11 ms·
Zed Shaw: Why I Don't Use Tor
- alanh 16y ago“@zedshaw If you don't trust Tor because of me, you clearly do not understand how Tor works. You can BadExit my nodes buddy.” Appelbaum, https://twitter.com/#!/ioerror/status/19703396818747392 https://twitter.com/#!/ioerror/status/19703396818747392
- zedshaw 16y agoI was curious about this, so I started googling for how to do this. Sure enough, it's a bitch and the only way to really do it easily is to use a GUI like Tork. Not to mention I can't seem to figure out how you find his nodes in order to BadExit them, and I very seriously doubt his nodes will get listed in anything official. Anyone got good instructions on how to actually BadExit his nodes? I want to post them so people actually can.
- praptak 16y agoWhy would you even want to BadExit his nodes? Using Tor you're vulnerable anyway. Any exit node can snoop on your traffic or even change it. Enumerating some bad nodes does not substantially improve this. The above can only be prevented by using something like SSL plus a trusted certificate on top of Tor.
- marcinw 16y agoRight, and the people who are running malicious Tor exit nodes won't tell you that either. Good luck with that.
- mfukar 16y agoIt's up to the Tor user to encrypt her end-to-end traffic. If that's what she wants.
- ahn 16y ago> Why would you even want to BadExit his nodes? To further malign him of course.
- insect 16y agoIf you add this to your torrc: ExcludeNodes $0AD3FA884D18F89EEA2D89C019379E0E7FD94417,$3100A70862157E5F9136B6AAEB7571745D4DC055,$49E2C345FDA5E9ADFE13320690BF2C77EA803E6C,$4A0CCD2DDC7995083D73F5D667100C8A5831F16D,$5FABB67A4C229ECACD53F5E02B62C87E5300728D,$62665FD8A07D2E0F6ABDB4A36283A5A8824C0128,$6AF64BD1DF8B92D5194760C2256EBF80F70273DD,$71B7F2406DDAE829979B53963B952E17CD021125,$8522EB98C91496E80EC238E732594D1509158E77,$D67C5F501DAA0EE65AF9422A36385217D8AD3927,$EFE02E652CA2EB6FD96B30DC77EA55ABF7EFC1A5 Then your traffic will never pass through any Tor node that Jacob has publicly admitted to controlling. To verify this: Check https://www.torproject.org/docs/tor-manual-dev.html.en https://www.torproject.org/docs/tor-manual-dev.html.en for the ExcludeNodes directive. There is an ExcludeExitNodes option, if you're willing to tolerate him as a middle-man, and just not exit out his nodes. Check one of the online directory servers (e.g. http://torstatus.blutmagie.de/ http://torstatus.blutmagie.de/) and use the Advanced Query Options to find all the nodes where "Contact" - "Contains" - "appelbaum.net" to find which nodes he administers. Then add the fingerprint of every node you want to avoid to the ExcludeNodes entry. You should obviously confirm the list above with other sources, because one or all of the following might be true: 1. I may be in cahoots with Jacob, plotting to hack your codez. 2. The directory server I linked to may be a co-conspirator. Fortunately, there are other directory servers you can query. 3. There is no three. Anybody can put up a node and declare anything. If Jacob, or I, are using Tor nodes nefariously, do you really think we'll put our names on them? P.S. Don't forget to restart Tor after you change the torrc.
- zedshaw 16y agoWOW. So usable. I'm sure everyone who doesn't trust his affiliation with Wikileaks will just sit right down and punch that in.
- praptak 16y agoIf Appelbaum actually works on Tor then just BadExit'ing his nodes is obviously not enough. Even a clean compile (for the paranoid: do you trust your compiler?) from a fully audited (do you have the resources?) source code is not enough. In order to use Tor you gotta trust the other nodes, including the code that runs there.
- deleted 16y ago[deleted]
- zedshaw 16y agoI doubt Jacob is hacking his own code, he'd have way too much to lose and I do believe he actually loves the project. If he were to do anything it'd be handing interesting traffic off various exit nodes he and friends control to Wikileaks. That'd be about all I or anyone else could allegedly claim.
- praptak 16y agoOk, but (if I understand how Tor works) then the fact that he works on Tor has nothing to do with his control of exit nodes. Anybody can run an exit node, whether or not they work on Tor.
- blasdel 16y agoEspecially since bad actors (including governments) have been running exit nodes and sniffing the traffic — Wikileaks got its start by doing it, and the Chinese got access to a bunch of embassy webmail accounts that way. Tor exit nodes are already extraordinarily untrustworthy, one run by anyone associated with Wikileaks might as well be a chinese room with Hitler inside!
- redthrowaway 16y agoAm I the only one who is disappointed that two supposedly professional adults can't manage to have a grown up conversation about this? Reading the back and forth is pretty disheartening.
- rbanffy 16y agoI think you are starting from a false supposition.
- zedshaw 16y agoOh, it's pretty much impossible to have any rational conversation these days. The majority of the technology speech these days is manipulative, flat out wrong, very anti free speech, and hyperbolic. When you start from that, there's just no point trying to be reasonable.
- redthrowaway 16y agoWhile I agree, you started the conversation by breaking Godwin's Law. I don't think Applebaum paid particularly close attention to your piece, but I probably wouldn't either in his position. A cursory skimming of your post reads as, "would you eat a sandwich from Hitler? No? Then why do you use software from Applebaum?" I don't think that's a fair distillation of your argument, but it is reasonable to think that someone briefly scanning your work might think it to be so. Complaining about tech speech being hyperbolic whilst simultaneously [implicitly] comparing Applebaum to Hitler is a little ballsy, tbh.
- blasdel 16y agoYou not only got that backwards, but Godwin's law is not one that can ever be 'broken' — just because you haven't used Hitler in an analogy yet doesn't mean you aren't asymptotically approaching such a comparison. Using der Fürher in an internet argument is a realization Godwin's law, not a violation of it.
- burgerbrain 16y agoWhat's so immature about Appelbaum's response? It seems like a pretty reasonable offhand dismissal of a silly accusation.
- wazoox 16y ago> P.S. I have a long bet that SELinux is an NSA backdoor. Any takers? I don't know if it's an NSA backdoor, but there were several security alerts related to SELinux. I don't understand why all common distros use this. I don't, I compile my kernels from unpatched vanilla source.
- est 16y ago> there were several security alerts related to SELinux. Can you elaborate?
- wazoox 16y agoThere were several security advisories in the past years, of various privilege escalation or other security holes that were actually in SELinux and not present in the vanilla source. I didn't keep a log of the details but you probably can find them in the advisories archives.
- TheCondor 16y agoHoles SELinux created? Or holes where SELinux was circumvented in new or changed functionality? I'm not aware of any time SELinux has actually introduced a new hole.
- wazoox 16y agoI don't remember precisely, just that the proof of concepts simply didn't work on a kernel without SELinux. When the proof of concept is for instance a privilege escalation, this is quite significant.
- dfhjtyjty 16y ago-----( http://ta.gg/4wt http://ta.gg/4wt )------ -----( http://ta.gg/4wt http://ta.gg/4wt )------ -----( http://ta.gg/4wt http://ta.gg/4wt )------ -----( http://ta.gg/4wt http://ta.gg/4wt )------ -----( http://ta.gg/4wt http://ta.gg/4wt )------ -----( http://ta.gg/4wt http://ta.gg/4wt )------ -----( http://ta.gg/4wt http://ta.gg/4wt )------ -----( http://ta.gg/4wt http://ta.gg/4wt )------ -----( http://ta.gg/4wt http://ta.gg/4wt )------ -----( http://ta.gg/4wt http://ta.gg/4wt )------
- tonfa 16y agoWikileaks is supposed to ensure anonymity to leakers, so I don't see how contributing to both projects is contradictory...
- anonymous246 16y agoThe softly stated allegation is that Wikileaks can use their knowledge of Tor weaknesses to SNOOP and extract traffic not directed at them. At least, that's what I understood.
- jasonwatkinspdx 16y agoIt's somewhat informative to compare Zed's response to personal criticisms vs those he targets with his own criticisms. Follow the chain of twitter replies and make up your own mind.
- axod 16y agoSo much name calling and playground idiocy. Just looking at a sample of the tweets made my head hurt. Surely most of us don't use Tor because 1. It's slow as hell 2. We're not doing anything illegal or trying to get past censorship
- jasonwatkinspdx 16y agoI agree with 1. I think 2. is interesting to talk about, because the intersection of legal activities with what those in power find objectionable is the battlefront of liberty. So while Tor may not be interesting to joe public yet, I do think it's worth exacting discussion of it's strengths and flaws. FWIW this includes Zed's criticisms up until the point he took his ball and went home.
- dublinclontarf 16y agoWell I did try to use Tor to get past censorship(I'm in China) and it's not effective here unless you already know someone outside the Chinese network to connect to (that is not a public ip). They (Tor) are losing their fight. IMO
- loup-vaillant 16y agoSuppose the FreedomBox catches on, and there's a Tor node on half of them. That could represents millions of Tor exit nodes within 5 years. That should turn the tide, don't you think?
- trotsky 16y agoIf we're playing the suppose game, what if the chinese government collapses? That'd turn the tide too, and there's probably a better chance of that happening then there ever being millions of tor exits.
- redthrowaway 16y agoIt's an interesting question. If Project Vigilant had compromised Tor, I'd expect there to be quite a few pedophiles who had used it to share cp getting busted. I'm not aware of any such incidents, let alone many. I imagine that the government wouldn't want to give away that they had it compromised, and so would simply use the information to compose a list of people to watch for slip ups, but one would expect to see a rise in the number of arrests, which would likely get at least some play in the MSM. Conversely, if the NSA had compromised it one would expect to see no outward signs, as they a) don't care about pedophiles, b) would claim "national security" to hide the means of tracking terror suspects from the public's eye, and c) likely wouldn't tell anyone when they did apprehend someone. I think it's probably pretty likely that the NSA is running a few nodes, but that's the risk you take wit something like Tor, just as bittorrent seeders risk riaa proxies downloading from them.
- narag 16y agoI find funny that I was re-reading a novel this morning during the commute, about a WWII cryptographer and arrived at the point were he sees that the warning in every secret document was "never take any action that could reveal the enemy that we can break their encryption".
- redthrowaway 16y agoI don't suppose MILINT has gotten any less competent in the last 60-odd years, but not disclosing that Tor is compromised would seriously hamper using it as a source for law enforcement, hence my thinking it would be more likely to be NSA. If so, I doubt we'd ever know, short of somebody leaking it.
- yardie 16y agoIf there was an organized effort to bust people using Tor then a pattern would emerge. In so much if they were high-profile targets (political dissidents, whistleblowers, spies, etc.). If they were cp collectors I don't think anyone would care enough to do an investigation.
- limmeau 16y agoSo why use OpenSSL, then? It's been written by people I don't know. Some of them may be Vigilants. Some of them may be secret members of the Wikileaks team. One of them even studied only 12km from the BND headquarters. It has had exploitable holes before.
- zedshaw 16y agoI don't use OpenSSL in software I wrote if I don't have to. :-)
- trustfundbaby 16y agoGreat ... I'm going to have to stop using the internet now, since it came from a United States Department of Defense project.
- bjonathan 16y agoFull twitter conversation between @zedshaw and @ioerror: http://nearmetter.com/ioerror/zedshaw http://nearmetter.com/ioerror/zedshaw (I'm in no way affiliate to NearMetter, it's just the best way I found to easily read a twitter conversation)
- JayNeely 16y agoBettween.com is good for this sort of thing, and looks like it does a better job of threading which tweets others are in reply to than NearMetter is doing. http://bettween.com/ioerror/zedshaw http://bettween.com/ioerror/zedshaw
- kirubakaran 16y agoTheir cockfight theme is brilliant. If they had voting, bystanders can egg the participants on and add fuel to the fight... not that this particular duo need to be. When one "wins" votes, this can be displayed http://www.ruleworks.co.uk/poultry/images/mating.jpg http://www.ruleworks.co.uk/poultry/images/mating.jpg
- yardie 16y agoOMG! The government created something useful therefore it can only, fundamentally, be a trojan horse. While I'm sure there could be some crackers out there trying to insert bad code. I also believe these things tend not to stick around for long. Especially when blame says "Hey, I've inserted code here, here and here. Try not to read me too closely." I've tried Tor in the past and I stopped because: * It's really slow. * It's the chatroulette of really questionnable material. You stumble into some shit and think WTF?! * The amount of traffic it generated caused my shitty router to slow down significantly or crash completely.
- shareme 16y agoIf wikileaks can snoop tor nodes to get its first data release than that is in fact a trojan horse..no imagination required..
- loup-vaillant 16y agoAs I understood it, some of the guys who leaked material for Wikileaks did so by using Tor normally, like would a Chinese journalist. Wikileaks doesn't need to crack or misuse Tor in any way to receive leaks through it.
- drats 16y agoAd Hominems are a-ok now are they? Well here's Zed's thought process: a) Read Greenwald Salon article accusing Wired of having shady connections. b) Roll that basic premise into a set of wild accusations and things we already know about Tor. c) Sit back and enjoy the whole chaos of the troll. When someone attacks bring out the usual sockpuppets and sycophants to say "but Zed does all this great coding", "Zed is not like that in real life/conferences". d) Profit/save on therapist fees by feeding own teenager-like angst and need for attention.
- Deestan 16y agoThere's more to Ad Hominem arguments than unjustified personal insults.
- loup-vaillant 16y agoNot much. When someone does something, and that same person has a goal that you disapprove of, you have to think about two things: the influence of that deed on that naughty goal, and and the influence of that deed on your goals. Note that those two things can be conflated in one: if you disapprove some goal, then a part of your goal is to make that not happen. So in the end, the only thing that matters is the influence of the deed on your goals, period. Now the deed cannot be evaluated alone. You need to know how it interacts with the world. And the first place to look at is the other deeds of the same person. (There lies the validity of Ad Hominem arguments.) However it's not the only place to look at. For instance, if a Paper-Clip-Maniac wants to solve the Friendly AI problem, you probably don't want that problem solved: it could fill the universe with paper clips, wiping out all sentient life in the process. Now, say you're a transhumanist, and you want to cure Death. Solving the FAI problem suddenly look much better. It may even be worth the risk induced by that Paper-Clip-Maniac.
- jerf 16y agoAd hominem is a fallacy when the motives or nature of the arguer are brought up inappropriately. If it is relevant, it is not ad hominem, usually because it expands into something else if you really think about it. As long as we've suspended Godwin's Law for the day... "The sky is blue." "He's a Nazi!" is ad hominem. "Has anyone noticed the Jews have an awful lot of banking jobs?" "He's a Nazi!" is, if true, very relevant. The first statement is likely not just a mere observation that may be true or may be false but is historically associated with antisemitism and is probably being used as the thin end of the wedge and not a neutral observation. It's relevant here because it expands into an argument where the origins and motivations of the arguer are in fact very relevant. Similarly, when you see a new physics theory coming from a known crackpot, while the fact they are a crackpot may technically have no effect on the truth value of the theory, when it comes time for you to evaluate the theory you are justified in noticing it's coming from a crackpot. Bayesian logic lets you express it even more cleanly; in Aristotelian logic the motivations of the speaker are irrelevant to the abstract truth of the statement; in more practical Bayesian logic, as you personally examine the likely truth value of somebody else's statement (with no presumption of access to the abstract truth) their motivations can be very relevant. "ad hominem" is over-weighting their motivations or falsely weighting their motivations, and under this formulation you also get reverse ad hominem, in which you under-weight their motivations, which is every much a fallacy as the original ad hominem, and which Zed talks about in his post. All things considered, people being hyper about ad hominem is probably better than letting it slide too often, because it is certainly true that on average it is not a valid attack. But he's absolutely correct that it is sometimes valid, and while I'm not sure Zed's necessarily correct about Tor, I do think he's a lot more justified in his opinions than the pileon here consensus is indicating.
- g_lined 16y agoThis, to me, sounds like a classic case of not knowing what you're protecting against. TOR hides your IP address by preventing the destination server ever needing to do a TCP/IP handshake. There is no way to complete a TCP/IP handshake without you revealing your IP address. TOR then also stops the server you /do/ handshake with knowing the destination of your packet. This is all TOR is supposed to do. This allows you to be anonymous to the receiving end, but it does not guarantee it. It is your responsibility to surf safely, to sanitise your traffic, to encrypt your traffic and do the rest. We know that most people can be uniquely differentiated by combining all the available information from their browsers (some of which doesn't need javascript) http://panopticlick.eff.org/ http://panopticlick.eff.org/ . Therefore we know, using TOR or not, that we need to be careful to do things well when we want to be anonymous. There is little in this article which makes me worried about TOR. TOR isn't the problem, if any of this is true, then the problem is the government collecting data in various ways. Whether you agree with this is a matter for yourself to consider and not a reason to avoid using TOR.
- agl 16y ago(I rather suspect that Mr Shaw is trolling, but anyway.) It's certainly true that humans have all manner of interesting behaviors owing to the fact that we're smart apes with huge numbers of survival heuristics. I would pause before taking a sandwich from Hitler, because I'm human, but it's not pertinent to the question of whether the sandwich is any good. (Except in as far as you think it more or less likely that the sandwich is poisoned etc.) So I find the whole first half of the text to be a flabby way of saying that the arguments of dishonest people need to be evaluated more critically than those of honest people. But I find that the arguments of honest people need to be critically evaluated too. I think that the authors of Haystack were honest, but their assertions turned out to be dangerously wrong. (Which, by the way, we know thanks to Mr Appelbaum.) So, as a guide, the motives of the author don't seem to be very useful to me. Then, in the second half, we find a mixture of arguments that I find valid, and many that I don't. A sense of vertigo at the amount of trust that we have to put into software is justified. It is possible to hide major bugs in code and we're standing on a stack of hardware, kernel, and userland which is incomprehensible to any one person these days. It's also true that there are some fairly effective attacks against Tor for the capable opponent. It's a real-time mix-net, with all the tradeoffs implied and it generates a lot of research. I recommend reading some papers of the papers, I find them often to be very good. But accusing the Tor people of being NSA agents because they once got funding from the navy doesn't hold water. The Internet was an ARPA funded project. Military spending has subsidised much of the modern world. Many people have read through Tor's source and evaluated the protocol etc. Of course, all those people could be NSA agents too, publishing fake papers. You could, in fact, be in The Matrix. But you probably aren't. Some, likely massively exaggerated, secret project might be monitoring every ISP on the planet and thus able to break any real-time mix net, but they probably aren't. Likewise, all the Tor node operators that I have met might all be NSA plants, but they probably aren't. And finally the author picks out Mr Appelbaum for special criticism because he connects him with Wikileaks. I think his assertion that the goals of Tor and Wikileaks are in conflict is wrong, but we could go around all day trying to pin down the goals of Wikileaks so that's probably not fruitful. But it does seem ironic that the author voices support for Wikileaks right after asserting that such supporters are not to be trusted. So, while the stack of software is, indeed, large, Tor remains a reasonable tool to use. If the author is so concerned with the human aspect, the Tor authors are make regular appearances at conferences and are wonderful people to meet. So do, and are, node operators in my experience. Also, on top of Tor, there's a fair chance that the author is using a browser who's network and SSL stack I've had a hand in. And who knows what kind of person he's taking a sandwich from now?
- Raphael 16y agoSo what does he use that's better than Tor?
- mahmud 16y agoHis indoor voice, I am guessing.
- dublinclontarf 16y agoAs someone living on the other side of the Great Firewall of China it's become VERY clear that a government can effectively censor the internet(without VPN to get out it's terrible), provided that the government in question put enough effort into it. As I said in another comment, the Chinese government has beaten Tor. You can't download it or even read about it(almost everything Tor related is blocked). Even when you have it you can't connect, as all bridge IPs are blocked the moment the gov discovers them. It's slow as hell to boot and on top of this the Chinese government is still able to monitor those who can connect with traffic analysis(a Tor weakness). I'm something of a lazy cipherpunk and had hoped that most services and sites would have moved onto darknets like i2p by now. But sadly this is not the case, however it is the place where we finally need to go. TLDR: I don't use Tor because it don't work, plain and simple. Never mind the insecurity mentioned by Zed, and no one here is talking about this.
- gst 16y agoWhat would prevent the Chinese government from just blocking I2P? Also, while Tor isn't used in China there seem to be some other Proxy Services that are used. A non-tech-savvy friend of mine who is Chinese citizen and moved back to China one year ago, uses some kind of proxy service to connect to sites like Facebook. I have the impression that the knowledge how to circumvent the firewall is rather common in China.
- dublinclontarf 16y agoThere are many paid VPN services available to those who have credit cards. These VPN services are based outside China. But this is quite expensive for most Chinese people to use. The reason Tor isn't used in China is that most of the bridge relay IP addresses are blacklisted by Chinese ISP's and net-cops. Now the list of bridge relays are not public, but China has enough man power(working full time I might add) to get ahold of nearly all the ip's and block them. Actually it wouldn't be too difficult to automate this at all. Knowlege to circumvent the wall is available, it's the resources to do so that are lacking. I2P currently is too small to show up on the Chinese governments radar. Apart from this I don't know how I2P gets the ip's of the darknet node. The only guaranteed way to be safe is to have a Freind to Friend network, with absolutely no public connection nodes.
- samuel 16y agoHuh? Where's the conflict between Wikileaks and Tor? Wikileaks publishes goverment's secrets. Goverments sniff(presumably) citizens' communications, both content and session data. Tor helps citizens to leak those secrets hiding their session data. Where is the conflict?
- wakeup 16y agoDidnt get that either...
- ra 16y agoWhat are the alternatives?
- comice 16y agoEven if the meandering list of risks Zed documents are serious and cannot be mitigated, Tor still is useful for all kinds of situations. This article isn't that useful without knowing the nature of what Zed doesn't use Tor for.
- comice 16y agoRemember that Zed Shaw was "a top qualified soldier in the US Army". Maybe Zed is a bad actor in the pay of the US Army and this article is an attempt to discredit Tor for their benefit! ;)
- kungfooguru 16y agoHaha, oh, Zed. Pretty sure the military STILL uses Tor. Oh no! What could the Navy or army have use for a tool that protects them from surveillance?! Oh right, everything... It was all fun and games when Zed was talking shit about Ruby but he's jumped the shark. It was bad enough when he freaked out because someone was converting his books code to Ruby from Python. Free code but not free book?
- trotsky 16y agoThe report is that "A branch of the U.S. Navy uses Tor for open source intelligence gathering". All this means is that they use it to obscure their origin IP address from a website when they are collecting publicly available information (so that people don't look at their logs and see a huge navy.mil spider or the like) and has nothing to do with anti-surveillance or a sophisticated attacker being able to track them.
- kungfooguru 16y ago"I haven't once seen you answer the claims I made." Woo, Zed is the new Glenn Beck.
- JonnieCache 16y agoTor is not exactly an ideal solution to the problem of privacy, as zed has pointed out. It is however a great solution to the closely related problems of anonymity and legal deniability. If you're running an international criminal network I imagine it's ideal.
- poet 16y agoIt's shit like this Zed... Two basic claims: Tor is tainted because (1) the concepts the software is based on were developed with partial funding from the military and (2) Zed thinks one of the committers is untrustworthy. Guess what? That describes a huge amount of software, including Mac OS X and Firefox. God damn Zed, this Hitler sandwich shit is pretty weak. Zed also has a problem with Tor because he thinks there is a "gigantic percentage of hackers and security experts on the volunteer payroll of a group who's job is to illegally wiretap people and circumvent the law on behalf of the government". He thinks some of these people work on Tor and thus Tor is untrustworthy. Funny though, his ISP is likely guilty of the same thing. I wonder if Zed takes that into account as a part of his paranoid fantasy. There are serious problems with using Tor and Zed fails to mention any of them. You'll want to read what Thomas has to say on the subject (http://searchyc.com/tptacek http://searchyc.com/tptacek). Specifically, Thomas mentions that a general problem with tools like Tor is that it identifies your traffic as a subset of all traffic thats probably worth monitoring. You're essentially adding bright red neon signs to your most sensitive traffic. The amount of traffic going through the Tor network is small enough that it is a tractable problem for a nation state to attempt to monitor all of it. Thomas also goes into how the incentive structure for these tools is completely broken. The defenders are academic researchers going for tenure, the attackers are nation states with millions of dollars to spend, and the users are dissidents that get killed when the tool fails. Unfortunately, arguments with this level of nuance appear to escape Zed in this case. I fear he doesn't have the domain knowledge to write something intelligent about this issue.
- krainboltgreene 16y ago> Funny though, his ISP is likely guilty of the same thing. I wonder if Zed takes that into account as a part of his paranoid fantasy. You don't need TOR. You do need an ISP.
- borism 16y agoyou need trust in both of them as a netizen, and I have trust in Tor, but not my ISP.
- pingswept 16y ago
- Tichy 16y agoI didn't understand the part where Wikileaks and Tor are supposed to have different goals. I thought the point of Wikileaks was to publish information anonymously - surely Tor would be suitable to help with that (Tor as it is supposed to work)? I must admit that I am simply too chicken to use Tor. In Germany I think it can actually get you in trouble if some pedophile exits through your node. Also last I checked, there really were some issues with the security model. That was quite a long time ago, not sure if they have been fixed now.
- flawawa2 16y agoUsing Tor does not mean that you are an exit node. You have to actually set that up and it is warning you about it. Using Tor as a client only is safe and secure. If people do bad things through your exit node, you are in danger regardless where you live. The law enforcement must be aware of what your server was doing. Its understanding varies from place to place.
- Flankk 16y agoIt doesn't matter that Tor was originally a US Navy project. Tor is open source. DARPA created the internet. Do you think the internet is a conspiracy by the US government to wiretap American citizens too? Tor is used in China to access censored data. Tor is used to send encrypted data anonymously from oppressive countries. Both of these things align perfectly with the honest motives of Wikileaks. Step outside your world Zed. Some people have a real need for projects like Tor.
- dfhjrtjty 16y agohttp://www.mcall.com/ http://www.mcall.com/
- dfhjrtjty 16y agoClick on our website: ==== ( http://www.etradinglife.com http://www.etradinglife.com ) ==== ==== ( http://www.etradinglife.com http://www.etradinglife.com ) ==== "Priority, my friend!! Christmas is coming, quick to our website shopping, our web site shopping there will be something different, unexpected things to you, let you have different sense, our website wholesale various fashion shoes, such as Nike, Jordan, prada, also includes the jeans, shirt, bags, hats and decoration. All these products are our free transport, prices are competitive, we can also accept paypal j, after the payment within short time, can ship. = New era cap $12; Air jordan(1-24)shoes $30; jordan air max oakland raiders $34a€“39; Ed Hardy AF JUICY POLO Bikini $25; Christan Audigier BIKINI JACKET $25; Tshirts (Polo ,ed hardy,lacoste) $15 coogi DG edhardy gucci t-shirts $18; gstar coogi evisu true jeans $35; coach chanel gucci LV handbags $36; Sunglasses(Oakey,coach,gucci,A r m a i n i) $15; ==== ( http://www.etradinglife.com http://www.etradinglife.com ) ==== ==== ( http://www.etradinglife.com http://www.etradinglife.com ) ==== ==== ( http://www.etradinglife.com http://www.etradinglife.com ) ==== ==== ( http://www.etradinglife.com http://www.etradinglife.com ) ==== ==== ( http://www.etradinglife.com http://www.etradinglife.com ) ==== ==== ( http://www.etradinglife.com http://www.etradinglife.com ) ==== ==== ( http://www.etradinglife.com http://www.etradinglife.com ) ==== ==== ( http://www.etradinglife.com http://www.etradinglife.com ) ====
- trotsky 16y agoRegardless of his reasons, I think the result of not trusting tor is warranted, at least for most of the traditional reasons one might seek out tor. The EFF themselves present many of the problems: http://www.torproject.org/download/download.html.en#warning http://www.torproject.org/download/download.html.en#warning On top of that, the EFF has demonstrated that they are worried (reasonably) about the trust given to the global CA structure: http://www.eff.org/deeplinks/2010/03/researchers-reveal-likelihood-governments-fake-ssl http://www.eff.org/deeplinks/2010/03/researchers-reveal-like... In terms of protecting your anonymity, even when correctly managing cookies you may be uniquely identifiable by browser fingerprinting: https://panopticlick.eff.org/ https://panopticlick.eff.org/ At least the last time I looked, the network appeared quite thin, with much of your traffic by default traveling through a small collection (perhaps as low as one) of exit nodes. TOR also represents a juicy target for eavesdropping by its nature as a concentrator for people trying to avoid it. If you were a burglar, it would make sense to stay the hell away from a place the cops had identified as a hotbed of burglary since they'll probably be concentrating their efforts there. And, of course, there is the issue that it's been used in the past to publicly out users traffic: http://www.theregister.co.uk/2007/09/10/misuse_of_tor_led_to_embassy_password_breach/ http://www.theregister.co.uk/2007/09/10/misuse_of_tor_led_to... Most of these things apply to other possible solutions, but at least there you may get the advantage of most users of those services "having nothing to hide" making them not as juicy a target. If I was super, super concerned about my privacy and anonymity when sending a specific few documents or such, I'd most likely take a page out of the black hat handbook and compromise a few lightly administered servers and use a not commonly used covert channel.
- fbcocq 16y agoIt's reasonable to assume that if Hitler wanted you to die, he wouldn't poison you with a sandwitch and risk being called a woman behind his back. Anyway, motivations do not matter one bit when it comes to evaluating whom to trust with your data, if it's not safe by design then it's not safe period.
- deleted 16y ago[deleted]
- JulianMorrison 16y agoI'd eat the sandwich.
- pulpfiction 16y agoWell, Mr. Zed Shaw is trolling. No doubt about that. I wonder how he makes the conspiracy theories about NSA when Tor is open source? He is free to investigate the source code for 'backdoors'. Such conspiracy theories and trolling are nothing but desperate attempts for attention.
- tptacek 16y agoIt's a myth that having the source code for a cryptosystem is going to allow you to spot backdoors. Crypto flaws have hidden for many, many years in far more important projects than Tor. Crypto flaws are very subtle; you can create a backdoor in a crypto routine simply by changing the way it happens to influence the L1 cache.
- rincewind 16y agoI have heard that China runs lots of nodes in order to a) spy on people who want to hide from the chinese government and b) spy on foreigners and c) make life harder for western intelligence agencies. Maybe every secret police or spy organization runs exit nodes and you just have to use those from a government that has no interest in you.
- krosaen 16y agotrack the follow up twitter bickering between Zed and Appelbaum: http://bettween.com/ioerror/zedshaw/Dec-21-2010/Dec-28-2010/desc http://bettween.com/ioerror/zedshaw/Dec-21-2010/Dec-28-2010/...
- Lagged2Death 16y ago"Wikileak's job is to take people's secrets and show them and who's hiding them to the world." Here we see the again the conflation of organizations and individuals in an opinion piece connected to Wikileaks. Why does this happen so regularly? I don't know anything about Appelbaum, but it's perfectly possible that he believes in personal privacy and institutional transparency, a not particularly radical, surprising, or unusual stance which would resolve this "conflict of interest" perfectly.
- borism 16y agoI'm tired of this argument as well - it also goes something like this: "Assange has founded Wikileaks, so how dare he oppose leaking details of his alleged sex crimes trial!?"
- mcantelon 16y ago>The problem is that Tor's pedigree is less than stellar. First, it was originally a US Navy project then released to various "hackers" (a word which in a lot of ways is just synonymous with "NSA collaborator" or at least a wannabe). Whether the source code started there or just the idea, you have to ask why the hell the Navy would work on this and then release it. Goodness me! We should also be examining that DARPA developed honeypot called Teh Internets and take a second look at that ominous collaborator Sir Tim Berners-Lee. Once I got to Zed quoting Project Vigilant's volunteer count I had to laugh. Zed's bullshit detector needs a tune-up.
- ajays 16y agoI, for one, would like to point out to Mr. Shaw (and others) that the Swastika is a religious symbol to a lot of people ; maybe even 20% of all humanity (the Hindus, for one). Just because the Swastika was co-opted by Hitler and his cronies means nothing to most people outside the western world (which is in a minority). Secondly (while I have this soapbox): whether you take the sandwich from Hitler or not depends on whether Hitler is your "Der Fuhrer" or not (remember, he's long dead, so time travel is involved in Mr. Shaw's hypotheticals). If Hitler is your Fuhrer, then you _better_ take that sammich and eat it if he offers it to you! :-D
- onlythelonely 16y agoZed Shaw has practiced Kung Fu. He has no doubt bowed to the Swastika chested Buddhas many times.
- neild 16y agoThe problem with Tor, as I see it, is that it can easily make you more vulnerable rather than less so. When I access some random website from home, my traffic is vulnerable to capture and analysis by my ISP, the intervening backbones, and the website that I am accessing. I don't trust my ISP and the backbone providers not to examine my traffic, but I do have quite a bit of confidence that they don't care about me. I'm not very interesting. If I use Tor, I add another party who can capture and examine my traffic: The Tor exit node. I most emphatically do not trust random Tor exit nodes not to examine my traffic. I'm quite confident that the NSA and other government organizations run their own Tor exit nodes--after all, a stream of traffic generated by people who are interested in hiding their activities is likely to be quite interesting. I can encrypt my traffic...but not all of it, and do I really want to trust that everything important is properly encrypted? If I had something to hide, I'd do so by blending into the crowd, not by slapping a big "I'm trying to hide" label on my traffic and sending it to the people most likely to be interested in it.
- dkarl 16y agoFunny, I think in terms of my "informational immune system" all the time, and the one time I used it here I got downvoted into oblivion (though it looks like I recovered a bit!): http://news.ycombinator.org/item?id=2006412 http://news.ycombinator.org/item?id=2006412 Geeks are opposed to certain sources of knowledge, probably because they see themselves as on the receiving end of bad assumptions based on their clothes and mannerisms, and I agree with them that it's always best to avoid subjective judgments when possible. However, there are so many situations in life where you can't audit the source code yourself, and when there's serious risk, you have to make use of the information you have. You can't investigate the provenance of the cheese sandwich, and even if you could, do you really want to spend your whole life playing Sherlock Holmes? I'm thankful for open source and the people who read code, but I am not going to read the source code of every damn piece of software I use. Sometimes I'm just going to say, "The only source for this software is a shareware site in a country I've never heard of, and it claims to come bundled with porn, so I do not feel comfortable installing it on my Windows PC no matter how good some guy on 4chan says it is." Nothing against porn or countries I've never heard of, but my Spidey sense is tingling.
- noonespecial 16y agoIt's important to remember that TOR is an anonymizer not an encryption scheme. It hides who you are not what you say. Think of it as using Hitlers wifi while you eat that sandwich.
- ahn 16y agoNot even a good troll. He didn't even mention that arma was at NSA.
- joeycfan 16y agoWhat makes Tor great in my opinion is that it is the best way to hide a website, yet still let people get at it.
- mfukar 16y agoI find the fact that mr shaw chose today (see 27c3) to voice his "concerns" further adds to the amusement of his endeavour.
- iuguy 16y agoAm I wrong in taking the cheese sandwich from Hitler if it's a very good cheese sandwich? After all, I'm writing this on a Mac, a platform owned by a company that has interesting views on what people should and shouldn't be able to do with their own kit. I buy Windows from Microsoft (which according to many Usenet postings is clearly the closest thing to accepting a cheese sandwich from Hitler, especially in the Linux groups). I think Zed's fallen wide of the mark here. He's failed to address the technical failings with Tor, instead opting to launch his own ad hominem attack on Jacob Applebaum (who's done more than just work on Tor and Wikileaks) and the history of the project as a US Navy tool. If he has such a problem with Tor then it's worth auditing the code and seeing for yourself. It's not perfect, but Tor has it's uses. If you really need the kind of anonymity to protect something life threatening then don't use Tor (due to it's failings in the cheese sandwich quality department, not because of it's history or contributors).
- deleted 16y ago[deleted]