4 ms·

I don’t think any typical internet user would accept Tor’s latency. User behavior has indicated again and again that convenience and frictionless-ness is the ov

I don’t think any typical internet user would accept Tor’s latency. User behavior has indicated again and again that convenience and frictionless-ness is the overriding priority for the majority. I appreciate the work done by the Tor community, but I also think we need to be realistic about what the threat model is and what viable solutions are on the table: * If you’re concerned about the MAANGs of the world hoovering data for targeted adverts I think you’d get far more traction with aggressive privacy legislation and brutal oversight, or (and I recognize this is extreme) straight nationalization of some of their products with a mandate to operate them in the public interest like PBS or the Beeb * If you’re concerned about an authoritarian state actor Tor was pwned years ago. TBH I think trying to win against ex. US TLAs in straight cryptography or protocol supremacy is kind of a fools errand (you’re ultimately going to get clobbered purely on the resource differential) and that the best bet is security through obscurity. Just my 2c, maybe overly fatalistic so curious about counter views

cma 3y ago
If everyone used it wouldn't latency go down (more nearby nodes), or is it that for privacy via timing attacks they don't preference nearby nodes and/or they add artificial delays?
- tech_ken 3y ago
  That’s a good question, tbh I have no idea. Yeah presumably if the user base increased then the number of nodes would also grow, but definitely unclear to me what level of latency (if any) is required for privacy
- r3trohack3r 3y ago
  I might misunderstand how Tor works, but unless you are a relay I don’t think you participate in routing. Unlike BitTorrent, clients don’t automatically contribute resources back to the network.
  - stavros 3y ago
    ~~My (perhaps mistaken) understanding is that all nodes relay, but not all nodes are exit nodes.~~ EDIT: They do not.
    - georgyo 3y ago
      All nodes to do not relay by default. They definitely have the ability to, but it is not the default.
      - stavros 3y ago
        Ah ok, thanks.
    - Dylan16807 3y ago
      That depends on how you define node. I would not call the software you run to connect a "node". And in that framework, I would say that node=relay.
  - nektro 3y ago
    this is a fatal flaw of Tor imo, it should be a question front and center to enable all browser installations to be relays
    - deleted 3y ago
      [deleted]
    - LoganDark 3y ago
      But critically not exit nodes. Exit nodes should still only be run by people who know they are running exit nodes.
      - matheusmoreira 3y ago
        I'm not sure exit nodes should exist in the first place. Everything should probably be a tor hidden service instead.
akira2501 3y ago
> If you’re concerned about an authoritarian state actor Tor was pwned years ago. I mean.. wasn't it created by a department of the US Navy? What did everyone expect? The "white label" slapped on it years ago was that this was meant to help "Iranian dissidents" share information on the web. The utility of this network to everyday people was never going to exist.
make3 3y ago
yes, why do people use Tor if it's well known that it's been hacked by multiple governments for a long time?
- wolverine876 3y ago
  It depends on the threat you are trying to mitigate. If it's commercial surveillance, then Tor makes some sense.
- timbit42 3y ago
  Where is this proof?
- adr1an 3y ago
  I used it plenty at the University to access research articles (sci hub). There are other use cases that go beyond the usual stuff that government try to monitor by serving exit nodes, or doing correlation attacks. Anyway, even if you were a terrorist, using your would be better than not using it. There are probably other solutions that they implement, sure.
- DANmode 3y ago
  Because the protocol isn't the issue. Lately, it's been surreptitiously fingerprinting or exploiting their Firefox fork, timing attacks (if you can see metadata all of the packets in the country or world, they can take as many hops as you choose, someone and or something can still easily line them up), or other op-sec screwups (controversial, because what is reporterd as fatal OpSec flaws can just as easily be parallel construction finding something that would look or sound blatantly obvious in retrospect).
- gray_charger 3y ago
  If you're not doing anything that affects national security they won't bother burning that capability on you. They save action only for those they can take action against in a clandestine way (so the fact they can crack Tor is not on public record), or against someone so dangerous they need to act quickly for national security reasons (and a government acting quickly with overwhelming force is hard to keep secret).

cma 3y ago

If everyone used it wouldn't latency go down (more nearby nodes), or is it that for privacy via timing attacks they don't preference nearby nodes and/or they add artificial delays?

tech_ken 3y ago
That’s a good question, tbh I have no idea. Yeah presumably if the user base increased then the number of nodes would also grow, but definitely unclear to me what level of latency (if any) is required for privacy
r3trohack3r 3y ago
I might misunderstand how Tor works, but unless you are a relay I don’t think you participate in routing. Unlike BitTorrent, clients don’t automatically contribute resources back to the network.
- stavros 3y ago
  ~~My (perhaps mistaken) understanding is that all nodes relay, but not all nodes are exit nodes.~~ EDIT: They do not.
  - georgyo 3y ago
    All nodes to do not relay by default. They definitely have the ability to, but it is not the default.
    - stavros 3y ago
      Ah ok, thanks.
  - Dylan16807 3y ago
    That depends on how you define node. I would not call the software you run to connect a "node". And in that framework, I would say that node=relay.
- nektro 3y ago
  this is a fatal flaw of Tor imo, it should be a question front and center to enable all browser installations to be relays
  - deleted 3y ago
    [deleted]
  - LoganDark 3y ago
    But critically not exit nodes. Exit nodes should still only be run by people who know they are running exit nodes.
    - matheusmoreira 3y ago
      I'm not sure exit nodes should exist in the first place. Everything should probably be a tor hidden service instead.

akira2501 3y ago

> If you’re concerned about an authoritarian state actor Tor was pwned years ago. I mean.. wasn't it created by a department of the US Navy? What did everyone expect? The "white label" slapped on it years ago was that this was meant to help "Iranian dissidents" share information on the web. The utility of this network to everyday people was never going to exist.

make3 3y ago

yes, why do people use Tor if it's well known that it's been hacked by multiple governments for a long time?

wolverine876 3y ago
It depends on the threat you are trying to mitigate. If it's commercial surveillance, then Tor makes some sense.
timbit42 3y ago
Where is this proof?
adr1an 3y ago
I used it plenty at the University to access research articles (sci hub). There are other use cases that go beyond the usual stuff that government try to monitor by serving exit nodes, or doing correlation attacks. Anyway, even if you were a terrorist, using your would be better than not using it. There are probably other solutions that they implement, sure.
DANmode 3y ago
Because the protocol isn't the issue. Lately, it's been surreptitiously fingerprinting or exploiting their Firefox fork, timing attacks (if you can see metadata all of the packets in the country or world, they can take as many hops as you choose, someone and or something can still easily line them up), or other op-sec screwups (controversial, because what is reporterd as fatal OpSec flaws can just as easily be parallel construction finding something that would look or sound blatantly obvious in retrospect).
gray_charger 3y ago
If you're not doing anything that affects national security they won't bother burning that capability on you. They save action only for those they can take action against in a clandestine way (so the fact they can crack Tor is not on public record), or against someone so dangerous they need to act quickly for national security reasons (and a government acting quickly with overwhelming force is hard to keep secret).