3 ms·

"Open source" means literally nothing for the majority of Tor users that are downloading prebuilt binaries from US Government-funded www.torproject.org/download

• sneak 5y ago
  So now you're asserting that the binaries are backdoored, or built from something other than the published source. Again, provide evidence or stop spreading FUD.
  • pphysch 5y ago
    That's sadly not how (cyber)security works. The USG persecutes and imprisons journalists for exposing its war crimes, anyways I'm going to download this Tor binary from them because it says 'totally legit' on the packaging and there's no "hard evidence" to the contrary...
    • rank0 5y ago
      Don’t those binaries come with signatures you can verify? People in the community would notice if building from source produced different signatures than the binaries provided directly by torproject
      • pphysch 5y ago
        In practice the USG would not distribute malevolent binaries everywhere, but could target them to particular IP- and time-ranges. Downloading Tor from a particular IP in Iran? We'll add a little something extra... Or maybe you're a US citizen with a set of known IPs on a "watchlist".
        • sneak 5y ago
          The USG does not operate or control the Tor Project’s servers.
• sweetbitter 5y ago
  And yet, confirmation attacks and traffic shaping by global adversaries are where the actual design flaws lie, inherent to any 'low-latency' (read: performance trumps privacy) anonymizing network, and you know that. Even efforts such as the Invisible Internet Project (I2P) which pile on tactic after tactic to improve upon this, but are too scared to delve in outright mixing traffic, are vulnerable to traffic confirmation attacks.