Hacker News Reader

>I'm not sure why people seem surprised by this.

Not to get too meta, but this 'lack of surprise' thing has become a too-common reaction. I mean, objectively, what's more important - that the NSA is labeling Tor users as extremists, or whether or not you found this new information 'surprising'? Apart from being a distasteful brag, I don't think the assumption is correct. I'd imagine most people's response to be 'anger' or 'depression' or 'concern', although of course it's impossible to know for sure.

But what I really object to, and why I hope people stop using this language, is that it asserts that our collective reaction (however it is characterized) is more important than the story itself. In a very subtle way, it refocuses the argument and lets the NSA off the hook, and indeed, blames us for our having silly, outdated ideas like that our government might value and even protect our right to anonymous speech, rather than criminalize it.

As for the rest, it's possibly true that ubiquity is the only way forward.

>> our right to anonymous speech

You lost me here. Privacy, yes, anonymity? Where is that in the Constitution (assuming you're a USA-ian).

Right there in the 1st amendment.

Backed up by the supreme court in the right for group memberships not to be revealed.

You have the right to anonymously assemble and associate with a political group. I hope you don't lose it.

The right to anonymous speech is can be considered (and is by many) an implication of first amendment rights to free speech. One way to look at it is that the requirement that a person be identified before being allowed to speak is itself a limitation on speech.

I'm too lazy to do my own citations, but the courts have repeatedly struck down bans on anonymous speech on these grounds.

Thanks for the clarification.

I strongly agree with this. Not only is the "why is anyone surprised" a cynical ploy at seeming "sophisticated," but it serves to make people feel foolish for their initial anger, distrust, fear, sense of betrayal etc. And they have very good reason to feel those things! But we look at them with blank, bored eyes and ask why they're surprised.

I mean, do we really expect anyone else to seriously care about this stuff, when we kind of subtly mock them for having initially cared at all?

"I'm not sure why anyone's surprised" is the nerd version of being too "cool" to ever care about something.

I haven't met anyone IRL that was not surprised by the extent of the revelations thus far. The prevalence of this "lack of surprise" opinion in online discussions (esp on reddit) seems disproportional to my personal observations, albeit in a rather limited sample size.

>* Apart from being a distasteful brag*

I don;t intend to come over as bragging, but given what is widely know surprise is simply not a sensible reaction if you keep up with the relevant news.

Constantly being surprised by this sort of thing means people simply aren't learning from the recent past. People seem to go from surprised, to offended/angry/disgusted, to apathetic, to completely forgetting until next time, to being surprised again.

I'm not sure what the answer is unfortunately, aside from maybe "stay offended/angry/disgusted and nag and nag and nag and nag and nag until things change or you are arrested".

"Better late than never" is a concept that badly needs to be used here. Even if someone IS horribly late in realizing something, scaring them away with dismissive language is just going to make the problem worse in the future.

I'd hate to be one of those people, but I'd enjoy some kind of citation on that claim that the majority of Tor users are using it for nefarious purposes.

I may be stretching here, but I think most of us would probably agree that monitoring or outright shutting down Tor would be OK if the nefarious usage was 100%. More interesting is, at which point do we consider monitoring morally wrong as that percentage approaches zero?

All you need to do is look at the hidden services listed on any of the .onion directories. This is why I stopped running a node -- I just can't justify helping criminals, even if I have no way to know which data passes through my system.

Maybe one could run an exit node or .onion proxy that only allows connections to critical sites for political dissidents like gmail, twitter, etc.

I am not disagreeing with your point of view, but how is Tor different from anything else that can be used by criminals, which includes pretty much ... everything? By that analogy, and again I am not being dense, the use of any encryption can be justified as helping criminals?

> By that analogy the use of any encryption can be justified as helping criminals?

That is certainly the view of the security services: anyone using encryption we can't break is a potential enemy hiding something we want to know.

That is why there were export restrictions on encryption technology until it became obvious that was detrimental (crypto developed elsewhere wan't covered, so the restrictions put allied commercial users at a disadvantage to other countries in the industrial espionage stakes without actually affecting the people the restrictions were aimed at at all).

It is also why services that offer encryption are pressured into giving authorities access to the private keys, and those that refuse (or can't due to the design meaning the keys are only in their users hands) tend to get shut down.

The difference here is that with Tor it is me who is providing the bandwidth for them to use. I want to see Tor succeed, but I just can't get past the fact that the people running .onion directories seem to feel that since it can be used for anything that everything should be promoted equally.

Websites hosted on tor are, but aren't the majority of users connecting to the external internet?

He never said the majority of tor users are criminals, just that the proportion/percentagefraction is higher than non-tor traffic.

I don't want to get into a semantics argument here, but:

"The proportion of nefarious types (relative to the total user-base) routinely using Tor is going to be significantly higher then the proportion of such who are not..."

He is claiming that nefarious usage is significantly higher than non-nefarious usage. That's the exact meaning of majority.

No, I think he meant "...who are not using Tor". He's saying that if 1% of normal internet traffic is nefarious, that he suspects that > 1% of Tor traffic is nefarious.

That is to say that your odds of finding a nefarious packet is greater on Tor than on the broader internet.

Exactly. My wording obviously could have been clearer.

I don't think it's worded very clearly, but at the end of the day there's only one reasonable interpretation. He's saying that (numbers made up and not realistic) 10% of nefarious types use Tor, while 1% of regular folk use Tor. If nefarious folk make up 1% of the general population, they'll make up about 10% of Tor users, and thus focusing on Tor users will get you a larger proportion of the nefarious.

Assume 5% of Tor users are nefarious. Assume 1% of Internet at large users are nefarious. The proportion of nefarious Tor users is significantly (5x) higher. But it's not majority.

In the context of normal law enforcement that would be like searching my car only on the basis of driving down a street where drug deals are are done relatively more often than on other streets.

It's difficult to judge that I guess. Maybe the legitimate uses of Tor are far more outreaching than the illegal things?

It does not even matter that "the majority of Tor users are using it for nefarious purposes". Any attempt at intimidation will work out exactly the other way around.

Doing anything that the NSA do not like, is "cool"; even more so in the global scene.

Seriously, if you want to get people to use Tor, all you have to say is that the NSA do not like it.

> but I'd enjoy some kind of citation on that claim that the majority of Tor users are using it for nefarious purposes.

I don't know about exit nodes, but at least for hidden services that seems to be true (assuming you count torrents and drugs as 'nefarious'). See http://www.verisigninc.com/assets/labs/Measuring-the-Leakage... / http://www.ieee-security.org/TC/SP2013/papers/4977a080.pdf / http://donncha.is/2013/05/trawling-tor-hidden-services/

Psst,

> It also records details about visits to a popular internet journal for Linux operating system users called "the Linux Journal - the Original Magazine of the Linux Community", and calls it an "extremist forum". [1]

Hush puppy, it's okay to call absurd that which is absurd. It won't bite you.

Oh, wait...

[1] http://daserste.ndr.de/panorama/aktuell/NSA-targets-the-priv...

The NSA strategy of spying on everyone only works when most people are not aware of it. The surprise element is now gone. They can undoubtedly already see the effect of the recent scandals in a serious decrease in quality of the information that they collect. The entire internet is now slowly but surely moving to stronger forms of encryption. On the long run, it probably means that the entire internet will go dark for them. In other words, the ones who wanted to see everything will end up seeing nothing at all.

The Snowden revelations also killed two other illusions:

1. Putting the state-actor threat in the too-hard pile is a viable security plan.

2. If you sell to governments, especially the US government, you can also sell internationally to strategically important customers and not provide a "trust nobody" level of security. "Trust that I have implemented no back doors."

Going dark simply means providing the level of security that was always needed against mafia-connected state-actors and other high-level threats. And it means adapting to the level of trust (i.e. none) required to do business across multiple sovereign nations that want real autonomy of action.

Trust that I have implemented no back doors.

Yes, you are right. This entire NSA thing is bad business for American companies. Even an erstwhile global darling such as Google suffers from this. They are now being viewed with suspicion ...

Around here you'll get a lot of "How dare you say Google isn't doing enough..."

The problem with that is there is a minimum threshold: Web-of-trust for key exchange; open clients; encryption the default, etc.

Google can be lauded for being 5% of the way there while everyone else is dawdling and hoping the toothpaste goes back in the tube. But that's not the same as actually equipping their users to trust nobody as the usual day to day way of working.