Hacker News Reader

Comment by dogma1138 | Hacker News Reader

Not a single intelligence agency or diplomatic service will rely on ToR for security that’s madness.

A properly configured commercial or open source VPN is considerably more reliable and secure than ToR since you have no idea who is listening on the exit nodes or who can execute unmasking attacks by traffic shaping or monitoring if they control enough relays.

For the most part any country which can perform intelligence collection out of its embassy will have sufficient budget and and technical capacity to develop their own secure means of phoning home.

Also for highly sensitive material a diplomatic pouch is still the most secure means of transport as it never leaves your sight and is never inspected and if you do get intercepted then destroying physical media is much easier than securing network traffic to the same level of assurance.

View on HN

>Not a single intelligence agency or diplomatic service will rely on ToR for security that’s madness... For the most part any country which can perform intelligence collection out of its embassy will have sufficient budget and and technical capacity to develop their own secure means of phoning home.

The CIA has it's own onion service: ciadotgov4sjwlzihbbgxnqg3xiyrg7so2r2o3lt5wz5ypk4sxyjstad.onion

Tor was developed by the US naval research lab, it was opened up because an anonymity network only spooks use isn't anonymous.

Smart intelligence agencies are not going to reinvent the wheel (or in this case, the onion router).

>A properly configured commercial or open source VPN is considerably more reliable and secure than ToR since you have no idea who is listening on the exit nodes

If traffic is encrypted this does not matter. (HTTPS also provides integrity checking to show messages were not modified in transit)

Also, traffic to onion services does not exit the Tor network - there is no "exit node"

>Also for highly sensitive material a diplomatic pouch is still the most secure means of transport as it never leaves your sight and is never inspected and if you do get intercepted then destroying physical media is much easier than securing network traffic to the same level of assurance.

They may use diplomatic pouches for especially sensitive information, but the need for low latency communication is strong. What's more likely is that one time pad codes for said communications are sent via pouch, and the communication itself then goes over Tor or some other channel.

HTTPS with SNI leaks what one visits, and if an adversary controls enough of the network they could also use timing attacks.

Yes but why would you use a single hop VPN instead of Tor? Wouldn't both leak that?

(Also it's my understanding Tor uses the exit node's DNS server)

Why would embassies need to be anonymous?

If I needed to design a secure system that didn't need to be anonymous I'd just have it send a HD full of random in a diplomatic pouch & ensure that the packets are sent with encrypted 0s if there isn't anything to say.

And that's only if you think that there isn't a safe pubic key protocol.

Bitcoin's security model relies on public key encryption & there is an extremely large bounty on breaking it. There doesn't seem to be evidence of it being broken yet.

Wow I wonder how much compute it took them to generate that hidden service name.

I tried one of the older, shorter .onion addresses once out of interest. Didn't take long on a laptop to get a specified 7 characters at the beginning.

I don't know how much the longer .onions affects generation time - anyone?

Is there a script to do that or did you roll your own?

I used https://github.com/katmagic/Shallot back then and it took 35221958203 attempts to find one with my chosen seven characters.

For the longer v3 .onions you'll want a different tool, this page mentions some and makes some estimates for finding increasing lengths of characters: https://www.jamieweb.net/blog/onionv3-vanity-address/

Unless they communicate via a hidden service, in which case there is no exit node, so that particular problem is easy to avoid.

Reply on news.ycombinator.com