6 ms·

If you think the Tor project is working on an important problem, consider running a relay. It's inexpensive, easy to administer, no hassle (if not an exit) and

If you think the Tor project is working on an important problem, consider running a relay. It's inexpensive, easy to administer, no hassle (if not an exit) and I think the scale is such that a couple thousand additional relays would make a noticeable difference to the network. You can even have it AWS where it will get automatic updates with almost no effort: https://cloud.torproject.org/ https://cloud.torproject.org/ If you want to run it on OS X: https://tor.stackexchange.com/questions/6567/how-do-i-manually-setup-a-relay-on-os-x https://tor.stackexchange.com/questions/6567/how-do-i-manual... I think it's pretty cool that you can help enable people to safely bypass censorship/surveillance from across the world.

rocky1138 11y ago
What sort of legal protections does Canada have for people running a Tor node?
- Zikes 11y ago
  A relay which is not an exit is practically zero risk. The design of the Tor system means you'll be receiving an encrypted packet from one source, unwrapping one layer of encryption, and passing it on to the next relay in the chain, with no knowledge of the original source, final destination, or true packet contents.
drinknderive 11y ago
What sort of legal protections does USA have for people running a Tor node?
- anfedorov 11y ago
  It's probably legal, but it hasn't yet been tested in courts: https://www.torproject.org/eff/tor-legal-faq.html.en https://www.torproject.org/eff/tor-legal-faq.html.en
- pfg 11y ago
  Generally speaking, running a relay node is considered to be fairly safe and hassle-free. Running an exit node is more of a hassle, you'll usually be receiving a lot of DMCA notices and a lot of ISPs won't permit running exit nodes from their network. There has been at least one case outside of the US where an exit node operator was prosecuted and found guilty of aiding in distributing child porn [1]. [1]: https://www.techdirt.com/articles/20140701/18013327753/tor-nodes-declared-illegal-austria.shtml https://www.techdirt.com/articles/20140701/18013327753/tor-n...
youaresolam3 11y ago
What sort of legal protections does Mexico have for people running a Tor node?
anfedorov 11y ago
> safely bypass surveillance from across the world Is this true, for a global passive adversary? If all of the nodes which route your link go through a friendly IC that shares ToR traffic patterns, I'm pretty sure traffic analysis can disclose where you are browsing or which hidden service you are visiting (or at least where it's hosted). Does anyone know more about how a ToR link is chosen, whether you can control it, and what some alternatives might be?
- noondip 11y ago
  From https://svn.torproject.org/svn/projects/design-paper/tor-design.html https://svn.torproject.org/svn/projects/design-paper/tor-des...: A global passive adversary is the most commonly assumed threat when analyzing theoretical anonymity designs. But like all practical low-latency systems, Tor does not protect against such a strong adversary.
  - moe 11y ago
    Since the global passive adversary is now a reality (NSA) it seems like Tor is broken by design.
    - tokenizerrr 11y ago
      Not everyone is hiding from the NSA.
      - andreyf 11y ago
        So ToR is like a shitty free VPN? Who can one be hiding from that a cheap VPN to a jurisdiction of your choice won't solve much better?
        tokenizerrr 11y ago
        No, it's not. It's also not written ToR. I recommend you venture over to their website and start reading the documentation.
devicenull 11y ago
> You can even have it AWS where it will get automatic updates with almost no effort: https://cloud.torproject.org/ https://cloud.torproject.org/ I guess you didn't click on your own link.... > As of May 8, 2015, the Tor Cloud project has been discontinued.
- fossuser 11y ago
  Wow yeah - you're right, I haven't checked in on mine in a while and assumed it was good (just pasted the link). Thanks for pointing that out.
jakobdabo 11y ago
Will running a relay decrease the chances of my guard nodes fingerprinting me (because of other people's injected traffic)? Or maybe the relay traffic is completely different and detectable from the the normal Tor usage traffic?
- fossuser 11y ago
  I'm speculating, but I'd suspect that your traffic connects and initially passes through your guard node while traffic passing through your relay is probably going to other nodes in the network (since guard nodes are used for initial connections and as a relay you're already the middle node). In this case it wouldn't help conceal anything extra from your guard node. For those who don't know, guard nodes are the nodes you initially connect to. In Tor once established, your first hop is always to the same node - this is because it's assumed some nodes are bad actors and if the first node is randomly selected each time your chance of eventually connecting to a node trying to collect information is high and partial compromise isn't much better than fully compromised. By selecting and using one guard node for your initial connection it's either a bad actor or not, but if it isn't then you're good to go from then on. When you run a relay if your relay is fast, stable and online for a while (60 days I think) the Tor network will automatically turn your relay into a guard.
jolan 11y ago
> no hassle (if not an exit) Not 100% true, your server's IP will be banned along side the IPs of exit nodes. It seems a lot of blacklists don't bother to make the distinction. https://www.reddit.com/r/TOR/comments/2abne1/hulu_blocked_after_setting_up_tor_nonexit_relay/ https://www.reddit.com/r/TOR/comments/2abne1/hulu_blocked_af... https://trac.torproject.org/projects/tor/wiki/org/doc/ListOfServicesBlockingTor https://trac.torproject.org/projects/tor/wiki/org/doc/ListOf...
- fossuser 11y ago
  Good point - I did notice this with Hulu, but haven't seen it elsewhere.
- driverdan 11y ago
  I've been running a relay at home for most of this year. The only site I've had issues accessing is Apple's shitty support forums. No big loss.
kerkeslager 11y ago
My sibling comment points out that Tor Cloud is discontinued anyway, but I have some concerns about running a relay on a cloud provider. If a lot of people do this, it seems like it could pose a risk to Tor users' anonymity. Tor works by bouncing traffic across a few nodes. In an ideal case, these nodes are run by different people in different countries, so even if a vulnerability in a server or legal action exposes the traffic across a single relay, the other nodes are not accessible to the attacker and the users' anonymity is maintained. If a large number of people start running nodes on cloud services, then this centralizes the nodes under the control of Amazon or whatever cloud provider. Even if you trust Amazon (there are many use cases where you shouldn't) a vulnerability in their cloud services could expose data from ALL of the nodes running on their cloud. I haven't done any specific analysis on this, but my guess is that if 5% of the nodes in the Tor relay system had their data completely exposed, the nodes would include all the nodes along routes for a significant number of users. Combine this with traffic analysis and other attacks, and even more users could be de-anonymized. I'm by no means an expert on Tor, so I can't say with confidence whether or not this is a concern. Perhaps someone with more knowledge will weigh in.
- pfg 11y ago
  One interesting thing I read recently is that, when building a circuit, Tor actively avoids picking more than one relay sharing a common attack vector. Basically, it will not pick more than one relay with the same family id, router or /16 subnet. Your point is still valid, since AWS and other big web hosts like OVH obviously have a lot of /16 subnets and distinct router addresses, but it's good to see this was anticipated by the design.
  - kerkeslager 11y ago
    Yeah, that's super interesting. To be fair, I suspect there is already a similar problem simply due to economics: running a relay costs money, so the vast majority of relays are running in the first world, which correlates well with countries that have extradition treaties with the US, for example.
- hueving 11y ago
akshatpradhan 11y ago
If you want to run a tor exit node, you can improve the security by subscribing to a rigorous hygiene process that provides accountability of your security upkeep. * System Hardening * Log Monitoring * Intrusion Prevention * Write proceses * Perimeter Control A compromised tor exit node is no good because all it takes is switching on NetFlow and all those sensitive packets are captured. http://motherboard.vice.com/read/how-the-nsa-or-anyone-else-can-crack-tors-anonymity http://motherboard.vice.com/read/how-the-nsa-or-anyone-else-...

rocky1138 11y ago

What sort of legal protections does Canada have for people running a Tor node?

Zikes 11y ago
A relay which is not an exit is practically zero risk. The design of the Tor system means you'll be receiving an encrypted packet from one source, unwrapping one layer of encryption, and passing it on to the next relay in the chain, with no knowledge of the original source, final destination, or true packet contents.

drinknderive 11y ago

What sort of legal protections does USA have for people running a Tor node?

anfedorov 11y ago
It's probably legal, but it hasn't yet been tested in courts: https://www.torproject.org/eff/tor-legal-faq.html.en https://www.torproject.org/eff/tor-legal-faq.html.en
pfg 11y ago
Generally speaking, running a relay node is considered to be fairly safe and hassle-free. Running an exit node is more of a hassle, you'll usually be receiving a lot of DMCA notices and a lot of ISPs won't permit running exit nodes from their network. There has been at least one case outside of the US where an exit node operator was prosecuted and found guilty of aiding in distributing child porn [1]. [1]: https://www.techdirt.com/articles/20140701/18013327753/tor-nodes-declared-illegal-austria.shtml https://www.techdirt.com/articles/20140701/18013327753/tor-n...

youaresolam3 11y ago

What sort of legal protections does Mexico have for people running a Tor node?

anfedorov 11y ago

> safely bypass surveillance from across the world Is this true, for a global passive adversary? If all of the nodes which route your link go through a friendly IC that shares ToR traffic patterns, I'm pretty sure traffic analysis can disclose where you are browsing or which hidden service you are visiting (or at least where it's hosted). Does anyone know more about how a ToR link is chosen, whether you can control it, and what some alternatives might be?

noondip 11y ago
From https://svn.torproject.org/svn/projects/design-paper/tor-design.html https://svn.torproject.org/svn/projects/design-paper/tor-des...: A global passive adversary is the most commonly assumed threat when analyzing theoretical anonymity designs. But like all practical low-latency systems, Tor does not protect against such a strong adversary.
- moe 11y ago
  Since the global passive adversary is now a reality (NSA) it seems like Tor is broken by design.
  - tokenizerrr 11y ago
    Not everyone is hiding from the NSA.
    - andreyf 11y ago
      So ToR is like a shitty free VPN? Who can one be hiding from that a cheap VPN to a jurisdiction of your choice won't solve much better?
      - tokenizerrr 11y ago
        No, it's not. It's also not written ToR. I recommend you venture over to their website and start reading the documentation.

devicenull 11y ago

> You can even have it AWS where it will get automatic updates with almost no effort: https://cloud.torproject.org/ https://cloud.torproject.org/ I guess you didn't click on your own link.... > As of May 8, 2015, the Tor Cloud project has been discontinued.

fossuser 11y ago
Wow yeah - you're right, I haven't checked in on mine in a while and assumed it was good (just pasted the link). Thanks for pointing that out.

jakobdabo 11y ago

Will running a relay decrease the chances of my guard nodes fingerprinting me (because of other people's injected traffic)? Or maybe the relay traffic is completely different and detectable from the the normal Tor usage traffic?

fossuser 11y ago
I'm speculating, but I'd suspect that your traffic connects and initially passes through your guard node while traffic passing through your relay is probably going to other nodes in the network (since guard nodes are used for initial connections and as a relay you're already the middle node). In this case it wouldn't help conceal anything extra from your guard node. For those who don't know, guard nodes are the nodes you initially connect to. In Tor once established, your first hop is always to the same node - this is because it's assumed some nodes are bad actors and if the first node is randomly selected each time your chance of eventually connecting to a node trying to collect information is high and partial compromise isn't much better than fully compromised. By selecting and using one guard node for your initial connection it's either a bad actor or not, but if it isn't then you're good to go from then on. When you run a relay if your relay is fast, stable and online for a while (60 days I think) the Tor network will automatically turn your relay into a guard.

jolan 11y ago

> no hassle (if not an exit) Not 100% true, your server's IP will be banned along side the IPs of exit nodes. It seems a lot of blacklists don't bother to make the distinction. https://www.reddit.com/r/TOR/comments/2abne1/hulu_blocked_after_setting_up_tor_nonexit_relay/ https://www.reddit.com/r/TOR/comments/2abne1/hulu_blocked_af... https://trac.torproject.org/projects/tor/wiki/org/doc/ListOfServicesBlockingTor https://trac.torproject.org/projects/tor/wiki/org/doc/ListOf...

fossuser 11y ago
Good point - I did notice this with Hulu, but haven't seen it elsewhere.
driverdan 11y ago
I've been running a relay at home for most of this year. The only site I've had issues accessing is Apple's shitty support forums. No big loss.

kerkeslager 11y ago

My sibling comment points out that Tor Cloud is discontinued anyway, but I have some concerns about running a relay on a cloud provider. If a lot of people do this, it seems like it could pose a risk to Tor users' anonymity. Tor works by bouncing traffic across a few nodes. In an ideal case, these nodes are run by different people in different countries, so even if a vulnerability in a server or legal action exposes the traffic across a single relay, the other nodes are not accessible to the attacker and the users' anonymity is maintained. If a large number of people start running nodes on cloud services, then this centralizes the nodes under the control of Amazon or whatever cloud provider. Even if you trust Amazon (there are many use cases where you shouldn't) a vulnerability in their cloud services could expose data from ALL of the nodes running on their cloud. I haven't done any specific analysis on this, but my guess is that if 5% of the nodes in the Tor relay system had their data completely exposed, the nodes would include all the nodes along routes for a significant number of users. Combine this with traffic analysis and other attacks, and even more users could be de-anonymized. I'm by no means an expert on Tor, so I can't say with confidence whether or not this is a concern. Perhaps someone with more knowledge will weigh in.

pfg 11y ago
One interesting thing I read recently is that, when building a circuit, Tor actively avoids picking more than one relay sharing a common attack vector. Basically, it will not pick more than one relay with the same family id, router or /16 subnet. Your point is still valid, since AWS and other big web hosts like OVH obviously have a lot of /16 subnets and distinct router addresses, but it's good to see this was anticipated by the design.
- kerkeslager 11y ago
  Yeah, that's super interesting. To be fair, I suspect there is already a similar problem simply due to economics: running a relay costs money, so the vast majority of relays are running in the first world, which correlates well with countries that have extradition treaties with the US, for example.
hueving 11y ago

akshatpradhan 11y ago

If you want to run a tor exit node, you can improve the security by subscribing to a rigorous hygiene process that provides accountability of your security upkeep. * System Hardening * Log Monitoring * Intrusion Prevention * Write proceses * Perimeter Control A compromised tor exit node is no good because all it takes is switching on NetFlow and all those sensitive packets are captured. http://motherboard.vice.com/read/how-the-nsa-or-anyone-else-can-crack-tors-anonymity http://motherboard.vice.com/read/how-the-nsa-or-anyone-else-...