3 ms·

Open source isn't a guarantee of safety for two reasons: 1) It's highly possible that there are federal government agencies with knowledge of encryption and se

by qq66 13y ago

Open source isn't a guarantee of safety for two reasons: 1) It's highly possible that there are federal government agencies with knowledge of encryption and security beyond the current state of the art in academia. There could be deliberate vulnerabilities that even the most highly regarded researchers/academics in the field could not detect. 2) Even if you trust the source, the source can be compromised elsewhere in the toolchain (the compiler could turn safe code into malicious code). Unless you trust every element of your toolchain, you trust nothing (from a mathematical sense -- of course it's much more complicated, and thus less likely, to compromise Tor through its own source code rather than gcc's source code).

shawnz 13y ago
> It's highly possible that there are federal government agencies with knowledge of encryption and security beyond the current state of the art in academia. There could be deliberate vulnerabilities that even the most highly regarded researchers/academics in the field could not detect. That's true, but Tor uses encryption that is common in many other products. Even if it were a privately owned product, it probably would have been implemented in a very similar way. > Even if you trust the source, the source can be compromised elsewhere in the toolchain (the compiler could turn safe code into malicious code). Unless you trust every element of your toolchain, you trust nothing (from a mathematical sense -- of course it's much more complicated, and thus less likely, to compromise Tor through its own source code rather than gcc's source code). OP is not talking about whether or not perfect security is possible. They are talking about the possibility of Tor specifically being backdoored, since it originated within and is funded by the U.S. government.
- autoexec 13y ago
  I doubt tor is backdoored, but it has it's own security issues. I wouldn't doubt for a second that three letter agencies are running a huge amount of nodes on the tor network and doing everything they can to correlate traffic and associate connections to individuals. At the end of the day, you can't rely on tor alone to keep you safe or anonymous on the internet.
anxiousest 13y ago
I'm not suggesting it's impossible, I'm just saying that it's much more difficult to hide stuff in OSS thus less likely. It's the closed source stuff you ought to be more suspicious of.
Jach 13y ago
> the compiler could turn safe code into malicious code While I agree toolchain compromises are a concern, this particularly famous one of backdooring a compiler has a counter: http://www.dwheeler.com/trusting-trust/ http://www.dwheeler.com/trusting-trust/

by qq66 13y ago

shawnz 13y ago

> It's highly possible that there are federal government agencies with knowledge of encryption and security beyond the current state of the art in academia. There could be deliberate vulnerabilities that even the most highly regarded researchers/academics in the field could not detect. That's true, but Tor uses encryption that is common in many other products. Even if it were a privately owned product, it probably would have been implemented in a very similar way. > Even if you trust the source, the source can be compromised elsewhere in the toolchain (the compiler could turn safe code into malicious code). Unless you trust every element of your toolchain, you trust nothing (from a mathematical sense -- of course it's much more complicated, and thus less likely, to compromise Tor through its own source code rather than gcc's source code). OP is not talking about whether or not perfect security is possible. They are talking about the possibility of Tor specifically being backdoored, since it originated within and is funded by the U.S. government.

autoexec 13y ago
I doubt tor is backdoored, but it has it's own security issues. I wouldn't doubt for a second that three letter agencies are running a huge amount of nodes on the tor network and doing everything they can to correlate traffic and associate connections to individuals. At the end of the day, you can't rely on tor alone to keep you safe or anonymous on the internet.

anxiousest 13y ago

I'm not suggesting it's impossible, I'm just saying that it's much more difficult to hide stuff in OSS thus less likely. It's the closed source stuff you ought to be more suspicious of.

Jach 13y ago

> the compiler could turn safe code into malicious code While I agree toolchain compromises are a concern, this particularly famous one of backdooring a compiler has a counter: http://www.dwheeler.com/trusting-trust/ http://www.dwheeler.com/trusting-trust/