Hacker News Reader

Comment by jupr | Hacker News Reader

Im sure a lot of people know about tor on this site...but let me remind everyone.

Tor is not for criminals. It's for you and me. And happens to be good enough that criminals use it too. This is the two sided nature of technology.

Tor is a networks of peers across the globe volunteering their network bandwidth to support people under oppression by their government.

The amount of privacy that can be gained from tor is proportional to the amount of people using it. The more that people utilize the technology, the more that everyone looks the same, and protects the people that need it the most.

Tor enables me to say no to these things and carry on, without permission.

View on HN

I think you overestimates the protection Tor provides. We have seen multiple cases of people getting caught on there, and CIA probably owns half the exit nodes anyways.

Maybe provide sources, or point out a specific claim on the Tor project website that you feel overestimates the capabilities or protections.

BGP attacks are largely defeated by onionservices.

And while governments have the ability to create exit nodes, so does anybody.

My guess my point is that it's not foolproof, and this is known. You can get unlucky and even if it's based on a side channel, and not Tor itself, it can still get serious if you though you were 100% safe.

>We have seen multiple cases of people getting caught on there

as far as i am aware, no one has been caught due to something technical in relation to tor.

it's always something dumb like logging into an email that has the person's real name in it, using a credit card, leaving javascript on, or otherwise making some opsec failure.

This could be true. But law enforcers lied how they found evidence in other cases.[1] They could have lied in Tor cases.

[1] https://en.wikipedia.org/wiki/Parallel_construction

It's increasingly difficult to accomplish much on the Internet without JavaScript, though. This is an era where literal image hosting sites won't show you an image without it; where it's used to reinvent <details> tags, forms, even ordinary hyperlinks.

On the other hand, it's never been easier to design a place that doesn't need those things, or be confident the javascript is on your side.

javascript, like tor, is powerful in both directions depending on what it's used for.

There is another angle not a lot of people consider. There was a Defcon video I recall watching from 10-15 years ago where the speaker referenced a case where police managed to arrest someone because the Tor traffic on the network (maybe a university) was so unusual as a one time event at a specific location, the police managed to tie the individual to specific Tor activity. The speaker's conclusion was essentially we should all be using Tor to create and normalise a higher volume of Tor traffic which can in turn help protect other Tor user's anonymity.

i believe that case is this one from 2013: https://www.informationweek.com/cyber-resilience/fbi-traces-...

"Reading the criminal complaint, it seems that the FBI got itself a list of Harvard users that accessed the Tor network, and went through them one by one to find the one who sent the threat, [...]"

"The FBI didn't have to break Tor; they just used conventional police mechanisms to get Kim to confess," Schneier wrote. "Tor didn't break; Kim did.""

iCloud private relay has done more in just a few years than Tor ever has, by being opt-out for iOS users instead of opt-in like Tor. Now platforms can’t rely on IP based reputation, instead relying on either a computational challenge (Cloudflare, Anubis) or de-anonymization (recaptcha relying on being signed into a Google account more than anything, especially when using private relay).

That wasn't meant to be an argument against other privacy protecting technologies. I'll take them all. Although you can't just compare apples to apples when you speak of close sources technology. I applaud apple for the long held stance of privacy protections.

And to be fair, tor comes at the price of speed. But convince isn't the only thing in the math equation here. Privacy basically boils down to a three part equation these days with the variables being Speed/Convenience.

A lot of that speed and convince can be made up for with being familiar with the tools and adapting to a new norm. The actual network speed isn't really that bad comparatively.

Tor is very much for US overseas intelligence operatives, among other things.

That is who it was created for.

Yet the same technology that protects them, protects the everyday Joe.

The binaries do not discriminate.

I'm using Tor right now! Everyone should. It's too bad that many websites block it, but most of those websites are slop anyway.

Everyone should study the basics on a server backend and full stack web.

If you can master what it takes to design and run your site on localhost....you are literally one step away from sharing it with anyone on the planet who has internet access for zero dollars because of the power of tor, and the global network that supports it.

The reality is, there is no gate there, just the knowledge of how to do it.

Tor is first and foremost a router.

Sites that block tor IP's do happen, this is because of the dual use nature of the technology. Its also well suited for abuse.

Tor is not for criminals. It's for you and me.

No. Tor is for the CIA. It won't work for them unless we use it as well. Criminals also find it useful.

It's easy to verify this. Tor was originally written by Paul Syverson, Michael G. Reed, and David Goldschlag. While all three were working at the U.S. Naval Research Laboratory.

These are the origins of Tor yes. The same technology that protects the spy, protects the journalist, or the citizen whose government blocked them, or placed a wall of ID verification checks.

I encourage everyone to learn about the origins. Even study these people and what they have said in the past. Don't for get https://en.wikipedia.org/wiki/Nick_Mathewson.

Nah, those people use plaintext Gmail as Epstein demonstrated.

That depends entirely on their perceived vulnerability.

Actors who feel they have little vulnerability --- that they can act with immunity or impunity --- regardless of the validity of that assessment, can and will act overtly.

Those who feel they are in a hostile or vulnerable environment will seek to conceal their actions and communications, and practice strong tradecraft.

Epstein (incorrectly as it happens) presumed impunity. His (mostly) unidicted co-conspirators have thus far been shown correct in their similar presumptions.

Yes, that's what it was created for. The internet was created by DARPA and happened to be useful for other things

Reply on news.ycombinator.com