10 ms·

The People Who Risk Jail to Maintain the Tor Network

209 points by Errorcod3 11y ago

paulhauggis 11y ago
I think Tor is great, but I just can't trust the people operating the exit nodes.
- 2close4comfort 11y ago
  You are wise not to. Not everyone who is an exit is on your side. It is better to assume that they are going to do everything nasty possible to you and your data.
  - cpncrunch 11y ago
    Also, you should probably assume that the FBI is monitoring the exit node you are using.
    - Uhhrrr 11y ago
      Or running it.
      - belorn 11y ago
        And the Internet connection you are using.
- mindslight 11y ago
  Why would you ever have to? (see also: The Internet is great, but I just can't trust the organizations running the backbone.)
  - cwyers 11y ago
    Well, except the backbone has no alternatives, and the whole point of something like Tor is to mitigate one's lack of trust in the people running the backbone. If Tor is insecure, all you're gaining by using it is letting a bunch of three-letter agencies know that your traffic is potentially more interesting than the average.
    - Absentinsomniac 11y ago
      I think the idea is, yeah, we can have untrustworthy exit nodes, but that's already anticipated as a potential threat so everyone should know better and use https as much as possible, among other means of encrypting exit data. Doesn't Tor at least try to encrypt even exit data as much as it can? Like the browser bundle even comes with https everywhere.
- Buge 11y ago
  Yes, many exit nodes are malicious. That's why you should always use https when using tor.
  - mrsteveman1 11y ago
    I've seen at least one exit node present an invalid certificate for any requested https:// https:// url, but that's loud and obvious.
    - schoen 11y ago
      If you let the Tor developers know about this, they can mark it as a BadExit.
at-fates-hands 11y ago
So what are options besides Tor right now? Is anybody working on anything more secure?
- patcon 11y ago
  I2P?
- dublinben 11y ago
  It depends on what you're looking for. Tor is still the best at what it does. Alternatives like Freenet solve completely different problems.
zupreme 11y ago
This is actually a good piece. It sticks to the facts without an evident attempt to push an agenda either for or against Tor. The operator ("Richard") seems relatable to a fellow tech like myself, and by the end of reading this I found myself thinking, "Maybe I should run an exit node too, since I have used Tor quite a bit". All in all, a good piece.
plg 11y ago
I thought Tor originated with the U.S. navy?
- fiatmoney 11y ago
  It did. And the State Department & CIA use it to promote subversion activities in other countries. And the FBI and NSA try to crack it & discourage its use to monitor everyone's traffic. "The government" isn't a monolith; it's made of quasi-independent agencies often operating at cross purposes.
  - dzhiurgis 11y ago
    > "The government" isn't a monolith; And somehow individual is expected to be.
  - plg 11y ago
    it's just strange to me that on the one hand parts of the government would be trying to "crack" this system that ... other parts of the government came up with wouldn't it render the system not-as-useful if it were to be "cracked" or weakened?
- AJ007 11y ago
  And still funded by the Federal government.
fiatmoney 11y ago
Every paragraph of this piece has me yelling "NEVER TALK TO THE POLICE" at my monitor. Had they wanted to, it would have been incredibly easy for the FBI to spin any of the many quotes in this article into a "false statement" and an insta-felony, just out of spite. If you're going to run an exit node, find an attorney beforehand. You don't necessarily need to put them on retainer, but figure out who you're going to call instead of walking into an FBI field office like, frankly, an idiot.
- mg1982 11y ago
  It reminds me of the astounding naivete of Aaron Swartz's girlfriend (or whatever she was at the time) in talking to the FBI and then being surprised that they were just looking for shit to pile on him and nothing else. Don't talk to the cops: https://www.youtube.com/watch?v=i8z7NC5sgik https://www.youtube.com/watch?v=i8z7NC5sgik
  - ternaryoperator 11y ago
    And if they ring your doorbell and ask to come in, the answer is "No, we'll talk outside." Once you let them in, anything they see is fair game.
    - yodsanklai 11y ago
      Could such a behavior make you more suspicious, and get you into more trouble?
      - rjaco31 11y ago
        They could find this suspicious and search harder for bogus stuff, but the point is it's your right and thus it cannot be held against you in court. Talking too much & giving them enough materials for false testimony or pseudo-confession is way more dangerous.
      - jklein11 11y ago
        The key is to be polite but assertive. If you yell from behind your door "Hell no PIG! You're never coming inside and it is my RIGHT to say no!!" then it may arouse suspicion. If instead you say " I'm sorry, I wasn't expecting company and my place is a mess. Lets talk outside instead." they will likely not think twice about it. If you treat a cop like the human they are they will probably be more trusting. Funny how that works...
christianbryant 11y ago
It's a moral responsibility to cooperate with law enforcement when they are trying to track criminals like pedophiles, terrorists or similarly malicious persons. I don't think there should be any argument there, Tor operator or not. However, we have every right to anonymity and to encrypt our communications and data such that only those we want to see it can. So what to do? Perhaps Tor operators can perform some act of vigilantism and expose criminals like the above without incriminating themselves through booting out and releasing the data of the pedophiles, terrorists and what have you. Being a revolutionary and a lover of freedom is not a crime, and the criminals who give us a bad name are making it one.
- golemotron 11y ago
  > It's a moral responsibility to cooperate with law enforcement when they are trying to track criminals like pedophiles, terrorists or similarly malicious persons. I don't think there should be any argument there, Tor operator or not. The sage advice is to help but at your lawyer's discretion. Never talk to law enforcement without a lawyer. It is dangerous and never in your interest. https://www.youtube.com/watch?v=6wXkI4t7nuc https://www.youtube.com/watch?v=6wXkI4t7nuc
  - christianbryant 11y ago
    No argument here on that note :-)
- maxlybbert 11y ago
  > Perhaps Tor operators can perform some act of vigilantism and expose criminals like the above without incriminating themselves through booting out and releasing the data of the pedophiles, terrorists and what have you. If Tor allows the exit nodes to access that data, (1) it's not very secure, and (2) it won't be long before the ability to monitor that data will become an obligation to monitor it.
  - simoncion 11y ago
    You may already know, but in case you don't: Tor exit nodes get access to: 1) The network traffic that they've been asked to proxy. 2) The IP address of the previous hop in the Tor network that relayed that traffic to them. IIRC, Tor currently runs a regular request through an entry node, a -er- middle node, and an exit node.
aestetix 11y ago
It's worth noting that if you want to support Tor exit nodes but do not want to run your own, you can donate to the Noisetor project. Noisebridge, a 501c3 nonprofit, has sponsored an exit node for several years now: http://www.noisetor.net http://www.noisetor.net
- liotier 11y ago
  And the French equivalent: https://nos-oignons.net https://nos-oignons.net
mirimir 11y ago
> For this reason, and others listed on the Tor Project website, operators are strongly advised to only run their exits remotely, by renting out server space. Better yet, do that anonymously. Always work via Tor. Use a false identity. Pay with well-mixed Bitcoins. Observe good OPSEC.
- TazeTSchnitzel 11y ago
  That doesn't sound like a good idea. When law enforcement come knocking, your position is less defensible if you seem to be trying to hide your tracks.
  - mirimir 11y ago
    If your OPSEC is adequate, they won't know where to come knocking.
    - rjaco31 11y ago
      I get your point, but it's more of an ideological battle here. Those people want to be legally allowed to run an exit node, not to use a compromised box & hide their tracks.
      - mirimir 11y ago
        That's a great ideal, and I wish them success. I'm more pragmatic. Raids are life-changing experiences, even if nobody gets killed, or ends up in prison. And where I live, freedom to legally run Tor exit nodes is limited, with poor prospects of increasing. I am not recommending the use of compromised servers. I'm recommending anonymous leasing from legitimate providers, which are located in jurisdictions that are unlikely to freely cooperate with your home jurisdiction. Ideally you run Tor-ramdisk, and store the node's credentials in another anonymous server, so there are no logs. This is rather like preemptively not talking to police except through your attorney.

209 points by Errorcod3 11y ago

paulhauggis 11y ago

I think Tor is great, but I just can't trust the people operating the exit nodes.

2close4comfort 11y ago
You are wise not to. Not everyone who is an exit is on your side. It is better to assume that they are going to do everything nasty possible to you and your data.
- cpncrunch 11y ago
  Also, you should probably assume that the FBI is monitoring the exit node you are using.
  - Uhhrrr 11y ago
    Or running it.
    - belorn 11y ago
      And the Internet connection you are using.
mindslight 11y ago
Why would you ever have to? (see also: The Internet is great, but I just can't trust the organizations running the backbone.)
- cwyers 11y ago
  Well, except the backbone has no alternatives, and the whole point of something like Tor is to mitigate one's lack of trust in the people running the backbone. If Tor is insecure, all you're gaining by using it is letting a bunch of three-letter agencies know that your traffic is potentially more interesting than the average.
  - Absentinsomniac 11y ago
    I think the idea is, yeah, we can have untrustworthy exit nodes, but that's already anticipated as a potential threat so everyone should know better and use https as much as possible, among other means of encrypting exit data. Doesn't Tor at least try to encrypt even exit data as much as it can? Like the browser bundle even comes with https everywhere.
Buge 11y ago
Yes, many exit nodes are malicious. That's why you should always use https when using tor.
- mrsteveman1 11y ago
  I've seen at least one exit node present an invalid certificate for any requested https:// https:// url, but that's loud and obvious.
  - schoen 11y ago
    If you let the Tor developers know about this, they can mark it as a BadExit.

at-fates-hands 11y ago

So what are options besides Tor right now? Is anybody working on anything more secure?

patcon 11y ago
I2P?
dublinben 11y ago
It depends on what you're looking for. Tor is still the best at what it does. Alternatives like Freenet solve completely different problems.

zupreme 11y ago

This is actually a good piece. It sticks to the facts without an evident attempt to push an agenda either for or against Tor. The operator ("Richard") seems relatable to a fellow tech like myself, and by the end of reading this I found myself thinking, "Maybe I should run an exit node too, since I have used Tor quite a bit". All in all, a good piece.

plg 11y ago

I thought Tor originated with the U.S. navy?

fiatmoney 11y ago
It did. And the State Department & CIA use it to promote subversion activities in other countries. And the FBI and NSA try to crack it & discourage its use to monitor everyone's traffic. "The government" isn't a monolith; it's made of quasi-independent agencies often operating at cross purposes.
- dzhiurgis 11y ago
  > "The government" isn't a monolith; And somehow individual is expected to be.
- plg 11y ago
  it's just strange to me that on the one hand parts of the government would be trying to "crack" this system that ... other parts of the government came up with wouldn't it render the system not-as-useful if it were to be "cracked" or weakened?
AJ007 11y ago
And still funded by the Federal government.

fiatmoney 11y ago

Every paragraph of this piece has me yelling "NEVER TALK TO THE POLICE" at my monitor. Had they wanted to, it would have been incredibly easy for the FBI to spin any of the many quotes in this article into a "false statement" and an insta-felony, just out of spite. If you're going to run an exit node, find an attorney beforehand. You don't necessarily need to put them on retainer, but figure out who you're going to call instead of walking into an FBI field office like, frankly, an idiot.

mg1982 11y ago
It reminds me of the astounding naivete of Aaron Swartz's girlfriend (or whatever she was at the time) in talking to the FBI and then being surprised that they were just looking for shit to pile on him and nothing else. Don't talk to the cops: https://www.youtube.com/watch?v=i8z7NC5sgik https://www.youtube.com/watch?v=i8z7NC5sgik
- ternaryoperator 11y ago
  And if they ring your doorbell and ask to come in, the answer is "No, we'll talk outside." Once you let them in, anything they see is fair game.
  - yodsanklai 11y ago
    Could such a behavior make you more suspicious, and get you into more trouble?
    - rjaco31 11y ago
      They could find this suspicious and search harder for bogus stuff, but the point is it's your right and thus it cannot be held against you in court. Talking too much & giving them enough materials for false testimony or pseudo-confession is way more dangerous.
    - jklein11 11y ago
      The key is to be polite but assertive. If you yell from behind your door "Hell no PIG! You're never coming inside and it is my RIGHT to say no!!" then it may arouse suspicion. If instead you say " I'm sorry, I wasn't expecting company and my place is a mess. Lets talk outside instead." they will likely not think twice about it. If you treat a cop like the human they are they will probably be more trusting. Funny how that works...

christianbryant 11y ago

It's a moral responsibility to cooperate with law enforcement when they are trying to track criminals like pedophiles, terrorists or similarly malicious persons. I don't think there should be any argument there, Tor operator or not. However, we have every right to anonymity and to encrypt our communications and data such that only those we want to see it can. So what to do? Perhaps Tor operators can perform some act of vigilantism and expose criminals like the above without incriminating themselves through booting out and releasing the data of the pedophiles, terrorists and what have you. Being a revolutionary and a lover of freedom is not a crime, and the criminals who give us a bad name are making it one.

golemotron 11y ago
> It's a moral responsibility to cooperate with law enforcement when they are trying to track criminals like pedophiles, terrorists or similarly malicious persons. I don't think there should be any argument there, Tor operator or not. The sage advice is to help but at your lawyer's discretion. Never talk to law enforcement without a lawyer. It is dangerous and never in your interest. https://www.youtube.com/watch?v=6wXkI4t7nuc https://www.youtube.com/watch?v=6wXkI4t7nuc
- christianbryant 11y ago
  No argument here on that note :-)
maxlybbert 11y ago
> Perhaps Tor operators can perform some act of vigilantism and expose criminals like the above without incriminating themselves through booting out and releasing the data of the pedophiles, terrorists and what have you. If Tor allows the exit nodes to access that data, (1) it's not very secure, and (2) it won't be long before the ability to monitor that data will become an obligation to monitor it.
- simoncion 11y ago
  You may already know, but in case you don't: Tor exit nodes get access to: 1) The network traffic that they've been asked to proxy. 2) The IP address of the previous hop in the Tor network that relayed that traffic to them. IIRC, Tor currently runs a regular request through an entry node, a -er- middle node, and an exit node.

aestetix 11y ago

It's worth noting that if you want to support Tor exit nodes but do not want to run your own, you can donate to the Noisetor project. Noisebridge, a 501c3 nonprofit, has sponsored an exit node for several years now: http://www.noisetor.net http://www.noisetor.net

liotier 11y ago
And the French equivalent: https://nos-oignons.net https://nos-oignons.net

mirimir 11y ago

> For this reason, and others listed on the Tor Project website, operators are strongly advised to only run their exits remotely, by renting out server space. Better yet, do that anonymously. Always work via Tor. Use a false identity. Pay with well-mixed Bitcoins. Observe good OPSEC.

TazeTSchnitzel 11y ago
That doesn't sound like a good idea. When law enforcement come knocking, your position is less defensible if you seem to be trying to hide your tracks.
- mirimir 11y ago
  If your OPSEC is adequate, they won't know where to come knocking.
  - rjaco31 11y ago
    I get your point, but it's more of an ideological battle here. Those people want to be legally allowed to run an exit node, not to use a compromised box & hide their tracks.
    - mirimir 11y ago
      That's a great ideal, and I wish them success. I'm more pragmatic. Raids are life-changing experiences, even if nobody gets killed, or ends up in prison. And where I live, freedom to legally run Tor exit nodes is limited, with poor prospects of increasing. I am not recommending the use of compromised servers. I'm recommending anonymous leasing from legitimate providers, which are located in jurisdictions that are unlikely to freely cooperate with your home jurisdiction. Ideally you run Tor-ramdisk, and store the node's credentials in another anonymous server, so there are no logs. This is rather like preemptively not talking to police except through your attorney.