Slashdot Mirror
Wikileaks Was Launched With Intercepts From Tor
The New Yorker is featuring a long and detailed profile of Julian Assange, founder of Wikileaks. From this Wired's Threat Level pulls out one salient detail: that Wikileaks' initial scoop came from documents intercepted from Tor exit routers. The eavesdropping was pulled off by a Wikileaks activist — neither the New Yorker nor Wired knows who or even in what country he or she resides. "The siphoned documents, supposedly stolen by Chinese hackers or spies who were using the Tor network to transmit the data, were the basis for Wikileaks founder Julian Assange's assertion in 2006 that his organization had already 'received over one million documents from 13 countries' before his site was launched ..."
Update: 06/02 06:31 GMT by T : In reaction to the Wired story, and the New Yorker story on which it drew, Andrew Lewman of the Tor Project points to this explanation / reminder of what Tor's software actually does and does not do. Relevant to the claims reported above, it reads in part "We hear from the Wikileaks folks that the premise behind these news articles is actually false -- they didn't bootstrap Wikileaks by monitoring the Tor network. But that's not the point. The point is that users who want to be safe need to be encrypting their traffic, whether they're using Tor or not." This flat denial of the assertion that Wikileaks was bootstrapped with documents sniffed from the Tor network is repeated unambiguously in correspondence from Wikileaks volunteers.
The summary is written as if Tor is suppose to be secure from eavesdropping. It isn't. It's supposed to offer anonymity. There's nothing to indicate that the _source_ of the documents was compromised.
"National Security is the chief cause of national insecurity." - Celine's First Law
Transparency is what the information age is for. It will be interesting to see how political bodies adjust... on one hand, the leaks are damaging, and truly innocuous or routine things can be spun and blown way out of proportion by opposition groups. On the other hand, they now have to behave to higher ethical standards (or at least the appearance of high ethical standards) because virtually anything could become public knowledge.
Heh, there have been rumors this has been a bonanza for the intelligence community. If wikileaks is doing it you can bet every three letter agency in the world has been doing it too.
An Education is the Font of All Liberty
I don't question the validity of their information. If their information wasn't valid, then companies wouldn't sue to have it taken down the way they have been. They'd be going with anti-defamation suits. They haven't been.
"There is a way that seems right to a man, but its end is the way of death." Proverbs 16:25 (NKJV)
Would this be a fundamental flaw of the TOR network? If you don't know who's controlling the exit nodes, then you will never know if the information you send is truly secure.
Tor offers anonymity, not security. Encryption and signing is for security. The two can be combined.
No, this is a fundamental flaw with unencrypted communication, which is exactly what you're doing when you use Tor to access things outside of the Tor network without additional encryption. Either stay inside the network or ensure whatever you're running over it has its own encryption, simple as that. As always, the biggest threat to security is incompetence.
Sounds like an excellent way to spread disinformation.....even better than say.....the New York Times.
You know, even as recently as the salad days of my youth, I could have labeled you a troll for writing that about the NYT.
Now, alas, all I can do is nod my head sadly in agreement.
Crumb's Corollary: Never bring a knife to a bun fight.
...for getting around the Great Firewall to d/l porn and access facebook, not for doing anything that needs to be secure.
"I don't care about the Constitution!" --Bill O'Reilly, November 17, 2009
The attempts by large groups to dominate the weak occurred long before capitalism, and will continue should capitalism ever cease to exist. It is simply one model of domination. There are many more in existence.
More precisely, it is not the nodes themselves that are the risk, but the (unencrypted) communication coming from the exit nodes.