10 ms·

This is fairly obvious. From the NSA's perspective, people that act like people who have something to hide are more likely to be hiding something. I'd be surpri

by burke 13y ago

This is fairly obvious. From the NSA's perspective, people that act like people who have something to hide are more likely to be hiding something. I'd be surprised if they didn't take it into account.

bigiain 13y ago
And this is why we should (and we should encourage everybody we can to) regularly do the most mundane of browsing using TOR. I'm making a personal effort to use TorBrowser whenever I have some trivial need to use a government website. I suspect I'd stop short of applying for a visa via TOR, but I'll happily look up my local state or federal politicians and their websites, or renew my car registration, or any of the other day-to-day things - in much the same way as I always choose to use BitTorrent for fully legal purposes when available - sure, we all know that 99% of Torrent traffic is copyright infringement, but at least _some_ of it is me grabbing the latest Ubuntu/Raspbian/GameOfThones (no, wait, not that last one...)
- hobs 13y ago
  Do you just want them to store more? Because using tor to renew your car registrations seems like an obvious way to connect some dots. If that's all, then I salute you!
  - bigiain 13y ago
    Yeah - both store more, and have an archive of obviously non-intelligence relevant encrypted/TOR traffic. I like to think that one day someone will have burn gigawatts of cpu/gpu power subverting the TOR network and breaking TLS/SSL, only to discover I'd been looking up what day the recycling bins are next collected in my local area. More to the point - I want the expectation of privacy and the deployment of tools to maintain privacy in the face of technological and legal "advances" in surveillance to seem closer to "technologically informed libertarian" rather than "paranoid wingnut" or "jetliner-hijacking 3rd-world-sympathiser".
  - dfc 13y ago
    You do realize that: "A global passive adversary is the most commonly assumed threat when analyzing theoretical anonymity designs. But like all practical low-latency systems, Tor does not protect against such a strong adversary. Instead, we assume an adversary who can observe some fraction of network traffic; who can generate, modify, delete, or delay traffic; who can operate onion routers of his own; and who can compromise some fraction of the onion routers."[1] If your attacker is not "a global passive adversary"(GPA) what dots are they going to connect if you renew your car registration? If your attacker is a GPA they are already connecting all the dots. [1] https://svn.torproject.org/svn/projects/design-paper/tor-design.html https://svn.torproject.org/svn/projects/design-paper/tor-des...
    - LoganCale 13y ago
      I think the point was that it defeats the common purpose of using anonymity software if you are submitting identifying information (your car registration information) through it. It doesn't necessarily have long term consequences—you can generate a new identity—but it nullifies that session's anonymity. However, that doesn't mean there isn't a good reason to use it anyway to make a statement and promote legitimate usage of Tor.
      - dfc 13y ago
        So location anonymity is not a common purpose of anonymity software?
    - bigiain 13y ago
      The "renew my car registration" example was intended to imply that'd I've chosen to "give them some connected dots" - dots which are operationally useless (or worse - preferably adding noise to make the job harder and evidence that the job is sometimes wasted effort). I'm assuming "they" have access to government servers and networks, and that they'll easily be able to connect me - as a real and (at least mostly) law abiding citizen - to a clean-slate browser using SSL over TOR - logging in to a government web server with real world credentials and doing some mundane and law abiding everyday task.
- dfc 13y ago
  And this is why we should (and we should encourage everybody we can to) regularly do the most mundane of browsing using TOR. And that's why I encourage everybody I can to run a tor node https://www.torproject.org/docs/tor-doc-relay.html.en https://www.torproject.org/docs/tor-doc-relay.html.en
  - tlrobinson 13y ago
    Also, if you don't want to run a node on your home network/machine http://cloud.torproject.org/ http://cloud.torproject.org/ makes it ridiculously easy to set up one on EC2 (for as little as ~$3/month)
    - dfc 13y ago
      Q: Should I run an exit relay from my home? A: No. If law enforcement becomes interested in traffic from your exit relay, it's possible that officers will seize your computer. For that reason, it's best not to run your exit relay in your home or using your home Internet connection. Instead, consider running your exit relay in a commercial facility that is supportive of Tor. Have a separate IP address for your exit relay, and don't route your own traffic through it. Of course, you should avoid keeping any sensitive or personal information on the computer hosting your exit relay, and you never should use that machine for any illegal purpose. https://www.torproject.org/eff/tor-legal-faq https://www.torproject.org/eff/tor-legal-faq
      - gizmo686 13y ago
        Its worth pointing out that that is talking specifically about exit nodes. There is no (legal) problem with running relay nodes out of your own house.
        dfc 13y ago
        What part of "Should I run an exit relay from my home?" was unclear? I am not trying to discourage people from supporting the tor network, quite the opposite actually. I want to make sure they are fully informed and support tor in a manner that is sustainable.
- lelandbatey 13y ago
  This reminds me of something that I thought of late one night that I feel needs to happen: tor, or something like it, distributed as the payload of a virus. Hopefully a very serious one. Then, even if things get patched, it's mere existence and prevelence among the layman gives you a tremendous amount of plausible deniability while also increasing the strength of the network. However, it's quite morally wrong to do so. I guess it's just one of those late-night thoughts.
  - tokenizerrr 13y ago
    Definitely would be a "good" thing for the tor network if a virus started infecting machines as relays.
- slacka 13y ago
  If you are a big Tor user, I hope you consider donating bandwidth to help offset your usage. Recently they made an announcement that they were short on relay nodes. Here's some info on how to help: https://blog.torproject.org/blog/support-tor-network-donate-exit-node-providers https://blog.torproject.org/blog/support-tor-network-donate-...
FooBarWidget 13y ago
I have plenty to hide. Like... my server passwords!
tsotha 13y ago
Yes. I can't imagine someone smart enough to encrypt their traffic wouldn't realize it makes them look dodgy to people who get paid to be paranoid.
- wiml 13y ago
  I'm pretty sure any professional paranoid would have been thinking I was dodgy for decades now, for things like using the internet (back when that was suspicious) or encrypting my logins with ssh (back when that was suspicious) or my websites with SSL (back when that was suspicious) or running weirdo commie unix-derivatives on my machines instead of honest commercial OSes (back when that was... well, unusual). This putative paranoid gaze has not affected my actual life in the least. I'm sure the paranoids are well aware that most opportunistic encryptors are, like me, random geeks with a slight antiauthoritarian streak and nothing whatsoever of interest to national security. I'm happy to help move the Overton window in the direction of greater privacy and ensure that the people who do actually need anonymity and security can get it.
aluhut 13y ago
Wouldn't that give them even more reason for surveillence and aquireing of additional ressources?

by burke 13y ago

bigiain 13y ago

And this is why we should (and we should encourage everybody we can to) regularly do the most mundane of browsing using TOR. I'm making a personal effort to use TorBrowser whenever I have some trivial need to use a government website. I suspect I'd stop short of applying for a visa via TOR, but I'll happily look up my local state or federal politicians and their websites, or renew my car registration, or any of the other day-to-day things - in much the same way as I always choose to use BitTorrent for fully legal purposes when available - sure, we all know that 99% of Torrent traffic is copyright infringement, but at least _some_ of it is me grabbing the latest Ubuntu/Raspbian/GameOfThones (no, wait, not that last one...)

hobs 13y ago
Do you just want them to store more? Because using tor to renew your car registrations seems like an obvious way to connect some dots. If that's all, then I salute you!
- bigiain 13y ago
  Yeah - both store more, and have an archive of obviously non-intelligence relevant encrypted/TOR traffic. I like to think that one day someone will have burn gigawatts of cpu/gpu power subverting the TOR network and breaking TLS/SSL, only to discover I'd been looking up what day the recycling bins are next collected in my local area. More to the point - I want the expectation of privacy and the deployment of tools to maintain privacy in the face of technological and legal "advances" in surveillance to seem closer to "technologically informed libertarian" rather than "paranoid wingnut" or "jetliner-hijacking 3rd-world-sympathiser".
- dfc 13y ago
  You do realize that: "A global passive adversary is the most commonly assumed threat when analyzing theoretical anonymity designs. But like all practical low-latency systems, Tor does not protect against such a strong adversary. Instead, we assume an adversary who can observe some fraction of network traffic; who can generate, modify, delete, or delay traffic; who can operate onion routers of his own; and who can compromise some fraction of the onion routers."[1] If your attacker is not "a global passive adversary"(GPA) what dots are they going to connect if you renew your car registration? If your attacker is a GPA they are already connecting all the dots. [1] https://svn.torproject.org/svn/projects/design-paper/tor-design.html https://svn.torproject.org/svn/projects/design-paper/tor-des...
  - LoganCale 13y ago
    I think the point was that it defeats the common purpose of using anonymity software if you are submitting identifying information (your car registration information) through it. It doesn't necessarily have long term consequences—you can generate a new identity—but it nullifies that session's anonymity. However, that doesn't mean there isn't a good reason to use it anyway to make a statement and promote legitimate usage of Tor.
    - dfc 13y ago
      So location anonymity is not a common purpose of anonymity software?
  - bigiain 13y ago
    The "renew my car registration" example was intended to imply that'd I've chosen to "give them some connected dots" - dots which are operationally useless (or worse - preferably adding noise to make the job harder and evidence that the job is sometimes wasted effort). I'm assuming "they" have access to government servers and networks, and that they'll easily be able to connect me - as a real and (at least mostly) law abiding citizen - to a clean-slate browser using SSL over TOR - logging in to a government web server with real world credentials and doing some mundane and law abiding everyday task.
dfc 13y ago
And this is why we should (and we should encourage everybody we can to) regularly do the most mundane of browsing using TOR. And that's why I encourage everybody I can to run a tor node https://www.torproject.org/docs/tor-doc-relay.html.en https://www.torproject.org/docs/tor-doc-relay.html.en
- tlrobinson 13y ago
  Also, if you don't want to run a node on your home network/machine http://cloud.torproject.org/ http://cloud.torproject.org/ makes it ridiculously easy to set up one on EC2 (for as little as ~$3/month)
  - dfc 13y ago
    Q: Should I run an exit relay from my home? A: No. If law enforcement becomes interested in traffic from your exit relay, it's possible that officers will seize your computer. For that reason, it's best not to run your exit relay in your home or using your home Internet connection. Instead, consider running your exit relay in a commercial facility that is supportive of Tor. Have a separate IP address for your exit relay, and don't route your own traffic through it. Of course, you should avoid keeping any sensitive or personal information on the computer hosting your exit relay, and you never should use that machine for any illegal purpose. https://www.torproject.org/eff/tor-legal-faq https://www.torproject.org/eff/tor-legal-faq
    - gizmo686 13y ago
      Its worth pointing out that that is talking specifically about exit nodes. There is no (legal) problem with running relay nodes out of your own house.
      - dfc 13y ago
        What part of "Should I run an exit relay from my home?" was unclear? I am not trying to discourage people from supporting the tor network, quite the opposite actually. I want to make sure they are fully informed and support tor in a manner that is sustainable.
lelandbatey 13y ago
This reminds me of something that I thought of late one night that I feel needs to happen: tor, or something like it, distributed as the payload of a virus. Hopefully a very serious one. Then, even if things get patched, it's mere existence and prevelence among the layman gives you a tremendous amount of plausible deniability while also increasing the strength of the network. However, it's quite morally wrong to do so. I guess it's just one of those late-night thoughts.
- tokenizerrr 13y ago
  Definitely would be a "good" thing for the tor network if a virus started infecting machines as relays.
slacka 13y ago
If you are a big Tor user, I hope you consider donating bandwidth to help offset your usage. Recently they made an announcement that they were short on relay nodes. Here's some info on how to help: https://blog.torproject.org/blog/support-tor-network-donate-exit-node-providers https://blog.torproject.org/blog/support-tor-network-donate-...

FooBarWidget 13y ago

I have plenty to hide. Like... my server passwords!

tsotha 13y ago

Yes. I can't imagine someone smart enough to encrypt their traffic wouldn't realize it makes them look dodgy to people who get paid to be paranoid.

wiml 13y ago
I'm pretty sure any professional paranoid would have been thinking I was dodgy for decades now, for things like using the internet (back when that was suspicious) or encrypting my logins with ssh (back when that was suspicious) or my websites with SSL (back when that was suspicious) or running weirdo commie unix-derivatives on my machines instead of honest commercial OSes (back when that was... well, unusual). This putative paranoid gaze has not affected my actual life in the least. I'm sure the paranoids are well aware that most opportunistic encryptors are, like me, random geeks with a slight antiauthoritarian streak and nothing whatsoever of interest to national security. I'm happy to help move the Overton window in the direction of greater privacy and ensure that the people who do actually need anonymity and security can get it.

aluhut 13y ago

Wouldn't that give them even more reason for surveillence and aquireing of additional ressources?