9 ms·

Tor users are selected and monitored by the NSA as extremists

214 points by sveme 12y ago

Nemcue 12y ago
Uh — someone has the XKeyscore sourcecode? How'd they get their hands on that? Is this verified?
- jonnybgood 12y ago
  That's what I'm still trying to figure out. How do we know if it's even real?
- manyman899 12y ago
  exactly. this is fear mongering propaganda
mkal_tsr 12y ago
"According to the source code will be labeled as extremists in XKeyscore users when they search the internet for anonymizing tools like Tor or Tails, thanks to the global monitoring of search queries." Holy fuck this is disturbing. Does someone have access to a human-translated copy or similar article?
- VMG 12y ago
  It's based on a report by the TV station ARD. The video shows source code printouts, here are screencaps: http://i.imgur.com/3flJ50Y.png http://i.imgur.com/3flJ50Y.png http://i.imgur.com/NRMY6Qo.png http://i.imgur.com/NRMY6Qo.png Edit: some say it's not really the XKeyscore code: http://blog.fefe.de/?ts=ad4bdd72 http://blog.fefe.de/?ts=ad4bdd72
  - mkal_tsr 12y ago
    "Edit: some say it's not really the XKeyscore code" Yeah, looking at the code it definitely involves TOR, but I'm really interested in the "searching for these Tools -> you're now flagged" claim+proof because that is just so wrong.
    - spacefight 12y ago
      It looks like a selector for 3 known TOR directories IPs, either based on HTTP or HTTPS traffic.
      - mike_hearn 12y ago
        They're just screenshots to make the TV show more interesting. They're obviously not showing the entire source on air. If they claim to have the entire source code of XKeyScore and knowing that Snowden accessed so much, why should we doubt them?
        spacefight 12y ago
        True. There's also not much use of showing more source code on screen (or config files as it looks in this case)...
    - Vespasian 12y ago
      Well whether this particular piece of information is true or not the whole situation is not making me feel more secure as someone who runs a (non exit) Tor relay. I curious to see if this backfires at me the next time I visit the US. At this point it wouldn't be a total surprise any more.
  - AlyssaRowan 12y ago
    Mmm, looks about right to me... Think of it a bit like crm114, but less hairy, bigger, and searching all your traffic. That's not directly part of a selector but a support library, so I highly doubt anyone is targeted purely on that - but it is probably part of attempted traffic correlation attacks on Tor. They're not very successful.)
    - AlyssaRowan 12y ago
      Well. I'd like to revise my comment above: article is 100% accurate and yes, that is real XKeyScore source code, and it is being directly called, solo, by real selectors in the wild. I'm horrified: this is actual "your name will also go on ze list" territory. Selectors as wide as this have absolutely no genuine intelligence value whatsoever. This never saw oversight. They're insane. Please do not let this discourage you from using Tor. Oh, quite the opposite - this shows you exactly why you need to use Tor, more than ever, and why more people, perhaps everyone, should. The more people who do, the more useless this selector becomes. I'd like to warmly thank all the new sources who have come forward since Snowden's disclosures last year (no, this isn't from Snowden). This is absolutely golden. By the way, malformed regexes are a frequent source of exploitable security bugs…
sveme 12y ago
Trying to human-translate the first part of the article: XKeyscore-Sourcecode: Tor-Users are marked and surveilled as extremists According to an analysis of the XKeyscore sourcecode by German public broadcasters ARD and WDR, people showing an interest in anonymization on the web by, for example, googling for "Tails" or "Tor" will be added as extremists to an NSA database and monitored from thereon. That's at least the gist of it. I'm pretty sure you'll get more background once the anglosphere awakens.
- arethuza 12y ago
  What if you are interested in geology and are looking for granite tors? http://en.wikipedia.org/wiki/Tor_%28rock_formation%29 http://en.wikipedia.org/wiki/Tor_%28rock_formation%29 [NB I am interested in geology and I probably have searched for "tor scotland" or similar at some point]
  - haakon 12y ago
    And what if you're interested in Norse mythology? Or people named Tor (a common name at least in Norway)? No, in the age of universal surveillance, it's best to conform to a narrow norm.
    - bitJericho 12y ago
      And what if you're interested in extremist anonymous activities? Oh wait I know that one.
  - mxfh 12y ago
    Or is just into Soccer, Architecture or older Literature, since "Tor" in German means gate or goal, or just a foolish person. Semantics matter. http://de.wikipedia.org/wiki/Tor http://de.wikipedia.org/wiki/Tor
- prof_hobart 12y ago
  It's difficult to believe that this is all it takes (or if it is, why they aren't just including everyone). Tails is hardly an uncommon word, with a meaning entire devoid of any terrorist connection. And so is Tor - it may not be that common elsewhere, but tor means "rock on top of a hill" and various places have it in their name. I've stayed the High Tor hotel in Derbyshire before, and as it was to see a fireworks festival they may have spotted various picture of explosions that I posted - I wonder if that set any triggers off.
noir_lord 12y ago
Create a "Fight the NSA button" that links to a google search for Tor or Tails then post it on everything. If they really are doing this (and considering recent events I would lean that way) that would seem like an effective irritant. EDIT: For clarity, the button should explain what it will do, putting someone on a watch list without their consent is not a moral thing to do.
- spacefight 12y ago
  Or embed a google search within an iframe.
  - noir_lord 12y ago
    The button requires user action, the iframe is passive I'm not convinced getting someone put on a watchlist without them taking a specific action is a particularly moral thing to do... For the sake of clarity I wasn't suggesting the button be put on without a clear explanation of what it did.
    - malka 12y ago
      That's the point. A watchlist with every human, and its friends on it, is kinda useless.
      - GFischer 12y ago
        Or maybe it will end up as a high-tech version of the Stasi archives (if it isn't there already). http://en.wikipedia.org/wiki/Stasi http://en.wikipedia.org/wiki/Stasi
        bausson 12y ago
        No way it's there, the Stasi did have file on most citizens, but it wasn't as well indexed, comprehensive, and easily searchable as what current government 'security' agencies have.
      - 12y ago
higherpurpose 12y ago
NSA policies are simply insane and/or lazily thought out. I mean we even learned a while ago that not using Facebook makes you "suspicious" - Seriously? Or maybe watching a certain type of Youtube videos. My point is I wouldn't single out just Tor here. They probably have dozens of other such idiotic policies that lead to abuses and putting people on "lists" that then they can take revenge on, such as through adding them to no-fly lists and so on, with very little to no recourse for the people affected (if they even ever find out about if or why they're put there, since it all tends to be secret). What happened to innocent until proven guilty? The NSA is simply out of control and needs to be reined in, otherwise expect abuses against people that haven't even heard of Tor.
- Shish2k 12y ago
  > we even learned a while ago that not using Facebook makes you "suspicious" I tried googling for evidence of this ("nsa not using facebook suspicious"), and this comment (posted 56 minutes ago as of my writing) is the top google hit, with others being irrelevant o_O Do you have a link to support this? At this point I am wondering if it's safe to assume all conspiracy theories are true by default, and lack of evidence is evidence of conspiracy to cover it up...
  - haswell 12y ago
    Remove "nsa" from your query, and you'll find a long list of relevant results. There was quite a bit of coverage around the web a year or two back about this topic, but never in the context of the NSA as far as I know.
- jdong 12y ago
  NSA uses several different parameters to identify potential targets. E.g a Tor user with no Facebook profile who recently spent two months in Syria, sound suspicious? The fact that someone doesn't make a Facebook profile stands out, the fact that someone is using Tor stands out and the fact that someone is taking regular trips to Syria stands out. Nobody's getting arrested for using Tor, or not having a Facebook profile. But those are things used in evaluating people.
fchollet 12y ago
Is it possible that this, and the release of this information, is part of a NSA strategy for deterring people from using TOR or encryption? Internet users will now be too scared to be put on some list to even look up information about TOR or PGP.
- mkohlmyr 12y ago
  Admittedly I'm not well versed in TOR and how secure it actually is but surely it would be more actionable for major intelligence agencies to operate a number nodes in the network and use them to attempt to track and mitm requests? As for encryption I haven't seen much to indicate a deterrence strategy, but maybe I'm not following the media as much as I should.
  - alextgordon 12y ago
    Read this: http://cryptome.org/2013/10/nsa-tor-stinks.pdf http://cryptome.org/2013/10/nsa-tor-stinks.pdf "Current: access to very few nodes. Success rate negligible because all three Tor nodes in the circuit have to be in the set of nodes we have access to"
    - mkohlmyr 12y ago
      Fair enough. Thanks for the link.
    - Globz 12y ago
      Funny how they want to investigate Evercookie persistence and use it to identify Tor users. For those of you who doesn't know about Evercookie : http://samy.pl/evercookie/ http://samy.pl/evercookie/ https://github.com/samyk/evercookie https://github.com/samyk/evercookie
  - Crito 12y ago
    It seems to me that the two tactics could be complementary. If you discourage people from using Tor, then you don't have to devote as many resources to the people that use Tor.
- 12y ago
caio1982 12y ago
If by extremists they mean freedom extremists then that's fine with me, bring it on NSA.
- nobodyshere 12y ago
  Anyways, if they are trying to justify doing that by fighting with terrorists, I'd say the terrorists have already won.
Create 12y ago
We begin therefore where they are determined not to end, with the question whether any form of democratic self-government, anywhere, is consistent with the kind of massive, pervasive, surveillance into which the Unites States government has led not only us but the world. This should not actually be a complicated inquiry. http://www.theguardian.com/technology/2014/may/27/-sp-privacy-under-attack-nsa-files-revealed-new-threats-democracy http://www.theguardian.com/technology/2014/may/27/-sp-privac...
dm2 12y ago
I was talking on the phone to someone in another country (a US friendly country) and the other person mentioned Tor. The second he got to the end of the word the phone call cut out. I haven't had a phone call cut out in years except that one time. It was most likely a complete coincidence but it would be very interesting if anyone else has ever had a similar experience.
- probably_wrong 12y ago
  Whenever I finish a Skype call, I immediately get a message supposedly from the other person with a 4-digit number. I don't know what that number means yet. Also, my phone's wifi will not turn off since last week. Those are all probably just coincidences, but then again, it would also fit in the kind of behavior I'd expect to observe from spyware, either state-sponsored or just the usual kind. In any case, the NSA has made it very easy to become paranoid.
  - randallsquared 12y ago
    If you're using Skype on Linux, it's the number of seconds of the call. Skype on Linux hasn't been updated in so long that the client doesn't always know what to do with what it's sent; if you're using Skype on Mac, that's when it tells you that you just got off a call with so-and-so for such-and-such time, but on Linux, it just prints out the literal number of seconds and it's done.
  - delian66 12y ago
    I had the same problem, when I used the 4.2 linux version of the Skype client. It seems that it was a protocol mismatch between the Windows and Linux versions of the Skype client, and the 4-digit number is the duration of the call in seconds.
  - AlyssaRowan 12y ago
    Does the other person know what that means? Is it their phone unlock code?
- e455b328 12y ago
  It was not a coincidence. I created an account just to respond because I've been waiting years to have my experience... "validated". The same exact thing has happened during phone conversations I've had except with a different word. And I first noticed it years ago but it was post-9/11. When it happened I thought the phone call dropped by accident. I called back and picked up where I left off telling the same story. At the same word the call dropped again. I called back again and said "uhh, that was weird. Did you notice it cut off again when I said _______?" And the call dropped once more. At that point there was no plausible way it was a coincidence. The next time I called, I decided not to test it again. I've been looking out ever since for some mention of this somewhere. Never saw one until now.
DamnYuppie 12y ago
I am obviously highly suspicious because I have not only searched for but used TOR. It is handy when you want to price compare flights. I also don't like Facebook, I wonder where I am ranked on the NSA's list of potential terrible people?
- fredley 12y ago
  For a while I taught a security course which included information about how Tor works. I did a lot of googling around Tor and anonymity in general. I must be on a few lists by now.
  - shill 12y ago
    You might have a record in the Hitlerian maincore database. http://en.m.wikipedia.org/wiki/Main_Core http://en.m.wikipedia.org/wiki/Main_Core
jonnybgood 12y ago
Pure unadulterated sensationalism. The NSA scandal is a moneymaker. No surprise that it's coming out of German media after the leaks about Merkel. It is in the US government's interest for Tor to thrive, it even uses Tor.
- why-el 12y ago
  There are factual statements in the article that you could respond to. That's how a constructive comment should be.
  - jonnybgood 12y ago
    What factual statements? It's vague and ambiguous. XKEYSCORE is also not just a computer program. This is not real source code of XKEYSCORE as you wouldn't hard code Tor or any targeting vectors in to the source. It's not how the NSA operates as we've already seen. This is the biggest giveaway that the source code they're showing is fake. Are we to accept any article about the NSA without question?
    - vidarh 12y ago
      > This is not real source code of XKEYSCORE as you wouldn't hard code Tor or any targeting vectors in to the source. The article mentions both source code and configuration files.
      - AlyssaRowan 12y ago
        Ambiguous. It's compiled to an executable FSM, and it's quite generalised, so I'd call it source.
      - jonnybgood 12y ago
        And how do you know this source code and config files are the real deal? Even so, the NSA creates programs that take user input for targeting vectors. Past leaks have shown this. I believe XKEYSCORE was one of these kinds of programs.
VexXtreme 12y ago
So would this XKeyscore thing know what you're searching for if you're not logged into your Google account and you're behind SSL? Would that imply they have private keys to Google SSL certificates?
- jeletonskelly 12y ago
  Yes, they probably can. One of the early NSA leaks showed that the NSA had compromised the private networks of many large tech companies. It would be safe to assume this gave them access to tons of unencrypted data about users and behavior. The NSA is using a graph database to store all sorts of data and then joining data across domains to get a fairly complete picture of your digital life.
- joeyspn 12y ago
  I guess the answer is yes... breaking (or by-passing) SSL must be a joke for a gazillion dollars funded agency (think "heartbleed" zero-day).
manyman899 12y ago
i'd say monitoring every single communication going in and out of your country and storing it is pretty extreme don't you think? I can't imagine any tor users really give a damn what the nsa think about them. The NSA are clinically insane
dspillett 12y ago
I'm not sure why people seem surprised by this. Any sufficiently (i.e. correctly) encrypted content/traffic should be indiscernible from any other of the same scale. While there are ways to infer what sort of traffic is being carried from certain packed inspection and statistical techniques (a bulk HTTP transfer will look different to a peer-to-peer one and both will look very different to an interactive SSH session, and so on) you can't do that for the content. There are five groups using Tor and similar by my understanding (in no particular order): criminals (including terrorists, people trafficers, illegal drug industry people, and so forth), the oppressed and freedom fighters (depending on your point of view a lot of people in this category might belong in the first one instead and vice-versa), the paranoid who think the whole world is out to get them, those wanting to protect all their content+comms whether secret or not out of principal, and those who are simply experimenting with it (out of "random" interest, academic interest, or because they work in a relevant/related field). The proportion of nefarious types (relative to the total user-base) routinely using Tor is going to be significantly higher then the proportion of such who are not, so the authorities are naturally going to look to Tor for that reason. They are not saying that they think everyone using Tor is a terrorist, they are saying some are but we can't tell who so we are going to check everyone. The only way this will change is if everything is thusly protected, so there will be no difference between the diversity of Tor users and the diversity of the overall population.
- TheCraiggers 12y ago
  I'd hate to be one of those people, but I'd enjoy some kind of citation on that claim that the majority of Tor users are using it for nefarious purposes. I may be stretching here, but I think most of us would probably agree that monitoring or outright shutting down Tor would be OK if the nefarious usage was 100%. More interesting is, at which point do we consider monitoring morally wrong as that percentage approaches zero?
  - bcl 12y ago
    All you need to do is look at the hidden services listed on any of the .onion directories. This is why I stopped running a node -- I just can't justify helping criminals, even if I have no way to know which data passes through my system.
plicense 12y ago
Lol what about Tor developers?
- forgottenpass 12y ago
  They're already on the list of boat-rockers to harass at airports. http://en.wikipedia.org/wiki/Jacob_Appelbaum#Detention_and_investigation http://en.wikipedia.org/wiki/Jacob_Appelbaum#Detention_and_i...
rett12 12y ago
I suppose everyone here is already on a list anyway. Everyone who leaves a criticism for the NSA. Everyone who up votes this conversation and other similar ones. Everyone who contributes to OSS Privacy. Everyone who misspells Thor. How useful can this really be when there's so much noise?
IgorPartola 12y ago
One possible solution to this would be for Firefox to integrate Tor with their private browsing mode. That would give the Tor network a huge spike in traffic. I have no doubt in my mind that the NSA can and probably does monitor every bit of traffic everyone sends, but the more inconvenient and muddled we make it the better. I think we can all assume we (HN readers/posters) are on the NSA lists. Lots of us mentioned Tor and the NSA online. "He who must not be named" will show up as soon as you say his name and all that. The question is whether this puts you into actual risk. I sincerely hope not, but this shit is really getting out of hand.
- Taek 12y ago
  I'm sure that the NSA also has a large array of lists. Having a list called 'extremists' and 'terrorists' helps you get warrants, even if the list is merely composed of people interested in protecting their anonymity. Tor will never take off on its own. There are many stigmas, and many barriers. Furthermore, in the past year to two years, pretty much every service has blacklisted all Tor exit nodes. It used to be moderately easy to sign up for Gmx (and, three years ago, even gmail) over Tor without needing a phone number. Many websites block all exit nodes from posting (though most at least allow viewing). I would dislike to see this as a feature in Firefox until Tor is easier to use. In principle it makes sense and I support the idea, but in practice it would make private browsing very frustrating. I also imagine that you'd have a much more extreme supply vs. demand problem if this happened, reducing an already slow Tor to barely usable speeds.
- javajosh 12y ago
  >One possible solution to this would be for Firefox to integrate Tor with their private browsing mode. I really like this idea. The practical downside is that Tor is generally very slow. BTW I'm not entirely sure how the NSA can justify an anti-Tor stance, when anonymous speech is clearly protected by the First Amendment. Without something like Tor, true anonymous speech on the Internet is impossible; therefore Tor, or something like it, is a necessary tool to maintain that right. (Anonymous speech has been historically important, when people would print and distribute anonymous pamphlets about political issues. Honestly, I am concerned about criminal use of Tor too, and would be perfectly happy to have a version of Tor limited to political speech and organization.)
plg 12y ago
What if we had a system where there was a constant stream of random bytes coming to/from every IP address out there... and when you wanted to send actual information, you always sent it encrypted ... then everyone would be an extremist and encryptors would no longer stand out.
- Istof 12y ago
  If everyone's communications were properly encrypted, you probably would not need useless random bytes sent down the pipes since there is so much data being transfered on the internet.
- grkvlt 12y ago
  Yes, this would defeat traffic analysis, but it only works if everyone is using the same shared channel, or if each user maintains a channel with every other user they might ever wish to communicate with. Every user must also check each packet to see if it is encrypted with their public key (requiring an extensive PKI) and is a valid message for them, which is expensive. The bandwidth required is also enormous for anything other than a very limited number of participants. Sure, Tor achieves some of these goals, and if everyone used Tor all of the time then it would make the NSAs job much more difficult, but it isn't ever going to happen, for obvious operational and practical reasons.
nnnnni 12y ago
Well, I guess that the FBI is full of extremists. They use Tor to stay anonymous just like everyone else.
lowlevel 12y ago
German is difficult. German run through google translate, even more so.
mullingitover 12y ago
I have to wonder if it'd be possible to DDOS the NSA by having everyone do 'dd if=/dev/random of=supersecretstuff.txt count=1024 bs=1048576' and post large files full of random bits all over the web. The NSA would be obligated to collect and store every damn one of those huge blobs of random bits on the off chance it'd be used later as a one-time pad, or that it's encrypted secrets that they need to investigate. It costs nothing to generate random bits, but it costs > 0 to store that data. Sooner or later they'd just run out of disk space.
- AlyssaRowan 12y ago
  No. But finite state machines take finite amounts of time and memory to run - and even though it runs 'nearline', XKeyScore is not invulnerable to targeted resource exhaustion attacks.

214 points by sveme 12y ago

Nemcue 12y ago

Uh — someone has the XKeyscore sourcecode? How'd they get their hands on that? Is this verified?

jonnybgood 12y ago
That's what I'm still trying to figure out. How do we know if it's even real?
manyman899 12y ago
exactly. this is fear mongering propaganda

mkal_tsr 12y ago

"According to the source code will be labeled as extremists in XKeyscore users when they search the internet for anonymizing tools like Tor or Tails, thanks to the global monitoring of search queries." Holy fuck this is disturbing. Does someone have access to a human-translated copy or similar article?

VMG 12y ago
It's based on a report by the TV station ARD. The video shows source code printouts, here are screencaps: http://i.imgur.com/3flJ50Y.png http://i.imgur.com/3flJ50Y.png http://i.imgur.com/NRMY6Qo.png http://i.imgur.com/NRMY6Qo.png Edit: some say it's not really the XKeyscore code: http://blog.fefe.de/?ts=ad4bdd72 http://blog.fefe.de/?ts=ad4bdd72
- mkal_tsr 12y ago
  "Edit: some say it's not really the XKeyscore code" Yeah, looking at the code it definitely involves TOR, but I'm really interested in the "searching for these Tools -> you're now flagged" claim+proof because that is just so wrong.
  - spacefight 12y ago
    It looks like a selector for 3 known TOR directories IPs, either based on HTTP or HTTPS traffic.
    - mike_hearn 12y ago
      They're just screenshots to make the TV show more interesting. They're obviously not showing the entire source on air. If they claim to have the entire source code of XKeyScore and knowing that Snowden accessed so much, why should we doubt them?
      - spacefight 12y ago
        True. There's also not much use of showing more source code on screen (or config files as it looks in this case)...
  - Vespasian 12y ago
    Well whether this particular piece of information is true or not the whole situation is not making me feel more secure as someone who runs a (non exit) Tor relay. I curious to see if this backfires at me the next time I visit the US. At this point it wouldn't be a total surprise any more.
- AlyssaRowan 12y ago
  Mmm, looks about right to me... Think of it a bit like crm114, but less hairy, bigger, and searching all your traffic. That's not directly part of a selector but a support library, so I highly doubt anyone is targeted purely on that - but it is probably part of attempted traffic correlation attacks on Tor. They're not very successful.)
  - AlyssaRowan 12y ago
    Well. I'd like to revise my comment above: article is 100% accurate and yes, that is real XKeyScore source code, and it is being directly called, solo, by real selectors in the wild. I'm horrified: this is actual "your name will also go on ze list" territory. Selectors as wide as this have absolutely no genuine intelligence value whatsoever. This never saw oversight. They're insane. Please do not let this discourage you from using Tor. Oh, quite the opposite - this shows you exactly why you need to use Tor, more than ever, and why more people, perhaps everyone, should. The more people who do, the more useless this selector becomes. I'd like to warmly thank all the new sources who have come forward since Snowden's disclosures last year (no, this isn't from Snowden). This is absolutely golden. By the way, malformed regexes are a frequent source of exploitable security bugs…

sveme 12y ago

Trying to human-translate the first part of the article: XKeyscore-Sourcecode: Tor-Users are marked and surveilled as extremists According to an analysis of the XKeyscore sourcecode by German public broadcasters ARD and WDR, people showing an interest in anonymization on the web by, for example, googling for "Tails" or "Tor" will be added as extremists to an NSA database and monitored from thereon. That's at least the gist of it. I'm pretty sure you'll get more background once the anglosphere awakens.

arethuza 12y ago
What if you are interested in geology and are looking for granite tors? http://en.wikipedia.org/wiki/Tor_%28rock_formation%29 http://en.wikipedia.org/wiki/Tor_%28rock_formation%29 [NB I am interested in geology and I probably have searched for "tor scotland" or similar at some point]
- haakon 12y ago
  And what if you're interested in Norse mythology? Or people named Tor (a common name at least in Norway)? No, in the age of universal surveillance, it's best to conform to a narrow norm.
  - bitJericho 12y ago
    And what if you're interested in extremist anonymous activities? Oh wait I know that one.
- mxfh 12y ago
  Or is just into Soccer, Architecture or older Literature, since "Tor" in German means gate or goal, or just a foolish person. Semantics matter. http://de.wikipedia.org/wiki/Tor http://de.wikipedia.org/wiki/Tor
prof_hobart 12y ago
It's difficult to believe that this is all it takes (or if it is, why they aren't just including everyone). Tails is hardly an uncommon word, with a meaning entire devoid of any terrorist connection. And so is Tor - it may not be that common elsewhere, but tor means "rock on top of a hill" and various places have it in their name. I've stayed the High Tor hotel in Derbyshire before, and as it was to see a fireworks festival they may have spotted various picture of explosions that I posted - I wonder if that set any triggers off.

noir_lord 12y ago

Create a "Fight the NSA button" that links to a google search for Tor or Tails then post it on everything. If they really are doing this (and considering recent events I would lean that way) that would seem like an effective irritant. EDIT: For clarity, the button should explain what it will do, putting someone on a watch list without their consent is not a moral thing to do.

spacefight 12y ago
Or embed a google search within an iframe.
- noir_lord 12y ago
  The button requires user action, the iframe is passive I'm not convinced getting someone put on a watchlist without them taking a specific action is a particularly moral thing to do... For the sake of clarity I wasn't suggesting the button be put on without a clear explanation of what it did.
  - malka 12y ago
    That's the point. A watchlist with every human, and its friends on it, is kinda useless.
    - GFischer 12y ago
      Or maybe it will end up as a high-tech version of the Stasi archives (if it isn't there already). http://en.wikipedia.org/wiki/Stasi http://en.wikipedia.org/wiki/Stasi
      - bausson 12y ago
        No way it's there, the Stasi did have file on most citizens, but it wasn't as well indexed, comprehensive, and easily searchable as what current government 'security' agencies have.
    - 12y ago

higherpurpose 12y ago

NSA policies are simply insane and/or lazily thought out. I mean we even learned a while ago that not using Facebook makes you "suspicious" - Seriously? Or maybe watching a certain type of Youtube videos. My point is I wouldn't single out just Tor here. They probably have dozens of other such idiotic policies that lead to abuses and putting people on "lists" that then they can take revenge on, such as through adding them to no-fly lists and so on, with very little to no recourse for the people affected (if they even ever find out about if or why they're put there, since it all tends to be secret). What happened to innocent until proven guilty? The NSA is simply out of control and needs to be reined in, otherwise expect abuses against people that haven't even heard of Tor.

Shish2k 12y ago
> we even learned a while ago that not using Facebook makes you "suspicious" I tried googling for evidence of this ("nsa not using facebook suspicious"), and this comment (posted 56 minutes ago as of my writing) is the top google hit, with others being irrelevant o_O Do you have a link to support this? At this point I am wondering if it's safe to assume all conspiracy theories are true by default, and lack of evidence is evidence of conspiracy to cover it up...
- haswell 12y ago
  Remove "nsa" from your query, and you'll find a long list of relevant results. There was quite a bit of coverage around the web a year or two back about this topic, but never in the context of the NSA as far as I know.
jdong 12y ago
NSA uses several different parameters to identify potential targets. E.g a Tor user with no Facebook profile who recently spent two months in Syria, sound suspicious? The fact that someone doesn't make a Facebook profile stands out, the fact that someone is using Tor stands out and the fact that someone is taking regular trips to Syria stands out. Nobody's getting arrested for using Tor, or not having a Facebook profile. But those are things used in evaluating people.

fchollet 12y ago

Is it possible that this, and the release of this information, is part of a NSA strategy for deterring people from using TOR or encryption? Internet users will now be too scared to be put on some list to even look up information about TOR or PGP.

mkohlmyr 12y ago
Admittedly I'm not well versed in TOR and how secure it actually is but surely it would be more actionable for major intelligence agencies to operate a number nodes in the network and use them to attempt to track and mitm requests? As for encryption I haven't seen much to indicate a deterrence strategy, but maybe I'm not following the media as much as I should.
- alextgordon 12y ago
  Read this: http://cryptome.org/2013/10/nsa-tor-stinks.pdf http://cryptome.org/2013/10/nsa-tor-stinks.pdf "Current: access to very few nodes. Success rate negligible because all three Tor nodes in the circuit have to be in the set of nodes we have access to"
  - mkohlmyr 12y ago
    Fair enough. Thanks for the link.
  - Globz 12y ago
    Funny how they want to investigate Evercookie persistence and use it to identify Tor users. For those of you who doesn't know about Evercookie : http://samy.pl/evercookie/ http://samy.pl/evercookie/ https://github.com/samyk/evercookie https://github.com/samyk/evercookie
- Crito 12y ago
  It seems to me that the two tactics could be complementary. If you discourage people from using Tor, then you don't have to devote as many resources to the people that use Tor.
12y ago

caio1982 12y ago

If by extremists they mean freedom extremists then that's fine with me, bring it on NSA.

nobodyshere 12y ago
Anyways, if they are trying to justify doing that by fighting with terrorists, I'd say the terrorists have already won.

Create 12y ago

We begin therefore where they are determined not to end, with the question whether any form of democratic self-government, anywhere, is consistent with the kind of massive, pervasive, surveillance into which the Unites States government has led not only us but the world. This should not actually be a complicated inquiry. http://www.theguardian.com/technology/2014/may/27/-sp-privacy-under-attack-nsa-files-revealed-new-threats-democracy http://www.theguardian.com/technology/2014/may/27/-sp-privac...

dm2 12y ago

I was talking on the phone to someone in another country (a US friendly country) and the other person mentioned Tor. The second he got to the end of the word the phone call cut out. I haven't had a phone call cut out in years except that one time. It was most likely a complete coincidence but it would be very interesting if anyone else has ever had a similar experience.

probably_wrong 12y ago
Whenever I finish a Skype call, I immediately get a message supposedly from the other person with a 4-digit number. I don't know what that number means yet. Also, my phone's wifi will not turn off since last week. Those are all probably just coincidences, but then again, it would also fit in the kind of behavior I'd expect to observe from spyware, either state-sponsored or just the usual kind. In any case, the NSA has made it very easy to become paranoid.
- randallsquared 12y ago
  If you're using Skype on Linux, it's the number of seconds of the call. Skype on Linux hasn't been updated in so long that the client doesn't always know what to do with what it's sent; if you're using Skype on Mac, that's when it tells you that you just got off a call with so-and-so for such-and-such time, but on Linux, it just prints out the literal number of seconds and it's done.
- delian66 12y ago
  I had the same problem, when I used the 4.2 linux version of the Skype client. It seems that it was a protocol mismatch between the Windows and Linux versions of the Skype client, and the 4-digit number is the duration of the call in seconds.
- AlyssaRowan 12y ago
  Does the other person know what that means? Is it their phone unlock code?
e455b328 12y ago
It was not a coincidence. I created an account just to respond because I've been waiting years to have my experience... "validated". The same exact thing has happened during phone conversations I've had except with a different word. And I first noticed it years ago but it was post-9/11. When it happened I thought the phone call dropped by accident. I called back and picked up where I left off telling the same story. At the same word the call dropped again. I called back again and said "uhh, that was weird. Did you notice it cut off again when I said _______?" And the call dropped once more. At that point there was no plausible way it was a coincidence. The next time I called, I decided not to test it again. I've been looking out ever since for some mention of this somewhere. Never saw one until now.

DamnYuppie 12y ago

I am obviously highly suspicious because I have not only searched for but used TOR. It is handy when you want to price compare flights. I also don't like Facebook, I wonder where I am ranked on the NSA's list of potential terrible people?

fredley 12y ago
For a while I taught a security course which included information about how Tor works. I did a lot of googling around Tor and anonymity in general. I must be on a few lists by now.
- shill 12y ago
  You might have a record in the Hitlerian maincore database. http://en.m.wikipedia.org/wiki/Main_Core http://en.m.wikipedia.org/wiki/Main_Core

jonnybgood 12y ago

Pure unadulterated sensationalism. The NSA scandal is a moneymaker. No surprise that it's coming out of German media after the leaks about Merkel. It is in the US government's interest for Tor to thrive, it even uses Tor.

why-el 12y ago
There are factual statements in the article that you could respond to. That's how a constructive comment should be.
- jonnybgood 12y ago
  What factual statements? It's vague and ambiguous. XKEYSCORE is also not just a computer program. This is not real source code of XKEYSCORE as you wouldn't hard code Tor or any targeting vectors in to the source. It's not how the NSA operates as we've already seen. This is the biggest giveaway that the source code they're showing is fake. Are we to accept any article about the NSA without question?
  - vidarh 12y ago
    > This is not real source code of XKEYSCORE as you wouldn't hard code Tor or any targeting vectors in to the source. The article mentions both source code and configuration files.
    - AlyssaRowan 12y ago
      Ambiguous. It's compiled to an executable FSM, and it's quite generalised, so I'd call it source.
    - jonnybgood 12y ago
      And how do you know this source code and config files are the real deal? Even so, the NSA creates programs that take user input for targeting vectors. Past leaks have shown this. I believe XKEYSCORE was one of these kinds of programs.

VexXtreme 12y ago

So would this XKeyscore thing know what you're searching for if you're not logged into your Google account and you're behind SSL? Would that imply they have private keys to Google SSL certificates?

jeletonskelly 12y ago
Yes, they probably can. One of the early NSA leaks showed that the NSA had compromised the private networks of many large tech companies. It would be safe to assume this gave them access to tons of unencrypted data about users and behavior. The NSA is using a graph database to store all sorts of data and then joining data across domains to get a fairly complete picture of your digital life.
joeyspn 12y ago
I guess the answer is yes... breaking (or by-passing) SSL must be a joke for a gazillion dollars funded agency (think "heartbleed" zero-day).

manyman899 12y ago

i'd say monitoring every single communication going in and out of your country and storing it is pretty extreme don't you think? I can't imagine any tor users really give a damn what the nsa think about them. The NSA are clinically insane

dspillett 12y ago

I'm not sure why people seem surprised by this. Any sufficiently (i.e. correctly) encrypted content/traffic should be indiscernible from any other of the same scale. While there are ways to infer what sort of traffic is being carried from certain packed inspection and statistical techniques (a bulk HTTP transfer will look different to a peer-to-peer one and both will look very different to an interactive SSH session, and so on) you can't do that for the content. There are five groups using Tor and similar by my understanding (in no particular order): criminals (including terrorists, people trafficers, illegal drug industry people, and so forth), the oppressed and freedom fighters (depending on your point of view a lot of people in this category might belong in the first one instead and vice-versa), the paranoid who think the whole world is out to get them, those wanting to protect all their content+comms whether secret or not out of principal, and those who are simply experimenting with it (out of "random" interest, academic interest, or because they work in a relevant/related field). The proportion of nefarious types (relative to the total user-base) routinely using Tor is going to be significantly higher then the proportion of such who are not, so the authorities are naturally going to look to Tor for that reason. They are not saying that they think everyone using Tor is a terrorist, they are saying some are but we can't tell who so we are going to check everyone. The only way this will change is if everything is thusly protected, so there will be no difference between the diversity of Tor users and the diversity of the overall population.

TheCraiggers 12y ago
I'd hate to be one of those people, but I'd enjoy some kind of citation on that claim that the majority of Tor users are using it for nefarious purposes. I may be stretching here, but I think most of us would probably agree that monitoring or outright shutting down Tor would be OK if the nefarious usage was 100%. More interesting is, at which point do we consider monitoring morally wrong as that percentage approaches zero?
- bcl 12y ago
  All you need to do is look at the hidden services listed on any of the .onion directories. This is why I stopped running a node -- I just can't justify helping criminals, even if I have no way to know which data passes through my system.

plicense 12y ago

Lol what about Tor developers?

forgottenpass 12y ago
They're already on the list of boat-rockers to harass at airports. http://en.wikipedia.org/wiki/Jacob_Appelbaum#Detention_and_investigation http://en.wikipedia.org/wiki/Jacob_Appelbaum#Detention_and_i...

rett12 12y ago

I suppose everyone here is already on a list anyway. Everyone who leaves a criticism for the NSA. Everyone who up votes this conversation and other similar ones. Everyone who contributes to OSS Privacy. Everyone who misspells Thor. How useful can this really be when there's so much noise?

IgorPartola 12y ago

One possible solution to this would be for Firefox to integrate Tor with their private browsing mode. That would give the Tor network a huge spike in traffic. I have no doubt in my mind that the NSA can and probably does monitor every bit of traffic everyone sends, but the more inconvenient and muddled we make it the better. I think we can all assume we (HN readers/posters) are on the NSA lists. Lots of us mentioned Tor and the NSA online. "He who must not be named" will show up as soon as you say his name and all that. The question is whether this puts you into actual risk. I sincerely hope not, but this shit is really getting out of hand.

Taek 12y ago
I'm sure that the NSA also has a large array of lists. Having a list called 'extremists' and 'terrorists' helps you get warrants, even if the list is merely composed of people interested in protecting their anonymity. Tor will never take off on its own. There are many stigmas, and many barriers. Furthermore, in the past year to two years, pretty much every service has blacklisted all Tor exit nodes. It used to be moderately easy to sign up for Gmx (and, three years ago, even gmail) over Tor without needing a phone number. Many websites block all exit nodes from posting (though most at least allow viewing). I would dislike to see this as a feature in Firefox until Tor is easier to use. In principle it makes sense and I support the idea, but in practice it would make private browsing very frustrating. I also imagine that you'd have a much more extreme supply vs. demand problem if this happened, reducing an already slow Tor to barely usable speeds.
javajosh 12y ago
>One possible solution to this would be for Firefox to integrate Tor with their private browsing mode. I really like this idea. The practical downside is that Tor is generally very slow. BTW I'm not entirely sure how the NSA can justify an anti-Tor stance, when anonymous speech is clearly protected by the First Amendment. Without something like Tor, true anonymous speech on the Internet is impossible; therefore Tor, or something like it, is a necessary tool to maintain that right. (Anonymous speech has been historically important, when people would print and distribute anonymous pamphlets about political issues. Honestly, I am concerned about criminal use of Tor too, and would be perfectly happy to have a version of Tor limited to political speech and organization.)

plg 12y ago

What if we had a system where there was a constant stream of random bytes coming to/from every IP address out there... and when you wanted to send actual information, you always sent it encrypted ... then everyone would be an extremist and encryptors would no longer stand out.

Istof 12y ago
If everyone's communications were properly encrypted, you probably would not need useless random bytes sent down the pipes since there is so much data being transfered on the internet.
grkvlt 12y ago
Yes, this would defeat traffic analysis, but it only works if everyone is using the same shared channel, or if each user maintains a channel with every other user they might ever wish to communicate with. Every user must also check each packet to see if it is encrypted with their public key (requiring an extensive PKI) and is a valid message for them, which is expensive. The bandwidth required is also enormous for anything other than a very limited number of participants. Sure, Tor achieves some of these goals, and if everyone used Tor all of the time then it would make the NSAs job much more difficult, but it isn't ever going to happen, for obvious operational and practical reasons.

nnnnni 12y ago

Well, I guess that the FBI is full of extremists. They use Tor to stay anonymous just like everyone else.

lowlevel 12y ago

German is difficult. German run through google translate, even more so.

mullingitover 12y ago

I have to wonder if it'd be possible to DDOS the NSA by having everyone do 'dd if=/dev/random of=supersecretstuff.txt count=1024 bs=1048576' and post large files full of random bits all over the web. The NSA would be obligated to collect and store every damn one of those huge blobs of random bits on the off chance it'd be used later as a one-time pad, or that it's encrypted secrets that they need to investigate. It costs nothing to generate random bits, but it costs > 0 to store that data. Sooner or later they'd just run out of disk space.

AlyssaRowan 12y ago
No. But finite state machines take finite amounts of time and memory to run - and even though it runs 'nearline', XKeyScore is not invulnerable to targeted resource exhaustion attacks.