3 ms·

Even Tor is not secure https://news.ycombinator.com/item?id=18911010 https://news.ycombinator.com/item?id=18911010

zrm 7y ago
By this logic GPS is "not secure" because the US government pays for that too. But GPS receivers don't even have to transmit anything, they calculate your position by receiving broadcasts made by satellites with timestamps and calculating your position by triangulation based on how long it takes for messages from particular satellites to reach you. It would be difficult to have better security properties than this, which was done on purpose because the US military can't have the positions of their units leaking to the enemy. We know this is true not just because their incentive are aligned but because the system's mechanism of operation is public and anybody who discovers a vulnerability can publish it. And so it is with Tor. The US government funds it because they use it, but it's also completely open source. If there is a vulnerability in it, as they say, PoC or GTFO. Most vulnerabilities don't come from breaking GPS or Tor or AES. They come from, you have a suitably private way of calculating your position using GPS and then your phone takes that information and uploads it to The Cloud. They come from people visiting a website using Tor and then typing their name into it. They come from people uploading their TLS private key to a public repository, or generating it with a predictable random number generator.
- 0xEFF 7y ago
  The US government can and does turn GPS off for certain regions of the globe when it feels the need to.
  - zrm 7y ago
    Which still doesn't give them the location of your GPS receiver. It also applies even less to Tor, because they "turn off" GPS by encrypting it so that only their own receivers can use it. Doing the same thing with Tor both doesn't work because they don't run all of the relays, and doesn't work because it would compromise the anonymity of their own users if they were ever the only ones using it.

zrm 7y ago

By this logic GPS is "not secure" because the US government pays for that too. But GPS receivers don't even have to transmit anything, they calculate your position by receiving broadcasts made by satellites with timestamps and calculating your position by triangulation based on how long it takes for messages from particular satellites to reach you. It would be difficult to have better security properties than this, which was done on purpose because the US military can't have the positions of their units leaking to the enemy. We know this is true not just because their incentive are aligned but because the system's mechanism of operation is public and anybody who discovers a vulnerability can publish it. And so it is with Tor. The US government funds it because they use it, but it's also completely open source. If there is a vulnerability in it, as they say, PoC or GTFO. Most vulnerabilities don't come from breaking GPS or Tor or AES. They come from, you have a suitably private way of calculating your position using GPS and then your phone takes that information and uploads it to The Cloud. They come from people visiting a website using Tor and then typing their name into it. They come from people uploading their TLS private key to a public repository, or generating it with a predictable random number generator.

0xEFF 7y ago
The US government can and does turn GPS off for certain regions of the globe when it feels the need to.
- zrm 7y ago
  Which still doesn't give them the location of your GPS receiver. It also applies even less to Tor, because they "turn off" GPS by encrypting it so that only their own receivers can use it. Doing the same thing with Tor both doesn't work because they don't run all of the relays, and doesn't work because it would compromise the anonymity of their own users if they were ever the only ones using it.