3 ms·

This article is from 2014. I did a lot of research on this a few years ago, and found plenty of circumstantial evidence that either (a) TOR is a honeypot, or (b

This article is from 2014. I did a lot of research on this a few years ago, and found plenty of circumstantial evidence that either (a) TOR is a honeypot, or (b) a large % of users have bad OPSEC, or (c) both a and b are true. Because of “parallel construction” (1) it will always be difficult to really get to the bottom of this issue. I’m not sure we’re ever safe from the prying eyes of nation states. We should all assume we’re never totally secure, and act accordingly. But I get “burnt out” on the level of paranoia necessary for that kind of research. I’m also exhausted from trying to convince others to wake up from their apathy over privacy and security. Security is a process that requires continuous improvement. New exploits, new information, and new technology will never stop affecting our security postures. I accept that I will miss things, get breached, and improve over time. For whistle-blowers, spies, and criminals, breaches have much more severe consequences. But it’s going to happen to them as part of the “job.” Cat-and-mouse, I suppose. Anyway, I assume Tor isn’t secure, because no networks are secure. 1.https://en.m.wikipedia.org/wiki/Parallel_construction https://en.m.wikipedia.org/wiki/Parallel_construction

qnsi 8y ago
Most people just simply dont care. Take Facebook for example. I heard from multiple people telling me they think FB listens to them and show them ads about what they talk about. I ask them, will they stop using FB because of it? No! All my friends use Facebook. There is no hope for our world. Facebook Google can do whatever they want. Why would people care about government spying on them?
- NoPicklez 8y ago
  You need to remember that the data world we live in today is very new. And the understanding of data privacy and its implications are mostly only understood by those in the realm of technology. For the average person knowing that Facebook listens to them and shows them ads about what they search and talk about, probably doesn't care because they don't know what the impact is to them, or perhaps they don't see an immediate impact. Realistically, in the world of surrounding problems and concerns that we each have in our daily lives, Facebook showing me ads based on what I search for is probably quite low on the list. I work in IT & Cyber risk and one thing I have learnt is that just because something sounds bad doesn't mean it realistically is. Everyone of us lives in a world of risks that are individual to each of us each day, some risks we rate higher than others for various reasons based on their consequence and likelihood. Therefore for a risk to be large enough for people to take action or mitigate, it needs to have a tangible impact on people's lives first and foremost. People have different risk appetites and therefore I may choose to mitigate the risk by putting less information into my Facebook account, you may choose to completely stop using the service and delete your account. I could talk all day about the potential reasons why its a bad idea for Facebook to provide advertisements based on search history. But I don't have enough time in the day to take into account everything that people say I should care about as much as each person thinks I should.
belorn 8y ago
When people claim Tor is a NSA honeypot I have now a default reply: how much faith do you have in the opsec of NSA to run continuously each year with leakers like Snowden and Manning? opsec is hard to do for dedicated security researchers. It is very hard. The difficulty of OPSEC is why I personally have faith in that the engineers for nuclear reactors are not all undercover foreign spies. Even for the most well funded organizations, doing perfect operational security for decades on end is an almost impossible task. If you also need to produce results, like if the majority Tor relay operators were all secret NSA employees, I see that as close to impossible to do for 16 years. > assume we’re never totally secure, and act accordingly That is true. Assume that at any given year NSA could be running the Tor network only to be discovered the next year. I do however doubt that they have that good opsec to have been running for 16 years, through all the leaks, and not be discovered.

qnsi 8y ago

Most people just simply dont care. Take Facebook for example. I heard from multiple people telling me they think FB listens to them and show them ads about what they talk about. I ask them, will they stop using FB because of it? No! All my friends use Facebook. There is no hope for our world. Facebook Google can do whatever they want. Why would people care about government spying on them?

NoPicklez 8y ago
You need to remember that the data world we live in today is very new. And the understanding of data privacy and its implications are mostly only understood by those in the realm of technology. For the average person knowing that Facebook listens to them and shows them ads about what they search and talk about, probably doesn't care because they don't know what the impact is to them, or perhaps they don't see an immediate impact. Realistically, in the world of surrounding problems and concerns that we each have in our daily lives, Facebook showing me ads based on what I search for is probably quite low on the list. I work in IT & Cyber risk and one thing I have learnt is that just because something sounds bad doesn't mean it realistically is. Everyone of us lives in a world of risks that are individual to each of us each day, some risks we rate higher than others for various reasons based on their consequence and likelihood. Therefore for a risk to be large enough for people to take action or mitigate, it needs to have a tangible impact on people's lives first and foremost. People have different risk appetites and therefore I may choose to mitigate the risk by putting less information into my Facebook account, you may choose to completely stop using the service and delete your account. I could talk all day about the potential reasons why its a bad idea for Facebook to provide advertisements based on search history. But I don't have enough time in the day to take into account everything that people say I should care about as much as each person thinks I should.

belorn 8y ago

When people claim Tor is a NSA honeypot I have now a default reply: how much faith do you have in the opsec of NSA to run continuously each year with leakers like Snowden and Manning? opsec is hard to do for dedicated security researchers. It is very hard. The difficulty of OPSEC is why I personally have faith in that the engineers for nuclear reactors are not all undercover foreign spies. Even for the most well funded organizations, doing perfect operational security for decades on end is an almost impossible task. If you also need to produce results, like if the majority Tor relay operators were all secret NSA employees, I see that as close to impossible to do for 16 years. > assume we’re never totally secure, and act accordingly That is true. Assume that at any given year NSA could be running the Tor network only to be discovered the next year. I do however doubt that they have that good opsec to have been running for 16 years, through all the leaks, and not be discovered.