5 ms·

Assuming it's a legal entity that will be performing these seizures, I'm curious to know the case against these servers. To my (albeit somewhat limited) knowled

by jwcrux 12y ago

Assuming it's a legal entity that will be performing these seizures, I'm curious to know the case against these servers. To my (albeit somewhat limited) knowledge of the Tor network, these DA's exist solely to maintain the integrity and structure of the network, and to provide a list of known relays to clients. I also understand that this list of trusted DA's is hardcoded into Tor clients. Since this is the case, I'd be curious how the network could be restored if there is a coordinated action on these servers.

catshirt 12y ago
"I also understand that this list of trusted DA's is hardcoded into Tor clients" forgive my ignorance, why would they do this in the first place? fear of MITM?
- click170 12y ago
  I think so. It wouldn't be very secure of Tor could be over-riden by an ISP inserting a bad DNS record in their servers.
- boklm 12y ago
  Because the clients need to get the list of nodes from somewhere. You can read more about how this works at this URL: https://gitweb.torproject.org/torspec.git/tree/dir-spec.txt https://gitweb.torproject.org/torspec.git/tree/dir-spec.txt
  - catshirt 12y ago
    just because they need a list of nodes doesn't mean they need to be hardcoded into the client. the other option of course would be to fetch the list remotely.
    - eli 12y ago
      From what? A directory directory server?
      - MichaelGG 12y ago
        From any peer? If the list is signed by a majority set of keys then it doesn't matter how it gets distributed.
        eli 12y ago
        Isn't finding a peer the original problem?
        catshirt 12y ago
        ah, point taken. i didn't think too hard about this apparently. if they had a host serving a list of trusted DAs, that host would be just as valuable a target.
        MichaelGG 12y ago
        Any Tor node could be a peer to distributed a signed piece of data.
        deleted 12y ago
        [deleted]
        eli 12y ago
        Yes, but how does one locate a tor node without a directory server?
        MichaelGG 12y ago
        Maybe like Bittorrent DHT? The client could keep a cache of other known nodes. You could share them on pastebin versus having them b only hard coded. You could preloaded a hundred peer nodes, instead of 9 master nodes. It doesn't strictly eliminate the problem, but it makes it less likely that one or two governments can just shut it all down.
        acebarry 12y ago
cjbprime 12y ago
The project would have to publish new source code containing new servers, and get everyone to upgrade immediately. I don't think there would be another way to restore the network (which is by design).
higherpurpose 12y ago
The Sony hack will probably be used as an excuse, whether that's the main reason or not. That's how the US gov operates now. They take advantage of certain situations to pass or do stuff that normally would have no chance of passing, even if those situations are barely related to what they're trying to pass. Example: The Patriot Act written many years before 9/11 by law enforcement agencies to help them in the War on Drugs, and then shamelessly used the 9/11 excuse to pass it. If the Patriot Act was "just about terrorists", then it should've referred only to terrorists. But it didn't. And now 99 percent of NSLs are used in drug cases.
- declan 12y ago
  I'm not sure if the above comment is downvoted because of the Patriot Act claim, but that claim happens to be correct. I wrote about this for CNET here: http://www.cnet.com/news/how-bin-laden-and-911-attacks-shaped-electronic-privacy/ http://www.cnet.com/news/how-bin-laden-and-911-attacks-shape... "Long before 9/11, the U.S. Department of Justice drafted the so-called Enhancement of Privacy and Public Safety in Cyberspace Act (PDF), which goes by the awkward and not very memorable acronym of EPPSCA. In July 2000, the Clinton administration forwarded EPPSCA to Congress, where it was introduced by Sen. Patrick Leahy (D-Vt.) and met with a generally chilly response... EPPSCA was designed to give police more authority to conduct Internet surveillance, not thwart terrorists armed with box cutters... within hours of the 9/11 attacks, the Justice Department had dusted off EPPSCA as a way to respond to bin Laden. On September 13, 2001, two days after the worst terrorist attack in U.S. history, the U.S. Senate approved the "Combating Terrorism Act of 2001," which includes portions copied directly from EPPSCA." As for the rest of the above comment, this is likely to be a fluid situation and I'm reserving judgment until we know more. It is possible that the good folks at Tor are wrong (I'd like them to be!) and no seizure happens. Government authorities sometimes bluff.
  - deleted 12y ago
    [deleted]
jwcrux 12y ago
Also - I've added more information here: https://news.ycombinator.com/item?id=8775530 https://news.ycombinator.com/item?id=8775530
acaloiar 12y ago
I think it is worth noting that, while hard-coded, this line suggests that the DA list can be overridden ( https://gitweb.torproject.org/tor.git/tree/src/or/config.c#n910 https://gitweb.torproject.org/tor.git/tree/src/or/config.c#n... ). Theoretically this should allow the Tor project to provision replacement servers and publish their IP addresses without modifying the "hard-coded" list in every Tor client. With that said, I know very little about Tor and this comment should be taken with a boulder of salt.

by jwcrux 12y ago

catshirt 12y ago

"I also understand that this list of trusted DA's is hardcoded into Tor clients" forgive my ignorance, why would they do this in the first place? fear of MITM?

click170 12y ago
I think so. It wouldn't be very secure of Tor could be over-riden by an ISP inserting a bad DNS record in their servers.
boklm 12y ago
Because the clients need to get the list of nodes from somewhere. You can read more about how this works at this URL: https://gitweb.torproject.org/torspec.git/tree/dir-spec.txt https://gitweb.torproject.org/torspec.git/tree/dir-spec.txt
- catshirt 12y ago
  just because they need a list of nodes doesn't mean they need to be hardcoded into the client. the other option of course would be to fetch the list remotely.
  - eli 12y ago
    From what? A directory directory server?
    - MichaelGG 12y ago
      From any peer? If the list is signed by a majority set of keys then it doesn't matter how it gets distributed.
      - eli 12y ago
        Isn't finding a peer the original problem?
        catshirt 12y ago
        ah, point taken. i didn't think too hard about this apparently. if they had a host serving a list of trusted DAs, that host would be just as valuable a target.
        MichaelGG 12y ago
        Any Tor node could be a peer to distributed a signed piece of data.
        deleted 12y ago
        [deleted]
        eli 12y ago
        Yes, but how does one locate a tor node without a directory server?
        MichaelGG 12y ago
        Maybe like Bittorrent DHT? The client could keep a cache of other known nodes. You could share them on pastebin versus having them b only hard coded. You could preloaded a hundred peer nodes, instead of 9 master nodes. It doesn't strictly eliminate the problem, but it makes it less likely that one or two governments can just shut it all down.
        acebarry 12y ago

cjbprime 12y ago

The project would have to publish new source code containing new servers, and get everyone to upgrade immediately. I don't think there would be another way to restore the network (which is by design).

higherpurpose 12y ago

The Sony hack will probably be used as an excuse, whether that's the main reason or not. That's how the US gov operates now. They take advantage of certain situations to pass or do stuff that normally would have no chance of passing, even if those situations are barely related to what they're trying to pass. Example: The Patriot Act written many years before 9/11 by law enforcement agencies to help them in the War on Drugs, and then shamelessly used the 9/11 excuse to pass it. If the Patriot Act was "just about terrorists", then it should've referred only to terrorists. But it didn't. And now 99 percent of NSLs are used in drug cases.

declan 12y ago
I'm not sure if the above comment is downvoted because of the Patriot Act claim, but that claim happens to be correct. I wrote about this for CNET here: http://www.cnet.com/news/how-bin-laden-and-911-attacks-shaped-electronic-privacy/ http://www.cnet.com/news/how-bin-laden-and-911-attacks-shape... "Long before 9/11, the U.S. Department of Justice drafted the so-called Enhancement of Privacy and Public Safety in Cyberspace Act (PDF), which goes by the awkward and not very memorable acronym of EPPSCA. In July 2000, the Clinton administration forwarded EPPSCA to Congress, where it was introduced by Sen. Patrick Leahy (D-Vt.) and met with a generally chilly response... EPPSCA was designed to give police more authority to conduct Internet surveillance, not thwart terrorists armed with box cutters... within hours of the 9/11 attacks, the Justice Department had dusted off EPPSCA as a way to respond to bin Laden. On September 13, 2001, two days after the worst terrorist attack in U.S. history, the U.S. Senate approved the "Combating Terrorism Act of 2001," which includes portions copied directly from EPPSCA." As for the rest of the above comment, this is likely to be a fluid situation and I'm reserving judgment until we know more. It is possible that the good folks at Tor are wrong (I'd like them to be!) and no seizure happens. Government authorities sometimes bluff.
- deleted 12y ago
  [deleted]

jwcrux 12y ago

Also - I've added more information here: https://news.ycombinator.com/item?id=8775530 https://news.ycombinator.com/item?id=8775530

acaloiar 12y ago

I think it is worth noting that, while hard-coded, this line suggests that the DA list can be overridden ( https://gitweb.torproject.org/tor.git/tree/src/or/config.c#n910 https://gitweb.torproject.org/tor.git/tree/src/or/config.c#n... ). Theoretically this should allow the Tor project to provision replacement servers and publish their IP addresses without modifying the "hard-coded" list in every Tor client. With that said, I know very little about Tor and this comment should be taken with a boulder of salt.