I wonder if this is going to be confirmation that a large fraction of Tor nodes are in fact run by the FBI.
We already know that the FBI passes information to local law enforcement agencies and tell them to do parallel construction when the information was obtained illegally, so why not the NSA too? It's probably easy to deanonymize Tor traffic when you see everyone's Internet traffic (they don't even need to setup exit nodes).
What makes things harder for them makes it harder for the enemy, and vice-versa.
If anything, maybe it will help intelligence services realize that gathering intelligence is only half of the job, keeping secrets is the other half. Well, maybe they already realized it and we are not aware of that (it means it worked). But at the time of Snowden's leaks they failed big time. While most people focused on the content of the leaks and arguing about whether Snowden is a hero or a traitor, what I mostly saw is a guy who managed to break the security of the NSA. If a single guy can do that, what about trained spies backed by world power gouvernements? I guess countries like Russia and China already knew everything there was to know about the NSA. I could go for some "master plan" conspiracy theory, but my guess is just that the NSA is incompetent, or at least it was at the time of Snowden. Maybe that "dagger to the heart" is more like a wake up call, I hope for them.
Discussion about these issues has been stifled since critics like Assange and Applebaum have been smeared (but not prosecuted) with sex charges and Greenwald is being depicted as a conspiracy theorist.
I have heard it somewhere but using Tor or end-to-end is like using armoured car to transport money between park bench and cardboard box. If someone wants you compromised, you will get compromised, it only matters how many resources they are willing to throw at you. And for average person, it's not a lot. So best way is to blend in. And using Tor, end-to-end, VPN(full of people with something to hide, it would be stupid not to infiltrate or honeypot) will make you stand out, you might even peek someone's curiosity. Not a very healthy way to operate on the Internet...
Wants who compromised? What are they going to do against people who use no pseudonym and never originate from the same machine or the same physical location?
0 - https://www.pcmag.com/news/fbi-sold-criminals-fake-encrypted...
But yeah, TOR is certainly a double edged sword, but I am led to believe that they assess that it's offensive capabilities to pierce against Anglo-Oligarchy enemies offsets the drawbacks it produces on how they themselves deal with homefront dissidents
My take is that, well, yeah, that's one of the benefits of having overwhelming power and capabilities, that they can afford to take one or two punches in the nose, if that means that they will beat the ever living shit out of their actual enemies
It is sharpest triple-edged sword in modern intelligence existence.
Based on what little I know of SSL, this suggests the server was compromised too? Or does tor do a bad job of certificate pinning?
Edit: Or the clients are/were compromised. Or the suspect’s computer was compromised. Or they can somehow decrypt traffic between client and server.
Not necessarily.
If a passive snooper knows I used Tor Browser to make an SSL request to en.wikipedia.org and received 987,654 bytes then immediately made a SSL request to upload.wikimedia.org and received 1,234,567 bytes that might be enough information to work out I visited https://en.wikipedia.org/wiki/National_Security_Agency.
It is large files / DDoS going over the network that is still hard to obfuscate.
Which is why TOR is intentionally slow, especially when requesting larger files. If it wasn't, you could watch the lump of data traverse across the pipe.
source: n/a
There is also random padding added to cells, so that the cell content is unpredictable.
Tor client wouldn’t save any of that.
To catch one specific guy doing one action one time that he might do hundreds of times without getting caught but he only needs to get caught once to get punished, if you only need to succeed 0.1% of the time you only need to own 0.1% of the nodes, as a simplification.
There's also the incredibly valuable chilling effect that he's being found guilty in public opinion of having read the wrong website once. If millions of people read the "wrong" website a dozen times a day for decades, you only need one bust in a couple billion accesses to generate massive propaganda that reading uncensored badthink is and should be punishable.
I speculate this is most likely case of a ISIS server run by FBI.
The real timing attack that is not fixed and will not be (it is not in threat model), is when your ISP works with police (that has warrant) and gives them data. And police also controls server or exit node.
https://www.bbc.com/news/technology-28573625
"The Tor Project suggests the perpetrator compromised the network via a "traffic confirmation attack".
This involves the attacker controlling both the first part of the circuit of nodes involved - known as the "entry relay" - as well as the exit relay.
By matching the volumes and timings of the data sent at one end of the circuit to those received at the other end, it becomes possible to reveal the Tor user's identity because the computer used as an entry relay will have logged their internet protocol (IP) address."
"Timing attack" that will not be fixed is when police has warrant for your ISP, and police has ISP logs and destination server logs. (so it can compare the two)