3 ms·

Wow, Tor is still a thing? We have confirmation that security agencies have taken over exit nodes and injected spyware before to track targets. I'm surprised an

by lnanek2 12y ago

Wow, Tor is still a thing? We have confirmation that security agencies have taken over exit nodes and injected spyware before to track targets. I'm surprised anyone uses it. It's like the security lottery.

icebraining 12y ago
Exit nodes are irrelevant for hidden services like WaPo's SecureDrop, the connection never leaves the Tor network.
meowface 12y ago
The NSA leaks reveal that for the most part, Tor is still secure if you're using a sufficient number of intermediary nodes. If anything, the real concern here is the implicit encouragement to use local library computers, which would be much easier for a government agency (or cybercriminal) to infect with malware and observe.
- Create 12y ago
  “The American Library Association (ALA) opposes any use of governmental power to suppress the free and open exchange of knowledge and information or to intimidate individuals exercising free inquiry…ALA considers that sections of the USA PATRIOT ACT are a present danger to the constitutional rights and privacy rights of library users.” http://www.librarian.net/technicality.html http://www.librarian.net/technicality.html https://www.gnu.org/philosophy/right-to-read.html https://www.gnu.org/philosophy/right-to-read.html
- handsomeransoms 12y ago
  (Securedrop dev) That's not an implicit encouragement, despite it being your interpretation. Library computers, in my experience, do not typically allow you to install software on them, such as the Tor Browser Bundle, which is needed to access SecureDrop. The explicit encouragement that is clearly written on the landing page is to use a personal computer (not a work computer) and a public network (e.g. a coffee shop).
  - meowface 12y ago
    Apologies, you're completely right. I think I got that impression from something someone else said in this thread.
deleted 12y ago
[deleted]
sp332 12y ago
Tor isn't some magic wand you can wave to get security, but it helps. The core Tor software's job is to conceal your identity from your recipient, and to conceal your recipient and your content from observers on your end. By itself, Tor does not protect the actual communications content once it leaves the Tor network. This can make it useful against some forms of metadata analysis, but this also means Tor is best used in combination with other tools. https://blog.torproject.org/blog/prism-vs-tor https://blog.torproject.org/blog/prism-vs-tor
middleclick 12y ago
I want to ask for citations but I think I will skip. But no, you are wrong.

by lnanek2 12y ago

icebraining 12y ago

Exit nodes are irrelevant for hidden services like WaPo's SecureDrop, the connection never leaves the Tor network.

meowface 12y ago

The NSA leaks reveal that for the most part, Tor is still secure if you're using a sufficient number of intermediary nodes. If anything, the real concern here is the implicit encouragement to use local library computers, which would be much easier for a government agency (or cybercriminal) to infect with malware and observe.

Create 12y ago
“The American Library Association (ALA) opposes any use of governmental power to suppress the free and open exchange of knowledge and information or to intimidate individuals exercising free inquiry…ALA considers that sections of the USA PATRIOT ACT are a present danger to the constitutional rights and privacy rights of library users.” http://www.librarian.net/technicality.html http://www.librarian.net/technicality.html https://www.gnu.org/philosophy/right-to-read.html https://www.gnu.org/philosophy/right-to-read.html
handsomeransoms 12y ago
(Securedrop dev) That's not an implicit encouragement, despite it being your interpretation. Library computers, in my experience, do not typically allow you to install software on them, such as the Tor Browser Bundle, which is needed to access SecureDrop. The explicit encouragement that is clearly written on the landing page is to use a personal computer (not a work computer) and a public network (e.g. a coffee shop).
- meowface 12y ago
  Apologies, you're completely right. I think I got that impression from something someone else said in this thread.

deleted 12y ago

[deleted]

sp332 12y ago

Tor isn't some magic wand you can wave to get security, but it helps. The core Tor software's job is to conceal your identity from your recipient, and to conceal your recipient and your content from observers on your end. By itself, Tor does not protect the actual communications content once it leaves the Tor network. This can make it useful against some forms of metadata analysis, but this also means Tor is best used in combination with other tools. https://blog.torproject.org/blog/prism-vs-tor https://blog.torproject.org/blog/prism-vs-tor

middleclick 12y ago

I want to ask for citations but I think I will skip. But no, you are wrong.