13 ms·

Well, sorry, I read it like you were the one injecting politics about 'government hostility' into it, regardless of Tor or SSL, ssh keys or whatever methods are

by jbooth 13y ago

Well, sorry, I read it like you were the one injecting politics about 'government hostility' into it, regardless of Tor or SSL, ssh keys or whatever methods are involved. You seemed to be attributing motives to the previous poster with comments about "maybe you prefer it that way" which seem to place him on the side of surveilling fascists, and I thought that was unjustified but maybe I misread it. If you're not getting political about it, then neither am I, and sorry. On a technical level.. I don't see how Tor could have performed better here. It's physically impossible for them to mask the fact that this guy connected, through the harvard network, to the tor network. The rest of it is between the police and the guy. If they had gotten proof that it was his specific machine that sent the emails through some weakness in Tor, then I'd lay some blame with Tor. I disagree that I have to root for this kid not to get caught. Tor didn't fall down, and I'm not rooting for Tor to fall down. He could have stonewalled the cops, or he could have taken the most basic precaution on earth of not doing it from his frickin dorm room, Tor or no EDIT: Actually, maybe they'd be able to correlate his mac address if they subpoena'd whatever coffee shop the email came from. That's a much bigger fishing expedition for "any coffee shop that connected to a tor node that day", though. But anyways, my point is that Tor can't be held responsible for things it will physically never be able to mask.

mindslight 13y ago
I'd just gotten done typing why it's impossible to convince most people this stuff matters, and was responding to a comment that seems to be written with the assumption that man-made laws are the ultimate authority. So I'll admit to being a bit presumptuous, but I really do believe it to be a fact that most people will never see the need for technically-granted anonymity, and that these opinions simply aren't relevant when discussing such software. Back to the technical, isn't this the point of Tor "bridges" ? Of course these don't work out of the box - they require finding out the address of one out-of-band and manually configuring it. Wider casual adoption of Tor would have also fixed the problem in this case (if the resulting Tor user list was too long to question everybody). The whole point is that ending up on a shortlist means you are essentially caught. This kid may have gotten off by playing it cool. But translated into the dissident scenario, it's still a loss. Given the proliferation of surveillance cameras, the coffee shop scenario becomes much harder. Assuming after-the-fact facial recognition is standard these days, it would only work if there were enough other Harvard students also on tape. Low latency is the mortal enemy of mix networks.
- anigbrowl 13y ago
  I do appreciate the arguments about why anonymity matters. You might find it interesting to consider the similarities fo debates about services like the penet remailer (http://www.textfiles.com/hacking/INTERNET/na.txt http://www.textfiles.com/hacking/INTERNET/na.txt and http://en.wikipedia.org/wiki/Penet_remailer http://en.wikipedia.org/wiki/Penet_remailer). With time, I've come to the conclusion that the ability to (re*-create such tools is more important than any individual instance of such a tool.
  - mindslight 13y ago
    I've come to the opposite conclusion. Adopted systems in continual use are what is important. I could setup any number of service 'anonymizers' within a day, but if an individual operator can even be short-term trusted, they certainly can't be relied on. Only by getting an overwhelming number of not-heavily-invested node operators can one bootstrap reliable trust. I want to live in a world where the routine use is anonymous, with nyms only connected voluntarily. Of course people have to be smart enough to not post 'my name is XXX' in-band, but they shouldn't have to go to a distant coffee shop. If privacy takes work, that means it's only accessible to the few willing to put in that work, and will be viewed as an aberration by everyone else. It's only by making it easily accessible to everyone that it can become societally accepted.

by jbooth 13y ago

mindslight 13y ago

I'd just gotten done typing why it's impossible to convince most people this stuff matters, and was responding to a comment that seems to be written with the assumption that man-made laws are the ultimate authority. So I'll admit to being a bit presumptuous, but I really do believe it to be a fact that most people will never see the need for technically-granted anonymity, and that these opinions simply aren't relevant when discussing such software. Back to the technical, isn't this the point of Tor "bridges" ? Of course these don't work out of the box - they require finding out the address of one out-of-band and manually configuring it. Wider casual adoption of Tor would have also fixed the problem in this case (if the resulting Tor user list was too long to question everybody). The whole point is that ending up on a shortlist means you are essentially caught. This kid may have gotten off by playing it cool. But translated into the dissident scenario, it's still a loss. Given the proliferation of surveillance cameras, the coffee shop scenario becomes much harder. Assuming after-the-fact facial recognition is standard these days, it would only work if there were enough other Harvard students also on tape. Low latency is the mortal enemy of mix networks.

anigbrowl 13y ago
I do appreciate the arguments about why anonymity matters. You might find it interesting to consider the similarities fo debates about services like the penet remailer (http://www.textfiles.com/hacking/INTERNET/na.txt http://www.textfiles.com/hacking/INTERNET/na.txt and http://en.wikipedia.org/wiki/Penet_remailer http://en.wikipedia.org/wiki/Penet_remailer). With time, I've come to the conclusion that the ability to (re*-create such tools is more important than any individual instance of such a tool.
- mindslight 13y ago
  I've come to the opposite conclusion. Adopted systems in continual use are what is important. I could setup any number of service 'anonymizers' within a day, but if an individual operator can even be short-term trusted, they certainly can't be relied on. Only by getting an overwhelming number of not-heavily-invested node operators can one bootstrap reliable trust. I want to live in a world where the routine use is anonymous, with nyms only connected voluntarily. Of course people have to be smart enough to not post 'my name is XXX' in-band, but they shouldn't have to go to a distant coffee shop. If privacy takes work, that means it's only accessible to the few willing to put in that work, and will be viewed as an aberration by everyone else. It's only by making it easily accessible to everyone that it can become societally accepted.