3 ms·

It's not more dangerous than connecting through a regular proxy, or through a Wifi network at some coffee shop or hotel. And how trustworthy is your ISP exactly

It's not more dangerous than connecting through a regular proxy, or through a Wifi network at some coffee shop or hotel. And how trustworthy is your ISP exactly? For example, while I visited the US it happened at 2 motels I stayed at for their network to insert ads in the web pages I was visiting. So they where not only snooping my traffic, but going further into altering it. Also, go to any conference or gathering of people, create an open Wifi hotspot (like, with your phone) and then enjoy all the cookies and passwords flowing through, from all the clueless people that connect to it. Truth of the matter is, websites should be secure by default. Those that aren't represent a huge security risk. Fortunately many of the big ones are (e.g. GMail, Twitter, Facebook, etc...) Also see: [1] http://en.wikipedia.org/wiki/Firesheep http://en.wikipedia.org/wiki/Firesheep [2] http://faceniff.ponury.net/ http://faceniff.ponury.net/

ianstormtaylor 13y ago
(I know nothing about this.) I interpreted tjoff's argument to be that the average Tor exit node is more malicious than any of the other average ways for proxies to be dangerous. In other words, yes coffee shops could be dangerous, but they are most often safe, whereas if you're getting routed through a bunch of exit nodes over a period of time (is that even how it works?) you stand a much greater chance of running into malice. Would love to hear someone address that claim as I understood it.
- bad_user 13y ago
  If you care about your security (or as a service provider, the security of your users) and if you can't establish a chain of trust, then you can't call a solution secure. If the connection is encrypted, then you have to trust the certificate authority, the browser and the service provider. If the connection is unencrypted, then in addition to the above, you have to trust that nobody is listening on that connection and that's a really tough pill to swallow, even if nothing bad happened to you in the past (just like with car accidents, it needs to happen only once to mess up your life). If you don't think bad things happen all the time in the wild, see this story of Ashton Kutcher's Twitter account being hacked while attending TED: http://www.huffingtonpost.com/2011/03/02/ashton-kutcher-twitter-hacked_n_830619.html http://www.huffingtonpost.com/2011/03/02/ashton-kutcher-twit...
  - jerguismi 13y ago
    There is different _probability_ of having malicious network sniffer with different service providers. I would bet my left testicle that the probability with tor is higher than average ISP. If you want to speak about security _theory_, then please state so. Usually in these kind of discussions people speak about practical security, which means trusting different people different amounts, and trading theoretical security with trust.
jerguismi 13y ago
"It's not more dangerous than connecting through a regular proxy, or through a Wifi network at some coffee shop or hotel. And how trustworthy is your ISP exactly?" Totally false claim. I would bet my ass that there is higher probability to have your traffic sniffed by tor exit nodes than by regular ISP's. At least for short-term malicious purposes, like email snooping and credit cards. (For more long-term malicious purporses, NSA etc., you can't be really sure.)
- belorn 13y ago
  "I would bet my ass that there is higher probability to have your traffic sniffed by tor exit nodes than by regular ISP's" Totally false claim. The biggest nodes on the tor network is run by established tor enthusiasts, and the largest portion of traffic is routed through them. Social pressure makes those people unlikely to put the node in jeopardy by sniffing exit traffic. However, there is not much that would deter a coffee shop employee against sniffing the wi-fi, or for that matter, making them care to secure the router against would-be-attackers. As such, I would be that there is a higher probability to have your traffic sniffed when visiting the local coffee shop, than by a tor exit nodes.
  - ris 13y ago
    I think you are massively over estimating the power of this "social pressure", especially when up against the obligations of NSLs and the like.

ianstormtaylor 13y ago

(I know nothing about this.) I interpreted tjoff's argument to be that the average Tor exit node is more malicious than any of the other average ways for proxies to be dangerous. In other words, yes coffee shops could be dangerous, but they are most often safe, whereas if you're getting routed through a bunch of exit nodes over a period of time (is that even how it works?) you stand a much greater chance of running into malice. Would love to hear someone address that claim as I understood it.

bad_user 13y ago
If you care about your security (or as a service provider, the security of your users) and if you can't establish a chain of trust, then you can't call a solution secure. If the connection is encrypted, then you have to trust the certificate authority, the browser and the service provider. If the connection is unencrypted, then in addition to the above, you have to trust that nobody is listening on that connection and that's a really tough pill to swallow, even if nothing bad happened to you in the past (just like with car accidents, it needs to happen only once to mess up your life). If you don't think bad things happen all the time in the wild, see this story of Ashton Kutcher's Twitter account being hacked while attending TED: http://www.huffingtonpost.com/2011/03/02/ashton-kutcher-twitter-hacked_n_830619.html http://www.huffingtonpost.com/2011/03/02/ashton-kutcher-twit...
- jerguismi 13y ago
  There is different _probability_ of having malicious network sniffer with different service providers. I would bet my left testicle that the probability with tor is higher than average ISP. If you want to speak about security _theory_, then please state so. Usually in these kind of discussions people speak about practical security, which means trusting different people different amounts, and trading theoretical security with trust.

jerguismi 13y ago

"It's not more dangerous than connecting through a regular proxy, or through a Wifi network at some coffee shop or hotel. And how trustworthy is your ISP exactly?" Totally false claim. I would bet my ass that there is higher probability to have your traffic sniffed by tor exit nodes than by regular ISP's. At least for short-term malicious purposes, like email snooping and credit cards. (For more long-term malicious purporses, NSA etc., you can't be really sure.)

belorn 13y ago
"I would bet my ass that there is higher probability to have your traffic sniffed by tor exit nodes than by regular ISP's" Totally false claim. The biggest nodes on the tor network is run by established tor enthusiasts, and the largest portion of traffic is routed through them. Social pressure makes those people unlikely to put the node in jeopardy by sniffing exit traffic. However, there is not much that would deter a coffee shop employee against sniffing the wi-fi, or for that matter, making them care to secure the router against would-be-attackers. As such, I would be that there is a higher probability to have your traffic sniffed when visiting the local coffee shop, than by a tor exit nodes.
- ris 13y ago
  I think you are massively over estimating the power of this "social pressure", especially when up against the obligations of NSLs and the like.