Tor: From the Dark Web to the Future of Privacy
direct.mit.edu
direct.mit.edu
However Im sure this would be immediately obvious (unless they have been slowly doing this since the begining of TOR)
Because eventually, no matter what you do, if you're up against a nation state, they'll just make you dead.
In terms of deanonymising people through surveillance (for example, by spying on the whole Internet and tracing you through the Tor network), Tor explicitly doesn't protect you against this. The decision was made early on - they switched all the high-security design elements to 'off' to make the network faster. They calculated that a hyper-secure network that was so slow no-one used it was less secure - i.e. made less privacy exist in the real world - than one that was less secure but used by millions, because that would give you a huge crowd of people to hide in. This gets really complicated - because you also want lots of different kinds of people using the network, so they can't tell if you're a drug dealer, an activist, a spy etc. just because you're using Tor.
Individual bits of major intelligence organisations can probably deanonymise you at some times, and not at others. The real question is if they can do so in a way that's dangerous to you in a sustained way, and if it's actually useful for them to do this. Usually, it's easier to do this through simpler mechanisms (bribing your friends, putting a camera in your bedroom, figuring out who you are etc.) than compromising the Tor network. Some security services absolutely will be researching and developing ways to deanonymise larrge numbers of Tor users at a given time - but in general, the budget for this is going to be quite high on a per-user basis (so you'd have to be a prime target for it to be worth it), and a lot of the complexity of the Internet geography makes this quite hard itself.
Ultimately, for any given high value target, there are usually easier ways to get them than through breaking Tor. In almost every case, a person will make a basic OPSEC error long before mass-scale traffic analysis gets them.
It is a assumed vulnerability of the network. The biggest question is if any state actor would consider it economical to do it compared to alternative methods. Personally I suspect that it is actually cheaper to have visibility into the entire internet, since that method bring value beyond tor and you do not need major secops to pull it off.
Use a DoS attack against nodes, like the 2-3 years ongoing attack which has lately progressed to a 100% CPU usage DoS against any targeted node. You still have to control a decent number of nodes, but you simply DoS (or DDoS, much noisier) the nodes that your target is connecting to. Once you have them connected to your guard, relay, and exit nodes, you continue the DoS on other nodes until you get the data you need - shorter time is better. I believe this method is being used currently, as I read a post from someone about it recently and noticed something similar happening when I started paying attention to nodes, although it seems it may have stopped for now.
I'm sure there are many vulnerability chains being exploited in tor. Here's an interesting tidbit from the Snowden leaks, which most people took that screenshot of "tor stinks :(" to mean it's safe. At least with JavaScript completely disabled, right?
> Tor users often turn off vulnerable services like scripts and Flash when using Tor, making it difficult to target those services. Even so, the NSA uses a series of native Firefox vulnerabilities to attack users of the Tor browser bundle.
> According to the training presentation provided by Snowden, EgotisticalGiraffe exploits a type confusion vulnerability in E4X, which is an XML extension for Javascript. This vulnerability exists in Firefox 11.0 – 16.0.2, as well as Firefox 10.0 ESR – the Firefox version used until recently in the Tor browser bundle. According to another document, the vulnerability exploited by EgotisticalGiraffe was inadvertently fixed when Mozilla removed the E4X library with the vulnerability, and when Tor added that Firefox version into the Tor browser bundle, but NSA were confident that they would be able to find a replacement Firefox exploit that worked against version 17.0 ESR. The Quantum system
> To trick targets into visiting a FoxAcid server, the NSA relies on its secret partnerships with US telecoms companies. As part of the Turmoil system, the NSA places secret servers, codenamed Quantum, at key places on the internet backbone. This placement ensures that they can react faster than other websites can. By exploiting that speed difference, these servers can impersonate a visited website to the target before the legitimate website can respond, thereby tricking the target's browser to visit a Foxacid server.
> In the academic literature, these are called "man-in-the-middle" attacks, and have been known to the commercial and academic security communities. More specifically, they are examples of "man-on-the-side" attacks.
> They are hard for any organization other than the NSA to reliably execute, because they require the attacker to have a privileged position on the internet backbone, and exploit a "race condition" between the NSA server and the legitimate website. This top-secret NSA diagram, made public last month, shows a Quantum server impersonating Google in this type of attack.
> The NSA uses these fast Quantum servers to execute a packet injection attack, which surreptitiously redirects the target to the FoxAcid server. An article in the German magazine Spiegel, based on additional top secret Snowden documents, mentions an NSA developed attack technology with the name of QuantumInsert that performs redirection attacks. Another top-secret Tor presentation provided by Snowden mentions QuantumCookie to force cookies onto target browsers, and another Quantum program to "degrade/deny/disrupt Tor access".
From https://www.theguardian.com/world/2013/oct/04/tor-attacks-ns...
Let's not forget about the NSA backdooring internet backbone routers and slurping data from undersea cables https://en.m.wikipedia.org/wiki/ANT_catalog
It's quite clear to me the US (and the other major Western players) are preparing for a large-scale war and know a great deal of spies are already living in the country. Warrantless wiretaps for any connections outside of the USA, and mandatory KYC for any cloud providers (VPS etc) within the US. In other words, the surveillance dragnet is now operating at a complete and full scale. Privacy is dead. If you would like to be an activist or give valid criticisms of the government, just know that your devices are likely going to be hacked and your communications decrypted. Airgapped computers may for now be safe with a faraday cage and components stripped out. Mesh networks like Briar are only useful as long as your phone is secure.
I wish I was simply being overly paranoid.
https://www.brennancenter.org/our-work/research-reports/refo...
https://torrentfreak.com/u-s-know-your-customer-proposal-wil...
https://www.ic3.gov/Media/Y2024/PSA240425
https://www.gov.uk/government/news/new-powers-to-seize-crypt...
DoS'ing a server and correlating timeouts is a well-known but still discernible technique.
Random delays and packet data have been added to help bugger against this and timing/padding/other side-channel attacks.
At this point most servers operate multiple random timeouts + blackouts + array of mirrors/jugglers to mitigate this de-anonymization technique.
Why are the PDFs individually watermarked?
It seems antithetical to the spirit of releasing a book about Tor and "future of privacy", and to then not only watermark each PDF, but to not explicitly state that this is the case, let alone explain why.
Can PDFs be crafted such that they would ping remote servers when opened in most PDF viewers?
It's thankfully licensed under Creative Commons Attribution-NonCommercial-NoDerivatives 4.0, which allows for converting the content to other formats (given attribution and non-commercial use, same license, etc etc) [0]. I'd reckon that making a de-fingerprinted version and redistributing it as an epub, md, or pdf again would be allowed, then.
As for getting a clean copy to work from, using Tor would be quite fitting. I plan to convert the version I downloaded to epub for ereader use, maybe downloading it a couple times over different routes and combining to see if that has any impact on the fingerprinting. I'll comment with a download if I get to that and feel it's of a quality worth sharing.
0: https://creativecommons.org/licenses/by-nc-nd/4.0/deed.en#re...
If there are no monetary incentives, then how does it achieves decentralization? Also, what stops a malicious actor with enough resources (a government) from controlling a big portion of the network?
That said, you're absolutely right about large entities being able to control a large number of nodes, which is why a great number of nodes are controlled by governments trying to do so and also prevent foreign adversaries from being able to.
I used to do that. But I've ultimately decided that the prospect of fighting accusations of abuse or crimes committed through my network wasn't that enticing. Proponents will try to downplay the risks by using vague ideological nonsense like "don't worry, an IP doesn't legally represent a person ;)" which, even if true, won't prevent a rather unpleasant ordeal.
Running a relay is likely fairly low-risk and still a good thing for the network, though.
For a few years Oniontip [1] allowed tipping Tor relay operators with Bitcoin. In my opinion that was a quite nice combination of technologies, as it allowed to anonymously tip operators of a service providing anonymity on the internet.
Also, bitcoin actually was more private back then, because KYC rules were much more lax.
There is nothing stopping a state actor controlling a large percentage of nodes thus increasing the likelihood that your anonymous communications are nothing of the sort.
After all, the field agents probably meet once or twice a year at some math/CS conference in France anyway.
These administrators can then launder the information to their respective agencies by means of any number of play-pretend activities you can write up for the transparency committee. The agency doesn't even need to (officially) know.
(Edit: I say this, but in reality I also think it's pretty safe to assume most are government controlled)
You are workng for the FBI.
It costs my ISP resources but I pay a flat rate. That would have value to me.
I’m confident it’s not an efficient market and they’re charging what the market can bare, not a tight markup over their actual costs.
Most of the people I spoke to saw themselves as providing a service - they wanted to help do something to bring a particular kind of future Internet about and found it rewarding to be a part of that. A number of them found the act of running a relay interesting and fun in itself - something they could get better at. Plus, membership of the relay community itself (especially now) is a kind of shared experience of community - and that's attractive to people in itself.
In terms of malicious actors, Tor does a lot to avoid this, from hunting down bad relays actively, monitoring the network as best as it can, continuously developing the algorithms which select routes through the network, and other mechanisms, like forcing relays to operate for a while before they get trusted with a lot of connections.
If there is a mechanism to block , let’s say, CSAM, then the same mechanism can be used to block dissident political speech, no?
Governments have other possibilities. Why should they run a relay if they can force the ISP to mirror the traffic of all relays to them?
You have, conveniently, moved your point back to tor when I pointed out the folly of your statement.
Here, have an example:
https://www.telegraph.co.uk/news/worldnews/asia/japan/104090...
Alt227 has a point but the Tor network is centered around a handful countries where traffic is cheap and there aren't that many huge IXs and Tier 1 ISPs where much of the traffic flows through.
I'm not saying that this is done but it's IMHO more likely than state actors running thousands of relays.
“a state actor has the physical capabilities/resources to perform an attack that determines Alice was speaking to Bob.”
I totally agree. Im just pointing out that we still have layer 5 encryption to protect the contents of our messages. Also at that point, if you’re so important they would just grab a warrant and raid your home.
This question
https://support.torproject.org/relay-operators/#relay-operat...
also seems to imply that it might be useful to run a node to provide cover for your own traffic (though not an exit node in your home), but that it isn't known for sure how useful that is.
I think the core argument against your suggestion is (1) having your devices more likely to be seized is just plain harmful to you; (2) if you're personally doing something that law enforcement cares about, having your devices more likely to be seized increases you risk that they could discover that by seizing those devices; and (3) there may be traffic analysis techniques that law enforcement could use to distinguish between your own traffic and your exit traffic, like trying to correlate inbound Tor circuit activity with exit traffic, and attributing the traffic to you if it couldn't be matched up with an inbound circuit.
It might be a good idea in a prosecution to raise reasonable doubt. Few people are willing to play punching bag for the police to find out. Also the general technical skill of the average cop and prosecutor is quite low.
It's also a bit like picking up trash when you're out for a walk, it's just a nice and proper thing to do to make society a better place to live in.
As far as I can tell tor was designed by spooks to allow remote agents operating in foreign countries a means to communicate with headquarters without being traced. It was never designed to allow two entities to communicate anonymously. The metadata always gets exposed, doesn't it?
Using tor also violates the hide in plain view principle, which all real spooks adhere to religiously.
- Guerilla mail let the FBI know it was being accessed with Tor (or they saw it in the email header)
- You have to login to use Harvard wifi with your student account, which means they could see who was using Tor.
If anything, Harvard wifi is the honeypot.
My memory of this case is that Harvard was able to easily determine who had recently used tor, possibly through netflow logs.
Same sort of thing used to happen with Signal traffic to their servers in AWS. I've been in countries where Signal does not work at all because the local government blocked Signal traffic after lobbying from companies that profit from expensive SMS charges.
I've read privacy activists stress that it's great that e2e encryption exists, but that intelligence agencies are mostly interested in the metadata (who you communicate with, how you communicate with them).
Though do consider buying it if you like it!
Either the technology is good enough to make people anonymous despite their lack of wealth, power, complicity of institutions, or it's not. It can't be a weak technology only in the context of the biggest problem with Tor.
> Some pointed out that it was bizarre for Tor to condemn neo-Nazis using its network when it had been largely silent on the documented issues of child abuse... much of the negative reaction to the activist turn in Tor was motivated by a reactionary queasiness towards feminism.
Well yeah, that is bizarre. You're making it sound like, if we understood the tribe of college and graybeard libertarians better, compared to better-known, run-of-the-mill progressives and "intersectionality," then we can forgive how "bizarre" this sounds.
I don't think that stuff matters. The commentary from the operators makes the whole effort look insincere. I don't think that relay operator actually cares that much about Turkish dissidents or whatever. That operator is definitely interested in being dramatic and provocative. That's how most libertarian ideas sound. They could align in some ways with social justice, but its failure in the marketplace of ideas is as simple as insincerity + drama.
In terms of condemning particular use cases (or deciding not to), I'm more trying to represent a particular argument that some people make about Tor (and lots of other technologies) - i.e. that the tech itself shouldn't carry explicit values/politics, those should all be down to the users. The argument is particularly strongly made by some privacy advocates as they see things like Tor becoming the foundations of a new Internet - and hence needing the broadest possible base of support. There's obviously a lot of good arguments against this philosophy, but I figured I should try to represent the different ways people think about Tor in as good faith as possible.
Obviously sometimes when people argue that they just have an issue with feminist values - sometimes it is definitely disingenuous. But I think there was a wider moment in the Tor community - in which a lot of people were concerned about the transition to a much more professional NGO, more strongly aligned with liberal, 'digital democracy' visions of US geopolitics, and away from a more chaotic and anarchic coalition. While I think there was a clear need for Tor to change and this was as much about its place amid wider changes in the landscape of digital rights, US tech, and hacker politics as anything else, it does give us a way (I think) of understanding the conflicts and choices that might emerge in Tor and other privacy enhancing infrastructures in the future.
All I am saying is that you could replace your antagonists in that line with "journalists" and you'd be like, "no wait, that's not true," and you'd be as wrong about journalists as anyone else.
Either there are some powerful institutions protecting journalists too, OR Tor is powerful enough to protect journalists. If it's not good enough for journalists, why bother? If it's good enough for journalists, listen, it's also good enough for criminals.
Anyway, some journalists are themselves powerful people! Maggie Haberman, John Carreyrou and Ronan Farrow are powerful people, and they don't need anonymity. There are powerless criminals too, I'm sure, who need anonymity to engage in criminal conduct without getting caught. You could live on an island with a Starlink Internet connection, literally divorced from institutions and communities, and you could engage in anonymous criminal activity with Tor, it would be your only way of doing that. It would be practicable and realistic. Where we really disagree is: I think the average person already lives in a metaphorical island, this isn't a fringe opinion, and thus no matter what they are doing, Tor is providing them not with anonymity - they are already anonymous in almost all ways that matter, already nobody cares what the average person is up to - Tor is providing them protection from law enforcement.
> chaotic and anarchic coalition
Those high drama characters were the only ones foolish enough to run exit nodes or relays. I am confident this is true but I have not investigated: not a single professional NGO employee or grant recipient, living in New York or Los Angeles, under the age of 40, is personally running a Tor exit node.
Those professionals are absolutely correct in their assessment that they would receive a much harsher punishment for so much as breathing on the third rail criminal activity on Tor compared to their colleagues who engage in some civil disobedience on highways here or there. And without exit nodes or relays, there's no Tor.
And given that the vast majority of online crime of all kinds isn't anonymous but goes entirely un-enforced against by law enforcement, I would argue that Tor's efforts to distribute power online make relatively little impact on the kinds of crime and harm we see online compared to a lot of other infrastructures built on top of the Internet. I've generally found the more I do this kind of research, the less convinced I am by technical fixes to major social problems - I don't think Tor is a 'fix' to the problem of power, but I think it opens up the battleground a bit for more different (and possibly more hopeful) kinds of future Internet to be built and asserted, that look less like the locked down and centralised versions we're being pitched just now. But I take your points and appreciate you engaging with the arguments in the book.
Actually the relay community is pretty diverse - they have some colourful characters but actually a lot of them are just IT professionals, activists, and people working for libraries or universities. They have come up with some ways (which I talk about in the book) of making them much less likely to get hassle for running an exit - and generally most exit relay operators proceed just fine.
Unless the son or daughter of an important politician, journalist or rich person, there are no pedigreed Ivy League people under 40 running exit nodes. No chance. There are tons of them working for NGOs. I am just trying to distill the cultural divide that people are really complaining about.
A great example of this is the Stanford student who won that journalism award, who was the son of a very important New York reporter. No chance a "normal" student would have gotten away with the campaign against the admins that he did, and yet, he gets the award! I mean bless his heart, but when talking about the most laudable aspect of Tor - protecting journalists - there's a complicated story there too, with bitter rivalries and dramas, that really characterize the "hair on fire" problem for most journalists.
Yes, you need to be a toxic slug or you will be eaten.
I was around for the transition and it was anything but clean. The only reason why tor didn't implode like women who code recently did is that it has a clear core product which the old developers kept chugging along despite the best efforts of the new 'professionals'.