4 ms·

Repeating a comment I made 3 days ago: (https://news.ycombinator.com/item?id=8449909 https://news.ycombinator.com/item?id=8449909) Note that Tor is still bei

Repeating a comment I made 3 days ago: (https://news.ycombinator.com/item?id=8449909 https://news.ycombinator.com/item?id=8449909) Note that Tor is still being actively funded by US law enforcement (http://pando.com/2014/07/16/tor-spooks/) and that Tor's security has been repeatedly broken by US law enforcement in order to take down sites illegal under US law. (http://www.wired.com/2014/09/fbi- silk-road-hacking-question/) It is debatable if Tor provides any more security than just using someone else's open wifi point. Great for evading bans on online forums, worthless against the DEA.

deepblueocean 12y ago
I think that's less than constructive. We know that intelligence and law enforcement have significant issues with Tor [1] that mostly are overcome by people missing the point of what Tor does and having bad operational security in general. Also, when parts of the government have attacked the security provided by Tor, it's been visible (and kind of hamhanded) [2]. [1] http://cryptome.org/2013/10/nsa-tor-stinks.pdf http://cryptome.org/2013/10/nsa-tor-stinks.pdf [2] https://freedom-to-tinker.com/blog/felten/why-were-cert-researchers-attacking-tor/ https://freedom-to-tinker.com/blog/felten/why-were-cert-rese...
somemacsysadmin 12y ago
No, it's really not debatable. If it were, you should have presented the argument with some evidence.
tatterdemalion 12y ago
This comment is really off base (and so is the pando story it's based on). First, TOR is being funded by the DoD, which is not a US law enforcement agency. The US government conflates the military and police enough for everyone without its critics doing so as well. Second, yes, TOR is funded by the DoD because having a network that enables US agents to anonymize themselves from entities other than the US government is in the interest of the US government. And yes, the US government is also trying to deanonymize TOR traffic because TOR users being knowable by the US government is /also/ in the interest of the US government. None of this is surprising or strange or fishy at all. And none of it is evidence that the TOR developers have made any compromises on anonymity. The US government may be able to deanonymize TOR traffic; that's bad, but I have ever confidence that the TOR developers are trying to do something about it.
- pinkyand 12y ago
  > I have ever confidence that the TOR developers are trying to do something about it. The basic architecture of TOR is limited theoretically with regards to some types of attacks it can handle.TOR developers probably cannot do anything about that. And in some sense , supporting TOR is taking funding and attention from better anonimity technologies , that might be able to do the job , with enough development. That's another reason why the US government is investing in TOR.
  - privong 12y ago
    > The basic architecture of TOR is limited theoretically with regards to some types of attacks it can handle. Would you mind providing some links on this topic? This is the first I have heard of this particular assertion and I would be interested to read more.
    - pyre 12y ago
      There are attacks that can be done by making sure that you own enough of the nodes on the network. Similar to the attacks against the Bitcoin network if you controler >50% of the miners.
    - papaf 12y ago
      Below is a link to a very readable review: https://gnunet.org/sites/default/files/DD08Survey.pdf https://gnunet.org/sites/default/files/DD08Survey.pdf
    - ObviousScience 12y ago
      The original Tor proposal has a pretty good summary of the threats they do and don't deal with, and other sections cover the project goals and how they address these threats. > A global passive adversary is the most commonly assumed threat when analyzing theoretical anonymity designs. But like all practical low-latency systems, Tor does not protect against such a strong adversary. Instead, we assume an adversary who can observe some fraction of network traffic; who can generate, modify, delete, or delay traffic; who can operate onion routers of his own; and who can compromise some fraction of the onion routers. > In low-latency anonymity systems that use layered encryption, the adversary's typical goal is to observe both the initiator and the responder. By observing both ends, passive attackers can confirm a suspicion that Alice is talking to Bob if the timing and volume patterns of the traffic on the connection are distinct enough; active attackers can induce timing signatures on the traffic to force distinct patterns. Rather than focusing on these traffic confirmation attacks, we aim to prevent traffic analysis attacks, where the adversary uses traffic patterns to learn which points in the network he should attack. > Our adversary might try to link an initiator Alice with her communication partners, or try to build a profile of Alice's behavior. He might mount passive attacks by observing the network edges and correlating traffic entering and leaving the network — by relationships in packet timing, volume, or externally visible user-selected options. The adversary can also mount active attacks by compromising routers or keys; by replaying traffic; by selectively denying service to trustworthy routers to move users to compromised routers, or denying service to users to see if traffic elsewhere in the network stops; or by introducing patterns into traffic that can later be detected. The adversary might subvert the directory servers to give users differing views of network state. Additionally, he can try to decrease the network's reliability by attacking nodes or by performing antisocial activities from reliable nodes and trying to get them taken down — making the network unreliable flushes users to other less anonymous systems, where they may be easier to attack. We summarize in Section 7 how well the Tor design defends against each of these attacks. From the Tor proposal: https://svn.torproject.org/svn/projects/design-paper/tor-design.html#subsec:threat-model https://svn.torproject.org/svn/projects/design-paper/tor-des...

deepblueocean 12y ago

I think that's less than constructive. We know that intelligence and law enforcement have significant issues with Tor [1] that mostly are overcome by people missing the point of what Tor does and having bad operational security in general. Also, when parts of the government have attacked the security provided by Tor, it's been visible (and kind of hamhanded) [2]. [1] http://cryptome.org/2013/10/nsa-tor-stinks.pdf http://cryptome.org/2013/10/nsa-tor-stinks.pdf [2] https://freedom-to-tinker.com/blog/felten/why-were-cert-researchers-attacking-tor/ https://freedom-to-tinker.com/blog/felten/why-were-cert-rese...

somemacsysadmin 12y ago

No, it's really not debatable. If it were, you should have presented the argument with some evidence.

tatterdemalion 12y ago

This comment is really off base (and so is the pando story it's based on). First, TOR is being funded by the DoD, which is not a US law enforcement agency. The US government conflates the military and police enough for everyone without its critics doing so as well. Second, yes, TOR is funded by the DoD because having a network that enables US agents to anonymize themselves from entities other than the US government is in the interest of the US government. And yes, the US government is also trying to deanonymize TOR traffic because TOR users being knowable by the US government is /also/ in the interest of the US government. None of this is surprising or strange or fishy at all. And none of it is evidence that the TOR developers have made any compromises on anonymity. The US government may be able to deanonymize TOR traffic; that's bad, but I have ever confidence that the TOR developers are trying to do something about it.

pinkyand 12y ago
> I have ever confidence that the TOR developers are trying to do something about it. The basic architecture of TOR is limited theoretically with regards to some types of attacks it can handle.TOR developers probably cannot do anything about that. And in some sense , supporting TOR is taking funding and attention from better anonimity technologies , that might be able to do the job , with enough development. That's another reason why the US government is investing in TOR.
- privong 12y ago
  > The basic architecture of TOR is limited theoretically with regards to some types of attacks it can handle. Would you mind providing some links on this topic? This is the first I have heard of this particular assertion and I would be interested to read more.
  - pyre 12y ago
    There are attacks that can be done by making sure that you own enough of the nodes on the network. Similar to the attacks against the Bitcoin network if you controler >50% of the miners.
  - papaf 12y ago
    Below is a link to a very readable review: https://gnunet.org/sites/default/files/DD08Survey.pdf https://gnunet.org/sites/default/files/DD08Survey.pdf
  - ObviousScience 12y ago
    The original Tor proposal has a pretty good summary of the threats they do and don't deal with, and other sections cover the project goals and how they address these threats. > A global passive adversary is the most commonly assumed threat when analyzing theoretical anonymity designs. But like all practical low-latency systems, Tor does not protect against such a strong adversary. Instead, we assume an adversary who can observe some fraction of network traffic; who can generate, modify, delete, or delay traffic; who can operate onion routers of his own; and who can compromise some fraction of the onion routers. > In low-latency anonymity systems that use layered encryption, the adversary's typical goal is to observe both the initiator and the responder. By observing both ends, passive attackers can confirm a suspicion that Alice is talking to Bob if the timing and volume patterns of the traffic on the connection are distinct enough; active attackers can induce timing signatures on the traffic to force distinct patterns. Rather than focusing on these traffic confirmation attacks, we aim to prevent traffic analysis attacks, where the adversary uses traffic patterns to learn which points in the network he should attack. > Our adversary might try to link an initiator Alice with her communication partners, or try to build a profile of Alice's behavior. He might mount passive attacks by observing the network edges and correlating traffic entering and leaving the network — by relationships in packet timing, volume, or externally visible user-selected options. The adversary can also mount active attacks by compromising routers or keys; by replaying traffic; by selectively denying service to trustworthy routers to move users to compromised routers, or denying service to users to see if traffic elsewhere in the network stops; or by introducing patterns into traffic that can later be detected. The adversary might subvert the directory servers to give users differing views of network state. Additionally, he can try to decrease the network's reliability by attacking nodes or by performing antisocial activities from reliable nodes and trying to get them taken down — making the network unreliable flushes users to other less anonymous systems, where they may be easier to attack. We summarize in Section 7 how well the Tor design defends against each of these attacks. From the Tor proposal: https://svn.torproject.org/svn/projects/design-paper/tor-design.html#subsec:threat-model https://svn.torproject.org/svn/projects/design-paper/tor-des...