12 ms·
Tor and HTTPS
- esalman 13y agoWhen using Tor+HTTPS, the first NSA eavesdropper can see location. How serious is that?
- icebraining 13y agoBy location they mean your IP (from which they can get your address, by asking the ISP). As long as they can't links the two captured packets, they just know that you're using Tor.
- vidyesh 13y agoWell your IP determines your location. That other evasdropper is from your ISP, since you first connect to your ISP and then Tor. Your ISP potentially knows your location which is what the NSA evasdropper gets. And since its shared with amongst both the evasdropper, potentially NSA knows your location even if you use Tor. They should have indicated that too I guess.
- icebraining 13y agoSharing the data is not enough, they have to link it to be useful. They probably can, though.
- Achshar 13y agoI am wondering how that works with dynamic ip allocation by ISP. My ip changes every time I reset my router.
- noerps 13y agoThat doesn't matter, since the changes of your endpoints ip are available from your ISP.
- vidyesh 13y agoWell only if its from your ISP. And the illustration should add that both the NSA eavesdropper(s) would get that information actually. Since data is shared.
- icebraining 13y agoThe data is shared, but the question is whether or not they can link it.
- nwh 13y agoThey only see the location of the user entering Tor, which is only really an issue if using Tor itself is illegal, or they also control the exit node you are using. In the second case, it would be possible (though unlikely) for them to correlate the entry and exit through bandwidth and timing.
- belorn 13y agoWe don't know. It slightly depends on how much worse things get in the US. You might get a permanent flag in "your file" as a potential troublemaker, but so might living in the wrong neighborhood, or going to the wrong bar, or being acquainted with someone under NSA suspicion. It's impossible to know what will or will not be put in the file, or which flags will give you grief (without you ever knowing why) when visiting an airport or when applying for a job.
- andrewcooke 13y agowell, it is serious, in that it's the most likely weak point in tor. however, exactly how serious is still an open question. remember - what the nsa wants is both your location and the site. your location alone only means that you were using the internet (and tor, which itself might be regarded a suspicious). the site alone only means someone was using the site. what the NSA have to do is connect those. so everything depends on whether the two NSA people can "join up the dots" (graphically, in that diagram, the dark blue dots joining them). because there's nothing "obvious" that tells them that the message with the location is connected to the message with the site. if they can't make that connection, then they don't know anything useful. but if they can make that connection, then they know that you (well, someone at your location - an open wifi might give you a little deniability, for example) looked at that site. the way they might be able to do it is by comparing traffic patterns. if they can show, for example, that every time you send a request, the site receives a request, and if that happens again and again, so reliably that it cannot be chance, then they can make the connection. so it depends on things like the frequency with which you look at the site, the amount of (tor) traffic when you are around, and the ability of the NSA to assemble and correlate large amounts of data. [disclaimer: not an expert; i don't know the current state of play on how bad a problem this is; i just know it's a known issue. and if i were going up against the nsa, i wouldn't trust tor alone - i'd use an anonymous, disposable, portable connection device, and keep data to an absolute minimum.]
- claudius 13y agoWould it be helpful to run a forwarding (at least non-exit, possibly entry) Tor node on one’s own computer to mask the Tor traffic actually originating from this machine?
- andrewcooke 13y agoi think it might, but only at about the level of adding an extra tor hop (the NSA can compare requests in and out, and try to detect which ones out are extra).
- belorn 13y agoAn excellent illustration for those already familiar with the concepts. However, I not sure its that easy to understand for those who don't know what "location" means, and the text is slightly small and hard to read. It would be a great improvement if they showed a small help text if one hovered over a label inside one of the yellow boxes. Still, a very excellent job of EFF.
- claudius 13y agoThere’s a little description text at the top explaining the meaning of the various labels, including ‘location’ (the last bullet point).
- belorn 13y agoThe term "IP address" would be similarly confusing. What would help is if they explained in context what it means, for example when a lawyer of one's ISP knows about location and site (possible termination of contract, providing it to NSA, selling it and so on). Also, using a help window when hovering would be a quite better UX than a glossary.
- eugene-d 13y agoI guess "location" means "IP Address". It's not your location in the URL bar, as HTTPS encrypts the connection, not just HTTP request body.
- icebraining 13y agoHTTPS doesn't encrypt the domain. That said, Tor does.
- buzzkills 13y agohttps encrypts the host header (indeed all the http headers), so yes it does encrypt the domain in that respect. What it can't encrypt is the destination IP address, which would be reverse looked up to the domain if everything was configured right in the DNS.
- Ihmahr 13y agoHow secure is ssl? Can't NSA fake a certificate?
- mbel 13y agoDo they really need to fake it? It surely might be a part of the famous indirectly accessed data.
- Phlarp 13y agoThis has been my question in this whole mess, if we assume NSA can and does subpoena the keys and certs as opposed to the direct data (and the NSA were copying data en masse, which now seems likely) would that not make HTTPS essentially useless?
- claudius 13y agoThe NSA is not the average guy listening in on your wifi and then using your CC to buy stuff online. HTTPS protects against those, and it does so relatively efficiently.
- Phlarp 13y agoSorry, I should have clarified that it negates HTTPS in the context of the NSA (and presumably other government actors around the world), still great protection from getting your facebook session hijacked over wifi. What about protection from the average NSA sysadmin or analyst with slightly less moral fiber than Edward Snowden? (or gambling debt, or a mental disease, or an obsession with your significant other etc.)
- nwh 13y agoI would continue under the assumption that they can and do. If confidentiality and authenticity is mission critical, you need to be using a hidden service rather than relying on SSL. A hidden service does not exit the network and does not rely on external validation.
- 13y ago
- theboywho 13y agoHow about using Tor > VPN (Note: Not VPN > Tor) ?
- noerps 13y agoIt could circumvent VPN censorship/supression or DPI since VPN is not a secure end to end communication. That way you would obfuscate your endpoint against your vpn endpoint/provider. It would add no further benefit to location obfuscation with Tor, since your VPN-provider will always snitch on you when opposed with lethal force.
- jaigouk 13y agoI've tried that. It seems google tracks ip and forces users to change password.
- alextebbs 13y agoInteresting how everyone in the diagram except the user, the sysadmin, and the relay nodes have "evil eyes".
- giardini 13y agoYes. Undoubtedly sysadmins are responsible for some, if not most of the most egregious handoffs of data to outsiders (legal or illegal).
- showsover 13y agoHow legal is operating a Tor node? I'm thinking of putting up a machine (and a VPS) to just run a node. I just don't want to get into legal trouble for running a(n exit) node.
- hnha 13y agoThat depends on your jurisdiction. In many countries it is perfectly legal. It is also very safe and low maintenance.
- ancarda 13y agoRunning a regular node is fine as you're routing encrypted information for the Tor network - your unlikely to get any hassle although check your countries laws on crypto first. Running an exit node may be a different story. You could get false DMCA takedown notices or get charged with someone else's crime. Think of it this way; you're running an open proxy. Uses of Tor can send any traffic through your connection. That being said, some ISPs are ok with it, others won't tolerate it. I suggest you checkout https://blog.torproject.org/running-exit-node https://blog.torproject.org/running-exit-node if your really serious about running an exit node.
- csomar 13y agoThen, maybe, use Bitcoins for payment and Tor+HTTPS while signing up for the hosting provider?
- noerps 13y agoBitcoin transactions are chained, that may compromise you. But you could use an anon currency-exchange or currency-bridge like paysafecard.com to obtain some value and obtain bitcoin with that value and never use that bitcoin key again to avoid that.
- throwmeaway33 13y agoIs there no system to swap ownership of coins? If not there should be. You send X amount of bitcoins to a middle man who then gives you X amount back. Technically they will be different coins and they'll go to a different account #, so you can't trace anything.
- B0Z 13y agoMaybe I'm misinformed, but I thought the big problem has less to do with data in transit than it does with the destinations (Google, Facebook, Microsoft, etc) working hand-in-hand with the NSA? What am I missing?
- Splendor 13y agoYep. It doesn't matter how you securely you get your data to Company X if Company X is handing the data over to the NSA.
- dllthomas 13y agoTor hidden services could help, though.
- path411 13y agoAs long as you aren't using a service with your actual data. If I use Tor to connect to facebook and input my personal information, Tor is only protecting my data in transit. The NSA can still request the data from my account from facebook.
- dllthomas 13y agoWith a Tor hidden service, the NSA cannot necessarily find the service provider. Of course, neither can I, so there is a whole different set of threats (and it could be the NSA providing the service in the first place) but it does help a little with this specific problem.
- mtgx 13y agoAssuming the NSA is tapping ISP cables, and siphoning all unencrypted data of the web, and that they need to ask the big companies in the slides for the encrypted data, would EFF's "HTTPS Everywhere" help with all the websites that are not encrypted, like say Reddit?
- voidlogic 13y agoI thought "HTTPS everywhere" is just switching your connection from HTTP to HTTPS when the site you are visiting is on the list of sites known to support their services over HTTPS.
- tlrobinson 13y agoAs another commenter mentiioned, that tool just automatically switches to HTTPS sites if available (on the same domain name) FYI: there's https://pay.reddit.com/ https://pay.reddit.com/ but it doesn't work with HTTP Everywhere because its on a different domain.
- jafaku 13y agoAnd sometimes users post links to reddit itself, and it won't be https.
- lurchpop 13y agoreddit is encrypted: https://pay.reddit.com/ https://pay.reddit.com/. (the "pay" part doesn't mean you have to be a paying member.)
- VexXtreme 13y agoWhat happens if NSA starts operating a number of Tor exit nodes and eavesdropping on the outgoing traffic? What prevents them from doing so?
- mitchty 13y agoThey start capturing lots of data. And nothing prevents them from doing so.
- noerps 13y agoThey are donating bandwidth, which is always scarce.
- doomrobo 13y agoNothing, but they would still not know where the traffic is coming from. The "Onion" defined in the Tor protocol is unwrapped layer by layer by each node. So the NSA has a choice where no option would help them too much: 1. Be the first node you access and be able to see your IP but not your traffic 2. Be the last node and be able to see your traffic but not your IP 3. Be a middle node and see neither
- sdfjkl 13y agoCan't they do both 1 and 2 and correlate the information?
- dllthomas 13y agoYes. Which is why we need to keep a lot of nodes running, and part of why Tor hidden services are a good thing.
- doomrobo 13y agoI don't believe that's possible. If they have two nodes then they're still not a part of a defined path. For instance, someone can go through their entrance node and come out someone else's exit node and vice-versa. The NSA would have no idea who is going through where and shouldn't be able to correlate the data.
- D9u 13y agoWith most ISP already using DPI it's anyone's guess how much the spies can see. http://www.bivio.net/products/dpi/ http://www.bivio.net/products/dpi/ http://arstechnica.com/tech-policy/2010/06/deep-packet-inspection-soon-to-be-15-billion-business/ http://arstechnica.com/tech-policy/2010/06/deep-packet-inspe... http://www.george-orwell.org/1984 http://www.george-orwell.org/1984
- bcl 13y agoYou can help contribute - https://cloud.torproject.org/ https://cloud.torproject.org/ Note that you can reduce your costs by using spot instances.
- yegg 13y agoDo you have any sense how many nodes (or I guess how much bandwidth or even something else I'm not thinking of) it would take to make a material difference on the speed of the network?
- bcl 13y agoI don't know, but you can monitor the status of the network here - http://torstatus.blutmagie.de/ http://torstatus.blutmagie.de/
- wyck 13y agoThe important part of the diagram for Tor is the first NSA character, as you can see it still shows "Location" before you are routed through the Tor relay. With the location information it is possible to correlate the exit information via pattern matching, though it would take considerable analysis, this can be done by logging volume and timing information on the two sides. I am sure there are even better techniques to analyze exit/entry correlations, especially if you're not using a secure browser. So having a private VPS doesn't really matter, in fact it can make matters worse because you are adding layers that can be "watched" before you hit an entry node, the more data that can be logged the easier it is to track. You're best option is to choose random nodes, connect at random times and also look into using Tor bridges. If possible using several different IPS's or even better random wi-fi hotspots, though this is hardly convenient for most users. Tor bridges: https://www.torproject.org/docs/bridges.html.en https://www.torproject.org/docs/bridges.html.en Whitepaper on Tor passive logging attacks (pdf): http://people.cs.umass.edu/~mwright/papers/wright-passive.pdf http://people.cs.umass.edu/~mwright/papers/wright-passive.pd...
- runeks 13y ago> With the location information it is possible to correlate the exit information via pattern matching, though it would take considerable analysis, this can be done by logging volume and timing information on the two sides. I am sure there are even better techniques to analyze exit/entry correlations, especially if you're not using a secure browser. I've thought the same. But I've also thought that if this is indeed possible, why does Silk Road still exist? Or does this analysis only apply Tor clients connecting to websites, and not Tor hidden services?
- haakon 13y agoHidden service routing works quite differently that regular exiting traffic. Twice the number of relays are involved, and the traffic is end-to-end encrypted instead of being visible to any relay (such as an exit node). Correlation attacks are always possible to a global passive adversary (which NSA may or may not be), but as far as I can tell, they seem much harder to pull off against hidden services.
- 13y ago
- chj 13y agoThe problem of HTTPS is that you will need certification from some CAs which may be working with government agents.
- icebraining 13y agoYeah, and even if you get a certificate from a CA which isn't, it doesn't matter, since any other CA can still issue a cert for your domain.
- noerps 13y agoFrom a crypto/security approach there is no difference between a self-signed certificate and from an "offical" CA. In terms of trust, your mileage may vary.
- runn1ng 13y agoI have problems even logging in on ycombinator with tor. Not to mention any site with anti-spam protection.
- deleted 13y ago[deleted]
- deleted 13y ago[deleted]
- noerps 13y agoSince nearly every Tor-exit has working reverse-lookup or by using https://check.torproject.org/ https://check.torproject.org/ it is easy to deny access to Tor-users while authenticating. It makes imho no sense to authenticate using Tor.
- btipling 13y agoWhy does the graphic portray police as mean angry people. Police are good people who provide a valuable service. They do a good thing. They are not the enemy.
- duairc 13y agoNo, they don't, they do a bad thing. In actual fact, all cops are bastards. Their primary function in society is to defend the property rights of the capitalist class against the working class, thus preserving inequality.
- unimpressive 13y agoIgnoring for a moment the validity of this statement, can I ask why you visit a site that is primarily about business news/Silicon Valley Hacker errata if you're not a fan of the 'bourgeois'?
- jlgreco 13y agoMaybe he sees dampening the echo chamber as a sort of community service.
- soult 13y agoHacker News features many programming and technology related articles as well.
- duairc 13y agoBecause it's Hacker News, not Bourgeois News. And I know this site is tied to an ideology that reimagines the "DIY" (for want of a better term) aspect of the hacker tradition as a kind of pro-capitalist (or at least "DIY capitalist") thing, but I don't think most hackers are capitalists, even on this site. For me, anti-authoritarianism has always been a central tenet of the hacker tradition, which for me goes hand-in-hand with anti-capitalism. I acknowledge that most hackers are not explicitly/consciously anti-capitalist.
- clarkmoody 13y ago
- jacob019 13y agoLove the evil faces in the infographic with the twisted eyes. Notice how the sysadmin is not evil.
- MarciaPetros 13y agoThat's hilarious. I guess the EFF knows that most of it's supporters are sysadmins, ironically the one class of people with the most direct and unfettered ability to violate privacy--and a track record of having done so.
- josscrowcroft 13y agoWhere does running traffic via a VPN [0] come into this? Does that count as HTTPS, or are they referring to 'SITE.COM' having an HTTPS certificate? Is it possible to use Tor and a VPN together? [0] e.g. I use https://ipredator.se https://ipredator.se
- noerps 13y agoIf you use a VPN to connect to Tor, you can hide the fact (from your local isp) that you use tor. If you use Tor to connect to your VPN-provider, you can hide your location from your VPN-provider. Since your VPN-provider may have payment information from your creditcard it makes no sense to use a VPN and Tor together, its just a cascade.
- dgallagher 13y agoWhat would be the highest level of anonymity one could achieve on the modern internet? How could you accomplish it?
- noerps 13y agoThere is no level on anonymity, either you are, or you are not. Addendum for achievement: Connect to Tor from a public accessible network/wifi that is free from surveillance using a pristine installation and never use that network-device again. Addendum 2: If you use the network device twice, you may achieve only pseudonymity.
- nbouscal 13y agoValid point that anonymity is a binary property, but, if you wanted to talk about levels you could perhaps measure the level of difficulty of finding your identity, or the likelihood of accurately doing so.
- noerps 13y agoThe tradeoff is the same as keysize in crypto. It is time. If you choose to communicate a second time from the same endpoint with the same equipment you may achieve only pseudonymity. Since Tor doesn't limit the encapsulated protocols, it depends on the implementation and awareness of the user and you can't put a number or percentage on that. Imho the Tor-role has changed, it provides access against censorship, DPI, region-partioning and hidden services. Simply try to access youtube or any other global service via different tor exits, that may be intresting, not from an anonymity point of view.
- rane 13y agoOut of curiosity, why does the equipment matter?
- noerps 13y agoThere may be information leaking (as in fingerprinting) from your device (that you are not aware of) that would allow very easy correlation, like in a mac address or existing session cookie, similar address in a public open network or whatever you can imagine to compromise your anonymity, that gives an adversary any advance to successfully correlate your current session with one of your previous sessions. At this event your anonymity becomes a pseudonym. The next step would be to try to reproduce or predict behavior and setup a trigger for that information. If the loss (compromise) of anonymity or pseudonymity may lead to imprisonment, torture, assassination or death this maybe an issue to consider. If you try to obfuscate your access to porn, it is a completly different story.
- frisco 13y agoI think this is misleading. I now believe that the NSA has the private keys for substantially all SSL certs in use, and I expect that a non-trivial percentage of Tor nodes are run by the government. SSL certs require cooperation of a trusted registrar even for the biggest companies -- Google's is signed by Equifax, for example. Given what we've seen in the last few days, requesting keys from the root CAs is a no-brainer. For Tor, a bunch of attacks are possible by owning only a small percentage of all nodes. Recently, Tor was issuing a "call for relays" due to a dwindling number of participants that was endangering the network. Considering that Tor came out of Navy research, if you don't think they have a statistically interesting number of nodes, you're crazy. If they don't, it's only because they don't think that Tor is an interesting source right now. TL;DR: Security depends on your threat model, and while I think that Tor and HTTPS provide strong protection from run-of-the-mill attackers, I don't think that either provides meaningful security if you're worried about the NSA.
- noerps 13y agoTor does not provide security, it can provide obfuscation that may lead to anonymity or pseudonymity, not more. I concur with your statement that SSL isn't really secure end-to-end communication when 3rd party certificates are involved.
- deleted 13y ago[deleted]
- deleted 13y ago[deleted]
- noerps 13y agoAll Convergence does is delegate to another 3rd party, which may lead to the conclusion there may be an attack in progress, that you may not have noticed before. You still have to trust another stranger that may offer you some perspective on issued and signed certificates (or not). Convegernce i.e. refused to work with CDNs which may have different certificates for the same domain for example, which may be completly valid. The key of public key crypto (like in RSA) was to make key management easier and independent of a 3rd party, to avoid further bloat, overhead and complexity. This is the same for Certificate Transparency/Pinning mentioned earlier, given the details it looks very strong on paper, but the implementation will suck in r/l terms.