Comment by gzer0 | Hacker News Reader

Comment by gzer0 | Hacker News Reader

Parent Full thread

I run a Tor middle relay on one of the 8 IP addresses I have purchased as a block from a certain ISP that allows you to, I have been for around a year. The amount of traffic passing through it is heavy. Obviously, this comes with certain caveats (the middle relay's, or any TOR relay IPs are publicly available and published weekly on GitHub and as you can imagine, some places like to instant ban anything to do with TOR).

Since it is only 1 of the 8 IP addresses; the other 7 remain free from blockages of any kind and the one running the TOR middle relay is setup in a manner in which I can use it normally (for the most part) and my traffic would just "blend in" with the normal tor traffic passing through it.

You might ask, what is the purpose of this? Well, if it is normal for a lot of TOR middle relay traffic to be passing through one of my IP's on a daily basis, plausible deniability becomes a real defense as checking DNS logs becomes a moot point as there are requests being routed 24/7/365.

Edit: https://hacky.solutions/blog/2020/06/06/operating-a-tor-rela...

This is an excellent, detailed, and in-depth guide of the process of going through running a TOR middle relay. The statistics provided and data presented are simply superb, Great read!

Its a nice setup, but you can’t see any DNS data in the TOR middle relay traffic. Middle relays just pass on encrypted data to the next tor node, not “the Internet”. So any DNS requests hitting outside from your 8 IPs are still all attributable to you.

For any activity in which I do not feel safe and threatened for my Identity, I utilize the middle relay as a full on end-to-end Wireguard VPN itself to route all traffic through a VM I've got specifically built for this.

In addition, there is also this for those that do not want to go through the hassle: https://blog.cloudflare.com/welcome-hidden-resolver/

Cloudflare runs their own DNS Tor resolver.

Why would an employer looking to fire you care about plausible deniability? Even if your setup worked technically, if the traffic traced back to you then you'd probably find yourself fired under these circumstances regardless.

I think this talk about tracing traffic could well be missing a bigger point. The last time I left a Glassdoor review I had to provide a company email address to do it. This means, although publicly my review was anonymous, Glassdoor knew (and very likely still know[0]) exactly who left it. If they have to hand over email addresses to the company taking legal action there's no need to get clever with traffic tracing.

[0] Even with GDPR and similar legislation all they need is a valid business reason and they can keep my PII.

This. One cannot post anything on Glassdoor today without first establishing an account. Nearly all companies that create accounts use services to “enrich” your user data via the IP, email address, etc. so they grab and keep that data. It is certainly no longer anonymous if it ever was.

> I had to provide a company email address

You mean you had to currently be working there, rather than formerly? I thought this lawsuit was about people who had already left Zuru, but I may have misread the article.

I understand why websites would ban Tor exit nodes, but what's the point of banning middle relays? Wouldn't those only communicate with either other relays or exit nodes?

Sites that don't want Tor users should only block exit relays, but some will lazily block all relays. It's unfortunate but that is the current state of affairs right now.

'should' from whose perspective though? 'Sites that don't want Tor users' have no incentive to care do they? If anything it stands to reason such a site would block anything and everything to do with Tor, using it as a search term, usernames containing it, anything?

(I don't know much about Tor, so am I missing something about 'middle relays' that such a site would want to allow them?)

Edit: oh is the point that you're not accessing the site using Tor, just from an IP addociated with Tor use?

Exit nodes are the interface between Tor and the "clearnet" (regular internet), whereas relays just relay traffic between Tor nodes (to make it harder to trace the route). So there wouldn't be any Tor traffic from this person's IP going to websites.

Presumably most folks neither know or care about this distinction and just block all Tor related infrastructure outright, since some of the traffic coming through is malicious.

Frankly, as the OP stated, one reason to use a tor relay for direct traffic is to hide your traffic. A bit like a guy in a trench coat and fedora trying to look inconspicuous.

It's not illegal, but it's also not surprising when such folks are escorted out.

You have plausible deniability but just be careful because the cops can still get a warrant based on IP alone. Also most savvy companies wouldn't say that they're firing you for posting unfavorable reviews, but they'd still terminate you.

Reply on news.ycombinator.com