Hacker News Reader

Comment by hershel | Hacker News Reader

First, basic reddit isn't even encrypted. Many probably use it that way because their https is slow.

Now since there are time stamps on reddit posts, even https could be possibly annonimized using traffic analysis.

And if you use Tor, there are tools that might work against Tor.

Considering all this, the fact that reddit sells anonymity, and people use it for really personal info - which could easily be hacked even by someone with a network sniffer - is not honest.

View on HN

Reddit doesn't really sell anonymity in the face of someone who is determined to find out who you are. People expect a basic level of anonymity, but they don't expect it to hold up before NSA level scrutiny.

I don't think the point of this post was anonymity against those with large resources, but rather day-to-day anonymity for social interaction.

The parent asked about NSA. i replied.

But the lack of default https IS relevant to day to day hacking: the case of a wifi sniffer.

I wouldn't trust Tor. It's surely deeply penetrated by the NSA, if in fact they didn't create it to begin with.

This keeps popping up again and again. The source code for Tor is public.

The idea that Tor is compromised by the NSA, if true, is not by releasing compromised source -- it's from the NSA running the tens or hundreds of thousands of Tor nodes required to compromise the system.

That's a red herring.

It's the network that is compromised. If you operate enough exit and relay nodes, you can be pretty damn well sure of where the traffic originated.

Anonymity hinges on the nodes, if an entity controls most of the nodes then the network is pretty much an effective honeypot.

Given that the FBI has been incredibly vocal about their efforts to take down Tor, and the fact that it is synonymous with illegal activity (drugs and child porn); operating enough nodes to investigate and bust criminals seems right up their alley.

There are user options to specify which entry and exit nodes to use [1]. I'm not saying there aren't ways to defeat Tor but I dislike this knee-jerk reaction that a lot of people have with it because of its origin.

[1] https://gitweb.torproject.org/torspec.git/blob/HEAD:/path-sp...

That doesn't prevent the 99% of Tor users accessing hidden services exposing the location of the service to whoever is operating the majority of honeypot nodes.

It also doesn't prevent owners of relay nodes from construing the origin of traffic. It may not be as accurate assuming the user routes their traffic through uncompromised entry/exit nodes, but given the resources certain agencies have they can cross reference ISP etc traffic logs to determine the identity of tor users.

Reply on news.ycombinator.com