4 ms·

I'm not sure quite what they're using it for, though. I suppose some sites block .gov IP ranges, but you'd think they could easily proxy via some innocuous host

by morsch 14y ago

I'm not sure quite what they're using it for, though. I suppose some sites block .gov IP ranges, but you'd think they could easily proxy via some innocuous host provided by a commercial provider.

derrida 14y ago
Law enforcement have for decades been anonymous, wearing plain clothes & hiding behind false identities in efforts to catch criminals. Tor just gives them digital plain clothes. If they were going through an open HTTP proxy, that box better have a decently network facing attack surface (unlikely). Sure, it's the same deal with Tor, except you have to pwn about 2/3rd of the network (4000+ boxes) before you know about the equivalent of pwning 1 sole proxy. Keep in mind there is a good mix of software, a whole variety of kernels etc. If you have one of the less common architectures around, consider running a Tor node on it :-) Then we get a mix against random machine-code backdoors too.
- dmix 14y ago
  Another good reason might be because there are a ton of illegal onion sites on Tor that they are investigating.
  - derrida 14y ago
    Sure, but that is a newer feature, and Roger Dingledine has been giving these talks to law enforcement for some years (the earliest I am aware of is 2008).
- ChrisWoodall 14y ago
  >If they were going through an open HTTP proxy, that box better have a decently network facing attack surface (unlikely). Sure, it's the same deal with Tor, except you have to pwn about 2/3rd of the network (4000+ boxes) before you know about the equivalent of pwning 1 sole proxy. Can you go into more detail about what you are saying? I'm sure you could drop a- ADOBE, Active-X, Java, ect- 0-day on a page and pwn said box. You can also send payloads to/from TOR; although there are limited transfer protocols you can use. The whole point of TOR is to try to anonymize you. It's not going to save you from getting owned.
- voltagex_ 14y ago
  I don't have the bandwidth available, but I'm willing to ship a Raspberry Pi to someone who does. Someone should start the TorPiDo project :P
  - derrida 14y ago
    Maybe that someone is you? Join the tor-talk list and just do it :-)
cjbprime 14y ago
They're not using it to evade website blocks, they're using it to anonymize themselves and evade being identified as FBI agents.

by morsch 14y ago

I'm not sure quite what they're using it for, though. I suppose some sites block .gov IP ranges, but you'd think they could easily proxy via some innocuous host provided by a commercial provider.

derrida 14y ago

Law enforcement have for decades been anonymous, wearing plain clothes & hiding behind false identities in efforts to catch criminals. Tor just gives them digital plain clothes. If they were going through an open HTTP proxy, that box better have a decently network facing attack surface (unlikely). Sure, it's the same deal with Tor, except you have to pwn about 2/3rd of the network (4000+ boxes) before you know about the equivalent of pwning 1 sole proxy. Keep in mind there is a good mix of software, a whole variety of kernels etc. If you have one of the less common architectures around, consider running a Tor node on it :-) Then we get a mix against random machine-code backdoors too.

dmix 14y ago
Another good reason might be because there are a ton of illegal onion sites on Tor that they are investigating.
- derrida 14y ago
  Sure, but that is a newer feature, and Roger Dingledine has been giving these talks to law enforcement for some years (the earliest I am aware of is 2008).
ChrisWoodall 14y ago
>If they were going through an open HTTP proxy, that box better have a decently network facing attack surface (unlikely). Sure, it's the same deal with Tor, except you have to pwn about 2/3rd of the network (4000+ boxes) before you know about the equivalent of pwning 1 sole proxy. Can you go into more detail about what you are saying? I'm sure you could drop a- ADOBE, Active-X, Java, ect- 0-day on a page and pwn said box. You can also send payloads to/from TOR; although there are limited transfer protocols you can use. The whole point of TOR is to try to anonymize you. It's not going to save you from getting owned.
voltagex_ 14y ago
I don't have the bandwidth available, but I'm willing to ship a Raspberry Pi to someone who does. Someone should start the TorPiDo project :P
- derrida 14y ago
  Maybe that someone is you? Join the tor-talk list and just do it :-)

cjbprime 14y ago

They're not using it to evade website blocks, they're using it to anonymize themselves and evade being identified as FBI agents.