4 ms·

Sites that allow anonymous postings through tor (e.g. reddit) are the last remaining voice of freedom on the Internet. It is unfortunate that HN is not numbere

Sites that allow anonymous postings through tor (e.g. reddit) are the last remaining voice of freedom on the Internet. It is unfortunate that HN is not numbered among those sites. Edit: I was incorrect about HN. See the comment below. I am happy to learn that I was wrong.

ig1 13y ago
Don't trust Tor to provide anonymity against government adversaries. It's likely not secure given Snowden disclosure of anti-Tor tools.
- ef4 13y ago
  I actually think Snowden's documents support a cautious optimism about Tor. The techniques they detail all amount to an admission that Tor itself is still quite difficult for the NSA to de-anonymize at scale. They resort to exploits against browsers instead, which is far less scalable and far more risky. According to Snowden, the NSA doesn't want to waste valuable vulnerabilities on low-value targets (since this risks discovery and disclosure, making the vulnerability useless in the future). So they can't do mass surveillance of Tor, and can only de-anonymize targeted individuals under optimal conditions.
  - haakon 13y ago
    Also, Snowden has a Tor sticker on his laptop.
deleted 13y ago
[deleted]
throughtor 13y ago
>It is unfortunate that HN is not numbered among those sites. Why do you think that? I'm posting from tor with a fresh throwaway account.
icebraining 13y ago
throughtor: yes, and your post is dead on arrival.
- throughtor 13y ago
  interesting - is it that the account has no karma, that it's using TOR, or a combination?
- notthroughtor 13y ago
  let's see... no tor, no karma
devconsole 13y ago
Hi, I'm posting this through Tor. The reason I'm able to do this is because this account is more than two weeks old. I also created this account through Tor, so HN's operators should have no idea who I am. For example, you have done an experiment below of posting comments through tor using the newly-created account "throughtor": https://news.ycombinator.com/threads?id=throughtor https://news.ycombinator.com/threads?id=throughtor If you turn on "showdead" in your profile, you'll see that account has a bunch of dead comments. Those comments are dead because the "throughtor" account is less than two weeks old, so HN's system automatically kills them since they're posted through tor. Once two weeks elapse, you'll be able to post comments and they won't be struck down. (Two weeks is the time it takes for the "new account" status to wear off.) This is a spam prevention technique, and it's necessary in order to drastically reduce the amount of work moderators have to do to filter spam. So, anyone who wants to post anonymously on HN should open up Tor Browser and create an account right now, and save it for a rainy day sometime in the future. Remember not to use the same password as your regular HN account, because you'll give your identity away if you do. In addition to the fact that there's nothing stopping any server from logging every password across every service, HN also stores passwords as unsalted SHA-1, so two identical passwords on two different HN accounts will be stored as the same hash in the database, making it trivial to detect your real identity. At least, unsalted SHA-1 was the case as of arc3.1, which is now several years old. Kogir probably changed it to something more sane in the meantime. But I highly doubt anyone will be able to break into HN's server running BSD anyway, so the unsalted SHA-1 isn't really a concern. This is just a reminder that every piece of information you provide is a piece of information that can be used to determine your identity. And if you use this information to create more work for HN's operators, then I will ssh into your macbook and scare the crap out of you in the middle of the night by setting your volume to 100% and using text-to-speech. But seriously, don't be lame. It's valuable that we are permitted any anonymity at all.
- ef47d35620c1 13y ago
  Thank you for correcting me. We have all learned from you.
- pg 13y ago
  We switched to bcrypt several years ago.
krapp 13y ago
It's a double edged sword. The primary adversary on a site with anonymous posting isn't a government but the staff of the site itself (as demonstrated by the OP.)

ig1 13y ago

Don't trust Tor to provide anonymity against government adversaries. It's likely not secure given Snowden disclosure of anti-Tor tools.

ef4 13y ago
I actually think Snowden's documents support a cautious optimism about Tor. The techniques they detail all amount to an admission that Tor itself is still quite difficult for the NSA to de-anonymize at scale. They resort to exploits against browsers instead, which is far less scalable and far more risky. According to Snowden, the NSA doesn't want to waste valuable vulnerabilities on low-value targets (since this risks discovery and disclosure, making the vulnerability useless in the future). So they can't do mass surveillance of Tor, and can only de-anonymize targeted individuals under optimal conditions.
- haakon 13y ago
  Also, Snowden has a Tor sticker on his laptop.

deleted 13y ago

[deleted]

throughtor 13y ago

>It is unfortunate that HN is not numbered among those sites. Why do you think that? I'm posting from tor with a fresh throwaway account.

icebraining 13y ago

throughtor: yes, and your post is dead on arrival.

throughtor 13y ago
interesting - is it that the account has no karma, that it's using TOR, or a combination?
notthroughtor 13y ago
let's see... no tor, no karma

devconsole 13y ago

Hi, I'm posting this through Tor. The reason I'm able to do this is because this account is more than two weeks old. I also created this account through Tor, so HN's operators should have no idea who I am. For example, you have done an experiment below of posting comments through tor using the newly-created account "throughtor": https://news.ycombinator.com/threads?id=throughtor https://news.ycombinator.com/threads?id=throughtor If you turn on "showdead" in your profile, you'll see that account has a bunch of dead comments. Those comments are dead because the "throughtor" account is less than two weeks old, so HN's system automatically kills them since they're posted through tor. Once two weeks elapse, you'll be able to post comments and they won't be struck down. (Two weeks is the time it takes for the "new account" status to wear off.) This is a spam prevention technique, and it's necessary in order to drastically reduce the amount of work moderators have to do to filter spam. So, anyone who wants to post anonymously on HN should open up Tor Browser and create an account right now, and save it for a rainy day sometime in the future. Remember not to use the same password as your regular HN account, because you'll give your identity away if you do. In addition to the fact that there's nothing stopping any server from logging every password across every service, HN also stores passwords as unsalted SHA-1, so two identical passwords on two different HN accounts will be stored as the same hash in the database, making it trivial to detect your real identity. At least, unsalted SHA-1 was the case as of arc3.1, which is now several years old. Kogir probably changed it to something more sane in the meantime. But I highly doubt anyone will be able to break into HN's server running BSD anyway, so the unsalted SHA-1 isn't really a concern. This is just a reminder that every piece of information you provide is a piece of information that can be used to determine your identity. And if you use this information to create more work for HN's operators, then I will ssh into your macbook and scare the crap out of you in the middle of the night by setting your volume to 100% and using text-to-speech. But seriously, don't be lame. It's valuable that we are permitted any anonymity at all.

ef47d35620c1 13y ago
Thank you for correcting me. We have all learned from you.
pg 13y ago
We switched to bcrypt several years ago.

krapp 13y ago

It's a double edged sword. The primary adversary on a site with anonymous posting isn't a government but the staff of the site itself (as demonstrated by the OP.)