5 ms·

From the Q&A at the end ( http://www.youtube.com/watch?v=9XaYdCdwiWU&feature=youtu.be&t=1h1m58s http://www.youtube.com/watch?v=9XaYdCdwiWU&feature=youtu.be&...

by narsil 13y ago

From the Q&A at the end ( http://www.youtube.com/watch?v=9XaYdCdwiWU&feature=youtu.be&t=1h1m58s http://www.youtube.com/watch?v=9XaYdCdwiWU&feature=youtu.be&... ), Grug has this to say on TOR: "Against [Law Enforcement Officials], it's fine. Against a nation-state, the TOR network has insufficient resources and has sufficient bad actors that it is not actually secure. So if you're going to hack the shit out of the NSA and do really really bad planning and do not actually evalute the targets you are after, you will go to jail." He also expands on how to unmask a user by controlling both the exit and entry nodes: "So if you can purchase 300 VPS accounts at $5 each then you can set up 1% of the TOR network and statistically, over a month, you will be able to uncover a large number of users. [...] You are better of selecting your targets so they will not be state actors."

lambda 13y ago
But what happens when the LEOs are getting their data from the NSA? http://www.washingtonpost.com/blogs/the-switch/wp/2013/08/05/the-nsa-is-giving-your-phone-records-to-the-dea-and-the-dea-is-covering-it-up/ http://www.washingtonpost.com/blogs/the-switch/wp/2013/08/05... TOR is not perfect. The NSA, or any other sufficiently large global passive adversary, can defeat it, with global timing correlation. However, a connection over TOR probably requires more resources to track down than a direct connection. On the downside, a connection over TOR may go through a foreign country, which removes any domestic safeguards the NSA does have in place, subjecting it to indiscriminate spying. TOR is also insufficient on its own. You need to use strong crypto, and be careful of your privacy in other ways (cookies, caches, etc) on top of it.
- deleted 13y ago
  [deleted]
- cdash 13y ago
  The NSA does not have domestic safeguards, and the act of actually using TOR makes you a primary target by being suspicious.
rorrr2 13y ago
> So if you can purchase 300 VPS accounts at $5 each then you can set up 1% of the TOR network and statistically, over a month I'd love to see this kind of evidence end up in court. It would be hilarious to see them try and prove anything beyond reasonable doubt with millions of random logs.
- pfortuny 13y ago
  You do not need a court if your adversary is in Guantanamo.
nwh 13y ago
> "So if you can purchase 300 VPS accounts at $5 each then you can set up 1% of the TOR network and statistically, over a month, you will be able to uncover a large number of users. [...] You are better of selecting your targets so they will not be state actors." Bear in mind that Tor avoids making circuits in the same country, specifically to avoid things like this. You'd need at least two large farms.

by narsil 13y ago

lambda 13y ago

But what happens when the LEOs are getting their data from the NSA? http://www.washingtonpost.com/blogs/the-switch/wp/2013/08/05/the-nsa-is-giving-your-phone-records-to-the-dea-and-the-dea-is-covering-it-up/ http://www.washingtonpost.com/blogs/the-switch/wp/2013/08/05... TOR is not perfect. The NSA, or any other sufficiently large global passive adversary, can defeat it, with global timing correlation. However, a connection over TOR probably requires more resources to track down than a direct connection. On the downside, a connection over TOR may go through a foreign country, which removes any domestic safeguards the NSA does have in place, subjecting it to indiscriminate spying. TOR is also insufficient on its own. You need to use strong crypto, and be careful of your privacy in other ways (cookies, caches, etc) on top of it.

deleted 13y ago
[deleted]
cdash 13y ago
The NSA does not have domestic safeguards, and the act of actually using TOR makes you a primary target by being suspicious.

rorrr2 13y ago

> So if you can purchase 300 VPS accounts at $5 each then you can set up 1% of the TOR network and statistically, over a month I'd love to see this kind of evidence end up in court. It would be hilarious to see them try and prove anything beyond reasonable doubt with millions of random logs.

pfortuny 13y ago
You do not need a court if your adversary is in Guantanamo.

nwh 13y ago

> "So if you can purchase 300 VPS accounts at $5 each then you can set up 1% of the TOR network and statistically, over a month, you will be able to uncover a large number of users. [...] You are better of selecting your targets so they will not be state actors." Bear in mind that Tor avoids making circuits in the same country, specifically to avoid things like this. You'd need at least two large farms.