Hacker News Reader

Comment by kar-kub | Hacker News Reader

Last paragraphs are very interesting:

"In its 2013 financial statements, the Tor Project - a group of developers that maintain tools used to access Tor - confirmed that the US Department of Defense remained one its biggest backers. The DoD sent $830,000 (£489,000) to the group through SRI International, which describes itself as an independent non-profit research centre, last year. Other parts of the US government contributed a further $1m. Those amounts are roughly the same as in 2012."

I'm not familiar at all how those founding works, could someone, from US, explain how and why US government is giving money to TOR?

View on HN

I've seen two explanations for why the US government gives money to the Tor Project. One reason is to support dissidents in countries like China. Another is that US agents use Tor, but that the network requires a degree of popularity in order for agents to "hide" in it.

I should think that both are likely true.

Another option is an effort to identify cryptographically-capable individuals around the works as targets for potential contact, work, on behalf of the U.S. and its allies.

TOR as a recruitment tool?

Isn't there a third possibility that US security services are capable of breaking Tor, and want to popularize it in order to encourage Tor usage among potential targets?

Two possible motivations:

1. Help political dissent in countries that cannot crack tor.

2. There's a reasonable chance that they can crack tor, at least to some extent ,especially with the help of the 5-eyes countries. Having that ability while "evildoers" think tor is safe is valuable.

Well, TOR was originally developed by the US Naval Research Lab for the purpose of securing government comms.

Source: https://www.torproject.org/about/overview

I was of a slightly different impression, but have no idea what is the "truth".

"Tor was not started by the US Navy. The US Naval Research Labs (NRL) started a project in the 1990s called onion routing7. Tor uses the basic onion routing principles and applies them to the Internet. The volunteer Tor group started in 2001. The formal charity, The Tor Project, started in 2006. We continue to work with Dr. Paul Syverson from NRL on improving onion routing and therefore Tor."

Source: https://blog.torproject.org/category/tags/sida

Not started by the US Navy but started by US Naval Research Labs instead? Is there any practical difference except where it appears on a military budget sheet? :)

If you ignore some of the drama, Pando has a very long and fairly comprehensive look at its funding (at least, it seemed comprehensive to me, I am not a Tor expert) - http://pando.com/2014/07/16/tor-spooks/

The Pando article is FUD at its best.

Yes, the government funds Tor. Pando thinks that all of the US government is akin to the NSA and wants to spy on people. This is not how it works. The government is not just one body and there are many parts of it that probably don't agree with what the NSA is doing.

Yes Tor is funded by the US government. My question is, how does it matter? The protocol is open. The code is open. There are research groups at some major universities researching on Tor.

Let the code speak, not fear mongering.

> This is not how it works. The government is not just one body and there are many parts of it that probably don't agree with what the NSA is doing.

This, I think, is a very important point. It is beyond naive to assume that a large body of structures that together are called "the US government" is a homogeneous entity that can be ascribed goals as if it were a single agent.

"Securing government comms" can be misleading. Tor is not by itself a secure channel, but may be part of a secure channel if you're concerned that a local or semi-local adversary may intercept your communications. My understanding is that Tor was developed primarily to facilitate informants and dissidents in countries with restrictive internet access policies, like China, who would not take kindly to seeing communications between Chinese IPs and U.S. military IPs.

There is a very widespread and dangerous misconception that Tor is a one-stop shop for secure or anonymous communication. This is not true. You need to encrypt your messages separately. When outside the onion network, Tor actually exposes all content sent through it to a third-party, the exit node. This means using Tor may be more dangerous than not using Tor if you don't know what you're doing.

Very good point. In fact, I had to council one of my colleagues on this issue as she prepares for an overseas trip. She was asking about Tor, but I advised that our organization's VPN is the correct solution... especially since she wanted confidentiality rather than anonymity.

The primary intended purpose of the tor network was to provide cover for US agents. Many of the core developers of TOR have at various times either directly worked for US intelligence or have been funded by them. It was opened to the public and popularized, because an anomization network that is only used by spies is pointless. Most of the current exit nodes are currently located in the US, so there is no question that almost all TOR traffic is monitored by the NSA. The tradeoff is that while TOR makes it slightly harder to identify targets, the majority of them use TOR and there are still ways to identify them if they are not extremely careful (this has been revealed in some of Snowdens documents).

> The primary intended purpose of the tor network was to provide cover for US agents. Many of the core developers of TOR have at various times either directly worked for US intelligence or have been funded by them

That's very interesting. Could you provide sources that back this up, especially the employment history of TOR developers?

See http://www.syverson.org/, he still works for the Navy. Dingledine worked briefly for the NSA, http://www.freehaven.net/~arma/cv.html.

It isn't just FUD, there are some serious questions that have been raised which are ignored by the EFF crowd. At the bare minimum it has been used as an intelligence honeypot because most users have no idea what they are doing. Google, FB, and so on forcing SSL may have reduced this value a little bit.

What are these questions?

Reply on news.ycombinator.com