6 ms·
> Using onion services mitigates attacks that can be executed by possibly-malicious “Tor Exit Nodes” — which, though rare, are not nonexistent Is there any evi
by nextaccountic 5y ago
> Using onion services mitigates attacks that can be executed by possibly-malicious “Tor Exit Nodes” — which, though rare, are not nonexistent
Is there any evidence that the majority of exit nodes aren't malicious? There's only 300 or so in the US, 300 or so in Germany, and in other countries even less. What would it take for three letter agencies to compromise most of it?
I mean, suppose all of the existing nodes weren't malicious. Could a government agency plausibly run 1000 exit nodes in a way that doesn't give away they are government-run? This would make the majority of exit nodes malicious.
- RL_Quine 5y agoThe behaviour of not always using the same exit means that you, over time, will almost assuredly use a malicious exit should more than zero exist. It's reckless to suggest that anybody should be using this system, your situation is almost always going to be worse than not.
- bauruine 5y agoThe only attacks an exit alone can do is sniff all traffic and modify the traffic. There are constant checks done by the Torproject to detect bad exits that modify traffic but sniffing is not detectable of course. But both of those attacks are mitigated by https which most sites support nowadays. Firefox and therefore the Tor Browser also has an option to disable http. [0] And using an .onion service removes this attack vector also. [0]: https://support.mozilla.org/en-US/kb/https-only-prefs https://support.mozilla.org/en-US/kb/https-only-prefs
- RL_Quine 5y agoIf they're not checking everything, any sort of non-general modification of traffic will obviously go completely unnoticed. The bad exit flag really is only ever going to catch the most obvious, ham fisted bad behaviour.
- bauruine 5y agoYou're correct this isn't really a solution but Tor Browser has already merged https only mode [0] so this should become less of an issue in the near future. [0]: https://gitlab.torproject.org/tpo/applications/tor-browser/-/merge_requests/256 https://gitlab.torproject.org/tpo/applications/tor-browser/-...
- michaelt 5y ago> But both of those attacks are mitigated by https which most sites support nowadays. Unfortunately, not as much as you might hope. For good reasons, the Tor browser doesn't store your browsing history - so there's no 'recently visited sites', no address bar autocomplete, no cached redirects, no cached HSTS, and no colour-changed 'visited' links. So if you're visiting a site that isn't HSTS-preloaded - for example bitcoinknots.org - you'd better remember to type in the https:// https:// explicitly, as that's your sole protection against getting MITMed.
- vageli 5y ago> So if you're visiting a site that isn't HSTS-preloaded - for example bitcoinknots.org - you'd better remember to type in the https:// https:// explicitly, as that's your sole protection against getting MITMed. >Tor Browser already comes with HTTPS Everywhere, NoScript, and other patches to protect your privacy and security. https://www.torproject.org/download/ https://www.torproject.org/download/
- ryeights 5y agoCaveat: HTTPS Everywhere relies on a manual whitelist of HTTPS-enabled sites. If the website you’re visiting isn’t popular enough to be on their list, you’re out of luck.
- michaelt 5y agoHTTPS Everywhere doesn't have a working rule for bitcoinknots.org And more broadly, neither HSTS preloading or HTTPS Everywhere include a list of every single site on the internet.
- tialaramex 5y agoMentioned below that HTTPS-default (which is an option in ordinary Firefox) is intended to become mandatory in Tor-browser. I use this on my main PC. Once or twice a day I might visit some old or especially cantankerous site that doesn't do HTTPS, I get a full page interstitial explaining the problem, I can decide if I'm OK with that. Otherwise every single link, typed URL, etc. is HTTPS regardless of whether that was what was originally written. I wouldn't recommend it in its current state for my mother, but it's definitely what someone using Tor would want, and it's only getting more ubiquitous.
- heavyset_go 5y agoEven if every exit node in the US is operated by private people or organizations, courts can compel the node owners to work with the government and not talk about it.
- TuringTest 5y agoAren't there warrant canaries set up to prevent this? Every website that can be compelled to behave that way should have one.
- rwmj 5y agoHow could a warrant canary work when you don't know which exit node you will connect to?
- krageon 5y ago> Aren't there warrant canaries set up to prevent this? No, because the police will tell you to not tell anyone about the court order. If you do so (for example using a warrant canary), you will be in big trouble. Those canaries were always a convenient fiction, almost to the point of it being entirely in question whether or not this fiction was created in good faith.
- Joakal 5y agoCan those warrant canaries holders who follow police/court orders, be sued for false advertising? Seems like a catch 22 that it's a lose-lose.
- krageon 5y agoIf being sued for false advertising was a real risk, advertising would be a lot more truthful :)
- FeepingCreature 5y agoYou can always be in trouble by the police for any reason or no reason at all. The question is law. The notion of a warrant canary is that the police cannot compel you to state that you are not under a court order. They can annoy you to lie, and they can always break the law, but they cannot legally force you to. To claim that regardless of this, the police can compel you to lie, is tantamount to saying that the rule of law has failed. ( https://www.eff.org/deeplinks/2014/04/warrant-canary-faq https://www.eff.org/deeplinks/2014/04/warrant-canary-faq )
- stingraycharles 5y agoIt’s not even about three letter agencies; many exit nodes are being scanned for passwords, if you happen to go through http instead of https. Here’s research conducted years ago about this matter: https://www.vice.com/en/article/mgbdwv/badonion-honeypot-malicious-tor-exit-nodes https://www.vice.com/en/article/mgbdwv/badonion-honeypot-mal... Effectively they set up a honeypot and used clear text passwords to log in, and plenty of exit nodes picked up on this and those credentials were later used to (attempt to) log in into the honeypot.
- thealig 5y agothe article talks about the research stumbling upon exit nodes performing MITM and other sniffing but does not refer to the exact details. is there a paper for this? only found this paper going over systematic process of exposing bad relays - http://www.cs.kau.se/philwint/spoiled_onions/pets2014.pdf http://www.cs.kau.se/philwint/spoiled_onions/pets2014.pdf
- heavyset_go 5y agoWhat research are you talking about? The article talks about at least two different researchers working on separate projects. Here's the link for first one:https://web.archive.org/web/20150705184539/https://chloe.re/2015/06/20/a-month-with-badonions/ https://web.archive.org/web/20150705184539/https://chloe.re/...
- thealig 5y agowell, was referring to the research indicated by the title of the article- honeypot setup to detect malicious exit relays. yes thats the one. interesting, seems they caught 15 unique relays harvesting logins. There seems to be scope to improve reporting and detection of malicious actors like this. They also have a block list on Tor's gitlab repo but doesn't seem to be up to date.
- deleted 5y ago[deleted]
- 5y ago
- bawolff 5y agoOr just use HSTS. Problem solved.
- idontwantthis 5y agoWhat does compromising the exit do? I thought the layering means you would need to compromise the entire path to do anything.
- foxfluff 5y agoExit node is where the tor-encrypted path ends and traffic goes to the clearnet.
- idontwantthis 5y agoWhat’s the point of any of it then to a paranoid user?
- Shish2k 5y agoThe reason to use the tor<->plaintext bridge is to route around censorship, eg the great firewall of china, or various western ISPs blackholing the pirate bay, and also to prevent the server from learning much about the client’s identity If you don’t want any MITM possibilities, that’s what the onion services are for (both client and server are speaking over tor connections)
- lazide 5y agoGot me - it looks like a decently effective honeypot though for ‘paranoid but hasn’t thought it all the way through’
- crtasm 5y agothe exit node has no knowledge of your IP address and your traffic should still be protected by HTTPS.
- ufmace 5y agoBecause it switches over to the clearnet there, the operator could do stuff like intercept non-https traffic or use a malicious DNS to attempt to MITM https traffic.
- Stevvo 5y agoThere were slides in the Snowden leaks where it laid out the NSA's strategy for dealing with TOR and compromising exit nodes was a big part of it. They have had the last 10 years to work on it; one might expect they had results.