4 ms·

Ok so VPN's and Tor aren't compromised. It's China's web services servers that are. Please refrain from making clickbait-y styled topic titles.

by jjar 11y ago

hackerboos 11y ago
To be fair, it's the NYT that has the "clickbait-y styled topic title".
- phil_s_stein 11y ago
  The NYT title, "Chinese Hackers Circumvent Popular Web Privacy Tools", is more accurate than the HN title. China has not "compromised" TOR and VPNs, they've circumvented them. They remain intact and working as designed. "Compromosed" is the wrong word here. "Circumvent" is the correct word.
mfoy_ 11y ago
Although the method of the attack didn't directly break Tor/VPN, the nature of it has compromised confidence in those technologies. What good is using Tor or a VPN if I can't be sure any web page I load will compromise me? Suddenly every single link becomes a potential land mine... is the web server compromised? Is it safe? You could argue that, of course, loading a malicious web page will do malicious things. But in this case, the malicious code is compromising all further web activity as well from the sounds of it.
- the8472 11y ago
  AIUI the issue only occurs when you're browsing through tor with a browser profile that also contains logins to chinese websites linked to your identity. This is why you shouldn't run your regular browser session through TOR for critical work and use the tor browser bundle instead, with a separate profile, with a as-paranoid-as-possible configuration (minimal cross-site requests! use µMatrix, not just noscript) if you really want to information leakage. Tor itself can only do so much, it doesn't magically prevent your browser from telling the world that you're person X.
  - mo 11y ago
    Tor Browser protects against these sorts of attacks very well. Just don't use Tor with a regular browser. https://twitter.com/torproject/status/610542145305464832 https://twitter.com/torproject/status/610542145305464832
frik 11y ago
@dang: if one flags such a click-baity headline, will the account get banned/shadowed for that task? How do I know if my account has crossed the invisible line? Who can check that? The karma ratio indicator vanished from the profile page. HN title reads: China has now compromised VPNs and Tor
- dang 11y ago
  I'm not sure I understand your question, but we don't ban accounts for either flagging or producing clickbaity headlines. I only saw your question by chance. To reliably get a response, please email hn@ycombinator.com.
acaloiar 11y ago
If one must click-bait, go all-in: "The Shockingly Disturbing and Weirdly Beautiful Chinese Compromise of VPNs and Tor"

Ok so VPN's and Tor aren't compromised. It's China's web services servers that are. Please refrain from making clickbait-y styled topic titles.

by jjar 11y ago

Ok so VPN's and Tor aren't compromised. It's China's web services servers that are. Please refrain from making clickbait-y styled topic titles.

hackerboos 11y ago

To be fair, it's the NYT that has the "clickbait-y styled topic title".

phil_s_stein 11y ago
The NYT title, "Chinese Hackers Circumvent Popular Web Privacy Tools", is more accurate than the HN title. China has not "compromised" TOR and VPNs, they've circumvented them. They remain intact and working as designed. "Compromosed" is the wrong word here. "Circumvent" is the correct word.

mfoy_ 11y ago

Although the method of the attack didn't directly break Tor/VPN, the nature of it has compromised confidence in those technologies. What good is using Tor or a VPN if I can't be sure any web page I load will compromise me? Suddenly every single link becomes a potential land mine... is the web server compromised? Is it safe? You could argue that, of course, loading a malicious web page will do malicious things. But in this case, the malicious code is compromising all further web activity as well from the sounds of it.

the8472 11y ago
AIUI the issue only occurs when you're browsing through tor with a browser profile that also contains logins to chinese websites linked to your identity. This is why you shouldn't run your regular browser session through TOR for critical work and use the tor browser bundle instead, with a separate profile, with a as-paranoid-as-possible configuration (minimal cross-site requests! use µMatrix, not just noscript) if you really want to information leakage. Tor itself can only do so much, it doesn't magically prevent your browser from telling the world that you're person X.
- mo 11y ago
  Tor Browser protects against these sorts of attacks very well. Just don't use Tor with a regular browser. https://twitter.com/torproject/status/610542145305464832 https://twitter.com/torproject/status/610542145305464832

frik 11y ago

@dang: if one flags such a click-baity headline, will the account get banned/shadowed for that task? How do I know if my account has crossed the invisible line? Who can check that? The karma ratio indicator vanished from the profile page. HN title reads: China has now compromised VPNs and Tor

dang 11y ago
I'm not sure I understand your question, but we don't ban accounts for either flagging or producing clickbaity headlines. I only saw your question by chance. To reliably get a response, please email hn@ycombinator.com.

acaloiar 11y ago

If one must click-bait, go all-in: "The Shockingly Disturbing and Weirdly Beautiful Chinese Compromise of VPNs and Tor"