5 ms·
The best attack against Tor is convincing people not to use it. If anyone tries to convince you Tor is not safe, ask yourself: cui bono?
by jstanley 2y ago
The best attack against Tor is convincing people not to use it.
If anyone tries to convince you Tor is not safe, ask yourself: cui bono?
- dijit 2y agoSame was true of Truecrypt. After the core team disbanded there was a full security audit which uncovered some very minor issues. People never really trusted Veracrypt though. Quite interesting how that turned out.
- hypeatei 2y ago> People never really trusted Veracrypt though Can you expand on this? It was my understanding that Veracrypt is the new de-facto standard.
- dijit 2y agoBitlocker, LUKS and FileVault are the new standard(s). Veracrypt is a curiousity, not beloved the way truecrypt was. I’d love to see hard numbers for this, just my outside impression. In fact, when trying to find old forums that I was part of during that era, I failed; and found only this: https://discuss.privacyguides.net/t/why-people-still-believe-truecrypt-is-much-better-than-veracrypt/18295 https://discuss.privacyguides.net/t/why-people-still-believe...
- UberFly 2y agoThis is complete conjecture. Like Truecrypt, Veracrypt is open source, has been audited and has been actively maintained. Could it use another audit? Sure but so could Bitlocker but that isn't happening for even the first time any time soon.
- dijit 2y agoI read this as intended to be some kind of rebuttal but… Where did I say it wasn't conjecture? I was stating facts about the ecosystem. People didn't trust it at the time. I never said there was a definite reason for that distrust.
- trompetenaccoun 2y agoNever heard of any credible reasons to distrust Veracrypt. Don't know who these "people" are either, none of the comments named anything more concrete than what sounds like online rumors.
- fencepost 2y agoIIRC there were a lot more options by the time of the Truecrypt-Veracrypt shift. Truecrypt was around when drive encryption was otherwise an expensive enterprise software thing, but I think Bitlocker was included with Pro versions of Windows by the time of Veracrypt so that probably became the easiest free option - and probably with better compatibility as well.
- no-dr-onboard 2y agothis presumes that anyone would trust bitlocker. https://pulsesecurity.co.nz/articles/TPM-sniffing https://pulsesecurity.co.nz/articles/TPM-sniffing
- bri3d 2y agoBeing able to sniff a key as it transits a local bus is a very different kind of compromise of "trust" than believing that something is preemptively backdoored by a threat actor. It is deeply mysterious that Microsoft don't simply use TPM encrypted sessions to prevent this, though.
- dylan604 2y agoIsn't this yet another example of if they have your physical machine, it's already game over?
- bri3d 2y agoNo? Any modern disk encryption system with a strong passphrase (basically, anything but default-BitLocker) is very effective against "they have your physical machine and it's off" for any known, current adversary. And, the basic cryptography in use is common, robust, and proven enough that this is probably true even if your tinfoil hat is balled quite tightly. Where modern research effort goes is into protecting against "they HAD your physical machine and they gave it back to you" or "they got your machine while it was on/running" - these are much more difficult problems to solve, and are where TEE, TPM, Secure Boot, memory encryption, DMA hardening, etc. come into play.
- cainxinth 2y agoThe best attack against Tor is creating entrance and exit nodes that monitor traffic. That was the biggest risk factor when Tor was invented and it still is today.
- theonionrouter 2y agoHow does that work technically, if I am connecting with SSL? The only thing I see is seeing which IP addresses are using Tor, when, and how much traffic exchanged, but mostly it will be a bunch of reused residential IPs? If you know who you are looking for anyway better to work with their ISP? With the exit nodes, you know which IP addresses are being looked up. You might get an exit node IP when investigating a crime say. Raid that person, but can you find anything more? This isn't an argument, but a question.
- cainxinth 2y agoThey don't use encrypted data. They look at the metadata like packet size and timing and perform traffic correlation, which defeats Tor's primary purpose: hiding the connection between the source and destination of traffic.
- no-dr-onboard 2y agoAfter the Snowden revelations regarding FOXACID and QUANTUM going largely undressed in the tor project, people have every right to feel sketched out with using ToR for anything. "We're still helping people" just isn't a good enough argument for most people. https://www.schneier.com/blog/archives/2013/10/how_the_nsa_att.html https://www.schneier.com/blog/archives/2013/10/how_the_nsa_a... https://blog.torproject.org/yes-we-know-about-guardian-article/ https://blog.torproject.org/yes-we-know-about-guardian-artic...
- xyst 2y agoWonder what has replaced “Xkeyscore” given the wide adoption of TLS. I know ISPs, especially national ISPs like AT&T (see: titanpointe - 33 thomas st, nyc) would feed data to NSA since traffic at the time was mostly via http (rather than https). I suppose the unencrypted dns queries are still useful (although DNSSEC is supposed to defend against snooping/deep packet inspection)
- xenophonf 2y agoDNSSEC is an authentication mechanism. It does not encrypt queries or responses. You might be thinking of DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT). There's also DNSCurve. https://en.wikipedia.org/wiki/DNSCurve https://en.wikipedia.org/wiki/DNSCurve
- no-dr-onboard 2y agoDoH and DNSSEC don't use ECH (encrypted client hello) From what I remember, only DoT uses ECH https://media.ccc.de/v/chaoscolloquium-1-dns-privacy-security https://media.ccc.de/v/chaoscolloquium-1-dns-privacy-securit...
- _rdvw 2y agoECH can be used regardless of DoT, DoH, dnscrypt, or plain as long as your resolver passes HTTPS queries. You can easily test this: dig @8.8.8.8 https pq.cloudflareresearch.com
- stavros 2y agoI'll ask the inverse: if Tor is unsafe, who benefits from telling you to use it?
- appendix-rock 2y agoEspecially “the solution to an unsafe Tor is more Tor!” it feels like I’m at a charity drive.
- theonionrouter 2y ago"Unsafe" is not enough data. Safer or unsafer than ISP or VPN, is the question. (I presume safe means private here)
- pphysch 2y agoThe groups that primarily fund The Tor Project, i.e. the US State and Defense Departments.
- supportengineer 2y agoSociety benefits when people refrain from illegal and immoral activities.
- barbazoo 2y agoAre you implying that Tor is primarily used for illegal or "immoral" purposes?
- fsckboy 2y agoare you implying that Tor is not used for illegal or immoral purposes? (I took out the primarily that you threw in to make your argument stronger because that made my argument stronger, and I took out your scare quotes because morality doesn't scare me)
- barbazoo 2y agoI have no idea who is using Tor other than that I heard it can be used by people requiring privacy from governments, e.g. whistleblowers. It also seems to have broad support from the tech industry so I'd be surprised if it was in fact primarily used for illegal or "immoral" purposes. That's why I'm asking.
- alt187 2y agoWhat's a scare quote?
- fsckboy 2y agodid your search button break? lmgtfy https://www.urbandictionary.com/define.php?term=scare+quotes https://www.urbandictionary.com/define.php?term=scare+quotes this is a helpful answer, downvoting it would be extremely bad form
- lukan 2y agoI would assume very likely yes? There definitely are legit use cases for it and in an ideal world, I think all traffic should go over onion routing by default to protect them. But in reality today besides a handful of idealists (like me some years ago), and legitimate users, like protestors under oppressive regimes - I would assume the biggest group with a concrete interest to hide would be indeed pedophiles and other dark net members and therefore use it.
- jancsika 2y agoA question before I enter your Manichean universe: Does Tor Browser Bundle currently ship with Ublock Origin installed and on by default?
- duskwuff 2y agoIt would be irresponsible for it to do so. Ad blocker lists can inject scripts into web pages which could compromise user privacy.
- jancsika 2y agoIn that case we're talking at cross-purposes, so I'll reserve judgment. I'm concerned with what let's call Gorhill's Web-- that is, the experience glued together by gorhill's Ublock Origin that is viewed by the vast majority of HN commenters on a day to day basis. What you're describing is the Web-based Wasteland that is experienced by the vast majority of non-technical users who view the web without an ad blocker. Encouraging Wasteland users to use TBB may well be an overall improvement for them. But there are more and more popular parts of the web that are practically unusable without an ad blocker-- e.g., fake download buttons, myriad other ad-based shenanigans, multiple ads squeezed into short pieces youtube content that ruins the music, etc. And there's an older segment of the population who at I cannot in good conscience move away from Gorhill's Web. If Tor uptake somehow spikes to the point that some services can no longer get away with discriminating against exit nodes, then great! But in the meantime, I and many others have solid reasons for encouraging more and more Ublock Origin use among a wide variety of users. And as you point out, there are technical reasons why the ad blocker lists are at odds with TBB design goals. Thus, I find the top poster's "cui bono" comment low effort and unhelpful. Edit: clarification
- School-Cotton 2y agoI don’t think it’s true that the vast majority of HN users use ad blockers. I don’t, and I don’t find the web “practically unusable”.
- 2y ago
- knodi123 2y ago> If anyone tries to convince you Tor is not safe, ask yourself: cui bono? It could be for insidious reasons, or because the speaker legitimately believes it. "If anyone tries to convince you you shouldn't use Rot13 as an encryption scheme, ask yourself- cui bono?" Silly example, but the point is, just about *everything* could be explained equally by either evil lies or honest warnings.
- andai 2y agoSomeone tries to convince you a room totally isn't bugged and that you should have private conversations in it. (A room designed by the US military, incidentally...)
- deleted 2y ago[deleted]
- orthecreedence 2y ago> cui bono? You look for the person who will benefit, and uhh...uhh you know, uhh, you know, you'll uhh, uhh. Well, you know what I'm trying to say. - VI Lenin