Slashdot Mirror

← Back to Stories (view on slashdot.org)

Tor Users Urged To Update After Security Breach

Posted by timothy on from the points-of-failure dept.

An anonymous reader writes "If you use Tor, you're cautioned to update now due to a security breach. In a message on the Tor mailing list dated Jan 20, 2010, Tor developer Roger Dingledine outlines the issue and why you should upgrade to Tor 0.2.1.22 or 0.2.2.7-alpha now: 'In early January we discovered that two of the seven directory authorities were compromised (moria1 and gabelmoo), along with metrics.torproject.org, a new server we'd recently set up to serve metrics data and graphs. The three servers have since been reinstalled with service migrated to other servers.' Tor users should visit the download page and update ASAP."

93 of 161 comments (clear)

  1. From: Anonymous Coward by Anonymous Coward · · Score: 5, Interesting

    Anyone else find it so funny that a news story about anonymity is suggested to slashdot by anonymous coward?

    I think it's the best form of joke... one with an epic amount of unexpected expectedness.

    1. Re:From: Anonymous Coward by DNS-and-BIND · · Score: 1, Insightful
      A joke? How, exactly, is it funny? I'm curious to know. Who cares who submits the stories, anyway? Half of them turn out to be fakes or misleading anyway.

      The real TOR way to do it would not be anonymously, but instead giving it to another person's slashdot account, who submits it for you. But go ahead with the "funny" "jokes".

      --
      Shutting down free speech with violence isn't fighting fascism. It IS fascism!
    2. Re:From: Anonymous Coward by Anonymous Coward · · Score: 1, Funny

      I wonder if the intruder was using Tor when they broke in ?

  2. Takes all types... by adbge · · Score: 2

    Anyone else find it so funny that a news story about anonymity is suggested to slashdot by anonymous coward?

    I think it's the best form of joke... one with an epic amount of unexpected expectedness.

    If you think that's funny, just think...

    Every Anonymous Coward posting about this article will be an Anonymous Coward posting about an Anonymous Coward's anonymity story. A story by an Anonymous Coward for Anonymous Cowards about Anonymous Cowards. Anonymous anonymous anonymous.

  3. Tor weaknesses by girlintraining · · Score: 4, Interesting

    The problem with Tor is that there's no way to detect compromises -- every node on the network could be compromised and you'd never know. Authors of botnets have greater anonymity than we do -- ironically because it's run by a central authority. An illegal and immoral one, yes, but one that comes with a measure of anonymity. Few botnet authors are actually caught even with the most primitive security methods. They don't even use encryption and they often can't be found...

    --
    #fuckbeta #iamslashdot #dicemustdie
    1. Re:Tor weaknesses by v1 · · Score: 5, Informative

      They don't even use encryption and

      Oh but they do, and that's the key to the problem. Everyone and their dog knows where the C&C servers are, and can monitor the commands sent out. Problem is, the commands are cryptographically signed, usually with a hideously large key (last one I saw was 2048 BYTES) so you can't subvert their network. Improperly signed commands are merely ignored.

      The bot herders get their anonymity from any of a hundred ways to anonymously sign into the IRC C&C channel. I'd speculate that most of them use TOR to do so.

      --
      I work for the Department of Redundancy Department.
    2. Re:Tor weaknesses by snowgirl · · Score: 4, Insightful

      The problem with Tor is that there's no way to detect compromises -- every node on the network could be compromised and you'd never know. Authors of botnets have greater anonymity than we do -- ironically because it's run by a central authority. An illegal and immoral one, yes, but one that comes with a measure of anonymity. Few botnet authors are actually caught even with the most primitive security methods. They don't even use encryption and they often can't be found...

      There's a lot to be said for hiding in a crowd though. While it is true that every node in the network could be compromised, and we'd never know, collecting all that data together to target you individually becomes more and more difficult the more people use the network... and we're not talking about big-O of n, we're talking at least big-O n squared or so.

      As with all forms of security, there's nothing you can do to guarantee security, you simply raise the burden of breaching that security until the opportunity to breach you is not worth the cost to breach you.

      --
      WARNING! This girl exceeds the MAXIMUM SAFE standards established by the FDA for BRATTINESS
    3. Re:Tor weaknesses by broken_chaos · · Score: 1

      last one I saw was 2048 BYTES

      It may make more sense, as long as that reference to bytes (not bits) is accurate, to refer to this as a 16 kilobit key instead, as public key encryption is usually referenced in bits. While RSA of this length can be done (even using GPG, though you have to modify the source to bypass the compatibility restrictions), it's quite a bit of overkill. The other algorithms used (since RSA is almost always only used for signing/encrypting something smaller -- like signing an SHA256 hash or encrypting an AES key) would almost certainly be much weaker.

      ...Mind you, in this instance, weaker still means "likely not in any danger of being broken for 20+ years".

    4. Re:Tor weaknesses by Anpheus · · Score: 1

      I believe at the beginning of 2010 the NIST increased their recommendation for RSA to a minimum of 2048 bits due to security concerns of 1024 bit keys.

    5. Re:Tor weaknesses by iluvcapra · · Score: 1

      It may make more sense, as long as that reference to bytes (not bits) is accurate, to refer to this as a 16 kilobit key instead, as public key encryption is usually referenced in bits.

      We could just quote the key size in terms of "cardinality of encodings of state of every atom in the universe," in which case I believe a 16 kilobit key would be about 200 universe-states. :)

      --
      Don't blame me, I voted for Baltar.
    6. Re:Tor weaknesses by X0563511 · · Score: 2, Interesting

      The fun begins when they start noting illegal commands and retaliating. Fun.

      --
      For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
    7. Re:Tor weaknesses by ShakaUVM · · Score: 1

      >>They don't even use encryption and they often can't be found...

      Also, they used "123456" and "iloveyou" as the master password on 2 of the 7 nodes.

    8. Re:Tor weaknesses by girlintraining · · Score: 1

      There's a lot to be said for hiding in a crowd though.

      Not when the IP headers of every packet sent through every major peer exchange point on this continent is recorded by this government, and the governments that control the intercontinental links each have peering arrangements so that said data is available on a reciprocal basis with other intelligence agencies operating under their respective governments worldwide.

      Most TCP/IP sessions can be reconstructed for months after their original transmission, because the cost of storing said data is so low and there's an intelligence value in having it accessible. Thanks to delta compression algorithms, they don't need to store the complete packet log at each collection point -- because the data is largely the same.

      All of this depends on an interesting fact about entropy: Very little of what you transmit is actually unique. Most of the traffic online is just a retransmit of something sent earlier, which makes the computational resources required to log all internet traffic and store it for months at a time make it a reasonably easy problem to solve. Easy, I mean, for a government with hundreds of millions to throw at the problem, not mere mortals like you or I. And of course there's ways to pair petabytes off the dataset using whitelisting and other data management methods.

      It honestly impresses me that people think that the internet is a substantial barrier to this kind of intelligence gathering; Since it runs on the same networks, uses largely the same technologies, and is often run by the same companies that deliver telecommunications services... Which anyone will tell you give full access to their lines and equipment with the flashing of a badge and a post-it note. You don't even have to buy them a beer after.

      Hiding in a crowd only works if you've done nothing to attract attention to yourself and can hide in statistical obscurity, surfing the noise floor. The moment you do anything even remotely interesting (and using Tor qualifies), bend over and kiss your anonymity goodbye.

      --
      #fuckbeta #iamslashdot #dicemustdie
    9. Re:Tor weaknesses by Onymous+Coward · · Score: 1

      When he talks about hiding in the crowd, he talks about hiding in the Tor crowd.

      When you talk about compressing packets, you probably aren't referring to encrypted packets. Including SSL. Which there's lots of.

      I ran a Tor node for a long time. And never used it myself. Others are welcome to "raise the noise floor" with such participation and/or licit uses.

      I think mix networks should work pretty well, but I wouldn't say that I have a complete grasp of the details. Nor do I expect you have, judging by your response. My guess is that if you have a substantial quantity of Tor nodes on your side of an eavesdropper tap that traffic analysis doesn't stand a real chance. Does that sound right to you? So mesh networks should be an anathema to would-be attackers. And any steps in that direction (more reliable peers and connections to peers) help. Anyway, I wouldn't already expect my government to be placing record-keeping taps at each ISP rather than just peering points.

      http://en.wikipedia.org/wiki/Tor_(anonymity_network)#Weaknesses

      As with any discussion about security, I note that the issue isn't black and white. There are many degrees and kinds of being hidden or vulnerable and countlessly varied purposes for hiding. If I want not to be traceable as the annoying AC who makes racist remarks on Slashdot, would I use Tor? Sure (or I wouldn't even bother). I wouldn't bend over and kiss my anonymity goodbye. If I were planning an attack on the World Trade Center, would I use Tor? Maybe. Though I'd be careful about my entry node and its immediate peers. And probably my endpoint would be an .onion service run by someone I trusted.

    10. Re:Tor weaknesses by Rich0 · · Score: 1

      Actually, that would be an unwise design - as it causes a node to take action when it gets an unauthenticated command. That basically gives anybody some level of control on your botnet.

      For example, I can spoof a fake command from some IP - now the botnet takes down a server of MY choosing. While it is busy doing that, it probably isn't taking down the server the botnet owner wants it to take down, or sending spam, or whatever.

      Nope - you design a node to treat an unauthenticated command as if it was never received.

    11. Re:Tor weaknesses by LearnToSpell · · Score: 1

      And "Chuck Norris" on the other 5.

      --
      Haida Manga
    12. Re:Tor weaknesses by girlintraining · · Score: 1

      When he talks about hiding in the crowd, he talks about hiding in the Tor crowd.

      Let me rephrase this: Tor is not as resistant to traffic analysis as it is believed, because the Tor authors make assumptions about the state of surveillance on the network which are fundamentally flawed. Specifically, they believe that security is improved by obscuring the location of the node to peers. Because of this, routing paths between nodes are made longer, increasing the statistical likelihood that it will pass through a collection point.

      Tor has limited utility -- if you initiate a connection domestically, to an international location that does not have access to the database mentioned earlier, then a degree of security is possible. But for protecting citizens against domestic spying by its government, Tor is inadequate. It may be inadequate in a wider theatre as well, but such an analysis is beyond the scope of this post.

      --
      #fuckbeta #iamslashdot #dicemustdie
    13. Re:Tor weaknesses by Onymous+Coward · · Score: 1

      What do you mean by "[they obscure] the location of the node to peers"?

  4. Further Details From Roger On or-talk mailing list by Anonymous Coward · · Score: 5, Informative

    Roger's entries to date on the subject (excluding first page linked within /. summary):

    (this is for those who are too lazy to page through mailing list threads, this post is
    missing other individuals replies as well as future replies from Roger and others)

    http://archives.seul.org/or/talk/Jan-2010/msg00165.html

    Here are some more technical details about the potential impacts, for
    those who want to know more about Tor's innards:

    ----- #1: Directory authority keys

    Owning two out of seven directory authorities isn't enough to make a new
    networkstatus consensus (you need four for that), but it means you've
    only got two more to go. We've generated new v3 long-term identity keys
    for these two authorities.

    The old v3 long-term identity keys probably aren't compromised, since
    they weren't stored on the affected machines, but they signed v3 signing
    keys that are valid until 2010-04-12 in the case of moria1 and until
    2010-05-04 in the case of gabelmoo. That's still a pretty big window,
    so it's best to upgrade clients away from trusting those keys.

    You should upgrade to 0.2.1.22 or 0.2.2.7-alpha, which uses the new v3
    long-term identity keys (with a new set of signing keys).

    ----- #2: Relay identity keys

    We already have a way to cleanly migrate to a new v3 long-term identity
    key, because we needed one for the Debian weak RNG bug:
    http://archives.seul.org/or/announce/May-2008/msg00000.html

    But we don't have a way to cleanly migrate relay identity keys. An
    attacker who knows moria1's relay identity key can craft a new descriptor
    for it with a new onion key (or even a new IP address), and then
    man-in-the-middle traffic coming to the relay. They wouldn't be able to
    spoof directory statements, or break the encryption for further relays
    in the path, but it still removes one layer of the defense-in-depth.

    Normally there's nothing special about the relay identity key (if you
    lose yours, just generate another one), but relay identity keys for
    directory authorities are hard-coded in the Tor bundle so the client
    can detect man-in-the-middle attacks on bootstrapping.

    So we abandoned the old relay identity keys too. That means abandoning
    the old IP:port the authorities were listening on, or older clients will
    produce warn messages whenever they connect to the new authority. Older
    Tor clients can now take longer to bootstrap if they try the abandoned
    addresses first. (You should upgrade.)

    ----- #3: Infrastructure services

    Moria also hosted our git repository and svn repository. I took the
    services offline as soon as we learned of the breach -- in theory a clever
    attacker could give out altered files to people who check out the source,
    or even tailor his answers based on who's doing the git update. We're
    in pretty good shape for git though: the git tree is a set of hashes
    all the way back to the root, so when you update your git tree, it will
    automatically notice any tampering.

    As explained in the last mail, it appears the attackers didn't realize
    what they broke into. We had already been slowly migrating Tor services
    off of moria (it runs too many services for too many different projects),
    so we took this opportunity to speed up that plan. A friendly anonymous
    sponsor has provided a pile of new servers, and git and svn are now up
    in their new locations. The only remaining Tor infrastructure services on
    moria are the directory authority, the mailing lists, and a DNS secondary.

    ----- #4: Bridge descriptors

    The metrics server had an archive of bridge descriptors from 2009.
    We used the descriptors to create summary graphs of bridge count and
    bridge usage by country, like the ones you can see at
    http://metrics.torproject.

  5. Wait a minute... by __aaclcg7560 · · Score: 3, Funny

    How do you update a Tor SF paparback book?

    1. Re:Wait a minute... by __aaclcg7560 · · Score: 1

      Nope. Paperback, dead tree edition. How you get a security breach from a dead tree is beyond me. ;)

    2. Re:Wait a minute... by GaryOlson · · Score: 1

      With a trilogy. The last two books add depth and detail to the initial book which was mostly inane and lacking in depth. The new details of course reinterpret all the facts, plot, and characters of the first book till the first book is almost unrecognizable.

      --
      Every mans' island needs an ocean; choose your ocean carefully.
    3. Re:Wait a minute... by __aaclcg7560 · · Score: 1

      The Wheel of Time series must be buggy as hell then. What is now, book 12? Books 13 and 14 are coming in the next few years. ;)

    4. Re:Wait a minute... by ravenshrike · · Score: 1

      Clearly it was done in C++ and some idiot set up a loop in Book 1. Possibly in the chapter about fields.

    5. Re:Wait a minute... by zmollusc · · Score: 1

      The bugginess is offset slightly by the neat RAID array of authors.

      --
      They whose government reduces their essential liberties for temporary security, receive neither liberty nor security.
    6. Re:Wait a minute... by Opportunist · · Score: 1

      Do papercuts count? They share a lot of features with security breaches. They are easy to get if you're not careful, they are barely noticable, everyone will think you're a crybaby if you're complaining about them and yet they hurt like hell.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    7. Re:Wait a minute... by machine321 · · Score: 1

      Redundant Author Is Dead?

    8. Re:Wait a minute... by harmonise · · Score: 1

      How do you update a Tor SF paparback book?

      With new pieces of papar.

      --
      Cory Doctorow talking about cloud computing makes as much sense as George W Bush talking about electrical engineering.
    9. Re:Wait a minute... by ShaunC · · Score: 1

      By visiting TORForge, of course...

      --
      Thanks to the War on Drugs, it's easier to buy meth than it is to buy cold medicine!
    10. Re:Wait a minute... by docwatson223 · · Score: 1

      Online Editions, Kindle, .pdf and for backup you can go Hardback.

  6. Re:Sooo...... by Anonymous Coward · · Score: 1, Insightful

    Not that I'm defending pedophilia, but the fact that you're conflating pedophiles and child molesters makes me suspect your statistics.

  7. US Intelligence almost certainly monitors TOR by presidenteloco · · Score: 3, Interesting

    I mean. That's where I'd go fishing for people trying to communicate secrets,
    if I was them.

    Now I don't want to spread paranoia, but
    did you know that the patent on Onion Routing was filed by the US Department of the Navy?
    Look it up.

    Remember kiddies. Always use your own encryption layer.

    --

    Where are we going and why are we in a handbasket?
    1. Re:US Intelligence almost certainly monitors TOR by wiredlogic · · Score: 3, Insightful

      They probably do more than just monitor. They almost certainly run their own exit nodes so they can log everything flowing through what they pwn.

      --
      I am becoming gerund, destroyer of verbs.
    2. Re:US Intelligence almost certainly monitors TOR by noz · · Score: 1

      This is because the US Navy are the initial authors of Tor. It was opened when they no longer withed to maintain it.

    3. Re:US Intelligence almost certainly monitors TOR by some_guy_88 · · Score: 1

      They'd have to monitor/run more than just the exit nodes in order to figure out it was you though right? Isn't that the whole idea?

      Just a single un-compromised node on the path from you to the destination would mean you were still anonymous (assuming there was enough traffic on the network). Although, if there wasn't much traffic and they had your entry and exit node you might be in trouble?

    4. Re:US Intelligence almost certainly monitors TOR by BitZtream · · Score: 2, Insightful

      Yes, the government created it, this is well known. They created it so they could securely communicate by bouncing signals off of unsecured ships, like your random cruise ship or an allied warship.

      They were involved with its creation, of course the watch it. So do lots of other people.

      As a general rule, people hiding their activities DO HAVE SOMETHING TO HIDE. The minority use something like this for legitimate uses. However, our founding fathers had the opinion that until we know you're hiding something bad, you can hide it so no one can come after your for something you do in private that doesn't bother anyone else. This helps to prevent people from having a bad opinion of you, prejudice and hate.

      It doesn't however change the fact that it will be used, primarily by people using it to hide illegal activities. It would be retarded if they DIDN'T watch it and as a tax payer I'd be pissed if they didn't.

      Reality says that most people have no need to use this sort of protection and that its of very little use to the majority of the people on the planet, even those doing minor illegal activities.

      I've talked about plenty of things over the phone, email and hell, even posted on bulletin boards (the real ones, cork board and paper with pushpins) at grocery stores about illegal activities. None of it was anything major of course, minor little crap, all of which were misdemeanors. There are 2 reasons why nothing ever came of it.

      A. It was minor crap, no one actually cares about what I did unless I was stupid enough to do it in front of an ON DUTY cop.

      B. Hiding in plain site and blending in with the crowd makes you a lot less obviously a target than the person hiding things, regardless of what you are hiding.

      So yes, when you make it obvious you're trying to hide something people are going to pay attention to try and figure out what you're hiding, thats being a good detective and what I expect from people who's job is to detect stuff.

      --
      Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
    5. Re:US Intelligence almost certainly monitors TOR by Mr.Bananas · · Score: 2, Interesting

      Have a read at this piece of work: http://papers.ssrn.com/sol3/papers.cfm?abstract_id=998565 While hiding in plain sight has its value, not being able to hide anything can have plenty of harm to an innocent person, especially if they have no control of how their data is used or interpreted.

    6. Re:US Intelligence almost certainly monitors TOR by djupedal · · Score: 1

      >Hiding in plain site and blending in with the crowd makes you a lot less obviously a target than the person hiding things, regardless of what you are hiding.

      Comparing your anecdote about hiding inside a group of grocery store customers doesn't apply to the debate at hand. How does one 'hide' in the manner you propose when they elect to do it inside a (tor) group that is already flagged as being watch-worthy?

      If the group was looting the store, and you wanted to loot too, would there be any logic to stating "I'm hiding by being inside the group of looters!"? At that point you are either a tor user or you're not. If you're a tor user it is silly to claim hiding rights inside the group.

      Reset and try again, please, thanks.

    7. Re:US Intelligence almost certainly monitors TOR by dkf · · Score: 1

      That's mitigated by sending random data at a constant rate, so there are no spikes in usage when you are actually using it.

      Actually, you want to introduce white noise in the rate at which you send the data too. Without that, it's possible to see when you're sending traffic by looking for spikes above the background rate.

      --
      "Little does he know, but there is no 'I' in 'Idiot'!"
    8. Re:US Intelligence almost certainly monitors TOR by Opportunist · · Score: 1

      You better stop using the internet. Remember who invented it? Hint: It wasn't Al Gore.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    9. Re:US Intelligence almost certainly monitors TOR by b4dc0d3r · · Score: 1

      As a general rule, people hiding their activities DO HAVE SOMETHING TO HIDE

      Whether they are watching banned movies in your living room, or watching Shrek with your children, I bet most people close their curtains when it gets dark. What are they hiding?

      Let me guess, you're the cop who pulled me over on super bowl sunday and wanted to search my car because I blew 0.00 on your breathalyzer. I was speeding, so the pullover was valid. I have anxiety problems, and being pulled over at night by a single cop is not the most comfortable experience. You thought I was acting suspiciously because of my general anxiety and wanted to search my car.

      "If you have nothing to hide, you have nothing to worry about."

      So, that's wrong. I'm not hiding anything, I'm enforcing my rights. Ignorance of the law is no excuse, right? So you expect people to know the law. But if they call you on it, all of a sudden it's suspicious. That's a double standard, and you as an authority figure are applying pressure to get me to do something I don't feel like doing, which is pretty much an abuse of power.

      "Hi judge, I just pulled this guy over and he said I couldn't search his car, that makes me think something's up. Can I have a warrant?"

      Sorry, that wouldn't work (that part didn't actually happen, because he knew it wouldn't work). The proper way to search is to ask my permission or get a warrant. Since I said no, now you have to get a warrant. If you can't convince a judge, you never had probable cause. Here's my legally owned prescription anxiety drugs in a properly labeled container, still think I'm acting suspiciously? You already gave me a field sobriety test which came back negative or I'd already be in the back seat of your car, so I'm not impaired by those drugs, and if I were under their influence I wouldn't seem so anxious, eh? Still think I'm acting suspiciously?

      "Yes, you're hiding something. What's wrong, you have a joint in there you don't want me to find? An unregistered gun?"

      OK, fine. You know what, search my car. No ticket, nothing turned up in the search, I got an apology and a warning. An apology, and no ticket, from a cop who pulled me over for going 75 in a 60 zone. Did I have something to hide? Yes, my personal belongings from someone who has no reason to see what I'm doing. I'm hiding from the government and its agencies anything it does not have, by the laws of the land, any right to see.

      When you have probable cause you can come for me, until then go away.

      They might be crazy, but I'd expect anyone who believes in UFOs and thinks Roswell was a coverup would use TOR to gather and share evidence that "the gvmt doesn't want you to see." Or people sharing "true stories from 9/11 workers showing it's an inside job" or "OKC bombing was an inside job and we just found a patsy to blame" and "John Wilkes Booth was hired by the CIA" and "Lee Harvey Oswald worked for Hoover". These people are mostly harmless and think they have something to hide - the opposite of your supposition. They are hiding despite having nothing to hide. Nothing substantial of course, but they think they do.

      Even more important, which I should have listed first, is the idea of free speech. People can't make changes if the government hides things from them, so it makes sense to create software that lets people share ideas. Silly harmless ones like above, or profound movements where the people force change in their government by revealing information. Someone sharing old 1970s era pictures of naked children is doing no actual harm (unless you want to conflate and suppose and imagine and maybe project, the pictures already exist). Someone working to free the Chinese people from a protective government is doing a great service (*in my opinion at least). Subverting your own government is treason, but I can freely say that I believe other citizens should subvert their governments without fear. What if I send that sentiment to my fri

  8. Re:Sooo...... by Anonymous Coward · · Score: 1, Insightful

    Sounds like anonymity projects are suffering the same problem as encryption in general -- it's too hard to use unless you're pretty sure you have a need for it.

    With the casual farming of information that goes on by Internet ad networks, the lack of security of public Wi-Fi, and the push for deep packet inspection by ISPs, I think we've reached a point where attacks on the privacy of innocent users justifies a need for average folks to have access to these sorts of products (and associated education.)

    But until it's as simple as hitting a button in Firefox to use Tor, of course it's only going to be the enthusiasts and scumbag fringes that'll put the time into researching and securing their privacy online.

  9. Re:Sooo...... by Anonymous Coward · · Score: 1, Informative
    I love it when clueless people comment and show their ignorance, it's good for future reference.

    It still seems this breach is unrelated to Tor itself. To be clear, it doesn't seem that anyone specifically attacked our servers to get at Tor. It seems we were attacked for the cpu capacity and bandwidth of the servers, and the servers just happened to also carry out functions for Tor.

    * Does this mean someone could have matched users up to their destinations?
    No....

    * Does this mean someone could have learned more about Tor than an ordinary user?
    Since our software and specifications are open, everyone already has access to almost everything on these machines...

  10. Re:Sooo...... by Velorium · · Score: 1

    Why is this modded troll? This is a valid notion.

  11. Re:Sooo...... by Anonymous Coward · · Score: 3, Informative

    I spent a bit over a year working with the FBI gathering information on a pedophile ring who was using one of our servers (to coordinate picture trading going on in Asian image board sites). Neither agents' opinions, the content gathered, nor the actual research I've seen, agree with your unsupported assertion that "they are one and the same". Though, two troll paratrooper points for accusing those who disagree with you of naivete. Good show, golf claps all around.

    I also don't know to what extent the "pedo" content in actual prepubescent kids, versus underage pubescent ("jailbait"). No, I don't really want to know either. Anyway, ephibophilia is illegal, but arguably medically normal, and ephibophiles and pedophiles make up separate populations.

  12. Re:Sooo...... by xous · · Score: 4, Insightful

    Hi,

    How did you collect your statistics when Tor is decentralized? Sure you could analyze the outbound traffic on a exit node but I doubt that this would be enough of a sampling to extrapolate a meaningful conclusion. Since you offer no supporting evidence your claim is irrelevant to the discussion.

    I also do not think that the number of child molesters could be large enough to represent a "vast majority" because I doubt the original content producers would distribute a such a high risk material for free. It is much more likely that pedophiles are distributing the material to other pedophiles. I think that it is important to note the difference because while I find either appalling I'd rather have them fapping to "old child pornography" instead of creating a demand for new material and reducing the profit margins of the people that are actually doing these horrible things to children. The lesser of of two evils is still evil but we don't live in a idealistic world.

    Unfortunately freedom has it's costs.

  13. Re:Sooo...... by trytoguess · · Score: 4, Insightful

    In short, people attracted to children will rape them? A bit like saying all men will rape women no? But that's not a perfect analogy, you can have sex with a man or woman without too much difficulty, whereas a pedophile can only masturbate. How about, would all slovenly, unattractive, misanthropes, who've zero chance of getting sex resort to rape? I rather doubt it, and even though pedophilia disturbs me, I don't think the sexual drive of that group is somehow stronger than your average male or female.

  14. New Tor attacks and anonimity attacks all the time by Anonymous Coward · · Score: 1, Interesting

    Attacking Tor at the Application Layer

    http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-gregory_fleischer-attacking_tor.pdf

    https://media.defcon.org/dc-17/video/DEFCON%2017%20Hacking%20Conference%20Presentation%20By%20Gregory%20Fleischer%20-%20Attacking%20Tor%20and%20the%20Application%20Layer%20-%20Video%20and%20Slides.m4v

    https://media.defcon.org/dc-17/video/DEFCON%2017%20Hacking%20Conference%20Presentation%20By%20Gregory%20Fleischer%20-%20Attacking%20Tor%20and%20the%20Application%20Layer%20-%20Slides.m4v

    https://media.defcon.org/dc-17/audio/DEFCON%2017%20Hacking%20Conference%20Presentation%20By%20Gregory%20Fleischer%20-%20Attacking%20Tor%20and%20the%20Application%20Layer%20-%20Audio.m4b

    Sniff Keystrokes With Lasers/Voltmeters - Side Channel Attacks Using Optical Sampling Of Mechanical Energy And Power Line
    Leakage:

    http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-barisani-bianco-sniff_keystrokes.pdf

    http://www.defcon.org/images/defcon-17/dc-17-presentations/Andrea_Barisani-Daniele_%20Bianco/defcon-17-barisani-bianco-sniff_keystrokes-wp.pdf

    https://media.defcon.org/dc-17/video/DEFCON%2017%20Hacking%20Conference%20Presentation%20By%20Andrea%20Barisani%20and%20Daniele%20Bianco%20-%20Sniffing%20Keystrockes%20with%20Lasers%20and%20Voltmeters%20-%20Video%20and%20Slides.m4v

    Router Exploitation

    http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-fx-wp.pdf

    https://media.defcon.org/dc-17/video/DEFCON%2017%20Hacking%20Conference%20Presentation%20By%20FX%20-%20Router%20Exploitation%20-%20Video%20and%20Slides.m4v

    https://media.defcon.org/dc-17/video/DEFCON%2017%20Hacking%20Conference%20Presentation%20By%20FX%20-%20Router%20Exploitation%20-%20Slides.m4v

    Unmasking You

    http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-abraham-hansen-unmasking_you.pdf

    Tactical Fingerprinting Using Metadata, Hidden Info and Lost Data

    http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-alonso-palazon-tactical_fingerprinting.pdf

    Down the R

  15. Re:Sooo...... by Runaway1956 · · Score: 2, Insightful

    I don't know where to find good citations - but you can research easily enough.

    Download not just TOR, but I2P, freenet, anonnet - search for more if you like. You WILL BE exposed to child porn. No questions asked, you'll be exposed.

    It's safe to say that 2/3 to 3/4 of all the sites out there are trash that you don't even want to see. But - there are also some interesting things that are NOT pornography.

    You can go explore, or not. It's slow, it's aggravating because all the CP gets in the way, there's not a whole LOT OF good stuff to find, but, go explore all the same. Make sure you read the documentation - you don't want to broadcast your IP across the dark web, with all your personal details. You think the regular internet is bad? LMAO

    --
    "Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
  16. Snail Mail by ArchieBunker · · Score: 1

    IMHO sending a message inside a birthday card draws a LOT less attention than using obscure and suspicious looking encryption software. But thats just my opinion.

    --
    Only the State obtains its revenue by coercion. - Murray Rothbard
    1. Re:Snail Mail by MrNaz · · Score: 5, Funny

      Dear John & Cynthia.
      Thank you for all your support this year, and I wish you all the best for the next.
      Yours truly,
      John and Sarah.

      P.S., Attack at dawn.

      --
      I hate printers.
  17. Re:Sooo...... by Anonymous Coward · · Score: 1, Insightful

    Anyway, ephibophilia is illegal, but arguably medically normal, and ephibophiles and pedophiles make up separate populations.

    No, it's not illegal. For that matter, neither is pedophilia. ACTING on ephibophilia or pedophilia is illegal.

  18. Re:Further Details From Roger by inviolet · · Score: 4, Insightful

    As explained in the last mail, it appears the attackers didn't realize what they broke into. We had already been slowly migrating Tor services off of moria (it runs too many services for too many different projects), so we took this opportunity to speed up that plan. A friendly anonymous sponsor has provided a pile of new servers, and git and svn are now up in their new locations.

    Mmmm, yes, free.

    And you will never, in a million years, detect the compromised hardware in those machines.

    The only way for tor (or wikileaks or other dangerous-to-the-authorities service) to buy hardware, is anonymously. If someone wants to donate servers, have them sell the servers and give you the cash.

    --
    FATMOUSE + YOU = FATMOUSE
  19. Re:Sooo...... by fuzzyfuzzyfungus · · Score: 1

    Unfortunately, the online anonymity mechanisms all suffer from a fundamental problem:

    Since, in order to get your packets from point you to point wherever and back, some number of untrusted machines have to know your IP and your desired destination(at a minimum, your destination gets to know, more typically, a fair few machines controlled by one or more ISPs will be involved) all the anonymity mechanisms attempt to break up the round-trip into chunks too small to be useful. It is always going to be slower, and less efficient(ie. less useful data transferred over a pipe of given capacity) to have your packets follow an intentionally tortuous path intended to make following them hard than it will be to be open about your intentions and let the usual mechanisms for efficient routing take over.

    This isn't to say that it isn't worth it, especially for whatever qualifies has "high risk activity" in your jurisdiction or just to give the marketing bastards the finger; but it will always be a tradeoff in ways that a nice frontend and easy config for the noobs will never solve.

  20. Re:Sooo...... by clang_jangle · · Score: 4, Informative

    But until it's as simple as hitting a button in Firefox to use Tor, of course it's only going to be the enthusiasts and scumbag fringes that'll put the time into researching and securing their privacy online.

    Duh!

    --
    Caveat Utilitor
  21. Re:first by JWSmythe · · Score: 2, Interesting

        Technically, it can't be. But since most of the exit points are pretty well known, it's not all that hard. If more people made themselves exit points, rather than just taking advantage of the network, that problem would go away.

        I've tried Slashdot. It's been a matter of switching exit points until you find one that isn't forbidden. Google is really on top of it though. I suspect they may have a tie-in with the network map, so they know the exit points as they come and go.

    --
    Serious? Seriousness is well above my pay grade.
  22. Re:Sooo...... by DigiShaman · · Score: 1

    I disagree.

    If you happen to stumble upon some questionable content, that's one thing. However, it's quite another to be on the constant pursuit of it. The way I see it, the later is generating a market demand. While that person isn't doing anything illegal from a physical standpoint, I still view them as an accessory to a crime.

    --
    Life is not for the lazy.
  23. Re:Sooo...... by Anonymous Coward · · Score: 1, Insightful

    I dislike how the second party gets abused though and don't say that they can consent to the pictures. You leave the child pretty twisted and the molesters don't care. It is just not fair to the child. It might not be fair to the molester as he can't help it, but it is not a victim less act. What they need is help understanding and managing. There is just so much social taboo around it that it is a real struggle for them.

  24. Re:Sooo...... by trytoguess · · Score: 2, Interesting

    People with sexual urges will eventually create an opportunity act on them, and readily available pornographic content simply encourages them by giving them validation and a sense of moral acceptance.

    Hmm... then how about homosexuality? It's not hard to find stories of people who denied attraction to the same sex their whole life in order to avoid being socially stigmatized.

    As for the effects of pornography, does masturbating calm your sexual urges, or does it inflame them?

  25. Re:Sooo...... by trytoguess · · Score: 2, Informative

    This is somewhat tangential, but there is illustrated porn where just about any deviance can be catered to without harming a minor. Actually molesting a child is wrong of course.

  26. Re:Sooo...... by trytoguess · · Score: 1

    Do try harder. As a member of slashdot you should appreciate the need to coldly analyze all things even if they are distasteful.

  27. Re:first by Dr.+Evil · · Score: 1

    Running an exit node is very, very, very risky.

    On the other hand, putting services like Slashdot or Google on as hidden services, it might reduce the demand for the exit nodes.

    Has any major company done this yet?

  28. Re:Sooo...... by larry+bagina · · Score: 2, Informative

    tor also lets you run an (anonymous) file server.

    --
    Do you even lift?

    These aren't the 'roids you're looking for.

  29. Re:Further Details From Roger by VortexCortex · · Score: 5, Informative

    Wait... Anyone can be a TOR node and it's still secure.

    TOR data is very encrypted.

    It doesn't matter if the hardware or software is compromised, it's still secure because a TOR node is just one node in a chain of encrypted nodes. You encrypt your data 5 times if you're sending it through 5 nodes.

    Each node takes off one layer of encryption and forwards the still encrypted data to the next node. If any intermediate nodes (2 3 4 in our 5 node example) are compromised (in software or hardware), they can not see the message in plain text, or determine the originating IP or destination IP of the traffic.

    If the first node is compromised it can see your source IP, but not the destination IP or any part of the message (it's still encrypted.)

    If the exit node is compromised it can see the destination IP, and clear text message, but not the source IP.

    These multiple layers of encryption mean that if any one node is compromised the system is still very secure.

    Taking off a layer of encryption at each router is like peeling an onion... hence, "The Onion Router".

    (this is an oversimplified explanaion -- if you're talking compromised code repositories, viruses and trojans are usually not delivered as source code, the tampering would be evident.)

  30. Re:Mercy-downmod parent? by mister_playboy · · Score: 1

    Those of us who are interested in everything Slashdot has to offer will still see the context.

    I personally don't understand who would want to browse a discussion where you only see half of what is going on, but to each his own.

    --
    Do what thou wilt shall be the whole of the Law ::: Love is the law, love under will
  31. Re:first by JWSmythe · · Score: 2, Insightful

        Ideally, everyone that runs a client is an exit node too. But, much like an open AP on your network, when the police come knocking at your door, just saying "But, I was just connected to Tor" isn't going to be much of a defense. It may work in court, but you may be waiting a long time for that day to come.

    --
    Serious? Seriousness is well above my pay grade.
  32. Re:Tor is going to get people killed. by Anonymous Coward · · Score: 3, Insightful

    I wish the holier than thous behind the Tor movement would stop with their outrageous and indefensible claims about the protections Tor allegedly provides.

    I tried to have this discussion with, among others, people who've made "names for themselves" traveling from conference to conference blustering about how Tor is making the Internet safe for unpopular opinions in places where an unpopular opinion can get you disappeared right quick (hello China)... shouted down every time because it's not a POPULAR point of view.

    I see that I'm not the only one in this discussion with concerns. Thank god things are changing.

    Whoever these people you have met traveling from conference to conference are not the authors of tor:

    # tor --help
    Jan 21 22:48:35.191 [notice] Tor v0.2.1.22. This is experimental software. Do not rely on it for strong anonymity. (Running on Linux x86_64)
    Copyright (c) 2001-2004, Roger Dingledine
    Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson
    Copyright (c) 2007-2009, The Tor Project, Inc.

    tor -f [args]
    See man page for options, or https://www.torproject.org/ for documentation.

  33. Re:Tor is going to get people killed. by jyoull · · Score: 1

    This is why i said "Tor movement" not "authors of Tor"

    It doesn't matter. The innocent, non-techies are not hearing from "the authors of Tor". They're hearing from others who are running around promoting it as the salvation of free speech in non-free places... and they are believed.

  34. Tor WILL get people killed, if it hasn't already by jyoull · · Score: 1, Insightful

    TOR apologists, no fair modding down these comments just because you don't like them.

    I wish the holier than thous behind the Tor movement would stop with their outrageous and indefensible claims about the protections Tor allegedly provides.

    I tried to have this discussion with, among others, people who've made "names for themselves" traveling from conference to conference blustering about how Tor is making the Internet safe for unpopular opinions in places where an unpopular opinion can get you disappeared right quick (hello China)... shouted down every time because it's not a POPULAR point of view.

    I see that I'm not the only one in this discussion with concerns. Thank god things are changing.

  35. Re:Tor WILL get people killed, if it hasn't alread by u38cg · · Score: 1

    The bigger problem is that Tor is hardly deniable. Your traffic might be secure, but in many circumstances the fact that you are sending secure traffic is far more interesting. Given the right circumstances, that enough is sufficient for the state to use rubber hose cryptanalysis...

    --
    [FUCK BETA]
  36. Re:Sooo...... by justice2010 · · Score: 1

    I digress. When "something" is freely available,free being the operative word,then much like a 'free' newspaper, it's always self supporting.Usage is driven by chance,and readership somewhat mercurial. Moreover,suggesting that someone is an "accessory to a crime" for viewing said 'questionable content' is flawed. Example: A woman is raped in a public park.There were 200 witnesses who walked past, but chose not take the matter any further. There was however,a security camera present that captured the said offense, inclusive of the 200 witnesses who failed to act. All 200 witnesses have been identified by the CCTV and are now all "an accessory to a crime".

  37. Re:Further Details From Roger by Kjella · · Score: 1

    Yes, but at the top is some form of directory service. If you compromise the majority of those servers you can create a new network consensus, and direct everyone to route through tor1,tor2...torX.nsa.gov. Or some suitable set of apparently random international network of nodes set up for the purpose. The layers don't work if the entire onion is rotten.

    --
    Live today, because you never know what tomorrow brings
  38. Re:Further Details From Roger by wall0159 · · Score: 2, Interesting

    "A friendly anonymous sponsor has provided a pile of new servers, and git and svn are now up
    in their new locations"

    I read this to mean that tor are hosting git and svn on the new, anonymously-donated servers. I expect that if they were hardware-compromised, that could be used, in turn, to compromise the source-repositories. Please correct me if I'm wrong tho...

    Having said all that - I'd also expect a project like tor to be pretty careful with security! Also, it's quite possible that although the servers were anonymously-donated, they may still have been sourced by the tor project - it's hard to imagine a guy in a trench-coat and dark glasses knocking on their door, handing them a server before fading into the shadows, and them welcoming it with open arms!

  39. Oh no! by interkin3tic · · Score: 1

    This is torrible news! The torror...

  40. Re:Further Details From Roger by Aceticon · · Score: 1

    You don't seem to have read the GGP post at all.

    It lists plenty of venues of attack for a suficiently willing and knowledgeable attacker which state agencies would be.

    I wouldn't so easilly dismiss attacks delivered via source code if I was you: the GP was talking about attacks by state security services - these guys usually employ full time some pretty clever people who can usually make their own code they're no just a bunch of script kiddies downloading tools from the Internet (although from the Google attacks I suspect that, like in many other things, the Chinese went for quantity over quality and a lot of their "State Hackers" are little more than script-kiddies). Understanding and subtly altering a code base is not that hard if you're an good and experienced programmer.

    State agents thus have both the resources and the willingness for impersonating a friendly interested party, providing free machines that are actually compromised at the BIOS or even hardware level and subtly compromise TOR via the source code once the Source Control repository gets put in one of the trojaned machines - some of them might even have a wise enough leadership that they're willing to go slowly and carefully infiltrate and take over the TOR system using techniques like this.

  41. Re:Further Details From Roger by L4t3r4lu5 · · Score: 1

    If the exit node is compromised it can see the destination IP, and clear text message, but not the source IP.

    So, collect enough packets at a compromised exit node and you can build a usage pattern with possibility of identification? Using Tor to check email or blog from oppressed nations just looked a little less appealing.

    --
    Finally had enough. Come see us over at https://soylentnews.org/
  42. Re:Further Details From Roger by Opportunist · · Score: 1

    Using tor to transmit anything unencrypted is a very DUMB thing. You have to understand that between the exit node and the target server, all traffic is done in the same fashion it would be done between you and the target server if you didn't use tor. If there is no inherent encryption (like https or ssh), it will NOT be encrypted between the exit node and the server.

    In other words, it is trivial for someone who wants to sniff passwords to establish an exit node and just collect packets.

    tor is NOT an encryption tool. It is a tool to mask your whereabouts, to give you the means to access information your government does not want you to see. It's a tool to avoid prosecution when you access "illegal" information (read: information your government deems illegal). It is NOT a tool to increase your security against MITM sniffing. Quite the opposite.

    --
    We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  43. What was the cause of the breach? by master_p · · Score: 2, Interesting

    The links are not very informative about what allowed the breach to happen. Was a security model vulnerability? man-in-the-middle attack? buffer overflow?

  44. Re:Sooo...... by Neoprofin · · Score: 1

    Depends where you live and what you know. There are quite a few places that have laws regarding your responsibility to aid those in need. I believe in Wisconsin it only applies specifically to people with emergency medical training but there is some group that is under a legal obligation to help. I personally don't agree not only because I don't think an unwilling population makes the best responder but also because I think the legislation of morality is a slippery slope.

    That being said, especially after the event in Oakland last year where the 15 year old was gang raped for two hours out side of a school dance and no one so much as called the police I wish a stronger sense of moral obligation existed in some people.

  45. Re:Sooo...... by Neoprofin · · Score: 1

    Unless you subscribe to the theory of many that it creates an atmosphere encouraging to the exploitation of real children.

    Of course I don't think that's anymore logical than saying videogames contribute to a society more accepting of stereotypical villains with bad voice acting.

  46. Re:Sooo...... by Opportunist · · Score: 4, Insightful

    The price of freedom isn't vigilance in this time and age, it's having to deal with unpopular content.

    Is tor used by people who want to circumvent laws for whatever reason? Yes. Duh. Basically that's what it was created for. We deem it positive that tor allows dissidents to avoid their laws concerning the freedom of speech, but we don't deem it positive that it also allows the circumvention of our laws. That's very human, but also quite a bit of a double standard.

    I hope /. is a bit above the killer arguments of "think of the children" (honestly, if you think of the children all the time, you're prolly a pedo yourself) and we're able to look at it from a bit of a detached position. Because that's what we have to deal with here. Basically swapping child porn in the US is, at least from a purely content point of view, not different from swapping anti-government ideas in China: Both is illegal, and both requires additional security to be done without prosecution. The question is now whether we're willing to accept the existance of the former to enable the latter. You will only get them together. Is the freedom of the Chinese people (and, given the recent development in the west, probably ours soon, too) worth it, knowing that this will also allow communication of pedophiles, terrorists, spies and maybe even worse? Or should we toss both? That's basically the options we have.

    And before someone replies with "but tor doesn't allow chinese to discuss freely, isn't secure, etc": This isn't just about tor. That question affects all tools that allow free speech. The question is, is free speech worth dealing with the effects of free speech that you do not want to exist?

    --
    We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  47. Re:Sooo...... by Opportunist · · Score: 1

    Emotions are rarely a good adviser when trying to find a sensible solution. Thus, yes, coldly analyzing even horrible ideas is basically the correct way to come to a conclusion that will in the long run result in the least troubles.

    For reference, see the current headless chicken approach to terrorism.

    --
    We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  48. Re:Sooo...... by Opportunist · · Score: 1

    The content of secret dropboxes reflect the legality of content in the community. Since it is a bit of a hurdle to access those items, and the download speed is fairly slow, people will not host legal content this way, simply for convenience and availability reasons.

    --
    We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  49. Re:first by xaxa · · Score: 1

        Technically, it can't be. But since most of the exit points are pretty well known, it's not all that hard.

    There is a list of TOR exit points in case you want to black- or white-list them.

    If more people made themselves exit points, rather than just taking advantage of the network, that problem would go away.

    Last time I looked at it, I concluded that most of the traffic on TOR was child pornography and shared music/films. I didn't want to risk the police thinking I was responsible.

    (But, I only have ADSL so it's not much of a loss.)

  50. Re:first by NotBornYesterday · · Score: 2, Insightful

    I concluded that most of the traffic on TOR was child pornography and shared music/films.

    Please explain how you arrived at this conclusion. Did you actually survey TOR traffic to see what it contained, or are you simply assuming that the only reason most people want anonymity is CP & file sharing? I was under the the impression that TOR encrypted its traffic, except for what entered/exited at the exit nodes.

    --
    I prefer rogues to imbeciles because they sometimes take a rest.
  51. Re:Sooo...... by NotBornYesterday · · Score: 1

    You won't have to wait long. We're getting there.

    --
    I prefer rogues to imbeciles because they sometimes take a rest.
  52. Re:Sooo...... by WillDraven · · Score: 1

    And in many states you can actually have sex with them, you just cant take pictures.

    --
    This is my sig. There are many like it but this one is mine.
  53. Re:Sooo...... by phorm · · Score: 1

    You know, however much my jobs have sucked at various times, I think that the parent's job would suck worse. Dealing with images of abused kids as a regular job = really not fun. Tracking down and actually catching some of the offenders would likely be lightening, but I over time could see it easily working towards a storm-trooper attitude of bowling over (human) obstacles to get at the real bad guys if you had to see the evil things they do all the time...

  54. Re:Tor WILL get people killed, if it hasn't alread by Hatta · · Score: 1

    Fighting oppression has always gotten people killed. If Tor allows people to speak out with less risk, it's done it's job.

    --
    Give me Classic Slashdot or give me death!
  55. Re:first by grub · · Score: 1


    Last time I looked at it, I concluded that most of the traffic on TOR was child pornography and shared music/films.

    Unless you were able to sniff all the traffic going through TOR, I fail to see how you reached this conclusion.

    .

    --
    Trolling is a art,
  56. Re:first by JWSmythe · · Score: 1

      That's not exactly a "list", but it does make a good way to test if an IP is an exit point.

        I don't know about your assertion on child porn and piracy. There was a story not too long ago about how particular agencies were using TOR, and their mail passwords were compromised because they were sent plaintext, and exit nodes got them by sniffing the traffic.
     

    --
    Serious? Seriousness is well above my pay grade.
  57. Re:Sooo...... by GameboyRMH · · Score: 1

    DURR WUT IS FIREFOX I GO ON THE INTERNET WITH (INTERNET EXPLORER / SAFARI)??? I DONT SEE A TOR BUTTON THIS IZ HARD!!!

    Until off-the-shelf computers come with Tor or something similar ready to go right out of the box, of course it's only going to be the enthusiasts and scumbag fringes that'll put the time into researching and securing their privacy online.

    --
    "When information is power, privacy is freedom" - Jah-Wren Ryel
  58. Re: Sending secure traffic is far more interesting by presidenteloco · · Score: 1

    Good point. Bang on.

    Now as we move to encrypted fragmented cloud storage and computing, that assumption will presumeably have to change, as it will become routine to encrypt both your stored content and its transmission. And I can see anonymization being offered as part of cloud services of the future, to prevent corporate espionage (shady forms of "business intelligence") etc.

    When encryption and anonymization of net communications becomes the norm, then who do you watch, and how?

    --

    Where are we going and why are we in a handbasket?