Hacker News Reader

Comment by rvnx | Hacker News Reader

Quite logical, same in France and likely many countries; if you run a Tor exit node (or any type of open proxy), you get visited by the police if someone does something wrong on your exit node.

Otherwise what could happen is that you run a Tor node and use it as an excuse for any crime you do.

View on HN

Couldn't you say the same for every coffee shop that gives random people Wi-Fi access?

A more politically controversial example would be social media/'platforms', IMO. Google and Facebook are allowed to be in possession of CSAM, as long as someone else put it there.

Of course. But "someone sit there for an hour downloading torrents" is not something they'd bother to chase vs "this guy seems to be downloading 854 torrents in last 24 hours"

Your coffee shop could turn over MAC addresses if the police showed up with a warrant - especially all of the 3rd party managed solutions with logging.

Your effective wi-fi MAC address — the one other devices see — isn't fixed in stone, and in fact modern OSes build in support for automatically + continuously randomizing it: https://support.microsoft.com/en-us/windows/how-to-use-rando...

Not just support it, but some platforms randomize by default

https://source.android.com/docs/core/connect/wifi-mac-random...

https://support.apple.com/en-ca/guide/security/secb9cb3140c/...

Yes. This drove me a little insane since I keep track of my devices at home via DHCP lease.

Same, I've had to disable it on devices of my family.

I like that it's the default though. Privacy first!

When you actually connect to the wifi network the mac addresses stay consistent and stable on macOS / iOS at least over multiple sessions. If they didn't do that, then a bunch of stuff would probably break.

Technically, yes, but realistically most random mom-and-pop places just have a random $50 router somewhere in the corner.

Would it be fair/sane/reasonable to convict such business owners if one of their customers commits a cybercrime?

What person doing illegal stuff doesn't randomize their MAC address?

There’s this silly HN conceit of these super sophisticated adversaries when the reality is most people don’t know the first thing about technology or network topology and wouldn’t know why they should obfuscate their MAC in the first place. It wouldn’t catch the 1% of sophisticated black hats but that describes a small fraction of actual people doing stuff online.

MAC addresses are useless to track, you can change it, randomize it (I think even Microsoft windows has that feature built in too), or simply just throw away that wireless adapter used. It would be useful if for example these MAC addresses are tied to your identity, say when you buy a laptop/phone, you have to go in the process of adding these MAC addresses to be linked to you of some sort.

And imagine if somebody changes their mac address to yours and does some illegal stuff. There is not way that this can work.

>There is not way that this can work.

Exactly!

That would be absolute opposite of useful

Useful for who?

The MAC address anyone can change?

If I was looking up illegal numbers, I would not want to do so in a coffee shop where someone might see me doing so.

Yes, exactly, https://www.bfmtv.com/economie/des-patrons-de-bars-en-garde-...

In Germany this was an actual issue until recent years - you were strictly liable for what transited your network.

As mentioned in the article, laws protect companies.

Running an exit node is not any different than being any other ISP. You are providing another hop between servers.

Swatting 2.0 will be people installing tor exit nodes

I'm trying to imagine a plausible reason to (a) run a Tor exit node, but also (b) not actually use Tor for online nefariousness, and I'm coming up blank. I don't think running a Tor node as an excuse is a real scenario. (edit: emphasis)

Edit2: Jeez guys. I support Tor. I'm saying anyone who runs an exit node is also going to use Tor for anything that might get them in trouble, not do those thing in the clear and "use Tor as an excuse" as suggested above. That's a silly scenario and a poor justification for criminalizing Tor exit nodes.

That's not how Tor works, you don't need to run a tor exit to use it.

If you were actually doing something nefarious and using tor for anonymity, running an exit from the same ip doesn't sound extremely smart.

You're misunderstanding the comment you're replying to. They're not saying you need an exit node to do bad stuff over Tor, they're saying that anybody with the technical ability and knowledge to run a tor exit mode would also choose to use Tor for any bad stuff, and that therefore it seems unlikely anyone who runs a tor exit node would also do bad stuff directly traceable to their own IP.

You're right, it took me a while but I see it now. The phrasing is confusing

Exactly, thank you.

Based on your wording, it sounds like you're conflating the two things together... running an exit node and using tor are orthogonal to one another both in value provided to the user as well as effort involved.

Plausible reasons for:

(a) you greatly value privacy and the privacy of others such that you are willing to altruistically provide an exit node as a service; your country is a police state and you are sympathetic to those affected while also willing to accept the risk

(b) you greatly value your privacy and do not trust your ISP; you cannot access content sanctioned in your country; you are an internet engineer and need to test services which depend on privacy as a core feature

Also, I assume it wasn't intentional, but consider against arguing from the position of "I can't think of anything". You are betraying yourself by implying that you know all there is to know...which no one does.

Maybe if I'd said "I can't imagine X therefore Y must be true," but what I said was "I can't imagine X so I think Y" which doesn't imply I know everything at all. Quite the opposite imho. It implies I could change my opinion on Y if you showed me an example of X.

In any case, apparently that plus my use of the word "not" were ill-advised, since almost everyone here misread my comment to mean the opposite of what I actually meant. One person did read it as intended, and got another person to see it that way.

As someone else helpfully clarified for me, my point is that anyone with the technical skill to run a Tor exit node is also going to use Tor to hide any illegal activities they do online.

Yes because every one is living in a free country with no invasion of privacy rights and ISP to MITM every thing about you, US including btw with patriot Act.. and before you say “yeah but I am not doing anything illegal!?”, yet, laws change all the time, not to mention you don’t have to do anything illegal, you just don’t like spooks/ISP/etc. looking into your business, after all, it should be the case as a free citizen.

See my edit above and my previous replies to your sibling comments.

Any privacy advocate would do (a). There's lots of reasons to do (b) if you don't trust the government of the country you're in, which seems quite reasonable in a lot of countries around the world.

Of course, but who would do (a) without also using Tor for anything that could get them in trouble?

In some countries "online nefariousness" include things like trying to access gay communities, or looking information about abortion.

I strongly support Tor. I'm saying that anyone who runs an exit node is also going to use Tor for anything that might get them in trouble. Hence, it's nonsense to say that Tor exit nodes should be illegal on the grounds that they can be "used as an excuse," as the comment above suggested.

If running Tor protected you from any responsibility of traffic coming from you then it would be a real scenario. But there is an expectation that you should be at least somewhat responsible of traffic you generate. That is why running Tor exit node is often linked with meeting law enforcement officials.

Reply on news.ycombinator.com