3 ms·

Tor was developed by US military and is funded by dept of state. It should not be trusted. Better set up your own tunnel/vpn on a host you control.

doublerabbit 4y ago
Unless you own colocation, with your own netblock, the VPN still cannot be trusted.
system33- 4y ago
Now the other end of that tunnel still uniquely identifies you. It helps in some adversary models, but not many or all. I work for the Navy. The Naval Research Lab where Tor and onion routing was started. I wrote a FAQ to respond to these concerns on Reddit here[0]. AMA if you want. [0]: https://old.reddit.com/r/onions/comments/kdjrxa/tor_was_started_and_funded_by_us_navy_how_can_you/gfxd72i/ https://old.reddit.com/r/onions/comments/kdjrxa/tor_was_star...
- cabirum 4y ago
  Thanks for an interesting read! Now, time for a thought experiment. Imagine Tor was instead developed by Russian researchers working for Russian ministry of defense at the time. Would you use it to visit rt.com blocked in your country?
  - system33- 4y ago
    Sure. The funding was secured to protect $military comms. Allegedly the $military actively uses it, so it better be actually secure, especially when malicious foreign enemy actors have had two decades to study it. Academics have studied it to death, and some of their discovered attacks have actually resulted in transitioned improvements. I myself have the benefit of (1) being extremely familiar with how it works on the lowest level and what its weaknesses are, and (2) not considering myself a target worth my $govt's close monitoring.
    - cabirum 4y ago
      Your point makes sense. My distrust comes from the fact that $militaries keep separate versions for toys they export/publish vs toys they use. See: M1 Abrams export variants, cryptography export laws (limited key lengths; restrictions mostly lifted), etc.
      - vbezhenar 4y ago
        Tor is open source and protocol is open. You can hardly make different versions of it. I can't imagine that at least. The point of Tor is that US spy can send his traffic to whitehose.gov from Moscow and his bytes will not be different from bytes of thousands of drug addicts looking for some marihuana on dark web. FBI won't be able to tell a difference. That's the whole point of Tor. It makes no sense to maintain two versions of tor networks or something like that.
ravenstine 4y ago
Not only that, but so much attention is on Tor and there are irreconcilable problems with its architecture. People should consider using I2P instead, which didn't come out of government research and has superior anonymity. https://geti2p.net https://geti2p.net The downside is it doesn't have a browser bundle like Tor, but it's possible to configure Tor Browser to use it. Turning off scripting all together is really a better approach no matter which tool you use, be it I2P or Tor.
HyperSane 4y ago

doublerabbit 4y ago

Unless you own colocation, with your own netblock, the VPN still cannot be trusted.

system33- 4y ago

Now the other end of that tunnel still uniquely identifies you. It helps in some adversary models, but not many or all. I work for the Navy. The Naval Research Lab where Tor and onion routing was started. I wrote a FAQ to respond to these concerns on Reddit here[0]. AMA if you want. [0]: https://old.reddit.com/r/onions/comments/kdjrxa/tor_was_started_and_funded_by_us_navy_how_can_you/gfxd72i/ https://old.reddit.com/r/onions/comments/kdjrxa/tor_was_star...

cabirum 4y ago
Thanks for an interesting read! Now, time for a thought experiment. Imagine Tor was instead developed by Russian researchers working for Russian ministry of defense at the time. Would you use it to visit rt.com blocked in your country?
- system33- 4y ago
  Sure. The funding was secured to protect $military comms. Allegedly the $military actively uses it, so it better be actually secure, especially when malicious foreign enemy actors have had two decades to study it. Academics have studied it to death, and some of their discovered attacks have actually resulted in transitioned improvements. I myself have the benefit of (1) being extremely familiar with how it works on the lowest level and what its weaknesses are, and (2) not considering myself a target worth my $govt's close monitoring.
  - cabirum 4y ago
    Your point makes sense. My distrust comes from the fact that $militaries keep separate versions for toys they export/publish vs toys they use. See: M1 Abrams export variants, cryptography export laws (limited key lengths; restrictions mostly lifted), etc.
    - vbezhenar 4y ago
      Tor is open source and protocol is open. You can hardly make different versions of it. I can't imagine that at least. The point of Tor is that US spy can send his traffic to whitehose.gov from Moscow and his bytes will not be different from bytes of thousands of drug addicts looking for some marihuana on dark web. FBI won't be able to tell a difference. That's the whole point of Tor. It makes no sense to maintain two versions of tor networks or something like that.

ravenstine 4y ago

Not only that, but so much attention is on Tor and there are irreconcilable problems with its architecture. People should consider using I2P instead, which didn't come out of government research and has superior anonymity. https://geti2p.net https://geti2p.net The downside is it doesn't have a browser bundle like Tor, but it's possible to configure Tor Browser to use it. Turning off scripting all together is really a better approach no matter which tool you use, be it I2P or Tor.

HyperSane 4y ago