Hacker News Reader

Comment by rank0 | Hacker News Reader

Because most voters think it’s a shitty take. It’s a hell of a lot easier to identify a vpn user or compel a vpn provider than to perform timing/throughput/correlation attacks on the tor network. Correlation based attacks can take months of consistent observation assuming you control exit and entry nodes the victim is using. Even then you will only identify your victim within some probability.

In places where your government is this hostile and you’re doing something subversive you’re probably using an onion service or i2p which vpns cannot access.

View on HN

In that case make the argument as you do above and the rest of us can decide whether it's more or less probable.

I'm still not convinced incidentally. State actors have very strong motivations to break Tor, regardless of difficulty, and have ample resources. They can also be very patient, as projects like Stuxnet demonstrated. [0] Doing something surprising is good military strategy as Guderian demonstrated in the Ardennes. [1]

[0] https://en.wikipedia.org/wiki/Stuxnet

[1] https://en.wikipedia.org/wiki/Manstein_Plan

Yea I’m confident the US military has the resources and expertise to fully compromise tor, but it would be extremely difficult/costly. I just believe it’s not worth their time to map every single tor user to an identity. Stuxnet was done to disarm the nuclear weapons program of a hostile nation state.

US intelligence already has plenty of surveillance capabilities and imo they’re not gonna waste their hand targeting non enemies of the state who just want privacy or even organized crime rings who are just chasing a profit.

Frankly it’s easier to catch high profile criminals with more conventional means.

And just to reiterate: my position is not that tor is bulletproof against the most powerful military force in history. I’m just saying it provides a much higher degree of privacy compared to using a simple VPN provider.

Anyone can help strengthen the network by operating nodes, donating money, or assisting with development/documentation!

How is that a shitty take? Tor is compromised, so are most VPNs, but there are some VPN providers that dont store logs (allegedly) like Mulvad. I would take a maybe-is-compromised think over a known-to-be-compromised , every day. Also Correlation based attacks are not the only Tor flaw.

It’s just my opinion on OPs argument. It’s quite a stretch to say that tor is compromised. The network is actively attacked sure. Nation states and sophisticated groups may be able to deanonymize users of high interest.

A single vpn provider would be way lower hanging fruit to powerful adversaries.

There’s a reason high profile criminal groups are able to operate over tor. When they DO get caught, it’s usually through some other unrelated opsec blunder.

I use tor, ProtonVPN, and mullvad in addition to self managed wire guard instances. There’s no reason to be binary and you should use the tools which fit your use case.

> It’s quite a stretch to say that tor is compromised.

1 in 300 connections were deanonymized at many points throughout this year.

For any given trustworthy VPN, 0 connections were deanonymized this year.

A truly trustworthy VPN is more trustworthy than Tor.

> 1 in 300 connections were deanonymized at many points throughout this year.

How do you figure? If you are referencing the bs “0.3%” chance figure. Please not that this assumes that each “peak” number of malicious nodes were used. If you actually look at that medium article, the peak exit, relay, and entry nodes do not occur at the same time. Those malicious nodes have since been removed. This also assumes tor users are not using any onion services.

> For any given trustworthy VPN, 0 connections were deanonymized this year.

Lol. I can’t believe I even have to respond to this. People use vpns to visit clear net sites with loads of fingerprinting JavaScript. They bring their google analytics cookies with them! There’s no onion services!

Reply on news.ycombinator.com