6 ms·
To be honest I just take it for granted that all exit relays are either run by Feds or at least compromised by Feds. If you use Tor for anything you wouldn't wa
by Analemma_ 5y ago
To be honest I just take it for granted that all exit relays are either run by Feds or at least compromised by Feds. If you use Tor for anything you wouldn't want Five Eyes to know about, you're an idiot.
- golergka 5y agoWhat would you use instead?
- Analemma_ 5y agoI don't really do anything worth hiding from state-level attackers, but if I did I wouldn't do it over the internet at all.
- gruez 5y agoso you'll do it in meatspace where there are witnesses and facial recognition/ALPR cameras everywhere?
- vinay_ys 5y agoThere's one kind of tech that's good enough to protect your privacy from corporations that want to profile your behavior or keep you safe from malicious hackers who want to steal your data by luring you into digital spider nets. Then there's another kind of tech (and tactics and practices) that could hope to keep you safe when you are targeted by state-level actors in both digital space and meat space. Tor barely belongs in the former category.
- munk-a 5y agoPurchase some hardware with cash and distribute it around the world to tunnel through. Then expose them as public proxy servers (or even Tor nodes) so that a fair amount normie traffic passes through them. If you seriously feel paranoid about being watched then you'll want to own the hardware you're actually passing through. And I assume that any large organizations that demand this level of invisibility (cartels etc...) have essentially done this - likely locating some of those servers behind armed guards that will protect the physical device. That said, I think it's unlikely that Tor has been majority compromised at this point, but as it fades from the minds of folks and becomes more and more niche the probability will escalate.
- itake 5y ago>Purchase some hardware with cash and distribute it around the world to tunnel through. how do you keep the hardware physically secure? What prevents a gov actor replacing it with their own mitm proxy?
- cyberpunk 5y agoI would have paid some homeless guys to get me bunch of SIM cards, use em once, and proxy via some hacked webcams, after cleaning the rest of the malware off em… I mean. That’s what I uhh, would do if I was doing something dodgy on the internet… Edit; with a second hand android bought from a pawn shop running nethunter as an ap ofc…
- v8dev123 5y ago> what I uhh Send me your address and I uhhh
- rsuelzer 5y agoGiven the immense barriers to setting up an exit node, I would find it rather surprising if the majority of exit nodes are not already controlled by state actors, either directly or by proxy. My personal opinion is that if anonymity on Tor is to continue, it will be the result of competition for control of the network between opposing states and not altruistic non-profits.
- encryptluks2 5y agoUse an open Wifi hotspot with a spoofed MAC.
- itake 5y agoThis didn't protect Ross Ulbricht.
- encryptluks2 5y agoBecause he walked away from his computer and left it unlocked. Wear a hidden bluetooth device or something to lock your computer and use USBGuard if you're that worried.
- flatiron 5y agoIIRC he was still sitting at the computer. They just distracted him to turn around and then they swiped it.
- encryptluks2 5y agoRegardless, USBGuard and a hidden bluetooth device to automatically lock when it leaves a certain radius would have likely prevented any issues.
- michaelt 5y agoUlbricht was arrested in 2013. USBGuard and usbkill were released in 2015. Tough to do encryptluks2-approved opsec if you have to use tools that don't exist.
- encryptluks2 5y agoUSBGuard is a newer tool, however the functionality has existed through udev or other integrations for some time.
- 5y ago
- 2OEH8eoCRo0 5y agoUse a VPN and don't do anything that would get you on a terrorist/cybercrime/pedo list in the first place? There is no safe when it comes to determined state actors.
- large 5y ago>Use a VPN Pretty sure that gets you on a list?
- 2OEH8eoCRo0 5y agoYou're pretty sure? It should be easy to find a source for that claim then.
- yakubin 5y ago> don't do anything that would get you on a terrorist/cybercrime/pedo list in the first place? This is going to be difficult: <https://arstechnica.com/information-technology/2014/07/the-nsa-thinks-linux-journal-is-an-extremist-forum/ https://arstechnica.com/information-technology/2014/07/the-n...>
- 2OEH8eoCRo0 5y agoThat says nothing.
- xvector 5y agoIsn’t Tor designed to ensure anonymity despite a snooping exit relay? I thought that even if you compromise an exit you can’t do much without compromising the in-between relays.
- bawolff 5y agoIts designed so that a snooping exit node can't identify you, but it can see all traffic. Which is why you should generally only use https when using tor. The last leg may be snooped on so you need to use encryption during it. (http is fine with hidden services though) Its important to keep in mind that anonoyminity and data integrity are separate properties. You can have one without the others.
- windy_willow 5y agoHmm, just trying to make sure then. If they can see all traffic would using a tool hide this in combination with Tor help?
- bawolff 5y agoUsing https would help. If you totally disable http (or only use http on .onion sites) the described attack won't work. Similarly, if the site in question enabled HSTS the attack would be prevented. Think of tor like the open wifi network of dubious origin at a black hat hacker convention. You are probably fine if using https, but plain http is a bad idea. Using a vpn is more questionable. Generally a paid vpn already knows who you are so hiding you origin ip with tor would be pointless. Also sometimes combining vpn technologies can cause traffic congestion algorithms to interact poorly and make things really slow, but that will depend on which technologies are in use.
- Lammy 5y agoDesigned by the US Navy to ensure anonymity of US agents abroad from other countries via the DoD-birthed Internet, sure.
- 5y ago