Hacker News Reader

Comment by londons_explore | Hacker News Reader

I'm hoping someone secretly deploys tor nodes onto all of these 200 million connections, and tor (or something like it) becomes the defacto standard for connecting to the internet.

Privacy matters more now than it did in the 1980's, and in todays age, having every website operator see your IP address isn't really cool.

View on HN

I'm not comfortable with sharing my internet connection with other people. Also, some people are on metered and / or low bandwidth internet connections.

Not just that. The reality is, unfortunately, that Tor is used for a whole bunch of illegal activities too. Most notably child pornagrahpy.

I wouldn't want that kind of traffic flowing through my IP address, even if it was only for legal reasons.

This is really only a concern if you are an exit node, which is not something that people are encouraged to do without experience and measures in place to knowingly protect themselves.

If you are just a relay, the content is encrypted and your chances of liability are low. Same goes if you are promoted to a guard node.

i used to run a tor node but then my bank blocked me because i was a tor node, even though i wasn't an exit node. that alone was too much of a hassle so i stopped doing it. i also work from home now and vpn to work at a really big company that it wouldn't surprise me if they would notice i ran a tor node with whatever edge security they have. so there are very valid reasons to not even run a tor node from home.

> i used to run a tor node but then my bank blocked me because i was a tor node, even though i wasn't an exit node. that alone was too much of a hassle so i stopped doing it. i also work from home now and vpn to work at a really big company that it wouldn't surprise me if they would notice i ran a tor node with whatever edge security they have. so there are very valid reasons to not even run a tor node from home.

How did the bank block you? By blocking your ip or your user account?

my ip. when i would visit their website it would say they don't allow tor. a week or two after i disabled my node they unblocked my ip.

If you run an exit node on you home internet connection _EVERYTTHING_ that sits behind cloudflare will recaptcha you on every page load. It's easy for service providers to get a list of all tor exit nodes and then blacklist them. If your home IP is an exit node, even non tor traffic coming from regular browsing on your machine is indistinguishable from actual tor traffic. 3

Cox is also very prone to turning off your internet at random times due to botnet traffic looking like it's originating from inside your network.

I'm with you but parent specifically said they were not running an exit node.

> If you are just a relay, the content is encrypted and your chances of liability are low.

It's not just liability, for me it's also ethics. It gives me piece of mind that I am not contributing towards these practices.

But being an ordinary relay means you are still being used as a hop for people to connect to hidden services. Do you think hidden services are less ethically dubious than clearnet services?

I think you're misunderstanding their argument. They don't want to be an exit node because they don't want to share their public IP (liability), nor do they want to be a relay because they don't want to help route to hidden services (ethics).

How's your piece of mind being complacent in the surveillance and persecution of innocent victims?

Based on that argument we shouldn't have the internet because some users will do unethical things with it.

You really shouldn't do anything for that matter.

You pay your taxes used to pay for bombs to kill people.

Sometimes you have to look at the big picture when making ethical decisions.

> You pay your taxes used to pay for bombs to kill people.

Paying tax is mandatory, unlike installing a tor node on your modem.

Not just that. The reality is, unfortunately, that money is used for a whole bunch of illegal activities too. Most notably child pornagrahpy. I wouldn't want that kind of currency flowing through my house, even if it was only for legal reasons.

Comcast in the US (idk ++millions of users) by default enables a 2nd WiFi network that is open to all of their subscribers. Is convenient, amusing, and annoying, depending on perspective.

To be fair - it is rate-limited and QoS-managed and traffic doesn’t count towards your usage limit (if you have one).

Back when I was a Comcast customer I did find it useful when I was in an area with no - or too slow - mobile-data connections.

Also, I believe using other people's xfinitywifi doesn't count towards your bandwidth.

BT in the UK does a similar thing - called "Fon"

I assume that traffic on that network is always qossed to lowest priority, but I've never used it (I don't use a BT router)

I glad to hear that Fon is still around. Back when they were giving out free AP's I snagged a couple and they were my first foray into hardware hacking. Neat little devices, I always felt a bit guilty about not using them to actually deploy fon hotspots.

A year or two ago they sent an email to all of us with 1st gen FON hardware and said they were retiring it and that we'd have to buy a new one. I didn't.

They never disabled my account - I not get worldwide FON roaming for free forever - yay!

Virgin Media do this too, your box is by default something like VM123456-[2|5]G and an (optional) 'community' hotspot (like FON) of VirginMedia

Who would trust Tor if one party controls 200 million nodes?

I've theorized the 50 percent attacks have already been executed at the nation state level for a long time now, but that many nodes could reduce the effectiveness of the current 50 attack. Unless of course the same three letter did both...

I don't know if 50percent attacks exist on Tor, but in Tor, you don't need a 50percent attack, all you need is to attack the single Entry Guard a target uses.

https://nakedsecurity.sophos.com/2015/08/03/can-you-trust-to...

I think 50 percent attacks apply to any supposedly decentralized service don't they?

It doesn't seem to be feasible using this vulnerability:

> Cable Haunt is exploited in two steps. First, access to the vulnerable endpoint is gained through a client on the local network, such as a browser. (emphasis mine)

That means loading a webpage from the internet, which then runs the exploit in javascript on your local machine. Tricking users to load the page through phishing or through ads served from shady ad networks is ‘all’ it takes

Thank you for the correction.

This is almost certainly exploitable remotely with a DNS rebinding attack.

You don't need any fancy rebinding attacks. That's a bit 2001 era web hacking :)

This issue is based on WebSockets where the software on the modem:

a) Doesn't verify any of the origin headers sent, so any origin works (rebinding is designed to beat origin checks)

b) Copies an uploaded message straight onto the stack without doing any size checks

@thu2111 He's giving you an attack chain. If you rebind the dns server of the modem with a snmp/tr069 exploit you could redirect/inject into the http traffic a page that contained the javascript payload to exploit the Cable Haunt vulnerabiliy against the Spectrum Analyser endpoint. Because websockets doesn't use CORS to restrict the requesting hosts domain to the modem, you could execute code on the gateway modem from the internet with the combination of a client on the remote network running a http request from a browser combined with an alternative dns rebinding attack against the gateway and a server hosting the malicious websockets payload on a http server.

Edit: or you could get them to click on a link

Sibling comments mention hacked web pages and DNS rebinding. I imagine there are also many of these routers that still have unpatched issues with SNMP, like "stringbleed". https://www.bleepingcomputer.com/news/security/several-cable...

It also seems to require that the attacker knows the credentials for the modem.

They are virtually always either the manufacturers default credentials or the carriers default credentials. Anyone can find the former, and all one has to do is find a pliable tech to get the latter.

Reply on news.ycombinator.com