Hacker News Reader

Comment by nightpool | Hacker News Reader

Yeah this is clearly by someone who doesn't really understand how Tor works. Revealing exit node IP addresses is completely useless—this is a fundamental tenant of Tor's security. In fact, I believe that at any given time you can easily query the network for a list of all Tor exit nodes.

I think the "why I now think Tor is the devil" question is answered in the opening—because it has illegal/immoral stuff on it. I'm not sure why anyone would be surprised about this though...

EDIT: In fact, I don't think that the security scanner was even that effective: "around 5-10% of the registered users chose to run the scanner" (later, he changes this to 4-7%) and that "some of the users who opted to run the software appeared to be government or private researchers". I don't know what percentage of people using Tor for illegal activity would be incautious enough to run some random program on their computer, but I would be surprised if it was very high.

View on HN

I don't know what percentage of people using Tor for illegal activity would be incautious enough to run some random program on their computer, but I would be surprised if it was very high.

I think it would certainly depend on the type of "illegal activity"; it's quite plausible that those looking for drugs or counterfeiting are going to have much higher suspicion and opsec than porn-driven pedophiles, leading to the difference in number of registrations at each honeypot.

Another thing is that Tor is global. People might not think twice about their security when they are effectively within the law or at worst may get a fine.

> this is a fundamental tenant

might be a typo, but just in case - a 'tenet' is a rule or principle, a 'tenant' is an occupier.

huh, I guess I just always assumed they were homonyms. Thanks!

It was 4-7%. I pre-wrote the article estimating the final numbers and then shut down the site two days early. Traffic dropped suddenly leading me to believe something was up.

The exit node IP is not totally useless. It's enough to prompt a knock on your door by the authorities. Granted, once they recognize you're running an exit node there's nothing they can do (otherwise Charter could also be held liable) but still, it can prompt an action by the authorities.

My guess that they some were researchers: at least one came from a university IP address while others were very bare-bone machines with minimal running services, possibly virtual machines or test boxes.

Here you go, all Tor exit nodes: https://check.torproject.org/exit-addresses

The Tor project does a lot of work to make operating an exit node safer and less likely to prompt the authorities to intervene. This is good, because even if the authorities did want to talk to exit node providers, those people _couldn't_ provide any useful logs.

Although they could be made to run a packet sniffer, which could provide useful information.

But the traffic between nodes is encrypted. All they may get is the previous node's IP address....then they have to start over. Go find that node operator and get them to do the same.

But most Tor users, especially the ones who are using it for disgusting purposes don't run an exit node, so I don't think I understand your point? In addition, Tor exit node IPs are basically public info already.

The exit node IP is run by an unrelated third party. Unless they're logging all of the traffic going through the exit node they have an extremely limited idea of what the exit node is doing.

"A knock on your door", ha! That's one way to put it.

Reply on news.ycombinator.com