Hacker News Reader

Comment by ed25519FUUU | Hacker News Reader

Tor is a project I want to like and support, but can’t. I feel (and I have no evidence) that for every 1 person using it to protect their privacy, 20 are using it for despicable purposes. I would love to be proved wrong on this.

I don’t want to shut it down, but at the same time I don’t feel I can personally or technically support it.

View on HN

FWIW, I have been doing all of my non-multimedia browsing over Tor for about a decade now. It provides cover traffic for people who actually need the anonymity and I feel like it is a step in the right direction to frustrate state and corporate surveillance.

Some sites break, but I have observed less and less sites breaking compared to a few years ago. Also browsing is fast enough as to not be distracting, it is like being on a mobile internet connection all the time. It is still lousy to come across sites which don't serve even static content to Tor users. I can understand going into a read-only mode, but throwing an HTTP 403?

This comment, posted from Tor :)

Out of curiosity, since you log into accounts via Tor, are you still concerned about exit node snooping these days? Do you enable the strict mode in HTTPS Everywhere, or do you trust that site-enforced HTTPS is enough?

Not the grandparent, but I've been doing the same (almost only for a couple of years) and yes I trust site-enforced HTTPS.

To anyone who last tried Tor years ago: It really got quite fast. I don't notice a difference to my native connection.

and tell us, what kind of activity requires such anonymity?

Asking for opinions on pictures of one's private parts while avoiding someone connecting that to your identity. I mean asking "is that pimple on my scrotum an STD", not advertising them.

good example but few non technical people would even know about tor, i am sure there are better options that dont necessarily help criminals hide there tracks

If you lived in a country with strict media censorship would you oppose its relaxation just because you felt that bad people would exploit the resulting situation? I've read somewhere that over the last decades people in Western countries have accepted a gradual diminution of their civil liberties in order to protect society from terrorists. That's how totalitarian regimes have persuaded populations before, in fact Goering explained how it works at his trial. Privacy should be the default and just because bad people will exploit that is no reason to deprive society at large of it. The police etc will just need to work with that limitation.

You would be surprised by who uses it. Iran and other places have a serious need for tor.

https://metrics.torproject.org/userstats-bridge-table.html

Yes, many places have a serious need for Tor. But the bridge stats are misleading because bridges are exclusivity for circumventing censorship.

The stats for tor relays [0] are different:

    United States   418568 (20.37 %)
    Russia          335382 (16.32 %)
    Germany         172251 (8.38 %)
    France           92643 (4.51 %)
    Netherlands      76496 (3.72 %)
    United Kingdom   68674 (3.34 %)
    Indonesia        61917 (3.01 %)
    Ukraine          50331 (2.45 %)
    Canada           48246 (2.35 %)
    India            43953 (2.14 %)

Out of the roughly 66.5% of relay users represented here, 42.5% are from western countries.

[0]: https://metrics.torproject.org/userstats-relay-table.html

You should normalize those numbers for population at least, or better for share of non-Tor traffic.

I personally don't trust Five Eyes any more than any other country.

loads of pedos and criminals love hiding via that network, and those who run it likely know it, but they defend it as “privacy” and “freedom” yet this stat shows its being used in somewhat free countries.

While I'm sure you're right about some of Tor's users, there are plenty of perfectly valid (and legal) reasons for using tor in free countries too.

I imagine the same is true for the use of guns. I’ve operated a middle/guard relay for little over a year now 24/7, and I keep doing it for that one person who genuinely need it.

Gun is a good analogy I think, and I do support personal gun ownership. But I wouldn’t loan people my gun unless I was 100% sure they wouldn’t use it for anything illegal. Even 99.999% doesn’t really cut it for me.

And probably 19 out of 20 of those despicable purposes involve buying weed edibles and shrooms.

But if the 20th is used for child pornography or human trafficking it might not matter that the other 19th just want to get high.

People use the regular internet for "nefarious" purposes. Should we not support the internet? Cars are used to haul human traffic victims, do we ban cars? How about electricity? It powers everything now, the internet, even cars, do we ban that too? People will find ways to do bad shit in every medium and that doesn't mean the medium is bad.

Maybe a weird question here. I have no doubt there's a disturbing amount of kiddie porn going over Tor. I'm sure it's served somewhere, and those who browse it have good reason to want to hide their IPs, since LE likes to seize the servers and track down everyone who viewed it by IP.

But how would Tor be used in human trafficking? I guess the people running it might email each other or something, but why bother doing that over Tor? I would guess the victims are mostly found in-person in low-income areas, probably no internet involved at all, so no point in using Tor. I would also think that if we're talking sex trafficking, the customers are also more of a street corner or in person deal than over the net. Even if the customers are finding it over the net, I haven't heard of anyone seizing whole servers for it and tracing them by IP. Am I missing something here? I just don't see it.

Author here. I thought of it as "is one person escaping an authoritarian regime to communicate freely worth more or less than ten people buying drugs?". A criminal will always find another way to engage in criminal activities, but can a news reporter or activist find another safe way to communicate? I felt as though the benefits to users using tor for legitimate purposes, outweighed the users who used tor maliciously.

I'd be less concerned about drugs and more about human trafficking or child pornography.

Purely speculation but I strongly suspect the subset of malicious tor users engaging in child pornography and human trafficking is extremely, extremely small. The largest group of malicious users is most likely drug and cybercrime related. Is it worth decrying tor as a heaven for pedophiles or human traffickers if they make up a negligible number of users? If so, the same could easily be said about bitcoin or any other decentralised cryptocurrency. The benefits given to journalists, activists, or any individual who wants anonymity for the sake of pricacy is worth more, to me, than maybe helping a negligible number of users. Further, those malicious users would likely find another way to engage in their activities but could the legitimate users?

There are a bunch of similar projects where such people could (and likely already are) move: I2P, Freenet, GNUnet, and probably some others. So closing (or not supporting) Tor just because some bad actors are there is pointless. Every tool can be used for both good and bad things.

If you feel like people use technology for despicable purposes, wouldn't you also think that bad governments would do even worse things if Tor did not exist?

Same things are said about all encryption technologies. And kitchen knife is the most popular murder weapon.

I think we call things rights only if someone potentially wants to take them. If no one ever took or would ever take a specific right from anyone, I don't see what's the point of calling that a right.

for every right, there are situations where someone stands to gain something from denying it. Therefore financial gain, stopping the bad guys are not in themselves sufficient excuse to deny innocent people their rights.

This admittedly causes an asymmetry making the abolition of rights much costlier than their recognition.

but I'd argue that's a good thing, as it reduces ladder pulling where people only recognize rights in the periods where it suits them. And in the long run results in people having more recognized rights.

Real strange that the mob here is downvoting you - you are right, tor is used by criminals. i’d stay away from it as it has nothing to do with being “anonymous” for...”privacy”.

I run most of my in-home apps as Tor hidden services, simply because it's a very easy way to get traffic in past multiple layers of NATs and firewalls, given that I always have a Tor enabled browser available on my remote phones and other devices.

> despicable purposes

not least; probing those others who want to protect their privacy

I highly doubt that 95% are using it for despicable purposes, so I have no ethical concerns with running a Tor relay at home, using Tor regularly, and financially supporting the Tor project.

Why? Well, the most obvious "usable for despicable purposes" feature is .onion services. Today, .onion service traffic makes up about 2% of Tor traffic[1] and the largest .onion service by far is Facebook[2] (served at https://facebookcorewwwi.onion/). So even if we assume that all traffic other than to Facebook is for nefarious purposes (which is not correct given that we know there are other very popular and legal services operating as .onion services), you're looking at much less than 2% of all Tor traffic at best being nefarious. I doubt that the same statistic for clearnet traffic is significantly better.

Now, you might argue that most of the clearnet browsing over Tor is nefarious and that focusing on Onion services is a distraction. But that doesn't really match up with reality either. CloudFlare has claimed in the past that 94% of (clearnet) Tor traffic they see is malicious (meaning "DDoS or spam" not "illegal or immoral content")[3] but they provided no justification for this figure, and at the same time Akamai published a study[4] which found that there is no statistically significant difference when it comes to e-commerce behaviour when comparing Tor users and the regular internet. The Tor Project postulated[5] that this claim by CloudFlare was based on them marking exit nodes as being malicious rather than individual connections from exit nodes and CloudFlare hasn't really responded to that in the past 4 years.

My point is that the 95% figure you posited doesn't pass the sniff test. That means that 1.9 million of the daily users of Tor are all using it for nefarious purposes. If you just count a handful of countries with well-known internet censorship (Brazil, Venezuela, Iran, Egypt, and China) you already have passed the 5% mark of daily Tor users.

[1]: If you compare the onion service and total daily Tor traffic (https://metrics.torproject.org/), you find that it's about 4 Gbit/s out of a total 200 Gbit/s -- so around 2% at time of writing.

[2]: https://www.facebook.com/notes/facebook-over-tor/1-million-p...

[3]: https://blog.cloudflare.com/the-trouble-with-tor/

[4]: https://www.stateoftheinternet.com/downloads/pdfs/state-of-t...

[5]: https://blog.torproject.org/trouble-cloudflare

You could say the same for cash.

Do you really believe 95% of cash transaction are for despicable purposes?

It's actually not that far of the mark. There's a LOT more cash out there than you probably think, and no one really know where is it and what's it being used for.

As an example, 80% of the bills in circulation in the US are 100$ bills. It's so much cash that "The average person would be having to carry around 35 or 36 of them in their house or in their wallet. This is for every man, woman, and child."

And according to the federal reserve, the demand for large bills comes mostly from border states - Florida, California and Texas.

Source: https://freakonomics.com/podcast/still-using-cash/

Its very likely skewed, such that 95% of the transactions are innocent but 95% of the value is despicable.

(for some value of 95%)

Most likely, the vast majority are not in circulation but stored somewhere and are outside the US anyway. A stack of $100 bills is probably the best long-term investment for illegal funds that will be used at some point in the future. It's relatively easy to transport, valid until eternity (other than e.g. UK where bills are taken out of circulation every few years or decades) and accepted world wide.

Depends on what you think is despicable. That's the problem with setting limits on freedom.

e-crimes are victimless crimes

Sometimes there are victims. https://nakedsecurity.sophos.com/2020/06/12/facebook-paid-fo...

I really can't consider that man a victim.

Maybe I want clear, if maybe you're joking. I was thinking of his victims.

Ah fair enough then. Yes, I had not considered this case of blackmailing.

I think you've got the wrong definition of Hacker for HN.

If someone was sharing a nude photo of you as a child for sexual purposes, you would not consider yourself a victim?

Reply on news.ycombinator.com