Law Enforcement Undermines Tor

The public tends to have a very strange idea as to a lot of things on this topic while forgetting that TOR itself was actually a department of defence project or NSW I forget originally.

If you’re interested in seeing what the next generation of this stuff looks like (although AFAIK is not really known outside of defence contracting circles) take a look at this https://github.com/tst-race/race-docs/blob/main/what-is-race...

Ukraine's main export after corn and before mail-order brides/SIM cards is Tor traffic.

Is that true? IIRC they still need to do the legal paperwork to get an email from google et al (FISA request?).

I2P with more steps and crypto-enforced minimum quotes to deter timing/correlative attacks.

Minimally-enforced "random" timeouts to prevent DDoS->outage correlation.

Also mirrors. Lots of mirrors.

Have mirrors tied to reputation tied to invites.

Then the border to entry is time + money + reputation(which is time + money)

Throw in some 0-KPz, and you are 100% chillin in Belize or 100% in Colorado-ADX

(in minecraft, hypothetically, to sell beets, i ♥ us)

Doesn't i2p also use this model?

Yes, loopix.

https://www.usenix.org/conference/usenixsecurity17/technical...

As I mentioned elsewhere in this thread if you’re looking for proper state of the art it’s coming out of DARPA projects and you can see what I mean here https://github.com/tst-race/race-docs/blob/main/what-is-race...

It probably doesn't; think about it, most websites already have a load of random stuff, plus all users combined is also heaps of randomness. No self-respecting analyist would go through logs manually, it's all fed into search / analysis software, filtering through noise.

Nothing new, and I'm pretty sure these sorts of attacks have been possible and used ever since it's founding.

TOR ultimately works like any old relay system; if you control enough nodes, you can effectively decloak people if they happen to connect to only your nodes. Nodes are assigned for connection based on a trust value so all a Nation state would have to do is host enough nodes (relay+exit) and they'd be able to decloak a connection. This kinda inherently gives TOR decloaking abilities to entities with the most infrastructure, which at that scale basically will only be nation states.

TOR works well enough for privacy when your adversaries aren't well-funded state actors. (ie. It's probably enough to mask your traffic if you use TOR to access resources to get out of an abusive relationship or need to circumvent cult-level inspection of your personal interests by religious schools. Most dictatorships also don't really have the resources to mount this sort of attack - it's probably just the US and some European countries.) That rule kinda also goes for VPNs in general however.

I think the surprising element is that the German government actually deployed enough resources.

The articled confirms that the authorities are conducting a dragnet operation. Everyone who connected to a certain entry relay was tracked and reported.

Does the tor daemon connect automatically? If so, even people who installed tor for fun and forget about may be on the list.

Did the lucky ones have the "Bundestrojaner" (gov surveillance app) installed on their machines?

Plenty of people still believe that using a VPN + Tor means they are “private”. What we need to teach others is that this is no longer the case - privacy is not a one size fits all solution. You may be private from other users on your network, but not nation state actors.

That time happened 10 years ago.

.1% fluff? May as well call em up yourself.

"everyone is assumed to be acting in good faith". Right. I think that when it comes to network service security the old adage told to my father by an Irish Catholic priest applies: "Bill, once you understand that most people are just no damn good, then you'll be fine".

Or, in the words of the NSA, "Trust, but verify".

I agree that HTTPS is bad though, as it is used. We only do one-sided TLS, not mutual. Most people don't verify the server's cert by looking at it. Most apps don't encrypt messages before they go over TLS. In a more secure world a proxy with stateful packet inspection would not be possible.

As is often the case, the problem isn't technical (or at least not mainly technical). Employers, governments, and ISPs want proxies that inspect traffic, either for CYA or to increase budgets by increasing situational awareness. For governments, situational awareness increases wins by enabling them to catch people they deem bad actors. For employers and governments, increased SA means a decreased chance of leaks and people not doing what they're supposed to do with their time. For ISPs, it means they can monitor the traffic and restrict certain things (like video streaming, or running a server from home) to increase profit.

I can think of at least one potential solution. Still, it requires a technically savvy public, a patient public, and money: Open Source phones in everyone's hands, circles of trust, distributed freenet with data passed E2E encrypted via gossip protocol when two phones get near enough for Bluetooth data transmission (figure 50m roughly) where both phones are within some N degrees of separation via circles of trust. However, this mean's getting/sending data is asynchronous with long delays and no guarantees.

I guess you weren't around for the fun when https://en.wikipedia.org/wiki/Firesheep was popular.

Agreed. An added benefit is then ISPs could monitor traffic and sell the data to AD or insurance companies, who could use it to drive more sales or cancel risky insurance policies, increasing the efficiency of the economy.

Yeah that's all fun, I don't have anything to hide either. But what if I actually WILL in the future, retroactively? I've said a few things here and there, what if certain types of speech end up getting banned and if you don't remove it on time (or lost access), you risk jail-time?

Seems far away, but it's literally happening in England.

Please watch out with this kind of thinking - it's dangerous to everyone.

You imply that the only bad actors one needs to protect themselves against are the police. The vilest criminals can also use my data against me.

Schools should ban the teaching of math so future criminals won’t be able to use encryption for their evil deeds.

It is not a thin line the one you are crossing.

Technology is never a solution to your democracy problems.

In 2024 I can't tell if this is sarcasm or not.