4 ms·

I wonder why the common assumption is that the NSA doesn't run Tor nodes. Why wouldn't they? The NSA's (authorized) budget is $10.8 billion[1]. For $5 you ca

I wonder why the common assumption is that the NSA doesn't run Tor nodes. Why wouldn't they? The NSA's (authorized) budget is $10.8 billion[1]. For $5 you can get a server with 20GB SSD and 1TB of transfer per month. It doesn't seem like it'd take very much money to be able to ensure that at least, say, 1% of Tor users' traffic passes through your entry and exit nodes, de-anonymizing them. So over a long enough time scale, that would de-anonymize quite a lot of interesting traffic, and interesting users. One solution is VPN over Tor. But the NSA claims they've cracked 30 VPN providers, and are focused on cracking the rest as soon as possible. That's a lot of compromised VPN providers. You could set up your own server and use that as a VPN, but if you pay with Bitcoin, then it's trivial to analyze the blockchain to tie your identity to the server, unless you use a tumbling service like bitcoinfog. But even if you manage to get a server set up anonymously, then what? You still would want to use VPN over Tor, since that's your best bet for privacy. But as soon as you get de-anonymized on Tor, that correlates your home IP address with your anonymous server, thus de-anonymizing your server too. I can't think of any options to be truly safe from a global passive adversary that doesn't also cost >1MM to set up initially. Any ideas? [1] http://www.washingtonpost.com/wp-srv/special/national/black-budget/ http://www.washingtonpost.com/wp-srv/special/national/black-...

alexkus 13y ago
> unless you use a tumbling service like bitcoinfog Which could be run by the NSA... It's turtles all of the way down.
elorant 13y ago
Connect to the Internet only through public WiFi hotspots. Run a sandboxed browser with all cookies deleted in each session or no cookies at all.
- tmp3123 13y ago
  still can't avoid security cams + face recognition...
  - reustle 13y ago
    Every time elorant's comment subject crosses my mind, this comes up. How would we go about getting online anonymously using open wifi without worrying about cameras being planted everywhere? Leave a raspberrypi hidden near an open wifi spot and connect into it and route traffic through it? That would still require us to connect to their network from another one...
    - chakalakasp 13y ago
      Probably the best opsec for this would be to access the Wi-Fi from a location that is somewhat distant from the hotspot using a cantenna. Use a laptop that you purchased with cash at least a few months ago at a non-local thrift store (most thift stores won't archive video for more than a few weeks at most, if they even have cameras) and run off of a live CD like tails. Wear gloves while using the laptop and destroy and dispose of it immediately after use, preferably in a place where an old discarded laptop would not be suspicious.
      - jlgreco 13y ago
        Doing all of this will make you stand out more. Better to blend in with the general public a bit more. Buy a cheap (preferably stolen) smartphone on craigslist and throw away the SIM card. Preferably this should be a phone with a removable battery. Walk to a bus stop that is near to a starbucks and jump onto their wifi with the phone, pretending to wait for the bus. After a while, walk away. Since you are outside during the entire process you can do this during winter and bundle up, concealing your identity while not looking suspicious. Using a laptop at a busstop would draw attention. Using a cantenna anywhere not private would also draw attention. Getting a private place to use the cantenna is prone to problems (you could aim it out your apartment window, but that ties you to a location. You could park a van nearby, but that is suspicious). You can easily dispose of the smartphone later; just microwave it then go for a nature walk and throw it in the river.
  - alan_cx 13y ago
    Wear an Obama mask?
jlgreco 13y ago
> I wonder why the common assumption is that the NSA doesn't run Tor nodes. Why wouldn't they? Is that really a common assumption? I would expect that most people assume otherwise. Surely anybody informed knows that at least many, if not most, exit nodes are "hostile".
rubikscube 13y ago
Do you have a source for the claim that the NSA has cracked thirty VPN providers? The only source I've seen so far that makes any similar claim was the cryptome.org document for prosecutors which was a hoax.
- alan_cx 13y ago
  Stop this "do you have evidence" lark. We are not talking scientific review or non US court here. All people are doing is applying the same logic and standards governments and spy agencies do. Is there any evidence that the WHOLE of the US and rest of the planet's public are traitors and terrorists? No. But they could be, right? Best not take a chance, right? "We" can do it, it is possible, so "they might be doing it. And so on. So, the NSA can or could compromise tor nodes, we know it is possible, so why take the risk? Especially if you are, say, Snowden or a freedom advocate.
  - sillysaurus2 13y ago
    They were just curious... It's probably good to insist on sources. I should've provided one originally anyway: http://www.nytimes.com/2013/09/06/us/nsa-foils-much-internet-encryption.html?pagewanted=4&_r=0 http://www.nytimes.com/2013/09/06/us/nsa-foils-much-internet...
- eliasmacpherson 13y ago
  http://www.nytimes.com/2013/09/06/us/nsa-foils-much-internet-encryption.html?pagewanted=4&_r=0 http://www.nytimes.com/2013/09/06/us/nsa-foils-much-internet... ctrl-f VPN. What is the cryptome document for prosectors that you refer to?
  - eliasmacpherson 13y ago
    I now assume you mean this: http://cryptome.org/2013/09/computer-forensics-2013.pdf http://cryptome.org/2013/09/computer-forensics-2013.pdf http://cryptome.org/2013/09/computer-forensics-2013-hoax.pdf http://cryptome.org/2013/09/computer-forensics-2013-hoax.pdf That's a pretty obvious hoax, detective "Stu Pitt" and "Laughlin Foo". It's good that it was quickly labelled as such.
rorrr2 13y ago
You can buy bitcoins for cash. Pay for a VPN with that.
- frank_boyd 13y ago
  Or pay VPN with cash. (Mullvad.net does it.)
alvarosm 13y ago
Well, many of us suspect a big percentage of Tor nodes are run by the NSA and it has been like that for many years. This isn't news...
confluence 13y ago
Run your own botnet. Illegal, anonymous, cheap and extremely effective. There's a reason both the NSA and the Chinese launch attacks via botnets. They hide the real actors behind a veil of zombies.

alexkus 13y ago

> unless you use a tumbling service like bitcoinfog Which could be run by the NSA... It's turtles all of the way down.

elorant 13y ago

Connect to the Internet only through public WiFi hotspots. Run a sandboxed browser with all cookies deleted in each session or no cookies at all.

tmp3123 13y ago
still can't avoid security cams + face recognition...
- reustle 13y ago
  Every time elorant's comment subject crosses my mind, this comes up. How would we go about getting online anonymously using open wifi without worrying about cameras being planted everywhere? Leave a raspberrypi hidden near an open wifi spot and connect into it and route traffic through it? That would still require us to connect to their network from another one...
  - chakalakasp 13y ago
    Probably the best opsec for this would be to access the Wi-Fi from a location that is somewhat distant from the hotspot using a cantenna. Use a laptop that you purchased with cash at least a few months ago at a non-local thrift store (most thift stores won't archive video for more than a few weeks at most, if they even have cameras) and run off of a live CD like tails. Wear gloves while using the laptop and destroy and dispose of it immediately after use, preferably in a place where an old discarded laptop would not be suspicious.
    - jlgreco 13y ago
      Doing all of this will make you stand out more. Better to blend in with the general public a bit more. Buy a cheap (preferably stolen) smartphone on craigslist and throw away the SIM card. Preferably this should be a phone with a removable battery. Walk to a bus stop that is near to a starbucks and jump onto their wifi with the phone, pretending to wait for the bus. After a while, walk away. Since you are outside during the entire process you can do this during winter and bundle up, concealing your identity while not looking suspicious. Using a laptop at a busstop would draw attention. Using a cantenna anywhere not private would also draw attention. Getting a private place to use the cantenna is prone to problems (you could aim it out your apartment window, but that ties you to a location. You could park a van nearby, but that is suspicious). You can easily dispose of the smartphone later; just microwave it then go for a nature walk and throw it in the river.
- alan_cx 13y ago
  Wear an Obama mask?

jlgreco 13y ago

> I wonder why the common assumption is that the NSA doesn't run Tor nodes. Why wouldn't they? Is that really a common assumption? I would expect that most people assume otherwise. Surely anybody informed knows that at least many, if not most, exit nodes are "hostile".

rubikscube 13y ago

Do you have a source for the claim that the NSA has cracked thirty VPN providers? The only source I've seen so far that makes any similar claim was the cryptome.org document for prosecutors which was a hoax.

alan_cx 13y ago
Stop this "do you have evidence" lark. We are not talking scientific review or non US court here. All people are doing is applying the same logic and standards governments and spy agencies do. Is there any evidence that the WHOLE of the US and rest of the planet's public are traitors and terrorists? No. But they could be, right? Best not take a chance, right? "We" can do it, it is possible, so "they might be doing it. And so on. So, the NSA can or could compromise tor nodes, we know it is possible, so why take the risk? Especially if you are, say, Snowden or a freedom advocate.
- sillysaurus2 13y ago
  They were just curious... It's probably good to insist on sources. I should've provided one originally anyway: http://www.nytimes.com/2013/09/06/us/nsa-foils-much-internet-encryption.html?pagewanted=4&_r=0 http://www.nytimes.com/2013/09/06/us/nsa-foils-much-internet...
eliasmacpherson 13y ago
http://www.nytimes.com/2013/09/06/us/nsa-foils-much-internet-encryption.html?pagewanted=4&_r=0 http://www.nytimes.com/2013/09/06/us/nsa-foils-much-internet... ctrl-f VPN. What is the cryptome document for prosectors that you refer to?
- eliasmacpherson 13y ago
  I now assume you mean this: http://cryptome.org/2013/09/computer-forensics-2013.pdf http://cryptome.org/2013/09/computer-forensics-2013.pdf http://cryptome.org/2013/09/computer-forensics-2013-hoax.pdf http://cryptome.org/2013/09/computer-forensics-2013-hoax.pdf That's a pretty obvious hoax, detective "Stu Pitt" and "Laughlin Foo". It's good that it was quickly labelled as such.

rorrr2 13y ago

You can buy bitcoins for cash. Pay for a VPN with that.

frank_boyd 13y ago
Or pay VPN with cash. (Mullvad.net does it.)

alvarosm 13y ago

Well, many of us suspect a big percentage of Tor nodes are run by the NSA and it has been like that for many years. This isn't news...

confluence 13y ago

Run your own botnet. Illegal, anonymous, cheap and extremely effective. There's a reason both the NSA and the Chinese launch attacks via botnets. They hide the real actors behind a veil of zombies.