25 ms·
Is Tor still safe to use?
- PreInternet01 2y ago[flagged]
- dyauspitr 2y agoTaiwanese made
- wolfi1 2y agoTaiwanese brand but produced in Hungary
- yieldcrv 2y agoIts just an address in Hungary Which can be decoupled from where the company was incorporated, or where any shipment, manufacturing, or tampering occurred
- deleted 2y ago[deleted]
- briffid 2y agoBulgarian made, through a one-person trade intermediary for a Taiwanese company. The Bulgarian co is owned by a Norwegian btw.
- jajko 2y agoNot only that, today there was another round of walkie talkie explosions, same type of targets, similar results. How dumb you have to be in this situation...
- roetlich 2y agoFor context, here's the NDR report: https://www.ndr.de/fernsehen/sendungen/panorama/aktuell/Investigations-in-the-so-called-darknet-Law-enforcement-agencies-undermine-Tor-anonymisation,toreng100.html https://www.ndr.de/fernsehen/sendungen/panorama/aktuell/Inve... And more info here: https://lists.torproject.org/pipermail/tor-relays/2024-September/021855.html https://lists.torproject.org/pipermail/tor-relays/2024-Septe... Edit: The NDR alleges a timing attack (no further explanation) that allows "to identify so-called ‘entry servers’" Very little information is actually available on the nature of the attack. The NDR claims this method has already lead to an arrest.
- LinuxBender 2y agoMight one mitigating possibility be to use a VPN that uses padded and rate limited packets, so that it is always sending and receiving user_defined bit rate and your real traffic would be traffic shaped to take priority but not exceed the padded streams? Maybe this assumes one is running their own tor daemon on a server somewhere and the vpn terminates on that node. I assume this could be done with tc sch_htb class shaping or perhaps sch_cake and tagging packets with iptables mangle rules and two never-ending bi-directional rsync streams reading /dev/urandom or big random files. e.g. Port 873 (native rsync) bulk traffic, low priority Port 3128 (squid mitm ssl-bump proxy) high priority
- cubefox 2y agoThis should be the article linked at the top.
- trustno2 2y agoAlso relevant - wikipedia for Boystown, the pedo site in question https://en.wikipedia.org/wiki/Boystown_(website) https://en.wikipedia.org/wiki/Boystown_(website)
- yieldcrv 2y agoThis isn't written in the most confidence inspiring way But the things that do inspire confidence: Tor is updated against vulnerabilities pre-emptively, years before the vulnerability is known to be leveraged Tor Project happens to be investigating the attack vector of the specific tor client, which is years outdated They should have just said “we fixed that vulnerability in 2022” with a separate article about the old software
- immibis 2y agoThe vulnerability is mitigated by shifting the economic incentives, not fixed by making it impossible. It can't be fixed without a completely different network design, like in Mixminion or Katzenpost. Someone suggested I2P, but it's mostly fundamentally the same as Tor. It uses unidirectional tunnels, which might help.
- birdman3131 2y agoTo quote the article. " To the best of our knowledge, the attacks happened between 2019-2021." and " This protection exists in Ricochet-Refresh, a maintained fork of the long-retired project Ricochet, since version 3.0.12 released in June of 2022." While it has been fixed for years it was not a case of using old software from what I am reading.
- qwery 2y ago> confidence inspiring I don't want them to try to sell me something. If they were making bold claims as you suggest I would be more concerned.
- yieldcrv 2y agoThe truth isn't confidence inspiring, the truth can be even without selling something, its not here. There is a risk that the network is compromised at any moment and cannot be relied upon, except for your own personal risk tolerance on the activity you are interested in.
- basedrum 2y agoYeah, but the problem is that they cannot say that with 100% confidence, because the details were not shared with them (why, I have no idea)
- jstanley 2y agoThe best attack against Tor is convincing people not to use it. If anyone tries to convince you Tor is not safe, ask yourself: cui bono?
- dijit 2y agoSame was true of Truecrypt. After the core team disbanded there was a full security audit which uncovered some very minor issues. People never really trusted Veracrypt though. Quite interesting how that turned out.
- hypeatei 2y ago> People never really trusted Veracrypt though Can you expand on this? It was my understanding that Veracrypt is the new de-facto standard.
- dijit 2y agoBitlocker, LUKS and FileVault are the new standard(s). Veracrypt is a curiousity, not beloved the way truecrypt was. I’d love to see hard numbers for this, just my outside impression. In fact, when trying to find old forums that I was part of during that era, I failed; and found only this: https://discuss.privacyguides.net/t/why-people-still-believe-truecrypt-is-much-better-than-veracrypt/18295 https://discuss.privacyguides.net/t/why-people-still-believe...
- UberFly 2y agoThis is complete conjecture. Like Truecrypt, Veracrypt is open source, has been audited and has been actively maintained. Could it use another audit? Sure but so could Bitlocker but that isn't happening for even the first time any time soon.
- dijit 2y agoI read this as intended to be some kind of rebuttal but… Where did I say it wasn't conjecture? I was stating facts about the ecosystem. People didn't trust it at the time. I never said there was a definite reason for that distrust.
- rolph 2y agohttps://github.com/blueprint-freespeech/ricochet-refresh https://github.com/blueprint-freespeech/ricochet-refresh ...We are writing this blog post in response to an investigative news story looking into the de-anonymization of an Onion Service used by a Tor user using an old version of the long-retired application Ricochet by way of a targeted law-enforcement attack. ...From the limited information The Tor Project has, we believe that one user of the long-retired application Ricochet was fully de-anonymized through a guard discovery attack. This was possible, at the time, because the user was using a version of the software that neither had Vanguards-lite, nor the vanguards addon, which were introduced to protect users from this type of attack. This protection exists in Ricochet-Refresh, a maintained fork of the long-retired project Ricochet, since version 3.0.12 released in June of 2022.
- nickphx 2y agonot when you consider the level of monitoring at critical internet exchange points..
- andirk 2y agoThat's why we need more bittorrent-like decentralized internet, like they were making on the show Silicon Valley.
- nixosbestos 2y agoIs it possible to "break" the protocol in such a way that Hidden Services cannot be used without some version of vanguards? It almost seems worth doing?
- valianteffort 2y agoFederal agencies operate enough exit nodes to make Tor use risky at best. I have no idea if they have since implemented some feature to prevent this but if not I would stay far away from Tor if you're planning to do illegal things. There's also the risk of trusting service operators to secure any PII you expose on marketplaces. Not that I think the Fed's would blow their cover to hunt down people buying drugs but still seems stupid to trust.
- drexlspivey 2y agoIf they run just the exit node they still can’t de-anonymize you right?
- system33- 2y agoDepends on the content of your traffic. If “deanonymize” strictly means perform a timing attack using info you have from the beginning and end of the circuit, then by definition you’re correct. But if you visit an identifying set of websites and/or ignore TLS errors or … they can still deanonymize you.
- iluvcommunism 2y agoWhat role do TLS errors play in de-anonymizing onion traffic?
- system33- 2y agoMy comment is strictly about exit nodes which are not used as part of connecting to onion services. Ignoring TLS errors might mean you’re ignoring the fact your exit relay is MitM attacking you.
- iluvcommunism 2y agoThanks, I just wanted to be sure I wasn’t missing something.
- smileson2 2y agoDepends on your risk, if are are trying to avoid censorship and political repression in say Iran or china you are probably fine If you are an enemy of the United States you probably aren’t but that’s a high bar
- Yawrehto 2y agoMaybe. I think the real distinction is reach. Are you consuming content passively, or are you creating content for many people? If you're creating content on torture China's doing, they absolutely will track you down. If you're in North Korea and revealing what life is really like in South Korea, or in Russia exposing the realities of the Ukraine war, Tor is probably unsafe. But there is also an element of resources. Even if you're sowing distrust in, say, the Comorian government, I don't think they have the resources to go after you unless you are truly destabilizing and not just annoying.
- smileson2 2y agoYes fair point
- deleted 2y ago[deleted]
- GaggiX 2y agoIt depends, are you dealing with Mossad or not Mossad?
- deleted 2y ago[deleted]
- teddyh 2y agoYou’re leaving out one very important class of actors, which I will call the NSA: The NSA, and others like them, unlike Mossad, are not after you personally, in that they don't want to do anything to you. Not immediately. Not now. They simply want to get to know you better. They are gathering information. All the information. What you do, what you buy, how you vote, what you think. And they want to do this to everybody, all the time. This might or not bite you in the future. You seems to imply that since nothing immediately bad is happening by using slightly bad security, then it’s OK and we shouldn’t worry about it, since Mossad is not after us. I think that we should have a slightly longer view of what allowing NSA (et al.) to know everything about everybody would mean, and who NSA could some day give this information to, and what those people could do with the information. You have to think a few steps ahead to realize the danger. (This has been a partial repost of a comment written four years ago: <https://news.ycombinator.com/item?id=23572778 https://news.ycombinator.com/item?id=23572778>)
- anizan 2y ago[flagged]
- alasdair_ 2y agoHere is what I don't understand: Let's say I as a private individual fund 1000 tor nodes (guard and exit nodes included) and have them all log everything. This could cost less than $5000 for a month, with some time needed to get guard node status. I want to find a certain kind of person so I look for people that access a specific hidden service or clearnet url. Surely eventually I'm going to get a hit where all three nodes in the circuit are my nodes that are logging everything? It will take a long time, and I can't target a specific person, but eventually I can find someone who has all three bounces through tor nodes I control, no?
- gaba 2y agoTor Project has a team that looks at relays and checks if relays are engaging in bad practices or any suspicious activity like a lot of nodes run by one operator. https://community.torproject.org/relay/governance/ https://community.torproject.org/relay/governance/
- alasdair_ 2y agoIran probably has enough money that it could pay a thousand different isps in a thousand different ways with a thousand different os versions and tor versions. This could all be automated pretty easily.
- krunck 2y agoWhen you think about countries that have the resources to "pay a thousand different isps in a thousand different ways with a thousand different os versions and tor versions" your first thought was Iran?
- alasdair_ 2y agoMy first thought was actually "I could probably do that myself given some motivation" Hiring people on something like fiverr could take care of most of the manual part. My point is that if I could do it, a nation state cracking down on dissidents could likely do it too.
- 2OEH8eoCRo0 2y agoIt's safe if you ain't a pedo or terrorist. Sometimes I wonder wtf y'all are doing with such crazy security expectations and paranoia.
- mass_and_energy 2y agoThe implication of the right to privacy being unnecessary because you have nothing to hide is akin to declaring the right to free speech unnecessary because you have nothing to say. The ability to maintain privacy and anonymity is not for today, it's for tomorrow.
- ciiiicii 2y agoI don't think many people seriously think that terrorists planning attacks to maim and kill people, and pedophiles sharing child sexual abuse imagery with each other, have an absolute right to privacy in such communications, nor that doing so is an example of free speech. Really it's a good thing that the "global adversary" is - almost certainly - keeping tabs on Tor traffic and tracking down who is responsible for the worst abuses within this network.
- lapphi 2y agoYou sound like a stalin era communist. The secret police are spying on you for your own good!
- ciiiicii 2y agoNot sure what you mean. Gathering evidence is a vital part of investigating criminal activity. In the age of the internet, this includes evidence generated on computer networks, such as connection metadata from distributed systems like Tor. Why, in your view, is this akin to Stalinism? It's just standard police work adapted for modern technologies, not an indication of totalitarian governance.
- 2y ago
- ObsidianBreaks 2y agoI think it's prudent to point out that the article's title is quite 'clickbaity', but to address it directly, the correct answer is (as it usually is) is 'it depends'. In my view, it depends on the answer to the question 'safe for who?', i.e. what is the threat model to which you are trying to guard against? If it's the US, then of course not, as the code is well-known to the US and I would expect that they have known vulnerabilities that they can leverage to ascertain the users of their service. The fact that TOR is, 'on paper', non-governmental doesn't really matter these days with the merging of private and public (and non-affiliated open-source communities) inside the security community. I would say that even the fact that it's open source isn't much of guard against such attacks, given that it relies on proficient oversight (which many eyes may not guarantee). Against other 'nation state' type adversaries - I'd wager that the more prominent who have the capacity to host a large number of relay nodes, and have access to very large computational power, will find it possible to decode portions of the TOR traffic. Against less technically proficient adversaries, such as 'run of the mill' police forces and minor nation states I'd go so far as to say it might be secure but only if you are using it for something uninteresting to them, but I ask 'how hard is it really to do a man in the middle a TOR relay?', and in terms of the most general case, 'what about the endpoints?' which of course aren't secured via TOR. Ultimately the best defense against 'snooping' in my view is to use a pre-agreed communication protocol which is undocumented and is known only between the communicators and is unusual enough to be hard to recognize or hard to work out what it means (preferably with a key to those communications known only to the two parties), but then I suppose you could use any communication protocol...
- oytis 2y agoDon't quite get it - why doesn't CCC share information with the Tor Project maintainers?
- solarpunk 2y agocurious about this as well
- some_random 2y agoI suspect that the reporter has a bone to pick with Tor and the CCC members that were given the documents were compelled legally or socially to not share them further.
- notepad0x90 2y agoMaybe they want to reveal it on the CCC in december?
- vaylian 2y agoIt's unlikely that they want so save the technical details for the conference. It would put people at risk if the tor project would not be able to fix the issue in the meantime.
- cubefox 2y agoThe information comes from the NDR (link im neighboring thread), not the CCC. The CCC only got to see the documents via the NDR.
- DonnyV 2y agoTor has never been safe to use.
- o999 2y agoOld Ricochet used onion v2, that has stopped working long ago as far as I know, or I am missing something
- basedrum 2y agoYou are right. The lack of details or time window when this happened make it difficult to know what the actual compromise was, or if it is still something that can be used. However, if they compromised a Ricochet user, then this attack was a long time ago, and from what Tor's blog says that client didn't have the defenses that would have prevented the attack they think it is. Without the actual details, it seems like this attack was mitigated some time ago and is no longer something that can be done in the same way.
- toby- 2y agoWe have a rough timeframe: "To the best of our knowledge, the attacks happened between 2019–2021." The hidden service targeted[0] had completely ceased to exist by April 2021, so that time range makes sense. [0]: https://www.ndr.de/fernsehen/sendungen/panorama/aktuell/Investigations-in-the-so-called-darknet-Law-enforcement-agencies-undermine-Tor-anonymisation,toreng100.html https://www.ndr.de/fernsehen/sendungen/panorama/aktuell/Inve...
- sathackr 2y agobased on the article I think this is old news just now being reported
- tonetegeatinst 2y agoAFAIK v2 has stopped working. Iirc were up to v3 or something.
- edm0nd 2y agono v2 onion urls resolve or work. It's been v3 since 2021.
- archsurface 2y agoThe more privacy the better as far as I'm concerned, but I've never used tor. What are people using tor for? General comms, piracy (mild illegal), other (very illegal), ...?
- ziddoap 2y ago>other (very illegal), ...? I will be waiting patiently for people to admit that they do very illegal things over Tor.
- knodi123 2y agoIt's okay, you can safely confess to felonies and crimes against humanity on HN. Our usernames are meaningless and our traffic is SSL encrypted!
- archsurface 2y agoThey don't have to be admissions, reports are an option.
- marc_abonce 2y agoBesides regular browsing (basically a free VPN), a pretty nice use case of Tor is that some news sites have non-paywalled onion addresses. The Guardian: https://www.guardian2zotagl6tmjucg3lrhxdk4dw3lhbqnkvvkywawy3oqfoprid.onion/ https://www.guardian2zotagl6tmjucg3lrhxdk4dw3lhbqnkvvkywawy3... New York Times: https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/ https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2l... BBC: https://www.bbcweb3hytmzhn5d532owbu6oqadra5z3ar726vq5kgwwn6aucdccrad.onion/ https://www.bbcweb3hytmzhn5d532owbu6oqadra5z3ar726vq5kgwwn6a...
- teddyh 2y agoLonger, regularly updated list of links: <https://dark.fail/ https://dark.fail/> (also <http://darkfailenbsdla5mal2mxn2uz66od5vtzd5qozslagrfzachha3f3id.onion/ http://darkfailenbsdla5mal2mxn2uz66od5vtzd5qozslagrfzachha3f...>).
- gigatexal 2y agoWas it ever safe? Wasnt it created by the AirForce or something? I’ve always thought of it as a honeypot.
- knodi123 2y ago> Wasnt it created by the AirForce or something? No, don't be silly, that's ridiculous! It was the Navy.
- unit149 2y ago[dead]
- lifeisstillgood 2y agoI am interested in the “legitimate” uses for tor. I have not kept up with this but I understand it was designed by US Navy to make it hard for oppressive regiemes to track their citizens use of web. What do we want Tor for except as a hope that Russian citizens might be able to get to the BBC site? I am asking honestly - and would prefer not to be told my own government is on the verge of a mass pogrum so we had better take precautions.
- tonymet 2y agoAnonymous publishing
- whimsicalism 2y agomost governments retaliate to some degree against journalists, whistleblowers, etc. - no pogrom needed
- knodi123 2y agoFor the same reason we have SSL on this site, despite the fact that it has no sex, no storefront, nor any access to my banking or private information. If everything is SSL secured, then we don't have to explain why any specific thing is SSL secured. The same reason can be applied to use of TOR.
- fragmede 2y agoThe point ranking on comments, which is private, would be of interest to parties training an LLM and want the data annotated, but your point stands.
- judge2020 2y agoI’m not sure how much more useful that is than just using HN’s automatic ranking for comments, at least outside of parent comments on posts; As far as I can tell, child comments are always ORDER BY score DESC. Even for top level comments, HN’s algorithm for ranking is pretty useful for assigning “worth”
- moogly 2y agoRepresenting the letters "nsa" in "unsafe" since 2006.
- cypherpunks01 2y agoRemember the Harvard student that emailed in a bomb threat via Tor to get out of a final exam in 2013? He got caught not by the FBI breaking Tor, but just by network analysis of university network traffic logs showing a very narrow list of on-campus people using Tor at the time the threat was communicated. He quickly confessed when interviewed. https://www.washingtonpost.com/blogs/the-switch/files/2013/12/kimeldoharvard.pdf https://www.washingtonpost.com/blogs/the-switch/files/2013/1... Just another factor to consider when using Tor - who's network you're on.
- Vegenoid 2y agoIf he simply didn’t confess, they likely could not have proven it was him - but yes, it is best to avoid suspicion altogether.
- pc86 2y agoAs relevant today as it has ever been: https://www.youtube.com/watch?v=d-7o9xYp7eE https://www.youtube.com/watch?v=d-7o9xYp7eE - "Don't Talk to the Police" by Regent Law professor James Duane (2012). 19M views for a reason, it's a great talk that I've watched a couple times now. And a former cop who was an L3 at the time of the video also speaks very convincingly on the topic, and about how the only times people who they knew were guilty but couldn't prove it got away were when they lawyered up and shut up immediately. As always there are caveats that he goes into regarding how to assert the right and all that but the major thrust is if the police want to talk to you for any reason, just don't. Lots of great stories, too. You are under no legal obligation to assist police in their investigations. Give only the information you are legally required to (varies by state and whether it's a consensual encounter, detainment, arrest, etc.), and no more. If you're arrested say you want an attorney and you will not answer questions until they arrive.
- MDJMediaLab 2y agoI recall this situation well as it interrupted an exam of mine. iirc, it was the MAC address of his machine being known/registered to the Campus network that nailed him.
- t3estabc 2y ago[dead]
- ocean_moist 2y agoIf your threat model includes western nation states, there are much bigger threats to your opsec than Tor. If your threat model does not include western nation states, Tor is safe to use.
- smm11 2y agoStill?
- notepad0x90 2y agoFrom what little I've heard, de-anonymization of Tor users is largely done by targeting their devices with zero-day exploits. That is still a valid method, I wouldn't trust Tor personally, but I'm with the Tor project that there is no credible evidence of a large scale de-anonymization attack.
- toby- 2y agoWhy wouldn't you trust Tor? Do you mean you wouldn't trust it at all, or wouldn't trust it completely?
- notepad0x90 2y agoI mean at all, but I don't have any reasons worth mentioning here, that I'm willing to defend on a public site.
- toby- 2y agoFair enough. Was just curious. :)
- tomcam 2y agoSincere question. This was created with US government funding. Is there any reason to believe it is safe?
- hnisoss 2y agoEven if you had your own SMT how can you be sure no one fiddled with your lab? If you can't trust your own stack 100% how can you trust ANYTHING else then? So my answer to your sincere question: no reason to believe it is safe, no.
- toby- 2y agoSo was the Internet at DARPA (or its modern foundation). And the WWW at CERN. Tor's development team aren't on the payroll of the US gov't, and their funding comes from many sources. If having received funding from a government agency is enough to earn your distrust, you'd quickly become a paranoid schizophrenic.
- oldgradstudent 2y ago> Tor's development team aren't on the payroll of the US gov't, and their funding comes from many sources. That's not serious. From the Tor official blog: > U.S. Government (53.5% of total revenue) > Individual Donations (28.5% of total revenue) > Non-U.S. Governments (7.5% of total revenue) > Foundations (6.4% of total revenue) > Corporations (3.4% of total revenue) > Other (0.6% of total revenue) https://blog.torproject.org/transparency-openness-and-our-2021-and-2022-financials/ https://blog.torproject.org/transparency-openness-and-our-20...
- toby- 2y agoIt's true that a majority is from the US government through various funding schemes and grants. They're very transparent about their funding and ongoing efforts to diversify. But a little over half coming from US government sources isn't the same as their devs literally being on the gov't payroll; people often talk about Tor as if the developers themselves earn a government salary. (Funnily, Signal also received major funding from US government sources but very few people seem to question that when lauding Signal.)
- ementally 2y agohttps://spec.torproject.org/vanguards-spec/index.html https://spec.torproject.org/vanguards-spec/index.html >A guard discovery attack allows attackers to determine the guard relay of a Tor client. The hidden service protocol provides an attack vector for a guard discovery attack since anyone can force an HS to construct a 3-hop circuit to a relay, and repeat this process until one of the adversary's middle relays eventually ends up chosen in a circuit. These attacks are also possible to perform against clients, by causing an application to make repeated connections to multiple unique onion services.
- Swobby 2y ago[flagged]
- ggm 2y agoAbsolutist statements about services like TOR or VPNs are often not helpful. It's highly contextual to the threat. If the threat is a state actor it's likely nothing, TOR included, can preclude them from determining things about you that you would prefer them not to know. Some specific state actors operate TOR entry and exit routers and can perform analysis which is different to others who just have access to the infra beneath TOR and can infer things from traffic analysis somewhat differently. I have never been in a situation where my life and liberty depended on a decision about a mechanism like TOR. I can believe it is contextually safe for some people and also believe it's a giant red flag to a lead pipe and locked room for others.
- edm0nd 2y agoI'm being pedantic but it's simply just Tor, not TOR. https://support.torproject.org/about/why-is-it-called-tor/ https://support.torproject.org/about/why-is-it-called-tor/ >Note: even though it originally came from an acronym, Tor is not spelled "TOR". Only the first letter is capitalized. In fact, we can usually spot people who haven't read any of our website (and have instead learned everything they know about Tor from news articles) by the fact that they spell it wrong.
- MR4D 2y agoI’m a tor novice, so please excuse the simplistic question… Couldn’t a national security organization just modify a node to route traffic to other nodes it controls instead of uncontrolled nodes?
- tg180 2y agoNo! The client controls path selection, and each hop is verified using its encryption keys.
- bobbylarrybobby 2y agoYou're saying that if you modify the tor software, other clients will be able to tell before connecting to you? And you can't trick them into sending to a bad node?
- mrln 2y agoIt is not the node that chooses the next one, but the client. A bad node cannot "fake" a good node, because it cannot cryptographically authenticate to be the new node the client selected (the client knows the public key of the newly selected node).
- kevincox 2y agoIf you run a node that forwards traffic to any node other than the one requested by the client then that node won't be able to decrypt the traffic. The client encrypts traffic to each node on its selected path in turn. If the traffic doesn't reach every desired node in order the traffic can't be decrypted.
- known 2y ago[dead]
- deviantbit 2y agoNo. It is not. More than 1/3 of the Tor servers are run by US Federal Govt as does other members of the Five Eyes. Israel has a large number as well. Cases are built backwards or in parallel that are from the fruit of the poisonous tree. If you don't know what that term means, look it up. Use Tor with extreme caution.
- ec109685 2y agoOr just hit onion services that don’t require exit nodes.
- loup-vaillant 2y agoHow is that even possible? Unless you keep to hidden services underneath you do need an exit point to talk to the regular internet.
- throawayonthe 2y ago[dead]
- pushupentry1219 2y agoComment is saying: never use regular internet ONLY use hidden services so you never need to exit the network through an exit node
- toby- 2y ago>More than 1/3 of the Tor servers are run by US Federal Govt Source? People repeat this claim and nobody every provides evidence.
- deleted 2y ago[deleted]
- hannasm 2y agoIf enough governmental bodies can get behind running Tor nodes then couldn't we theoretically protect the bulk of humanity from spying on Internet access? Truly an advance in the Internet technology. It's kind of like if a single nation does it they control everything, but once all the nations compete then everyone wins. But at planetary scale would Tor scale in an environmentally friendly way?
- perlgeek 2y agoMost governments value their law enforcement obligations and/or desire for surveillance more strongly than an Internet that is protected from spying, so good luck with that.
- berkes 2y agoIronically, most of these same sectors in the same governments have strong need to be protected from spying themselves. So in many cases it's really a case of "we want a monopoly on secrecy". Which should be a massive red flag for everyone, from left to right, from liberal to conservative, from anarchist to communist and so on. But somehow isn't picked up by any of these. I presume because they all believe somehow they either won't be targeted or will be exempt?
- pc86 2y agoSeveral of those ideologies you mention are just different flavors of authoritarianism, and one of an ideological authoritarian's primary goals is power. Hell, take out "anarchist" and you could make a convincing argument they're all authoritarians in their own way. You don't get power by giving the populace - or helping them to keep - a free, secure Internet. It's just completely antithetical to someone who wants to hold power by nondemocratic means.
- berkes 2y agoThat was deliberate: a way of saying "probably even those who align with authoritarianism won't like governments to have a monopoly on secrets".
- arminiusreturns 2y agoI doubt it, it's too vulnerable to relay or 50% style attacks. I stopped using it in 2011/12-ish.
- burningChrome 2y agoI remember Adrian Crenshaw doing a speech at Def Con 22 about how people got busted using Tor. Even then he point out in most of the cases, it was bad OpsSec by the person, and had nothing to do with Tor. How applicable do people think this information is now 9-10 years later? DEF CON 22 - Adrian Crenshaw- Dropping Docs on Darknets: How People Got Caught https://www.youtube.com/watch?v=eQ2OZKitRwc https://www.youtube.com/watch?v=eQ2OZKitRwc
- Vicinity9635 2y ago[dead]
- zoobab 2y agoTOR critics like Len Sassaman said the same years ago, with traffic analysis it is possible to detect where the source is coming from. https://en.wikipedia.org/wiki/Len_Sassaman https://en.wikipedia.org/wiki/Len_Sassaman
- toby- 2y agoTiming attacks are a well-known weakness. There's a lot of research into timing attacks and proposed countermeasures. Also, it's just Tor – not 'TOR'. >Note: even though it originally came from an acronym, Tor is not spelled "TOR". Only the first letter is capitalized. In fact, we can usually spot people who haven't read any of our website (and have instead learned everything they know about Tor from news articles) by the fact that they spell it wrong. https://support.torproject.org/about/why-is-it-called-tor/ https://support.torproject.org/about/why-is-it-called-tor/
- deleted 2y ago[deleted]
- vbezhenar 2y agoHere's imaginary attack with adversary. Just push as much traffic as possible from many hosts to the given hidden service. Now observe traffic metadata from high level network operators. With enough filtering it should be possible to detect where traffic spike is terminated.
- throawayonthe 2y ago[dead]
- remram 2y agoIt would be "terminated" at all the points that can't keep up, way ahead of the hidden service (or even rendez-vous node).
- loup-vaillant 2y agoTo get past the self signed certificate: https://web.archive.org/web/20240918195838/https://blog.torproject.org/tor-is-still-safe/ https://web.archive.org/web/20240918195838/https://blog.torp...
- dinkelberg 2y agoThe certificate for blog.torproject.org should not be self-signed. For me it is an extended validation certificate issued by DigiCert Inc.
- snailmailman 2y agoI don’t think you should be seeing a self-signed certificate? I’m getting a valid Digicert-signed certificate on my end.
- toby- 2y agoIt isn't a self-signed cert.
- 3np 2y agoYou're MitM'd yo.
- 2d8a875f-39a2-4 2y agoWas Tor ever safe to use? I don't think so.
- toby- 2y agoYes. Why wouldn't it be? The fact that adversaries need to rely on zero-days, or people running massively outdated and unsupported software, strongly suggests the network is safe and robust.
- NoGravitas 2y ago"Safe for what?" has always been a valid question.
- argentier 2y agosafe as it ever was
- iamyourcanary 2y ago[flagged]
- taneq 2y ago"Safe" doesn't have a meaning until you define your threat model.
- haolez 2y agoHere is an awesome DefCon talk about this topic from the perspective of a darknet vendor. It's amazing: https://youtu.be/01oeaBb85Xc https://youtu.be/01oeaBb85Xc
- alecco 2y agoNice presentation. Ironically the ?si= parameter is for tracking. You should remove it.
- giancarlostoro 2y agoIs it sad that when someone else gives me a video with an si parameter or similar, I keep it on when passing it forward, in my eyes, this feeds garbage to their backend.
- loceng 2y agoNew tool idea: a si parameter tracking "mixer"? Crowdsource making tracking useless?
- digging 2y ago> this feeds garbage to their backend How is a timestamped chain of communication between persons interested in a particular topic "garbage"?
- giancarlostoro 2y agoWe don't know that its just a timestamp, look up Discord Snowflake, which is a unique user ID with a timestamp to boot.
- haolez 2y agoThanks. I was on mobile and didn't notice it.
- alecco 2y ago
- flufluflufluffy 2y agoAs knowledgeable users of the Internet in 2024, we would do well to assume that nothing is 100% “safe” (I.e. there’s no such thing as perfect security/privacy). However, some things, like Tor, can make your use of the Internet safer. If all you’re doing is arguing that Tor shouldn’t be used because it isn’t/was never “safe”, then you might as well not use the Internet at all.
- deleted 2y ago[deleted]
- toby- 2y agoAgreed – you can never truly be completely "safe", but Tor remains the most privacy-preserving tool we've got. When people say they're distrustful of Tor (for various reasons) to the extent they refuse to use it, they seldom suggest alternative tools/measures that provide anywhere near the level of safety offered by Tor.
- dev1ycan 2y agoThe argument is that using "privacy" tools makes it easier for a party to single you out, and they do have a point.
- AnthonyMouse 2y agoThey have the opposite of a point. The logical conclusion of that line of reasoning is that everyone should use privacy tools so no one can be singled out. And that ordinary users with "nothing to hide" should be the first to start using them.
- horsawlarway 2y agoI mean, sure. And while we're at it pigs should fly. Functional security means understanding your risks, and using privacy tools is a risk - in the sense that it does single you out in the current environment. Your actual communications can be secure, but that doesn't stop a bad actor/government from picking you up and beating you with a wrench until you talk - if they get suspicious enough. Just saying "everyone should use these tools!" is not actually a counter-argument. It's a fine long term goal, but it's not addressing the real risk that some folks might be in.
- SumRandoDude38 2y ago[dead]
- randymercury 2y agoAt the most basic level we're talking about a very public service that has been around for a long time that is a potential weakness/ enormous target for the best funded and most technically proficient intelligence agencies in the world.
- puppycodes 2y agoThe question is always and forever who are you hiding from and how strong is their will? Assume if the will is strong and the resources are strong you will be eventually identified. If your not worth it then your not worth it. become not worth it
- nortonham 2y agohttp://yashalevine.com/articles/tor-spooks http://yashalevine.com/articles/tor-spooks http://surveillancevalley.com/blog/fact-checking-the-tor-projects-government-ties http://surveillancevalley.com/blog/fact-checking-the-tor-pro...
- grayxu 2y agoA safer approach is to treat Tor only as a special obfuscation method.
- spit2wind 2y agoA great history of Tor was recently published (with open access). Super interesting read. https://direct.mit.edu/books/oa-monograph/5761/TorFrom-the-Dark-Web-to-the-Future-of-Privacy https://direct.mit.edu/books/oa-monograph/5761/TorFrom-the-D...
- drumttocs8 2y agoAgencies operate untold nodes. No.