7 ms·

Why do you think it fails as basic security against the government? Honestly curious. And what would you suggest instead. To my knowledge many dissidents and ac

Why do you think it fails as basic security against the government? Honestly curious. And what would you suggest instead. To my knowledge many dissidents and activists around the world are specifically using TOR because it supposedly does indeed provide protection against government tracking.

MintelIE 6y ago
It’s literally funded and made by the NSA. Dissidents and activists have been busted using Tor and there’s always a friendly government damage control agent ready to pop up (any forum, any time of day) to remind people that Tor couldn’t possibly be backdoored or owned, it was always some other type of thing they used in parallel construction. Over-shilling is what clued next in. You don’t get this kind of response without a massive panopticon dispatching reputation managers. Why the heck would the NSA write NSA proof software? LOL. EDIT: this is in reply to mapgrep and his crew: Did I say I won't use Tor Browser? Is it really necessary to put words into my mouth to make your point? I've noticed this a lot with people who are very very lightning fast, almost unbelievably fast, to defend Tor on any forum or platform on the Internet. The speed at which it occurs, and the typical over-the-top, rude, and unnecessary attempts to make people seem to say things they 100% have not. You should apologize. Obviously the NSA has broken Tor, they made it. Forget about current funding, where'd it originate? And why does the Tor Project publish a list of exit nodes?
- NikolaeVarius 6y ago
  Why do you trust literally any secure comms code?
  - MintelIE 6y ago
    Did you stop beating your girlfriend yet? Same question, different pose.
- mapgrep 6y ago
  The fact that the US government, largely through Open Technology Fund, originally an arm off the State Department (via Radio Free Asia!), has arguably done more to fund core internet privacy technologies than the private sector is an indictment of the private sector, not of the U.S. government. We should absolutely be aware of funding sources, skeptical of code written by other people, etc, but if you were to actually enforce in your life a position that you won’t use any security or privacy technology with funding ties to the USG you will quickly find yourself in quite an untenable position.
- pfundstein 6y ago
  AES which is the encryption standard for asymmetric crypto and used everywhere (including by the gubment) was designed by the NSA. So what's your point?
  - dependenttypes 6y ago
    > is the encryption standard Some others (such as chacha20) are pretty popular too. This is the only cipher used by wireguard and one of the ciphers used by ssh and tls. > was designed by the NSA No it was not. It was designed by two Belgian cryptographers (the same ones that did SHA3). > for asymmetric crypto Symmetric No offence but you seem quite clueless.
    - pfundstein 6y ago
      Fair enough, but my point against the tinfoil hattery still stands; Just because the gubment was involved with it's inception doesn't mean it has backdoors.
komali2 6y ago
Rumors abound that the NSA runs a bunch of Tor exit nodes
- insertnickname 6y ago
  It would be unreasonable to assume that they aren't. It's a cheap, easy, and low-risk way to soak up lots of interesting traffic.
- teddyh 6y ago
  Even if this was true, it should not change anyone’s behavior; a malicious exit node should be assumed when using Tor. I.e. either always use HTTPS sites, or .onion sites. No HTTP unencrypted sites.
deleted 6y ago
[deleted]
dependenttypes 6y ago
> Why do you think it fails as basic security against the government? Tor connections against normal sites use 3 hops while they use 6 hops against onion sites. Controlling or potentially even analysing the traffic from 2 of the hops is enough to know where the user connects to (it might be 4 hops for the onion case but I am not sure). I am pretty sure that NSA has enough resources for their own nodes. I2P has a better architecture in general but it still does not solve the issue. I am looking into evaluating lokinet at the moment. In general tor does not have a great track record. For example they took ages to upgrade from an 80-bit sha-1 truncated address scheme with dh1024 and aes128 into something more modern.
- pfundstein 6y ago
  You could've just said that you have a hunch.
  - dependenttypes 6y ago
    Are you kidding? What part of "Tor connections against normal sites use 3 hops while they use 6 hops against onion sites. Controlling or potentially even analysing the traffic from 2 of the hops is enough to know where the user connects to (it might be 4 hops for the onion case but I am not sure). I am pretty sure that NSA has enough resources for their own nodes" seems like a hunch? Do you have something that you disagree with? If so just say it.
- shadowprofile77 6y ago
  Okay, definitely a bit less practical, but what about using TOR with TAILS on a laptop that's dedicated to nothing else (laptops for TAILS use generally shouldn't run over top of a Windows or regular OS installation). Furthermore, using said machines or TOR alone from an IP address that isn't one's own identifiable address. That aside, what do you concretely propose as alternatives to TOR for the seriously privacy-conscious (and those, such as activists and dissidents, who need anonymity in a life-or-death way.
  - dependenttypes 6y ago

MintelIE 6y ago

It’s literally funded and made by the NSA. Dissidents and activists have been busted using Tor and there’s always a friendly government damage control agent ready to pop up (any forum, any time of day) to remind people that Tor couldn’t possibly be backdoored or owned, it was always some other type of thing they used in parallel construction. Over-shilling is what clued next in. You don’t get this kind of response without a massive panopticon dispatching reputation managers. Why the heck would the NSA write NSA proof software? LOL. EDIT: this is in reply to mapgrep and his crew: Did I say I won't use Tor Browser? Is it really necessary to put words into my mouth to make your point? I've noticed this a lot with people who are very very lightning fast, almost unbelievably fast, to defend Tor on any forum or platform on the Internet. The speed at which it occurs, and the typical over-the-top, rude, and unnecessary attempts to make people seem to say things they 100% have not. You should apologize. Obviously the NSA has broken Tor, they made it. Forget about current funding, where'd it originate? And why does the Tor Project publish a list of exit nodes?

NikolaeVarius 6y ago
Why do you trust literally any secure comms code?
- MintelIE 6y ago
  Did you stop beating your girlfriend yet? Same question, different pose.
mapgrep 6y ago
The fact that the US government, largely through Open Technology Fund, originally an arm off the State Department (via Radio Free Asia!), has arguably done more to fund core internet privacy technologies than the private sector is an indictment of the private sector, not of the U.S. government. We should absolutely be aware of funding sources, skeptical of code written by other people, etc, but if you were to actually enforce in your life a position that you won’t use any security or privacy technology with funding ties to the USG you will quickly find yourself in quite an untenable position.
pfundstein 6y ago
AES which is the encryption standard for asymmetric crypto and used everywhere (including by the gubment) was designed by the NSA. So what's your point?
- dependenttypes 6y ago
  > is the encryption standard Some others (such as chacha20) are pretty popular too. This is the only cipher used by wireguard and one of the ciphers used by ssh and tls. > was designed by the NSA No it was not. It was designed by two Belgian cryptographers (the same ones that did SHA3). > for asymmetric crypto Symmetric No offence but you seem quite clueless.
  - pfundstein 6y ago
    Fair enough, but my point against the tinfoil hattery still stands; Just because the gubment was involved with it's inception doesn't mean it has backdoors.

komali2 6y ago

Rumors abound that the NSA runs a bunch of Tor exit nodes

insertnickname 6y ago
It would be unreasonable to assume that they aren't. It's a cheap, easy, and low-risk way to soak up lots of interesting traffic.
teddyh 6y ago
Even if this was true, it should not change anyone’s behavior; a malicious exit node should be assumed when using Tor. I.e. either always use HTTPS sites, or .onion sites. No HTTP unencrypted sites.

deleted 6y ago

[deleted]

dependenttypes 6y ago

> Why do you think it fails as basic security against the government? Tor connections against normal sites use 3 hops while they use 6 hops against onion sites. Controlling or potentially even analysing the traffic from 2 of the hops is enough to know where the user connects to (it might be 4 hops for the onion case but I am not sure). I am pretty sure that NSA has enough resources for their own nodes. I2P has a better architecture in general but it still does not solve the issue. I am looking into evaluating lokinet at the moment. In general tor does not have a great track record. For example they took ages to upgrade from an 80-bit sha-1 truncated address scheme with dh1024 and aes128 into something more modern.

pfundstein 6y ago
You could've just said that you have a hunch.
- dependenttypes 6y ago
  Are you kidding? What part of "Tor connections against normal sites use 3 hops while they use 6 hops against onion sites. Controlling or potentially even analysing the traffic from 2 of the hops is enough to know where the user connects to (it might be 4 hops for the onion case but I am not sure). I am pretty sure that NSA has enough resources for their own nodes" seems like a hunch? Do you have something that you disagree with? If so just say it.
shadowprofile77 6y ago
Okay, definitely a bit less practical, but what about using TOR with TAILS on a laptop that's dedicated to nothing else (laptops for TAILS use generally shouldn't run over top of a Windows or regular OS installation). Furthermore, using said machines or TOR alone from an IP address that isn't one's own identifiable address. That aside, what do you concretely propose as alternatives to TOR for the seriously privacy-conscious (and those, such as activists and dissidents, who need anonymity in a life-or-death way.
- dependenttypes 6y ago