4 ms·

There is also the inescapable fact that Tor was created by US Intelligence, specifically the US Naval Research Lab[0]. And according to FOIA documents it contin

by yucky 4y ago

There is also the inescapable fact that Tor was created by US Intelligence, specifically the US Naval Research Lab[0]. And according to FOIA documents it continues to receive a huge chunk of funding & resources from US Intelligence, particularly from the United States Agency for Global Media (formerly the Broadcasting Board of Governors), which supervises our propaganda channels Voice of America and Radio Free Europe/Radio Liberty[1]. As far as I can tell, the US Intelligence community has never explained it's aims/goals for Tor. The fact that Tor not only attracts the type of traffic that US Intelligence would have a lot of interest in monitoring, but also by design then funnels that traffic through a small number of exit nodes, makes it seem self-explanatory. But I wouldn't want to presume anything. [0] https://en.wikipedia.org/wiki/Tor_(network) https://en.wikipedia.org/wiki/Tor_(network) [1] https://www.documentcloud.org/app?q=%2Bproject%3Athe-tor-files-transparenc-37206 https://www.documentcloud.org/app?q=%2Bproject%3Athe-tor-fil...

HackerNCoder 4y ago
You don't need (outdated) FOIA documents for that... Go to https://www.torproject.org/about/sponsors/ https://www.torproject.org/about/sponsors/ and you will see that they get money from the US government, if you want to know more about how much, go check the IRS 990 forms [1] or check the blog post that explains the 990, it also gives clear percentages on how much comes from where, [2] [1] https://www.torproject.org/about/reports/ https://www.torproject.org/about/reports/ [2] https://blog.torproject.org/transparency-openness-and-our-2020-and-2021-financials/ https://blog.torproject.org/transparency-openness-and-our-20...
- yucky 4y ago
  This part appears to be missing from the Tor website: > 2,500 pages of correspondence — including strategy and contracts and budgets and status updates — between the Tor Project and its main funder, a Central Intelligence Agency spinoff now known as the Broadcasting Board of Governors (BBG). These files show incredible cooperation between Tor and the regime change wing of the US government. So the documents acquired via FOIA requests are worth reading, and it's worth discussing why the US Intelligence community has such an active interest in propping up Tor.
  - deleted 4y ago
    [deleted]
  - bombcar 4y ago
    It's pretty obvious that TOR is a helpful tool if you're doing spyshit in foreign countries.
    - amatecha 4y ago
      That's what _they_ want you to think! (finally I can say that and it may in fact actually be true for once! hahaha)
neilv 4y ago
I use Tor Browser as my daily driver (for everything that doesn't need me to be logged into an account), for an on-principle protest against the out-of-control commercial surveillance that almost every Web site willingly participates in. The federal government isn't in my threat model, and "you can't fight city hall".
dinosaurdynasty 4y ago
AFAIK there are US intelligence agencies that rely on and use Tor for their agents abroad and US intelligence agencies that try to break it for their own reasons.
zxcvbn4038 4y ago
That’s probably one of the reasons that TLS over Tor has remained such a tough nut, with people who otherwise seem to have tinfoil hats claiming that it’s not needed because Tor provides enough protection. My opinion is that you want that end to end protection for the same reason you want it on the clearnet - to make so nobody along the way is sniffing your traffic. (that includes both exit nodes and any middle nodes that might be taking advantage of an unknown flaw or bias) Having a bunch of Tor site certs in your MacOS keychain has its own issues, so what is really needed is a way for Tor browsers to accept those certs directly without using the OS trust stores. The current practice of authenticating the remote site by PGP signature would remain more or less the same - you just wouldn’t have exit nodes sniffing traffic. I’m also convinced that the whole reason Google has pushed TLS so hard isn’t some noble quest to protect people’s privacy and freedom of speech - it’s more to keep people from blocking their advertisements, which isn’t nearly so sexy an argument, but it has brought good benefits for a lot of people.
- schoen 4y ago
  > people who otherwise seem to have tinfoil hats claiming that it’s not needed because Tor provides enough protection I've been on the side of advocating for it, but the other side isn't making an obviously ridiculous argument. The onion protocol itself negotiates an end-to-end cryptographic session, authenticated by the onion site's public key, between the onion site and the end user. There's not cleartext traffic sent between a Tor exit node and the onion site or anything! My argument in favor of TLS to onion sites was that, at least as of onion protocol v2, the cryptographic session was not itself TLS, and its security and threat model hadn't been as extensively reviewed as those of TLS. So it might turn out that there was something suboptimal there that the rendezvous server could then use to perform a sophisticated cryptographic attack. I don't know if this is still true of onion protocol v3 or if the client-to-onion-site session is now also based on TLS.
  - HackerNCoder 4y ago
    No, v3 isn't TLS either. TLS is only used as a connector between hops (so the client connect to a node using TLS, and the nodes connect to each other using TLS), but that is it. (I think, if I'm wrong do tell me. I didn't go check the spec)

by yucky 4y ago

HackerNCoder 4y ago

You don't need (outdated) FOIA documents for that... Go to https://www.torproject.org/about/sponsors/ https://www.torproject.org/about/sponsors/ and you will see that they get money from the US government, if you want to know more about how much, go check the IRS 990 forms [1] or check the blog post that explains the 990, it also gives clear percentages on how much comes from where, [2] [1] https://www.torproject.org/about/reports/ https://www.torproject.org/about/reports/ [2] https://blog.torproject.org/transparency-openness-and-our-2020-and-2021-financials/ https://blog.torproject.org/transparency-openness-and-our-20...

yucky 4y ago
This part appears to be missing from the Tor website: > 2,500 pages of correspondence — including strategy and contracts and budgets and status updates — between the Tor Project and its main funder, a Central Intelligence Agency spinoff now known as the Broadcasting Board of Governors (BBG). These files show incredible cooperation between Tor and the regime change wing of the US government. So the documents acquired via FOIA requests are worth reading, and it's worth discussing why the US Intelligence community has such an active interest in propping up Tor.
- deleted 4y ago
  [deleted]
- bombcar 4y ago
  It's pretty obvious that TOR is a helpful tool if you're doing spyshit in foreign countries.
  - amatecha 4y ago
    That's what _they_ want you to think! (finally I can say that and it may in fact actually be true for once! hahaha)

neilv 4y ago

I use Tor Browser as my daily driver (for everything that doesn't need me to be logged into an account), for an on-principle protest against the out-of-control commercial surveillance that almost every Web site willingly participates in. The federal government isn't in my threat model, and "you can't fight city hall".

dinosaurdynasty 4y ago

AFAIK there are US intelligence agencies that rely on and use Tor for their agents abroad and US intelligence agencies that try to break it for their own reasons.

zxcvbn4038 4y ago

That’s probably one of the reasons that TLS over Tor has remained such a tough nut, with people who otherwise seem to have tinfoil hats claiming that it’s not needed because Tor provides enough protection. My opinion is that you want that end to end protection for the same reason you want it on the clearnet - to make so nobody along the way is sniffing your traffic. (that includes both exit nodes and any middle nodes that might be taking advantage of an unknown flaw or bias) Having a bunch of Tor site certs in your MacOS keychain has its own issues, so what is really needed is a way for Tor browsers to accept those certs directly without using the OS trust stores. The current practice of authenticating the remote site by PGP signature would remain more or less the same - you just wouldn’t have exit nodes sniffing traffic. I’m also convinced that the whole reason Google has pushed TLS so hard isn’t some noble quest to protect people’s privacy and freedom of speech - it’s more to keep people from blocking their advertisements, which isn’t nearly so sexy an argument, but it has brought good benefits for a lot of people.

schoen 4y ago
> people who otherwise seem to have tinfoil hats claiming that it’s not needed because Tor provides enough protection I've been on the side of advocating for it, but the other side isn't making an obviously ridiculous argument. The onion protocol itself negotiates an end-to-end cryptographic session, authenticated by the onion site's public key, between the onion site and the end user. There's not cleartext traffic sent between a Tor exit node and the onion site or anything! My argument in favor of TLS to onion sites was that, at least as of onion protocol v2, the cryptographic session was not itself TLS, and its security and threat model hadn't been as extensively reviewed as those of TLS. So it might turn out that there was something suboptimal there that the rendezvous server could then use to perform a sophisticated cryptographic attack. I don't know if this is still true of onion protocol v3 or if the client-to-onion-site session is now also based on TLS.
- HackerNCoder 4y ago
  No, v3 isn't TLS either. TLS is only used as a connector between hops (so the client connect to a node using TLS, and the nodes connect to each other using TLS), but that is it. (I think, if I'm wrong do tell me. I didn't go check the spec)