3 ms·

The Tor Browser is scrutinized heavily. I know that is kind of a fallacious argument, but they have a routine presence at DefCon and they are really committed t

The Tor Browser is scrutinized heavily. I know that is kind of a fallacious argument, but they have a routine presence at DefCon and they are really committed to protecting people around the world. At DefCon last year, the Tor project talked about the biggest security concern as countries who monitor the entry points to the network, and the challenges with getting those IPs distributed confidentially and keeping them hidden. (If you don't already know, Tor does require an entry IP address list before the anonymization occurs: countries can arrest people who visit these URLs, so this is the big challenge right now.) Someone who knows more can probably elaborate, but after hearing them present year after year, and how much global advocacy they engage in, and their transparency, I find it unlikely they have NSA spooks embedded. I use it when I need to read something objectionable through a VPN. (Still not perfect, because I run a VPN on EC2 and the exit zone is in the US...) Not trying to be flame-baity here, but with Trump's ranting about making ANTIFA a terror org, and with the recent legislation that allows warrant-less IP tracking, I am legitimately concerned I might end up on a watch list because I visit a website this admin finds objectionable.

elliekelly 6y ago
> If you don't already know, Tor does require an entry IP address list before the anonymization occurs: countries can arrest people who visit these URLs, so this is the big challenge right now. Sorry, can you explain what this means? Would my home IP address be the "entry IP address" you're referring to?
- rakoo 6y ago
  No, it's the IP of the first relay. Tor works pretty much like this: You -> Relay 1 -> Relay 2 -> Relay 3 -> The website Each arrow is an encrypted connection. The content of the exchange on a single arrow is the address of the next hop and the query of the next hop. Thanks to this: - Relay 1 only knows you're going through Relay 2 - Relay 2 doesn't know who's asking (you) but knows it passed through Relay 1 and is going through Relay 3 - Relay 3 doesn't know who's asking (you) and where you entered, but knows it's going to the website The nodes in the middle know everything that goes through them, but don't have the big picture. The entry IP address is the IP address of Relay 1. Your computer must know an address to connect to, and that address is distributed in listings by the Tor Project. Since this listing is public, it also makes it easier for censors to censor, or at least detect who's interested in connecting through Tor
  - staycoolboy 6y ago
    Do you know if GDPR prevents EU countries from obtaining IP logs for Amazon zones located there? I was hoping I could spin up an EC2 VPN in Europe and feel more secure that my IP logs can't be obtained by the US gov't. I use RunBox for email in Norway, which has the strictest privacy laws, but there is no AWS zone there. Any thoughts? Thanks.
    - uzakov 6y ago
      Maybe through the UKUSA agreement or similar. https://en.m.wikipedia.org/wiki/UKUSA_Agreement https://en.m.wikipedia.org/wiki/UKUSA_Agreement
    - justinclift 6y ago
      The US CLOUD Act was designed specifically to enable US gov agencies to access that information: https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act So, don't use EC2 or stuff hosted by other US companies for things to you want to keep private from the US gov. Also note the US gov shares intelligence with other countries, as mentioned by a sibling post.
    - DanBC 6y ago
      > Do you know if GDPR prevents EU countries from obtaining IP logs for Amazon zones located there? GDPR has specific exemptions for law enforcement and national security. Governments are allowed to get the data by claiming it's for national security. Some EU countries may have better protections than others. To give better advice I guess people would want to know what your risk model is. Who do you think is after your data? What do you want to protect?
      - staycoolboy 6y ago
        > risk model is Mostly curiosity: what is the highest degree I can obscure my web use and meta data with off-the-shelf technologies?
- deleted 6y ago
  [deleted]

elliekelly 6y ago

> If you don't already know, Tor does require an entry IP address list before the anonymization occurs: countries can arrest people who visit these URLs, so this is the big challenge right now. Sorry, can you explain what this means? Would my home IP address be the "entry IP address" you're referring to?

rakoo 6y ago
No, it's the IP of the first relay. Tor works pretty much like this: You -> Relay 1 -> Relay 2 -> Relay 3 -> The website Each arrow is an encrypted connection. The content of the exchange on a single arrow is the address of the next hop and the query of the next hop. Thanks to this: - Relay 1 only knows you're going through Relay 2 - Relay 2 doesn't know who's asking (you) but knows it passed through Relay 1 and is going through Relay 3 - Relay 3 doesn't know who's asking (you) and where you entered, but knows it's going to the website The nodes in the middle know everything that goes through them, but don't have the big picture. The entry IP address is the IP address of Relay 1. Your computer must know an address to connect to, and that address is distributed in listings by the Tor Project. Since this listing is public, it also makes it easier for censors to censor, or at least detect who's interested in connecting through Tor
- staycoolboy 6y ago
  Do you know if GDPR prevents EU countries from obtaining IP logs for Amazon zones located there? I was hoping I could spin up an EC2 VPN in Europe and feel more secure that my IP logs can't be obtained by the US gov't. I use RunBox for email in Norway, which has the strictest privacy laws, but there is no AWS zone there. Any thoughts? Thanks.
  - uzakov 6y ago
    Maybe through the UKUSA agreement or similar. https://en.m.wikipedia.org/wiki/UKUSA_Agreement https://en.m.wikipedia.org/wiki/UKUSA_Agreement
  - justinclift 6y ago
    The US CLOUD Act was designed specifically to enable US gov agencies to access that information: https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act So, don't use EC2 or stuff hosted by other US companies for things to you want to keep private from the US gov. Also note the US gov shares intelligence with other countries, as mentioned by a sibling post.
  - DanBC 6y ago
    > Do you know if GDPR prevents EU countries from obtaining IP logs for Amazon zones located there? GDPR has specific exemptions for law enforcement and national security. Governments are allowed to get the data by claiming it's for national security. Some EU countries may have better protections than others. To give better advice I guess people would want to know what your risk model is. Who do you think is after your data? What do you want to protect?
    - staycoolboy 6y ago
      > risk model is Mostly curiosity: what is the highest degree I can obscure my web use and meta data with off-the-shelf technologies?
deleted 6y ago
[deleted]