5 ms·

I think a lot of comments here are forgetting it takes months to be considered a trusted guard node by TOR. Unless you have hundreds of these and a lot of time

by gzer0 7y ago

I think a lot of comments here are forgetting it takes months to be considered a trusted guard node by TOR. Unless you have hundreds of these and a lot of time and patience, and somehow knock off all of the non-malicious guard-nodes + have your "aged" guard nodes set up, this attack will be very difficult to conduct.

Santosh83 7y ago
Which the larger countries do. And the main point of Tor is to evade serious adversaries isn't it? If you're not anonymous from nation states when using Tor, then what will protect whistle-blowers and investigative journalists and dissidents? VPNs can be ordered to turn over data by courts and you can never be sure a "no logs" VPN does what it says. Tor is the only viable alternative and we know it can be at least seriously compromised by the bigger nations.
- azalemeth 7y ago
  What about i2p and Freenet?
  - mirimir 7y ago
    About Freenet, see https://news.ycombinator.com/item?id=22216177 https://news.ycombinator.com/item?id=22216177 I2P was rather like the love child of Freenet and Tor. Like Freenet, it's pure P2P, where all users route traffic for each other. And although there are outproxies to the open Internet, it's mostly about I2P-hosted content. If anything, it's mostly like Tor onion services. It uses a version of Tor's onion routing, called garlic routing. The main difference is that I2P tunnels are unidirectional, whereas Tor tunnels are bidirectional. That will allow for content caching and bundling, but that's not implemented yet. There are reportedly ~10^4 I2P nodes, versus ~2x10^6 Tor users and ~6x10^3 relays. It's been argued that unidirectional tunnels are harder to deanonymize than bidirectional tunnels. But on the other hand, all I2P nodes are readily discoverable by malicious peers, but Tor users are much harder to discover, because Tor clients don't change guards frequently. So bottom line, they arguably provide similar anonymity. Edit: Yes, guards can discover users. But Tor is designed to make it hard for a given guard to see that many users. So you'd need lots of guards. And that's not so easy, because Tor folk are constantly on the lookout for suspicious guards, especially when a bunch show up at the same time.
    - Astarte 7y ago
      > but Tor users are much harder to discover, because Tor clients don't change guards frequently. I don't get that. Every guard can discover users because the users directly connect to guard nodes. As a guard you can just collect the real IP addresses of Tor users except they use a VPN or proxy to connect to the Tor network.
    - Astarte 7y ago
      >So you'd need lots of guards Can't edit my other reply. The operator in the OP runs 68 nodes. I did not look at each one, but it looks like most, if not all of them are guard nodes. This article mentions someone running at least 10% of the guard capacity: https://medium.com/@nusenu/the-growing-problem-of-malicious-relays-on-the-tor-network-2f14198af548?source=---------5------------------ https://medium.com/@nusenu/the-growing-problem-of-malicious-... Tor's design obviously failed. Everyone can become a guard. You just need some patience. Also other nodes like DirAuths, bridges, fallback directories can discover Tor users.
      - mirimir 7y ago
        Yes, that is an issue for Tor. But it's still arguably worse for I2P, because all peers can connect to each other. But regardless, that's why I never use Tor or I2P from home, except through nested VPN chains. I don't care so much about VPS, because I'm very careful to isolate myself from them. For dedicated servers, however, which are more expensive, and where I invest more work for setup, I also use nested VPN chains.
- tutfbhuf 7y ago
  Has there been any known case where a person using Tor has been tracked down and put into curt, without human mistake that lead to his de-anonymization?
  - 4gotunameagain 7y ago
    I would imagine that if anyone had this capability, they would go into great extents to hide it's existence.
  - mirimir 7y ago
    Yes. See https://news.ycombinator.com/item?id=22215126 https://news.ycombinator.com/item?id=22215126 Not one person. Hundreds, maybe thousands. Because of a exploited vulnerability, and failure to pay attention to an upsurge in suspicious relays. Unless you consider that the mistake was using Tor directly, rather than through a VPN service.
    - belorn 7y ago
      https://blog.torproject.org/tor-security-advisory-relay-early-traffic-confirmation-attack https://blog.torproject.org/tor-security-advisory-relay-earl... A bit more detail would be welcome about those "Hundreds, maybe thousands" of persons. Clearly the security researcher did find a vulnerability in the protocol and confirmed it by unmasking users, but I don't see the support for people getting "tracked down and put into [court]". More important, what purpose is there to reference a 5 year old patched security vulnearbility? The same year as the above vulnerability was found in Tor, HTTPS was also broken with Heartbleed. The only fool-proof security is security in so many layers that it become statistically unlikely to cause a negative impact.
      - mirimir 7y ago
        The issue isn't that the CMU people exploited the "relay early" bug. It's that the FBI subpoenaed all their data, tracked down onion services, and served malware. This is just the outcome from busting one site, PlayPen: At least 350 U.S.-based individuals arrested 25 producers of child pornography prosecuted 51 hands-on abusers prosecuted 55 American children successfully identified or rescued 548 international arrests, with 296 sexually abused children identified or rescued https://www.fbi.gov/news/stories/playpen-creator-sentenced-to-30-years https://www.fbi.gov/news/stories/playpen-creator-sentenced-t...
- euro_expat 7y ago
  Tor however has always made the disclaimer that even basic correlation attacks will defeat its anonymity. People use it as the de facto tool for beating the big guys, but it provides no such capability or claim of such. This seems to not be so well known though.
  - DyslexicAtheist 7y ago
    not making such claims is a the only way to be taken seriously by the community it serves. Those using tor-browser know it's a best effort approach. The same attitude should be expected from all InfoSek vendors. But it's easier to sell a product with claims it will protect you rather than saying the truth (that it's riddled with edge-cases like everything else). Tor, unlike many of the VPN companies, thankfully lack a marketing department trying to push it with incorrect claims about its alleged ability. edit: if the threat model is to protect against corporate mass-surveillance ("the big guys"), then Tor is incredibly effective. They wouldn't go through the trouble to identify and blacklist exit nodes and present users with a captcha otherwise. (ofc assuming that it is used correctly: never log in, or if you must only log-in with sock-puppet identities etc).
    - Astarte 7y ago
      >They wouldn't go through the trouble to identify and blacklist exit nodes and present users with a captcha otherwise. Do you really think they care about that 1% (made up number) of Tor users using their service legitimately? Or do they just want to avoid being attacked or their service being abused?
  - belorn 7y ago
    The only thing that can work against big national agencies is security in depth, in which tor can be part. Tor is also better than nothing, which is a better de factor tool than plain text. In modern society everything gather meta data. The phone, the credit card, the mass transit system, cameras with face recognition, the isp, all the routers between A and B, the devices people own, the platforms they socialize on. Its almost impossible to make a face to face meeting without allowing nation agencies to know about it. A leaker wanting to talk to a journalist without risking becoming a target might not be 100% protected by tor, but then I don't know any single better method right now. Some combination of obfuscation, encryption, mixing, and plausible deniability seems to be the best bet.
Astarte 7y ago
> Unless you have hundreds of these There are single operators that run dozens of nodes. Just take a look at the article. Anyone can setup nodes and give no contact info or just change it to something else. I could spin up nodes as gzer0 and the next week add new ones as gze1. You could run hundreds of nodes as a single person without anyone noticing it. >and a lot of time and patience Tor has been around for a while ... Creation of nodes, which mostly are just VM's running in some datacenter, can be automated to some extend. > and somehow knock off all of the non-malicious guard-nodes There is no need for that. When you become the malicious guard of someone, by design, you can run correlation attacks for months. Just be patient and probability will do the rest for you. Tor is not as secure as it (maybe) once was. Related reading: https://medium.com/@nusenu/the-growing-problem-of-malicious-relays-on-the-tor-network-2f14198af548?source=---------5------------------ https://medium.com/@nusenu/the-growing-problem-of-malicious-... Also when being a guard you get the IP addresses of Tor users. Using Tor puts you in a group consisting of "interesting" people. No, these are probably not thousands of whistleblowers and people from oppressed regimes (well maybe russia). The majority of traffic comes from the US, and western European countries. Interesting people are: hackers, fraudsters, crawlers (guess why many sites block Tor), drug dealers, drug users, pedophiles, literally everything (cyber)crime and people having something to hide. A list of those people would be quite interesting wouldn't it? Even if there would be thousands of whistleblowers these are persons of interest, too.

by gzer0 7y ago

Santosh83 7y ago

Which the larger countries do. And the main point of Tor is to evade serious adversaries isn't it? If you're not anonymous from nation states when using Tor, then what will protect whistle-blowers and investigative journalists and dissidents? VPNs can be ordered to turn over data by courts and you can never be sure a "no logs" VPN does what it says. Tor is the only viable alternative and we know it can be at least seriously compromised by the bigger nations.

azalemeth 7y ago
What about i2p and Freenet?
- mirimir 7y ago
  About Freenet, see https://news.ycombinator.com/item?id=22216177 https://news.ycombinator.com/item?id=22216177 I2P was rather like the love child of Freenet and Tor. Like Freenet, it's pure P2P, where all users route traffic for each other. And although there are outproxies to the open Internet, it's mostly about I2P-hosted content. If anything, it's mostly like Tor onion services. It uses a version of Tor's onion routing, called garlic routing. The main difference is that I2P tunnels are unidirectional, whereas Tor tunnels are bidirectional. That will allow for content caching and bundling, but that's not implemented yet. There are reportedly ~10^4 I2P nodes, versus ~2x10^6 Tor users and ~6x10^3 relays. It's been argued that unidirectional tunnels are harder to deanonymize than bidirectional tunnels. But on the other hand, all I2P nodes are readily discoverable by malicious peers, but Tor users are much harder to discover, because Tor clients don't change guards frequently. So bottom line, they arguably provide similar anonymity. Edit: Yes, guards can discover users. But Tor is designed to make it hard for a given guard to see that many users. So you'd need lots of guards. And that's not so easy, because Tor folk are constantly on the lookout for suspicious guards, especially when a bunch show up at the same time.
  - Astarte 7y ago
    > but Tor users are much harder to discover, because Tor clients don't change guards frequently. I don't get that. Every guard can discover users because the users directly connect to guard nodes. As a guard you can just collect the real IP addresses of Tor users except they use a VPN or proxy to connect to the Tor network.
  - Astarte 7y ago
    >So you'd need lots of guards Can't edit my other reply. The operator in the OP runs 68 nodes. I did not look at each one, but it looks like most, if not all of them are guard nodes. This article mentions someone running at least 10% of the guard capacity: https://medium.com/@nusenu/the-growing-problem-of-malicious-relays-on-the-tor-network-2f14198af548?source=---------5------------------ https://medium.com/@nusenu/the-growing-problem-of-malicious-... Tor's design obviously failed. Everyone can become a guard. You just need some patience. Also other nodes like DirAuths, bridges, fallback directories can discover Tor users.
    - mirimir 7y ago
      Yes, that is an issue for Tor. But it's still arguably worse for I2P, because all peers can connect to each other. But regardless, that's why I never use Tor or I2P from home, except through nested VPN chains. I don't care so much about VPS, because I'm very careful to isolate myself from them. For dedicated servers, however, which are more expensive, and where I invest more work for setup, I also use nested VPN chains.
tutfbhuf 7y ago
Has there been any known case where a person using Tor has been tracked down and put into curt, without human mistake that lead to his de-anonymization?
- 4gotunameagain 7y ago
  I would imagine that if anyone had this capability, they would go into great extents to hide it's existence.
- mirimir 7y ago
  Yes. See https://news.ycombinator.com/item?id=22215126 https://news.ycombinator.com/item?id=22215126 Not one person. Hundreds, maybe thousands. Because of a exploited vulnerability, and failure to pay attention to an upsurge in suspicious relays. Unless you consider that the mistake was using Tor directly, rather than through a VPN service.
  - belorn 7y ago
    https://blog.torproject.org/tor-security-advisory-relay-early-traffic-confirmation-attack https://blog.torproject.org/tor-security-advisory-relay-earl... A bit more detail would be welcome about those "Hundreds, maybe thousands" of persons. Clearly the security researcher did find a vulnerability in the protocol and confirmed it by unmasking users, but I don't see the support for people getting "tracked down and put into [court]". More important, what purpose is there to reference a 5 year old patched security vulnearbility? The same year as the above vulnerability was found in Tor, HTTPS was also broken with Heartbleed. The only fool-proof security is security in so many layers that it become statistically unlikely to cause a negative impact.
    - mirimir 7y ago
      The issue isn't that the CMU people exploited the "relay early" bug. It's that the FBI subpoenaed all their data, tracked down onion services, and served malware. This is just the outcome from busting one site, PlayPen: At least 350 U.S.-based individuals arrested 25 producers of child pornography prosecuted 51 hands-on abusers prosecuted 55 American children successfully identified or rescued 548 international arrests, with 296 sexually abused children identified or rescued https://www.fbi.gov/news/stories/playpen-creator-sentenced-to-30-years https://www.fbi.gov/news/stories/playpen-creator-sentenced-t...
euro_expat 7y ago
Tor however has always made the disclaimer that even basic correlation attacks will defeat its anonymity. People use it as the de facto tool for beating the big guys, but it provides no such capability or claim of such. This seems to not be so well known though.
- DyslexicAtheist 7y ago
  not making such claims is a the only way to be taken seriously by the community it serves. Those using tor-browser know it's a best effort approach. The same attitude should be expected from all InfoSek vendors. But it's easier to sell a product with claims it will protect you rather than saying the truth (that it's riddled with edge-cases like everything else). Tor, unlike many of the VPN companies, thankfully lack a marketing department trying to push it with incorrect claims about its alleged ability. edit: if the threat model is to protect against corporate mass-surveillance ("the big guys"), then Tor is incredibly effective. They wouldn't go through the trouble to identify and blacklist exit nodes and present users with a captcha otherwise. (ofc assuming that it is used correctly: never log in, or if you must only log-in with sock-puppet identities etc).
  - Astarte 7y ago
    >They wouldn't go through the trouble to identify and blacklist exit nodes and present users with a captcha otherwise. Do you really think they care about that 1% (made up number) of Tor users using their service legitimately? Or do they just want to avoid being attacked or their service being abused?
- belorn 7y ago
  The only thing that can work against big national agencies is security in depth, in which tor can be part. Tor is also better than nothing, which is a better de factor tool than plain text. In modern society everything gather meta data. The phone, the credit card, the mass transit system, cameras with face recognition, the isp, all the routers between A and B, the devices people own, the platforms they socialize on. Its almost impossible to make a face to face meeting without allowing nation agencies to know about it. A leaker wanting to talk to a journalist without risking becoming a target might not be 100% protected by tor, but then I don't know any single better method right now. Some combination of obfuscation, encryption, mixing, and plausible deniability seems to be the best bet.

Astarte 7y ago

> Unless you have hundreds of these There are single operators that run dozens of nodes. Just take a look at the article. Anyone can setup nodes and give no contact info or just change it to something else. I could spin up nodes as gzer0 and the next week add new ones as gze1. You could run hundreds of nodes as a single person without anyone noticing it. >and a lot of time and patience Tor has been around for a while ... Creation of nodes, which mostly are just VM's running in some datacenter, can be automated to some extend. > and somehow knock off all of the non-malicious guard-nodes There is no need for that. When you become the malicious guard of someone, by design, you can run correlation attacks for months. Just be patient and probability will do the rest for you. Tor is not as secure as it (maybe) once was. Related reading: https://medium.com/@nusenu/the-growing-problem-of-malicious-relays-on-the-tor-network-2f14198af548?source=---------5------------------ https://medium.com/@nusenu/the-growing-problem-of-malicious-... Also when being a guard you get the IP addresses of Tor users. Using Tor puts you in a group consisting of "interesting" people. No, these are probably not thousands of whistleblowers and people from oppressed regimes (well maybe russia). The majority of traffic comes from the US, and western European countries. Interesting people are: hackers, fraudsters, crawlers (guess why many sites block Tor), drug dealers, drug users, pedophiles, literally everything (cyber)crime and people having something to hide. A list of those people would be quite interesting wouldn't it? Even if there would be thousands of whistleblowers these are persons of interest, too.