know it’s a privacy issue. Anonymity applies from the perspective and intention of the sender.
        TrappedInVR 8y ago
        The only balance that might be had between Privacy and Anonymity is the concept of Pseudonymity. Pseudonymity is similar to what you have here or on reddit. I don't know who you are or anything about you, but I can know information about dogma1138. Pseudonymity is creating an identity that then holds its own reputation.

>they just route all your data through TOR which is actually a pretty poor thing to do from an OpSec perspective. Could you elaborate? (On the second half, i.e. why you say so.)

Rjevski 8y ago

See my comment above. Basically they host the Tor bridge and so your traffic (before being Torified) is still visible to the upstream carrier.

ryanlol 8y ago
I'm sorry, but this is just completely wrong. Traffic is torified on localhost when it goes into the Tor daemon.

dogma1138 8y ago

Because TOR provides anonymity not privacy, privacy and anonymity are in principle opposites the more private something is the less anonymous it is and vise versa. Privacy is the agency you have over controlling your interactions and information, anonymity is the level of distance you have between a certain interaction and your identity. A private conversation cannot be anonymous because you need to be able to establish and verify the identity of the parties involved and have trust in them not to dessiminate that information further. TOR focuses on anonymity which means that if you use it to access things in private such as your gmail or bank account that anonymity goes out the window as you now can be tied to an identity. Pushing everything through TOR can also include services that are not anonymous by definition which can expose your identity.

logicallee 8y ago
I think this is an interesting perspective but I need more clarification. Let's take these cases: 1. I am the only user of my logicallee front-end on a server somewhere. Nobody knows who I am. I'm also a shitty admin and don't have ssl enabled properly, everyone between me and the server can see everything between us. 2. Same thing but now I'm a good admin and the conversation with the server is private and nobody can break. 3. Same as 1 except this time instead of being the only user, 1.2 billion other users use it too. Google is a shitty web admin and anyone can decrypt my gmail session. 4. Same thing as 3 except this time Google is a great sys admin and so people can't decrypt session info. Can you talk about the privacy and anonymity levels of these 4 scenarios? What about a scenario 5 where Google is the world's perfect possible admin and their servers are coded to be so secure, nobody at Google can access anyone's inbox or what mail they're sending in practice. Obviously they can in theory, but assume their practice is perfect and doesn't do that. Really interested in your answers.
- rsync 8y ago
  "Can you talk about the privacy and anonymity levels of these 4 scenarios?" Your thinking is going in the right direction here, but you should consider some deeper analysis of your behavior ... In your example, 1.2B people access gmail - so far, so good. But how many people access gmail and HN ? How about gmail and HN and MeFi ? All during US timezone waking hours ? You can see where I am going with this. Now let's look at a different angle - you only visit gmail, so you're safely back in the 1.2B herd, right ? But how many people visit gmail with OSX ? With OSX vX.Y ? With your screen resolution, your enabled fonts, and your patch level? You might be very surprised at how unique your web hit really is.[1] The point being made here is that if you funnel all of your usage (traffic ?) everywhere, you create a usage "fingerprint" that can then be noticed or logged or tracked or correlated anywhere else you go. It's not hopeless - you could spin up a throwaway VM that you would only use for gmail and nothing else, but again - there are opsec considerations there that can sink the whole operation, just like above, if you aren't very, very careful. [1] https://panopticlick.eff.org/ https://panopticlick.eff.org/
  - logicallee 8y ago
    Are you specifically saying that if someone wants to post to "get you killed.com", the web site for "Exposés that'll probably get you killed. Have an exposé you want to post that'll probably get you killed? Post them here now! We're on tor, too" then out of these two versions: 1. Only log in to tor to visit "get you killed.com" once you're ready to post the stuff that'll get you killed. No other tor usage. 2. Do all your usage through tor, including making your "get you killed.com" post but everything else too. Then out of these two versions, the person who is doing (1) is safer than the person doing (2)?
- dogma1138 8y ago
  I don’t exactly understand the question I think you are trying to take descrete elements that may be needed to ensure or support privacy such as confidentiality and generalizing them. Let’s think what privacy actually is, privacy in the broadest sense is your sovereignty over yourself. What does privacy means? Privacy means that you control how you interact with the environment, how you think who you interact with, what do you do etc. Let’s take the least private environment one can think of in the western world which is prisons. Now prisons dont have privacy not because they monitor your calls that’s just one part of it, they lack privacy because prison requires you to surrender nearly all of your agency to a higher power. Prisons take control over your entire daily routine, who you can talk to, when and how, what information you can access, anything you own can be searched and taken from you at any time and while you can still have confidential discussions with say a lawyer these discussion aren’t really private as they can only be had under predetermined conditions which you have no agency over. Now let’s take a descrete case for example communications what properties do they need to exhibit to ensure privacy? With email specifically you need to be able to establish an identity which is unique to you that can be used to establish trust with the party you communicate with. You need to be fairly certain that the provider would deliver your correspondence to the intended recipient. You need to be fairly certain that the email provider would not impersonate you or modify the contents of your correspondence. You need to be fairly certain that the email provider would not access your correspondence. You need to be fairly certain that the link betweeen you and your provider is secure and that 3rd parties can not intercept the communications between you and the email provider. Now there can be a bunch of more requirements extrapolated form this but this will be too long. Now again in the descrete case of email what are the technical controls needed to support these requirements? So for the first one it would be mainly account control the provider need to support registration, account security they shouldn’t recycle inactive addresses. The 2nd one is usually implied trust in the competency of the provider meaning that if you send an email to johnsmith@email.com it would go to that address and only to that address. The 3rd and 4th ones are more complicated this can be solved with an implicit trust in the provider or if that trust is not sufficient then through other means like using PGP for your emails. The 5th one is also “tricky” because it expands the model to involve more parties which some can be adversarial but in the most basic approach you need a private link between you and your provider if that private link is established over a public one for example the internet you need some sort of mechanism to validate the identity of your provider and ensure the confidentiality and integrity of the communications this is essentially what SSL/TLS does as it allows parties to prove that they are who they say they are and exchange keys securely. Now in nearly all your cases there was some sort of a technical failure that adversely affected the ability of the email provider to allow you to communicate in private with another party.
jarfil 8y ago
Privacy and anonymity are not opposites, you can establish anonymously an encrypted session which gives you both. However, privacy is often paired with authentication, which is the opposite of anonymity.
- dogma1138 8y ago
  If you establish the session anonymously it cannot be private as you have no idea who you are talking too. Keep in mind that anonymity isn’t Eve not knowing that Alice is talking to Bob but that Alice doesn’t know that it’s Bob who is talking to her regardless of what Eve knows.
  - jarfil 8y ago
    If Alice only knows that Bob is the same one who talked to her a second ago, that on itself doesn't break the anonymity of not knowing which one of 7.5 billion people is Bob. It only becomes a problem if Alice can cross-reference that with some other data to narrow down Bob's identity.
    - dogma1138 8y ago
      Anonymity is when Bob wants to talk to Alice in a way she can’t know it’s Bob who is talking to her. If Bob wants to talk to Alice (regardless if it’s anonymous or not) but he doesn’t want Eve to know it’s a privacy issue. Anonymity applies from the perspective and intention of the sender.
      - TrappedInVR 8y ago
        The only balance that might be had between Privacy and Anonymity is the concept of Pseudonymity. Pseudonymity is similar to what you have here or on reddit. I don't know who you are or anything about you, but I can know information about dogma1138. Pseudonymity is creating an identity that then holds its own reputation.