Hacker News Reader

Comment by acabal | Hacker News Reader

I'm starting to feel like anonymity on the internet is going to be one of the most important challenges in the next decade. Especially with stuff like 6 strikes starting the ball rolling (today it's warning messags, in ten years it might be disconnection for breaking any of modern society's myriad and unfathomable laws).

The internet wasn't built with anonymity in mind; eventually an IP address has to be tied to a paying customer. Is there any way we can build on today's technology to ensure anonymity on a grand scale? I.e., so that your grandma is surfing anonymously, even though she doesn't know it, using the iPad she just bought?

View on HN

The thing with the whole "six strikes" thing is that there's no motivation to actually enforce it. Businesses generally will not turn away people willing to give them money, especially if their monopolistic market position allows them to gouge the customer up to their pain threshold.

The answer might be something like Tor.

Not something like, the answer is TOR. Thats exactly what it is for. Anonymity.

Unless the government can see both what's entering Tor and what's exiting it. Then you're screwed.

Eh, I was mostly responding to the 'grandma using an iPad' part. It's quite possible that Tor will eventually be what everyone uses for anonymity on the internet, but it might well turn out out to be something different. Hence the 'something like'. ;)

but with Tor you are only anonymous at the exit node, right? Sure, your ISP (or anyone else listening in) doesn't know WHERE you are connecting to, when you use Tor, but if the connection isn't encrypted (for example using SSL or ssh) then they sure can listen in to WHAT you are sending and receiving. In other words if the traffic between your computer and the Tor entrance node is not encrypted (and it wouldn't be unless you are using SSL or ssh), your ISP (or any third party listening in on that traffic) can read everything you are doing. Or am I mistaken?

You're mistaken. With Tor you are (in theory) anonymous at every leg of the journey. The only connection Tor doesn't encrypt is the connection between the exit node and the server you're connecting to, which is unavoidable. Your ISP can probably tell you're using Tor, but they won't know what you're sending or what its ultimate destination is.

In a little more detail, when connecting through a circuit of Tor routers R1 -> R2 -> R3, the encryption looks something like this.

    client <- E1(E2(E3(msg))) -> R1 <- E2(E3(msg)) -> R2 <- E3(msg) -> R3 <- msg -> server

It's not perfect, though. If you can see the traffic between the client and R1 and between R3 and the server and you're being reasonably clever you can probably break Tor's anonymity. (This is what's called an 'end-to-end correlation attack'.)

Hey thank you for the clarification!! I didn't realize there was any encryption at all with Tor. RTFM I guess ;)

Reply on news.ycombinator.com