5 ms·

Yeah this is clearly by someone who doesn't really understand how Tor works. Revealing exit node IP addresses is completely useless—this is a fundamental tenan

Yeah this is clearly by someone who doesn't really understand how Tor works. Revealing exit node IP addresses is completely useless—this is a fundamental tenant of Tor's security. In fact, I believe that at any given time you can easily query the network for a list of all Tor exit nodes. I think the "why I now think Tor is the devil" question is answered in the opening—because it has illegal/immoral stuff on it. I'm not sure why anyone would be surprised about this though... EDIT: In fact, I don't think that the security scanner was even that effective: "around 5-10% of the registered users chose to run the scanner" (later, he changes this to 4-7%) and that "some of the users who opted to run the software appeared to be government or private researchers". I don't know what percentage of people using Tor for illegal activity would be incautious enough to run some random program on their computer, but I would be surprised if it was very high.

geek_slop 11y ago
It was 4-7%. I pre-wrote the article estimating the final numbers and then shut down the site two days early. Traffic dropped suddenly leading me to believe something was up. The exit node IP is not totally useless. It's enough to prompt a knock on your door by the authorities. Granted, once they recognize you're running an exit node there's nothing they can do (otherwise Charter could also be held liable) but still, it can prompt an action by the authorities. My guess that they some were researchers: at least one came from a university IP address while others were very bare-bone machines with minimal running services, possibly virtual machines or test boxes.
- vfdva 11y ago
  "A knock on your door", ha! That's one way to put it.
- girvo 11y ago
  But most Tor users, especially the ones who are using it for disgusting purposes don't run an exit node, so I don't think I understand your point? In addition, Tor exit node IPs are basically public info already.
- aftbit 11y ago
  Here you go, all Tor exit nodes: https://check.torproject.org/exit-addresses https://check.torproject.org/exit-addresses The Tor project does a lot of work to make operating an exit node safer and less likely to prompt the authorities to intervene. This is good, because even if the authorities did want to talk to exit node providers, those people _couldn't_ provide any useful logs.
  - gizmo686 11y ago
    Although they could be made to run a packet sniffer, which could provide useful information.
    - utuxia 11y ago
      But the traffic between nodes is encrypted. All they may get is the previous node's IP address....then they have to start over. Go find that node operator and get them to do the same.
- icehawk 11y ago
  The exit node IP is run by an unrelated third party. Unless they're logging all of the traffic going through the exit node they have an extremely limited idea of what the exit node is doing.
userbinator 11y ago
I don't know what percentage of people using Tor for illegal activity would be incautious enough to run some random program on their computer, but I would be surprised if it was very high. I think it would certainly depend on the type of "illegal activity"; it's quite plausible that those looking for drugs or counterfeiting are going to have much higher suspicion and opsec than porn-driven pedophiles, leading to the difference in number of registrations at each honeypot.
- htns 11y ago
  Another thing is that Tor is global. People might not think twice about their security when they are effectively within the law or at worst may get a fine.
vacri 11y ago
> this is a fundamental tenant might be a typo, but just in case - a 'tenet' is a rule or principle, a 'tenant' is an occupier.
- nightpool 11y ago
  huh, I guess I just always assumed they were homonyms. Thanks!

geek_slop 11y ago

It was 4-7%. I pre-wrote the article estimating the final numbers and then shut down the site two days early. Traffic dropped suddenly leading me to believe something was up. The exit node IP is not totally useless. It's enough to prompt a knock on your door by the authorities. Granted, once they recognize you're running an exit node there's nothing they can do (otherwise Charter could also be held liable) but still, it can prompt an action by the authorities. My guess that they some were researchers: at least one came from a university IP address while others were very bare-bone machines with minimal running services, possibly virtual machines or test boxes.

vfdva 11y ago
"A knock on your door", ha! That's one way to put it.
girvo 11y ago
But most Tor users, especially the ones who are using it for disgusting purposes don't run an exit node, so I don't think I understand your point? In addition, Tor exit node IPs are basically public info already.
aftbit 11y ago
Here you go, all Tor exit nodes: https://check.torproject.org/exit-addresses https://check.torproject.org/exit-addresses The Tor project does a lot of work to make operating an exit node safer and less likely to prompt the authorities to intervene. This is good, because even if the authorities did want to talk to exit node providers, those people _couldn't_ provide any useful logs.
- gizmo686 11y ago
  Although they could be made to run a packet sniffer, which could provide useful information.
  - utuxia 11y ago
    But the traffic between nodes is encrypted. All they may get is the previous node's IP address....then they have to start over. Go find that node operator and get them to do the same.
icehawk 11y ago
The exit node IP is run by an unrelated third party. Unless they're logging all of the traffic going through the exit node they have an extremely limited idea of what the exit node is doing.

userbinator 11y ago

I don't know what percentage of people using Tor for illegal activity would be incautious enough to run some random program on their computer, but I would be surprised if it was very high. I think it would certainly depend on the type of "illegal activity"; it's quite plausible that those looking for drugs or counterfeiting are going to have much higher suspicion and opsec than porn-driven pedophiles, leading to the difference in number of registrations at each honeypot.

htns 11y ago
Another thing is that Tor is global. People might not think twice about their security when they are effectively within the law or at worst may get a fine.

vacri 11y ago

> this is a fundamental tenant might be a typo, but just in case - a 'tenet' is a rule or principle, a 'tenant' is an occupier.

nightpool 11y ago
huh, I guess I just always assumed they were homonyms. Thanks!