3 ms·

(I know nothing about this.) I interpreted tjoff's argument to be that the average Tor exit node is more malicious than any of the other average ways for proxi

(I know nothing about this.) I interpreted tjoff's argument to be that the average Tor exit node is more malicious than any of the other average ways for proxies to be dangerous. In other words, yes coffee shops could be dangerous, but they are most often safe, whereas if you're getting routed through a bunch of exit nodes over a period of time (is that even how it works?) you stand a much greater chance of running into malice. Would love to hear someone address that claim as I understood it.

bad_user 13y ago
If you care about your security (or as a service provider, the security of your users) and if you can't establish a chain of trust, then you can't call a solution secure. If the connection is encrypted, then you have to trust the certificate authority, the browser and the service provider. If the connection is unencrypted, then in addition to the above, you have to trust that nobody is listening on that connection and that's a really tough pill to swallow, even if nothing bad happened to you in the past (just like with car accidents, it needs to happen only once to mess up your life). If you don't think bad things happen all the time in the wild, see this story of Ashton Kutcher's Twitter account being hacked while attending TED: http://www.huffingtonpost.com/2011/03/02/ashton-kutcher-twitter-hacked_n_830619.html http://www.huffingtonpost.com/2011/03/02/ashton-kutcher-twit...
- jerguismi 13y ago
  There is different _probability_ of having malicious network sniffer with different service providers. I would bet my left testicle that the probability with tor is higher than average ISP. If you want to speak about security _theory_, then please state so. Usually in these kind of discussions people speak about practical security, which means trusting different people different amounts, and trading theoretical security with trust.

bad_user 13y ago

If you care about your security (or as a service provider, the security of your users) and if you can't establish a chain of trust, then you can't call a solution secure. If the connection is encrypted, then you have to trust the certificate authority, the browser and the service provider. If the connection is unencrypted, then in addition to the above, you have to trust that nobody is listening on that connection and that's a really tough pill to swallow, even if nothing bad happened to you in the past (just like with car accidents, it needs to happen only once to mess up your life). If you don't think bad things happen all the time in the wild, see this story of Ashton Kutcher's Twitter account being hacked while attending TED: http://www.huffingtonpost.com/2011/03/02/ashton-kutcher-twitter-hacked_n_830619.html http://www.huffingtonpost.com/2011/03/02/ashton-kutcher-twit...

jerguismi 13y ago
There is different _probability_ of having malicious network sniffer with different service providers. I would bet my left testicle that the probability with tor is higher than average ISP. If you want to speak about security _theory_, then please state so. Usually in these kind of discussions people speak about practical security, which means trusting different people different amounts, and trading theoretical security with trust.