7 ms·

Tor is a project I want to like and support, but can’t. I feel (and I have no evidence) that for every 1 person using it to protect their privacy, 20 are using

Tor is a project I want to like and support, but can’t. I feel (and I have no evidence) that for every 1 person using it to protect their privacy, 20 are using it for despicable purposes. I would love to be proved wrong on this. I don’t want to shut it down, but at the same time I don’t feel I can personally or technically support it.

Izmaki 6y ago
I imagine the same is true for the use of guns. I’ve operated a middle/guard relay for little over a year now 24/7, and I keep doing it for that one person who genuinely need it.
- ed25519FUUU 6y ago
  Gun is a good analogy I think, and I do support personal gun ownership. But I wouldn’t loan people my gun unless I was 100% sure they wouldn’t use it for anything illegal. Even 99.999% doesn’t really cut it for me.
stormdennis 6y ago
If you lived in a country with strict media censorship would you oppose its relaxation just because you felt that bad people would exploit the resulting situation? I've read somewhere that over the last decades people in Western countries have accepted a gradual diminution of their civil liberties in order to protect society from terrorists. That's how totalitarian regimes have persuaded populations before, in fact Goering explained how it works at his trial. Privacy should be the default and just because bad people will exploit that is no reason to deprive society at large of it. The police etc will just need to work with that limitation.
minimalist 6y ago
FWIW, I have been doing all of my non-multimedia browsing over Tor for about a decade now. It provides cover traffic for people who actually need the anonymity and I feel like it is a step in the right direction to frustrate state and corporate surveillance. Some sites break, but I have observed less and less sites breaking compared to a few years ago. Also browsing is fast enough as to not be distracting, it is like being on a mobile internet connection all the time. It is still lousy to come across sites which don't serve even static content to Tor users. I can understand going into a read-only mode, but throwing an HTTP 403? This comment, posted from Tor :)
- bilegeek 6y ago
  Out of curiosity, since you log into accounts via Tor, are you still concerned about exit node snooping these days? Do you enable the strict mode in HTTPS Everywhere, or do you trust that site-enforced HTTPS is enough?
  - IngoBlechschmid 6y ago
    Not the grandparent, but I've been doing the same (almost only for a couple of years) and yes I trust site-enforced HTTPS. To anyone who last tried Tor years ago: It really got quite fast. I don't notice a difference to my native connection.
- pamperson 6y ago
  and tell us, what kind of activity requires such anonymity?
  - loa_in_ 6y ago
    Asking for opinions on pictures of one's private parts while avoiding someone connecting that to your identity. I mean asking "is that pimple on my scrotum an STD", not advertising them.
    - pamperson 6y ago
      good example but few non technical people would even know about tor, i am sure there are better options that dont necessarily help criminals hide there tracks
wolco 6y ago
You would be surprised by who uses it. Iran and other places have a serious need for tor. https://metrics.torproject.org/userstats-bridge-table.html https://metrics.torproject.org/userstats-bridge-table.html
- maltalex 6y ago
  Yes, many places have a serious need for Tor. But the bridge stats are misleading because bridges are exclusivity for circumventing censorship. The stats for tor relays [0] are different: United States 418568 (20.37 %) Russia 335382 (16.32 %) Germany 172251 (8.38 %) France 92643 (4.51 %) Netherlands 76496 (3.72 %) United Kingdom 68674 (3.34 %) Indonesia 61917 (3.01 %) Ukraine 50331 (2.45 %) Canada 48246 (2.35 %) India 43953 (2.14 %) Out of the roughly 66.5% of relay users represented here, 42.5% are from western countries. [0]: https://metrics.torproject.org/userstats-relay-table.html https://metrics.torproject.org/userstats-relay-table.html
  - adrianN 6y ago
    You should normalize those numbers for population at least, or better for share of non-Tor traffic.
  - Shared404 6y ago
    I personally don't trust Five Eyes any more than any other country.
  - pamperson 6y ago
    loads of pedos and criminals love hiding via that network, and those who run it likely know it, but they defend it as “privacy” and “freedom” yet this stat shows its being used in somewhat free countries.
    - maltalex 6y ago
      While I'm sure you're right about some of Tor's users, there are plenty of perfectly valid (and legal) reasons for using tor in free countries too.
justatdotin 6y ago
> despicable purposes not least; probing those others who want to protect their privacy
fiblye 6y ago
And probably 19 out of 20 of those despicable purposes involve buying weed edibles and shrooms.
- dx034 6y ago
  But if the 20th is used for child pornography or human trafficking it might not matter that the other 19th just want to get high.
  - spoopyskelly 6y ago
    People use the regular internet for "nefarious" purposes. Should we not support the internet? Cars are used to haul human traffic victims, do we ban cars? How about electricity? It powers everything now, the internet, even cars, do we ban that too? People will find ways to do bad shit in every medium and that doesn't mean the medium is bad.
  - ufmace 6y ago
    Maybe a weird question here. I have no doubt there's a disturbing amount of kiddie porn going over Tor. I'm sure it's served somewhere, and those who browse it have good reason to want to hide their IPs, since LE likes to seize the servers and track down everyone who viewed it by IP. But how would Tor be used in human trafficking? I guess the people running it might email each other or something, but why bother doing that over Tor? I would guess the victims are mostly found in-person in low-income areas, probably no internet involved at all, so no point in using Tor. I would also think that if we're talking sex trafficking, the customers are also more of a street corner or in person deal than over the net. Even if the customers are finding it over the net, I haven't heard of anyone seizing whole servers for it and tracing them by IP. Am I missing something here? I just don't see it.
dependenttypes 6y ago
e-crimes are victimless crimes
- blackboxlogic 6y ago
  Sometimes there are victims. https://nakedsecurity.sophos.com/2020/06/12/facebook-paid-for-a-0-day-to-help-fbi-unmask-child-predator/ https://nakedsecurity.sophos.com/2020/06/12/facebook-paid-fo...
  - dependenttypes 6y ago
    I really can't consider that man a victim.
    - blackboxlogic 6y ago
      Maybe I want clear, if maybe you're joking. I was thinking of his victims.
      - dependenttypes 6y ago
        Ah fair enough then. Yes, I had not considered this case of blackmailing.
- Shared404 6y ago
  I think you've got the wrong definition of Hacker for HN.
- ed25519FUUU 6y ago
  If someone was sharing a nude photo of you as a child for sexual purposes, you would not consider yourself a victim?
  - dependenttypes 6y ago
    no
dimator 6y ago
You could say the same for cash.
- adrianN 6y ago
  Do you really believe 95% of cash transaction are for despicable purposes?
  - deleted 6y ago
    [deleted]
  - maltalex 6y ago
    It's actually not that far of the mark. There's a LOT more cash out there than you probably think, and no one really know where is it and what's it being used for. As an example, 80% of the bills in circulation in the US are 100$ bills. It's so much cash that "The average person would be having to carry around 35 or 36 of them in their house or in their wallet. This is for every man, woman, and child." And according to the federal reserve, the demand for large bills comes mostly from border states - Florida, California and Texas. Source: https://freakonomics.com/podcast/still-using-cash/ https://freakonomics.com/podcast/still-using-cash/
    - clort 6y ago
      Its very likely skewed, such that 95% of the transactions are innocent but 95% of the value is despicable. (for some value of 95%)
    - dx034 6y ago
      Most likely, the vast majority are not in circulation but stored somewhere and are outside the US anyway. A stack of $100 bills is probably the best long-term investment for illegal funds that will be used at some point in the future. It's relatively easy to transport, valid until eternity (other than e.g. UK where bills are taken out of circulation every few years or decades) and accepted world wide.
  - deathgrips 6y ago
deathgrips 6y ago
If you feel like people use technology for despicable purposes, wouldn't you also think that bad governments would do even worse things if Tor did not exist?
GoblinSlayer 6y ago
Same things are said about all encryption technologies. And kitchen knife is the most popular murder weapon.
cyphar 6y ago
I highly doubt that 95% are using it for despicable purposes, so I have no ethical concerns with running a Tor relay at home, using Tor regularly, and financially supporting the Tor project. Why? Well, the most obvious "usable for despicable purposes" feature is .onion services. Today, .onion service traffic makes up about 2% of Tor traffic[1] and the largest .onion service by far is Facebook[2] (served at https://facebookcorewwwi.onion/ https://facebookcorewwwi.onion/). So even if we assume that all traffic other than to Facebook is for nefarious purposes (which is not correct given that we know there are other very popular and legal services operating as .onion services), you're looking at much less than 2% of all Tor traffic at best being nefarious. I doubt that the same statistic for clearnet traffic is significantly better. Now, you might argue that most of the clearnet browsing over Tor is nefarious and that focusing on Onion services is a distraction. But that doesn't really match up with reality either. CloudFlare has claimed in the past that 94% of (clearnet) Tor traffic they see is malicious (meaning "DDoS or spam" not "illegal or immoral content")[3] but they provided no justification for this figure, and at the same time Akamai published a study[4] which found that there is no statistically significant difference when it comes to e-commerce behaviour when comparing Tor users and the regular internet. The Tor Project postulated[5] that this claim by CloudFlare was based on them marking exit nodes as being malicious rather than individual connections from exit nodes and CloudFlare hasn't really responded to that in the past 4 years. My point is that the 95% figure you posited doesn't pass the sniff test. That means that 1.9 million of the daily users of Tor are all using it for nefarious purposes. If you just count a handful of countries with well-known internet censorship (Brazil, Venezuela, Iran, Egypt, and China) you already have passed the 5% mark of daily Tor users. [1]: If you compare the onion service and total daily Tor traffic (https://metrics.torproject.org/ https://metrics.torproject.org/), you find that it's about 4 Gbit/s out of a total 200 Gbit/s -- so around 2% at time of writing. [2]: https://www.facebook.com/notes/facebook-over-tor/1-million-people-use-facebook-over-tor/865624066877648/ https://www.facebook.com/notes/facebook-over-tor/1-million-p... [3]: https://blog.cloudflare.com/the-trouble-with-tor/ https://blog.cloudflare.com/the-trouble-with-tor/ [4]: https://www.stateoftheinternet.com/downloads/pdfs/state-of-the-internet-q2-2015-security-report-threat-tor-preso.pptx https://www.stateoftheinternet.com/downloads/pdfs/state-of-t... [5]: https://blog.torproject.org/trouble-cloudflare https://blog.torproject.org/trouble-cloudflare
P-ala-din 6y ago
I think we call things rights only if someone potentially wants to take them. If no one ever took or would ever take a specific right from anyone, I don't see what's the point of calling that a right. for every right, there are situations where someone stands to gain something from denying it. Therefore financial gain, stopping the bad guys are not in themselves sufficient excuse to deny innocent people their rights. This admittedly causes an asymmetry making the abolition of rights much costlier than their recognition. but I'd argue that's a good thing, as it reduces ladder pulling where people only recognize rights in the periods where it suits them. And in the long run results in people having more recognized rights.
birb007 6y ago
Author here. I thought of it as "is one person escaping an authoritarian regime to communicate freely worth more or less than ten people buying drugs?". A criminal will always find another way to engage in criminal activities, but can a news reporter or activist find another safe way to communicate? I felt as though the benefits to users using tor for legitimate purposes, outweighed the users who used tor maliciously.
- dx034 6y ago
  I'd be less concerned about drugs and more about human trafficking or child pornography.
  - birb007 6y ago
    Purely speculation but I strongly suspect the subset of malicious tor users engaging in child pornography and human trafficking is extremely, extremely small. The largest group of malicious users is most likely drug and cybercrime related. Is it worth decrying tor as a heaven for pedophiles or human traffickers if they make up a negligible number of users? If so, the same could easily be said about bitcoin or any other decentralised cryptocurrency. The benefits given to journalists, activists, or any individual who wants anonymity for the sake of pricacy is worth more, to me, than maybe helping a negligible number of users. Further, those malicious users would likely find another way to engage in their activities but could the legitimate users?
  - tjomk 6y ago
    There are a bunch of similar projects where such people could (and likely already are) move: I2P, Freenet, GNUnet, and probably some others. So closing (or not supporting) Tor just because some bad actors are there is pointless. Every tool can be used for both good and bad things.
pamperson 6y ago
Real strange that the mob here is downvoting you - you are right, tor is used by criminals. i’d stay away from it as it has nothing to do with being “anonymous” for...”privacy”.
Diederich 6y ago
I run most of my in-home apps as Tor hidden services, simply because it's a very easy way to get traffic in past multiple layers of NATs and firewalls, given that I always have a Tor enabled browser available on my remote phones and other devices.

Izmaki 6y ago

I imagine the same is true for the use of guns. I’ve operated a middle/guard relay for little over a year now 24/7, and I keep doing it for that one person who genuinely need it.

ed25519FUUU 6y ago
Gun is a good analogy I think, and I do support personal gun ownership. But I wouldn’t loan people my gun unless I was 100% sure they wouldn’t use it for anything illegal. Even 99.999% doesn’t really cut it for me.

stormdennis 6y ago

If you lived in a country with strict media censorship would you oppose its relaxation just because you felt that bad people would exploit the resulting situation? I've read somewhere that over the last decades people in Western countries have accepted a gradual diminution of their civil liberties in order to protect society from terrorists. That's how totalitarian regimes have persuaded populations before, in fact Goering explained how it works at his trial. Privacy should be the default and just because bad people will exploit that is no reason to deprive society at large of it. The police etc will just need to work with that limitation.

minimalist 6y ago

FWIW, I have been doing all of my non-multimedia browsing over Tor for about a decade now. It provides cover traffic for people who actually need the anonymity and I feel like it is a step in the right direction to frustrate state and corporate surveillance. Some sites break, but I have observed less and less sites breaking compared to a few years ago. Also browsing is fast enough as to not be distracting, it is like being on a mobile internet connection all the time. It is still lousy to come across sites which don't serve even static content to Tor users. I can understand going into a read-only mode, but throwing an HTTP 403? This comment, posted from Tor :)

bilegeek 6y ago
Out of curiosity, since you log into accounts via Tor, are you still concerned about exit node snooping these days? Do you enable the strict mode in HTTPS Everywhere, or do you trust that site-enforced HTTPS is enough?
- IngoBlechschmid 6y ago
  Not the grandparent, but I've been doing the same (almost only for a couple of years) and yes I trust site-enforced HTTPS. To anyone who last tried Tor years ago: It really got quite fast. I don't notice a difference to my native connection.
pamperson 6y ago
and tell us, what kind of activity requires such anonymity?
- loa_in_ 6y ago
  Asking for opinions on pictures of one's private parts while avoiding someone connecting that to your identity. I mean asking "is that pimple on my scrotum an STD", not advertising them.
  - pamperson 6y ago
    good example but few non technical people would even know about tor, i am sure there are better options that dont necessarily help criminals hide there tracks

wolco 6y ago

You would be surprised by who uses it. Iran and other places have a serious need for tor. https://metrics.torproject.org/userstats-bridge-table.html https://metrics.torproject.org/userstats-bridge-table.html

maltalex 6y ago
Yes, many places have a serious need for Tor. But the bridge stats are misleading because bridges are exclusivity for circumventing censorship. The stats for tor relays [0] are different: United States 418568 (20.37 %) Russia 335382 (16.32 %) Germany 172251 (8.38 %) France 92643 (4.51 %) Netherlands 76496 (3.72 %) United Kingdom 68674 (3.34 %) Indonesia 61917 (3.01 %) Ukraine 50331 (2.45 %) Canada 48246 (2.35 %) India 43953 (2.14 %) Out of the roughly 66.5% of relay users represented here, 42.5% are from western countries. [0]: https://metrics.torproject.org/userstats-relay-table.html https://metrics.torproject.org/userstats-relay-table.html
- adrianN 6y ago
  You should normalize those numbers for population at least, or better for share of non-Tor traffic.
- Shared404 6y ago
  I personally don't trust Five Eyes any more than any other country.
- pamperson 6y ago
  loads of pedos and criminals love hiding via that network, and those who run it likely know it, but they defend it as “privacy” and “freedom” yet this stat shows its being used in somewhat free countries.
  - maltalex 6y ago
    While I'm sure you're right about some of Tor's users, there are plenty of perfectly valid (and legal) reasons for using tor in free countries too.

justatdotin 6y ago

> despicable purposes not least; probing those others who want to protect their privacy

fiblye 6y ago

And probably 19 out of 20 of those despicable purposes involve buying weed edibles and shrooms.

dx034 6y ago
But if the 20th is used for child pornography or human trafficking it might not matter that the other 19th just want to get high.
- spoopyskelly 6y ago
  People use the regular internet for "nefarious" purposes. Should we not support the internet? Cars are used to haul human traffic victims, do we ban cars? How about electricity? It powers everything now, the internet, even cars, do we ban that too? People will find ways to do bad shit in every medium and that doesn't mean the medium is bad.
- ufmace 6y ago
  Maybe a weird question here. I have no doubt there's a disturbing amount of kiddie porn going over Tor. I'm sure it's served somewhere, and those who browse it have good reason to want to hide their IPs, since LE likes to seize the servers and track down everyone who viewed it by IP. But how would Tor be used in human trafficking? I guess the people running it might email each other or something, but why bother doing that over Tor? I would guess the victims are mostly found in-person in low-income areas, probably no internet involved at all, so no point in using Tor. I would also think that if we're talking sex trafficking, the customers are also more of a street corner or in person deal than over the net. Even if the customers are finding it over the net, I haven't heard of anyone seizing whole servers for it and tracing them by IP. Am I missing something here? I just don't see it.

dependenttypes 6y ago

e-crimes are victimless crimes

blackboxlogic 6y ago
Sometimes there are victims. https://nakedsecurity.sophos.com/2020/06/12/facebook-paid-for-a-0-day-to-help-fbi-unmask-child-predator/ https://nakedsecurity.sophos.com/2020/06/12/facebook-paid-fo...
- dependenttypes 6y ago
  I really can't consider that man a victim.
  - blackboxlogic 6y ago
    Maybe I want clear, if maybe you're joking. I was thinking of his victims.
    - dependenttypes 6y ago
      Ah fair enough then. Yes, I had not considered this case of blackmailing.
Shared404 6y ago
I think you've got the wrong definition of Hacker for HN.
ed25519FUUU 6y ago
If someone was sharing a nude photo of you as a child for sexual purposes, you would not consider yourself a victim?
- dependenttypes 6y ago
  no

dimator 6y ago

You could say the same for cash.

adrianN 6y ago
Do you really believe 95% of cash transaction are for despicable purposes?
- deleted 6y ago
  [deleted]
- maltalex 6y ago
  It's actually not that far of the mark. There's a LOT more cash out there than you probably think, and no one really know where is it and what's it being used for. As an example, 80% of the bills in circulation in the US are 100$ bills. It's so much cash that "The average person would be having to carry around 35 or 36 of them in their house or in their wallet. This is for every man, woman, and child." And according to the federal reserve, the demand for large bills comes mostly from border states - Florida, California and Texas. Source: https://freakonomics.com/podcast/still-using-cash/ https://freakonomics.com/podcast/still-using-cash/
  - clort 6y ago
    Its very likely skewed, such that 95% of the transactions are innocent but 95% of the value is despicable. (for some value of 95%)
  - dx034 6y ago
    Most likely, the vast majority are not in circulation but stored somewhere and are outside the US anyway. A stack of $100 bills is probably the best long-term investment for illegal funds that will be used at some point in the future. It's relatively easy to transport, valid until eternity (other than e.g. UK where bills are taken out of circulation every few years or decades) and accepted world wide.
- deathgrips 6y ago

deathgrips 6y ago

If you feel like people use technology for despicable purposes, wouldn't you also think that bad governments would do even worse things if Tor did not exist?

GoblinSlayer 6y ago

Same things are said about all encryption technologies. And kitchen knife is the most popular murder weapon.

cyphar 6y ago

I highly doubt that 95% are using it for despicable purposes, so I have no ethical concerns with running a Tor relay at home, using Tor regularly, and financially supporting the Tor project. Why? Well, the most obvious "usable for despicable purposes" feature is .onion services. Today, .onion service traffic makes up about 2% of Tor traffic[1] and the largest .onion service by far is Facebook[2] (served at https://facebookcorewwwi.onion/ https://facebookcorewwwi.onion/). So even if we assume that all traffic other than to Facebook is for nefarious purposes (which is not correct given that we know there are other very popular and legal services operating as .onion services), you're looking at much less than 2% of all Tor traffic at best being nefarious. I doubt that the same statistic for clearnet traffic is significantly better. Now, you might argue that most of the clearnet browsing over Tor is nefarious and that focusing on Onion services is a distraction. But that doesn't really match up with reality either. CloudFlare has claimed in the past that 94% of (clearnet) Tor traffic they see is malicious (meaning "DDoS or spam" not "illegal or immoral content")[3] but they provided no justification for this figure, and at the same time Akamai published a study[4] which found that there is no statistically significant difference when it comes to e-commerce behaviour when comparing Tor users and the regular internet. The Tor Project postulated[5] that this claim by CloudFlare was based on them marking exit nodes as being malicious rather than individual connections from exit nodes and CloudFlare hasn't really responded to that in the past 4 years. My point is that the 95% figure you posited doesn't pass the sniff test. That means that 1.9 million of the daily users of Tor are all using it for nefarious purposes. If you just count a handful of countries with well-known internet censorship (Brazil, Venezuela, Iran, Egypt, and China) you already have passed the 5% mark of daily Tor users. [1]: If you compare the onion service and total daily Tor traffic (https://metrics.torproject.org/ https://metrics.torproject.org/), you find that it's about 4 Gbit/s out of a total 200 Gbit/s -- so around 2% at time of writing. [2]: https://www.facebook.com/notes/facebook-over-tor/1-million-people-use-facebook-over-tor/865624066877648/ https://www.facebook.com/notes/facebook-over-tor/1-million-p... [3]: https://blog.cloudflare.com/the-trouble-with-tor/ https://blog.cloudflare.com/the-trouble-with-tor/ [4]: https://www.stateoftheinternet.com/downloads/pdfs/state-of-the-internet-q2-2015-security-report-threat-tor-preso.pptx https://www.stateoftheinternet.com/downloads/pdfs/state-of-t... [5]: https://blog.torproject.org/trouble-cloudflare https://blog.torproject.org/trouble-cloudflare

P-ala-din 6y ago

I think we call things rights only if someone potentially wants to take them. If no one ever took or would ever take a specific right from anyone, I don't see what's the point of calling that a right. for every right, there are situations where someone stands to gain something from denying it. Therefore financial gain, stopping the bad guys are not in themselves sufficient excuse to deny innocent people their rights. This admittedly causes an asymmetry making the abolition of rights much costlier than their recognition. but I'd argue that's a good thing, as it reduces ladder pulling where people only recognize rights in the periods where it suits them. And in the long run results in people having more recognized rights.

birb007 6y ago

Author here. I thought of it as "is one person escaping an authoritarian regime to communicate freely worth more or less than ten people buying drugs?". A criminal will always find another way to engage in criminal activities, but can a news reporter or activist find another safe way to communicate? I felt as though the benefits to users using tor for legitimate purposes, outweighed the users who used tor maliciously.

dx034 6y ago
I'd be less concerned about drugs and more about human trafficking or child pornography.
- birb007 6y ago
  Purely speculation but I strongly suspect the subset of malicious tor users engaging in child pornography and human trafficking is extremely, extremely small. The largest group of malicious users is most likely drug and cybercrime related. Is it worth decrying tor as a heaven for pedophiles or human traffickers if they make up a negligible number of users? If so, the same could easily be said about bitcoin or any other decentralised cryptocurrency. The benefits given to journalists, activists, or any individual who wants anonymity for the sake of pricacy is worth more, to me, than maybe helping a negligible number of users. Further, those malicious users would likely find another way to engage in their activities but could the legitimate users?
- tjomk 6y ago
  There are a bunch of similar projects where such people could (and likely already are) move: I2P, Freenet, GNUnet, and probably some others. So closing (or not supporting) Tor just because some bad actors are there is pointless. Every tool can be used for both good and bad things.

pamperson 6y ago

Real strange that the mob here is downvoting you - you are right, tor is used by criminals. i’d stay away from it as it has nothing to do with being “anonymous” for...”privacy”.

Diederich 6y ago

I run most of my in-home apps as Tor hidden services, simply because it's a very easy way to get traffic in past multiple layers of NATs and firewalls, given that I always have a Tor enabled browser available on my remote phones and other devices.