6 ms·
Tor Project Loses 12% of Entry/Exit Bandwidth Because of Heartbleed
- nteon 13y agoIts actually pretty impressive that 88% of tor operators have deployed OpenSSL updates. Curious how that compares to the web.
- aroch 13y agoIts more likely that a lot of them are running unaffected versions of OpenSSL
- dfc 13y agoThis makes no sense.
- jessaustin 13y agoI don't know that it's true, but it's certainly plausible that these hosts used OpenSSL versions prior to 1.0.1. Many other sites were in the same position.
- jfasi 13y ago> Tor's Bleeding Edge nodes (guards and exits) [1] Seriously, the choice of Heartbleed as a name is genius. It makes for so many awesome derivative names. I mean c'mon, "Bleeding Edges?" That's brilliant. [1] https://encrypted.redteam.net/bleeding_edges/ https://encrypted.redteam.net/bleeding_edges/
- sp332 13y agoWhat's the difference between "!reject" and "not Valid"? Edit: I'm a TOR noob, I have no idea what a Valid flag does. Why wouldn't it show up in logs the same way?
- TranceMan 13y agoFrom the article: I thought for a while about taking away their Valid flag rather than rejecting them outright, but this way they'll get notices in their logs.
- quasque 13y agoMakes me wonder how many malicious nodes on the network might be doing a reverse Heartbleed attack on vulnerable clients. It could be an effective way of unmasking the identity of hidden services, if they happen to have chosen such a node as their entry guard.
- trhway 13y agoHeartbleed seems to be more plausible answer to how NSA has cracked Tor instead of the global whole-Internet-scale input-output analysis. Well, at least i hope it is so...
- alanpca 13y agoCan you provide a source for the NSA cracking tor?
- rbag 13y agoCan you provide a source for the NSA cracking anything ?
- trhway 13y agobeside that being the question of the day if not the month, do you imply that my tax dollars have been just wasted fruitlessly?
- alttab 13y agoThey haven't needed to, they can simply run exit nodes: "If you actually look in to where these Tor nodes are hosted and how big they are, some of these nodes cost thousands of dollars each month just to host because they're using lots of bandwidth, they're heavy-duty servers and so on. Who would pay for this and be anonymous?"[1] [1]http://en.wikipedia.org/wiki/Tor_(anonymity_network)#Exit_node_eavesdropping http://en.wikipedia.org/wiki/Tor_(anonymity_network)#Exit_no...
- oakwhiz 13y agoThe only other plausible explanation I can think of, is that some Tor exit nodes are running on high-end machines without their owners' consent or knowledge.
- belorn 13y agoBecause no one owning, working or operating a ISP would ever, ever, dream of sponsoring some cable time to an anonymity network. They might be technical people who's job it is to work with computer networks, by why would they be interested in computer network technology? That would be like a technology company sponsoring open source project with work hours.
- Torgo 13y agoIf your node can't be a guard unless it has sufficient uptime and hasn't shared a name with any other node for six months, where does that put you when you upgrade your OpenSSL and generate new keys? Now my relay has a different fingerprint with the same nickname as before, and downtime, so it can't be an entry point anymore. How many entry points were lost because of this?