Torservers.net: Professional Global Tor infrastructure

https://mailman.stanford.edu/pipermail/liberationtech/2013-June/008718.html

by mo • 13 years ago

117 24 13 years ago

mailman.stanford.edu

This is ripe for a crowdfunding campaign.

dmix• 13 years ago

Agreed, the non-profits are set up, they just need a big marketing campaign. Crowdfunding pages are good ways to communicate to general audiences.

alan_cx3• 13 years ago

Knowledge gap on my part...

I thought Tor was suspected of being compromised, since is was originally developed by ex-government or military types? Is this the case, is Tor actually accepted as secure and free from government interference?

Also, I vaguely remember concerns about things like child porn being handled by exit points. Were the legal or moral concerns resolved? Or are such concerns accepted as being a thin end of the censorship wedge?

Sprint• 13 years ago

You are victim of fear, uncertainty and doubt.

Tor's security is in its design (which is free and open). And thanks to that it does not matter what the original purpose was. Everyone can run a router and thus contribute to the network.

You can find research on remaining issues in https://blog.torproject.org/category/tags/research

alan_cx3• 13 years ago

I am a "victim" of nothing... yet.

haakon6• 13 years ago

The Tor Project sprung out of a research project at the U.S. Naval Research Laboratory, and to this day a large part of its funding comes from U.S. government sources.

This is entirely fine as far as I can tell - the U.S. interest can be explained as two-fold:

First, it could be a genuine wish to fund projects with potential to support freedom of expression in parts of the world they think need it (Secretary of State Clinton has expressed this as a policy at least once).

Second, and I think this is the more important reason, is that the various intelligence arms in the U.S. need Tor for themselves, in order to provide anonymous means of communications for secret agents and other foreign operatives who work in hostile environments. The important thing to realise is that low-latency mixnets absolutely depend on being widely used by many kinds of users for many purposes, so that each user can hide in the crowd. Therefore Tor absolutely needs to be publicly available - if American spies were its only users, they would stick out like sore thumbs and the entire thing would be hilariously pointless.

Tor is of course open source and can be inspected for backdoors and such, and its design continues to be subject to scrutiny and research. If there is a danger involved, it is an attack where the U.S. government controls sufficiently many Tor nodes in order to be able to do traffic analysis efficiently. So far I don't know of any signs of this, and I question if they would want to sabotage a project that has such a useful potential for themselves.

alan_cx3• 13 years ago

Ok, so the main part is that it is open source, and presumably one can inspect the code and compile it for one's self.

If so, then any government/military/intelligence concerns become irrelevant. Right?

benregenspan2• 13 years ago

Tor is open-source and its developers and supporters include the EFF, Jacob Appelbaum, and others who (if you can trust anyone at all) would not cooperate with government surveillance. But again, it's open-source and lots of security experts regularly look at the code, so it's not so much a matter of blind trust. The reason it was funded by the US government is described at http://cryptome.org/0003/tor-spy.htm -- not because it helps governments to spy on users but precisely the opposite.

The fact that it's very unlikely it was created as part of some conspiracy doesn't mean that it's impossible to compromise a Tor user's anonymity. I'm not an expert but as far as I know the most credible large-scale attack against it is still the one described in this paper: http://wesscholar.wesleyan.edu/cgi/viewcontent.cgi?article=1... . To be successful, it requires controlling a very large proportion of Tor's entry and exit nodes.

benregenspan2• 13 years ago

(But to compromise many users, there might not be a need for a complicated, expensive large-scale attack -- if you can infect someone with malware, it renders whether or not they are using Tor moot).

anologwintermut• 13 years ago

I had a talk with Roger Dingledine(Director of the Tor foundation/ dev on Tor) about this (specifically regarding the NSA, which is who is one everyones mind I assume).

Tor, compromised or not, is completely worthless against an attacker who can monitor the entire network, observe both entry and exit nodes, and correlate packets. The NSA wouldn't bother compromising nodes since they presumably already can see all the traffic and a compromised node might expose them.

frankblizzard• 13 years ago

Afaik a lot of Tor endpoints are actually run by the NSA / secret services. "If people try to use encrypted services they must seek to hide something"

majke2• 13 years ago

It's hard to comment speculations.

But fortunately, even if what you're saying was true you're still safe! Endpoint alone can't tell much about the origin of the connection :)

haakon6• 13 years ago

This is key - Tor's purpose is to help you be anonymous. It does not give you confidentiality; for this you need additional tools (such as SSL).

BMarkmann• 13 years ago

If they're actually following the "correct" way to implement tor routing, wouldn't they still be unable to determine the source / destination? I suppose if they're being shady, though, they could either route only to other known nodes they control, they could still track the traffic.

mike-cardwell2• 13 years ago

The client chooses every node that is used. The client picks the three nodes, and then encrypts the traffic using each of those three nodes public keys in order. Then each node in turn peals off a layer of encryption and passes it on to the next node, which is the only node that is able to decrypt the next layer.

mindslight• 13 years ago

In light of this week's subject of outrage, it's important to point out that TOR doesn't protect against a global adversary sniffing traffic at a significant number of nodes and then correlating sessions.

Torservers.net: Professional Global Tor infrastructure

Related Stories