3 ms·

starts reading.... ah that cant be good.... well lets keep kalm and read on > "Based on the board's understanding of Rabbi Rob's work with Team Cymru, the boar

• anigbrowl 4y ago
  I mean, I can see ways in which it's completely transparent and above board. Assume for the sake of argument Tor's source code is fully open and vetter open, no sneaky zero-day backdoors, and lets look at this in purely amoral interest-based terms. Rob openly says 'as a mass surveillance guy, I would totally fingerprint people by looking at things like browser window size, warning them about that is good. And here are other ways I'd try to track you down.' It's in his commercial interest to disclose his firm's/his state clients' general techniques, in that Tor works like a stone to sharpen sword (or a cloth with which to polish the shield if you prefer). From the state surveillance point of view, There's a few different objectives in play. I want to have a panopticon because I'm paranoid. I rationalize to myself that this is for the safety benefit of my population who actually prefer security to liberty, and most of them are happy to live in a shopping mall society. I do engage in repression against malcontents, but some of them are fools and some of them are genuinely awful. I also make some egregious mistakes, but hey, I'm a state. Like an elephant, just walking around does a certain amount of damage to smaller organisms. I gather up as much data as I can, and I'm content for a small part of it to flow invisibly over Tor - knowing who is using Tor and when and how often helps me focus my efforts where it matters, and it's not too hard distinguish between privacy nuts (probably too paranoid to join subversive or criminal organizations) and networked threat actors will probably leak enough data that I can make inferences about the existence of relationships and engage in more direct surveillance. Now, I also have rival states, and some of them are hostile, some of them are awful, and some are both. I'd like them to disappear or at least change and be more like me. they also have surveillance capabilities, so I want to have anti-security tools like Tor that are freely available to their malcontents and subversives, and as a backup to awful people that nevertheless consume state resources. So as a state in a networked world, I'm making two bets - that people in other states would prefer to live in a state like me and will gently or forcefully move their societies in my direction over time, and that my mall cops are better than their mall cops and that I'm better at distinguishing between evil people and the merely dissatisfied. Now if I'm Tor as an organization, I hate panopticons but I'm also free enough to make privacy software in the open and engage in advocacy. I understand that I'm tolerated partly because I enable subversion to occur in repressive states and partly because the use of Tor is itself a signal. I provide the tools and educate people on the methods of anonymity, and hope that the combination of network effects and anonymity create emergent social benefits. The transactional price for existing is that the state keeps a close eye on me (through its commercial proxies) and I don't advocate any particular ideology or political purpose of my own, leaving it up to my users to articulate why they pursue privacy and anonymity if challenged legally or politically. Trying to look at all this from the outside, I suspect there are conflicts within western-aligned states between cops who hate Tor and think the desire for encryption or anonymity is prima facie evidence of people being up to no good, and national security types who are more strategically minded and balance internal comfort against the need for resilience against external challenges - from other states, from environmental changes, from abstracts like the uncertain constraints of thermodynamics and economics. High level national security thinkers value flexibility over tranquility, like an athlete that accepts a level of discomfort and injury risk in favor of maximizing performance.
  • sweetbitter 4y ago
    I suspect that these threat actors will be beyond outraged when it becomes more popular (and inexpensive enough) for anonymity networks to implement some degree of link padding, thus removing the coveted (passive) correlation attack from their toolbox.