5 ms·

I'm in charge of a security for a reasonable sized company. I generally support the Tor project and the goals of having a surveillance free internet. However -

I'm in charge of a security for a reasonable sized company. I generally support the Tor project and the goals of having a surveillance free internet. However - if an employee would install tor browser or use tor on a company device, or a device attached to the company network, they would be fired immediately. I would then refer them to law enforcement after conducting a forensic audit. Should you make your site only available via onion routing, or primarily available on onion routing, all workplaces will immediately block access and look at anyone who accesses with great incredulity

tomrod 6y ago
Naive question, as I am not a security professional. Why?
- coolspot 6y ago
  In some businesses it is important that all employee communications are captured and can be inspected in case there is suspicion of IP or customer data theft. For example in a hospital, there is no good reason for employee to use Tor on work computer.
  - Reelin 6y ago
    That's an excellent example but I'd point out that in any such scenario devices ought to be thoroughly locked down and run strictly audited environments. If properly configured you wouldn't be firing an employee for using Tor but instead for maliciously tampering with company hardware.
  - toyg 6y ago
    > in a hospital, there is no good reason for employee to use Tor on work computer. I would argue that hospitals and other public settings are actually more in need of higher privacy in electronic communications. Imagine a physician working on, say, Scarlett Johansson's health issues; he periodically sends this data to the specialist that will run some test, and a creepy sysadmin finds out. Should he be able to MITM those comms, and resell the info to newspapers (or worse)...? Nope; the physician should have perfect privacy from network operators.
  - 0xggus 6y ago
    >For example in a hospital, there is no good reason for employee to use Tor on work computer. "I'm a doctor in a very political town. When I have to do research on diseases and treatment or look into aspects of my patients' histories, I am well aware that my search histories might be correlated to patient visits and leak information about their health, families, and personal lives. I use Tor to do much of my research when I think there is a risk of correlating it to patient visits. - Anonymous Tor User" From here: https://blog.torproject.org/remote-work-personal-safety https://blog.torproject.org/remote-work-personal-safety
JTbane 6y ago
That seems like a bit of a knee-jerk reaction, you could just ask them not to use Tor on the company network. Some legit browser come bundled with it (Brave).
Erlich_Bachman 6y ago
What logic is there behind what you wrote?
MattGaiser 6y ago
> I would then refer them to law enforcement What kind of industry do you work in where the mere act of using Tor is reasonable suspicion of a law being broken?
- lexicon0 6y ago
  Financial services, but I suspect any business that provides hardware & software to it's employees would take the same view.
  - bravoetch 6y ago
    You're saying that if someone installs TOR, you'd refer them to law enforcement? This is interesting. What do you tell law enforcement? You: "Hey I'd like to report someone a work installed a web browser that I don't like.." LEO: "are you reporting a crime?" You: "No, just that they installed TOR." LEO: "Sounds serious. Did they hack your network?" You: "No, I'm the head of security, I let my users install what they want, except I'm also mad they chose TOR so please come and arrest them."
danShumway 6y ago
I wasn't as active on the Internet during the initial rise of HTTPS, but I wonder how many companies, schools, and public stores threw the exact same fits back then when they realized there might be a world where they could no longer MITM every web request that went across their routers. I do remember the "kids who use Linux are hackers" arguments from schools; arguments that still occasionally pop up on rare occasions. And even more recently, I see the pushback from administrators and ISPs over encrypted DNS. My instinct in this situation is that the "only criminals need privacy" argument is probably evergreen, and that Tor probably isn't in a unique position. Of course, companies can choose what to install on their own devices, and they can choose what software they'll allow to connect to their networks. The Tor project changes nothing about employers' rights to control and monitor the hardware that they issue. It's normal for workplace networks to have more restrictions than ordinary networks. Nevertheless, if (beyond those policies) your instinct is that anyone you see using Tor is probably a criminal, then I'm not sure you can honestly claim that you "generally support the Tor project and the goals of having a surveillance free internet." A casual observer would be forgiven for thinking that maybe the opposite is true, and you're terrified of a world where the Internet can't be monitored -- particularly the ordinary, everyday Internet as accessed by regular nontechnical people on their regular, everyday smartphones and laptops.
- lexicon0 6y ago
  There is no legitimate use for it in this context, and as such, every single instance of it has been associated with a crime, mostly CSAM.
  - danShumway 6y ago
    > There is no legitimate use for it in this context There's no legitimate usage for World of Warcraft on a work computer, and I'd happily ban that from work computers. But I also wouldn't hop onto an unrelated article for new players and imply that all of them were criminals. The linked article never mentions work computers, it's talking to website operators. If your objection here is that you think Tor is inappropriate at this moment in one specific work setting, then fine, but that's not really adding anything to the conversation about whether or not general websites should be made available over Tor. It's just unrelated FUD. I want to be clear, the goal of Tor proponents is for everyone to be running Tor (or something similar), and for most websites to be available over Tor by default. People should be running Tor on their smartphones, on their home laptops. Tor should be the default way that people share files with each other, and the default way that people set up technical blogs, or even just quick websites that show off pictures of their cat. The vision of the Tor project is a world where Tor is normal and ubiquitous for regular, non-technical people. So unless your work policy bans all personal devices from your network, creating an expectation that any smartphone that joins and boots up a Tor browser automatically belongs to a criminal is contrary to the goals of the privacy movement. Our goal is that every device and every website should be private by default. Your network should be the exception, and it should only have company-owned devices on it. And of course it's fine if you disagree with that, you don't have to be a privacy proponent. Lots of smart, reasonable people disagree with us about what the balance is between security and privacy. But demonizing Tor users in ordinary, everyday contexts is anti-Tor. > or primarily available on onion routing, all workplaces will immediately block access and look at anyone who accesses with great incredulity To go a step farther and suggest that making a website available over Tor should automatically mean that people who visit it are suspicious -- that is also anti-Tor and (I would argue) anti-privacy in general. If I went into an interview for any company in any field offhandedly mentioning that I ran a Tor website, and then had to field a bunch of questions about whether or not I was a criminal, that would be a major red flag to me to avoid that company.
zozbot234 6y ago
You can use public onion gateways for this use case. No need to install or use Tor inside the company.
teddyh 6y ago
I note that you have not disclosed your identity here on HN. Should you therefore be banned?
ex_amazon_sde 6y ago
I've been in charge of security in a company with a very popular product. Data leaks were a concern. Yet, the Tor browser was recommended to protect employees from targeted attacks based on browser fingerprinting. I'd like to hear what threat you are mitigating.
user_agent 6y ago
I've been working for a couple multinational corporations during last 10 years or so and I never had ANY issues with using Tor in the workplace.
- hirako2000 6y ago
  I've plugged my laptop to my Corp WiFi, Brave browser was running a tor client process, I got approached by Ciso within 3 minutes asking to stop torring or get off the network immediately.

tomrod 6y ago

Naive question, as I am not a security professional. Why?

coolspot 6y ago
In some businesses it is important that all employee communications are captured and can be inspected in case there is suspicion of IP or customer data theft. For example in a hospital, there is no good reason for employee to use Tor on work computer.
- Reelin 6y ago
  That's an excellent example but I'd point out that in any such scenario devices ought to be thoroughly locked down and run strictly audited environments. If properly configured you wouldn't be firing an employee for using Tor but instead for maliciously tampering with company hardware.
- toyg 6y ago
  > in a hospital, there is no good reason for employee to use Tor on work computer. I would argue that hospitals and other public settings are actually more in need of higher privacy in electronic communications. Imagine a physician working on, say, Scarlett Johansson's health issues; he periodically sends this data to the specialist that will run some test, and a creepy sysadmin finds out. Should he be able to MITM those comms, and resell the info to newspapers (or worse)...? Nope; the physician should have perfect privacy from network operators.
- 0xggus 6y ago
  >For example in a hospital, there is no good reason for employee to use Tor on work computer. "I'm a doctor in a very political town. When I have to do research on diseases and treatment or look into aspects of my patients' histories, I am well aware that my search histories might be correlated to patient visits and leak information about their health, families, and personal lives. I use Tor to do much of my research when I think there is a risk of correlating it to patient visits. - Anonymous Tor User" From here: https://blog.torproject.org/remote-work-personal-safety https://blog.torproject.org/remote-work-personal-safety

JTbane 6y ago

That seems like a bit of a knee-jerk reaction, you could just ask them not to use Tor on the company network. Some legit browser come bundled with it (Brave).

Erlich_Bachman 6y ago

What logic is there behind what you wrote?

MattGaiser 6y ago

> I would then refer them to law enforcement What kind of industry do you work in where the mere act of using Tor is reasonable suspicion of a law being broken?

lexicon0 6y ago
Financial services, but I suspect any business that provides hardware & software to it's employees would take the same view.
- bravoetch 6y ago
  You're saying that if someone installs TOR, you'd refer them to law enforcement? This is interesting. What do you tell law enforcement? You: "Hey I'd like to report someone a work installed a web browser that I don't like.." LEO: "are you reporting a crime?" You: "No, just that they installed TOR." LEO: "Sounds serious. Did they hack your network?" You: "No, I'm the head of security, I let my users install what they want, except I'm also mad they chose TOR so please come and arrest them."

danShumway 6y ago

I wasn't as active on the Internet during the initial rise of HTTPS, but I wonder how many companies, schools, and public stores threw the exact same fits back then when they realized there might be a world where they could no longer MITM every web request that went across their routers. I do remember the "kids who use Linux are hackers" arguments from schools; arguments that still occasionally pop up on rare occasions. And even more recently, I see the pushback from administrators and ISPs over encrypted DNS. My instinct in this situation is that the "only criminals need privacy" argument is probably evergreen, and that Tor probably isn't in a unique position. Of course, companies can choose what to install on their own devices, and they can choose what software they'll allow to connect to their networks. The Tor project changes nothing about employers' rights to control and monitor the hardware that they issue. It's normal for workplace networks to have more restrictions than ordinary networks. Nevertheless, if (beyond those policies) your instinct is that anyone you see using Tor is probably a criminal, then I'm not sure you can honestly claim that you "generally support the Tor project and the goals of having a surveillance free internet." A casual observer would be forgiven for thinking that maybe the opposite is true, and you're terrified of a world where the Internet can't be monitored -- particularly the ordinary, everyday Internet as accessed by regular nontechnical people on their regular, everyday smartphones and laptops.

lexicon0 6y ago
There is no legitimate use for it in this context, and as such, every single instance of it has been associated with a crime, mostly CSAM.
- danShumway 6y ago
  > There is no legitimate use for it in this context There's no legitimate usage for World of Warcraft on a work computer, and I'd happily ban that from work computers. But I also wouldn't hop onto an unrelated article for new players and imply that all of them were criminals. The linked article never mentions work computers, it's talking to website operators. If your objection here is that you think Tor is inappropriate at this moment in one specific work setting, then fine, but that's not really adding anything to the conversation about whether or not general websites should be made available over Tor. It's just unrelated FUD. I want to be clear, the goal of Tor proponents is for everyone to be running Tor (or something similar), and for most websites to be available over Tor by default. People should be running Tor on their smartphones, on their home laptops. Tor should be the default way that people share files with each other, and the default way that people set up technical blogs, or even just quick websites that show off pictures of their cat. The vision of the Tor project is a world where Tor is normal and ubiquitous for regular, non-technical people. So unless your work policy bans all personal devices from your network, creating an expectation that any smartphone that joins and boots up a Tor browser automatically belongs to a criminal is contrary to the goals of the privacy movement. Our goal is that every device and every website should be private by default. Your network should be the exception, and it should only have company-owned devices on it. And of course it's fine if you disagree with that, you don't have to be a privacy proponent. Lots of smart, reasonable people disagree with us about what the balance is between security and privacy. But demonizing Tor users in ordinary, everyday contexts is anti-Tor. > or primarily available on onion routing, all workplaces will immediately block access and look at anyone who accesses with great incredulity To go a step farther and suggest that making a website available over Tor should automatically mean that people who visit it are suspicious -- that is also anti-Tor and (I would argue) anti-privacy in general. If I went into an interview for any company in any field offhandedly mentioning that I ran a Tor website, and then had to field a bunch of questions about whether or not I was a criminal, that would be a major red flag to me to avoid that company.

zozbot234 6y ago

You can use public onion gateways for this use case. No need to install or use Tor inside the company.

teddyh 6y ago

I note that you have not disclosed your identity here on HN. Should you therefore be banned?

ex_amazon_sde 6y ago

I've been in charge of security in a company with a very popular product. Data leaks were a concern. Yet, the Tor browser was recommended to protect employees from targeted attacks based on browser fingerprinting. I'd like to hear what threat you are mitigating.

user_agent 6y ago

I've been working for a couple multinational corporations during last 10 years or so and I never had ANY issues with using Tor in the workplace.

hirako2000 6y ago
I've plugged my laptop to my Corp WiFi, Brave browser was running a tor client process, I got approached by Ciso within 3 minutes asking to stop torring or get off the network immediately.