Group Thinks Anonymity Should Be Baked Into the Internet Itself Using Tor

Hugh Pickens DOT Com writes "David Talbot writes at MIT Technology review that engineers on the Internet Engineering Task Force (IETF), an informal organization of engineers that changes Internet code and operates by rough consensus, have asked the architects of Tor to consider turning the technology into an Internet standard. If widely adopted, such a standard would make it easy to include the technology in consumer and business products ranging from routers to apps and would allow far more people to browse the Web without being identified by anyone who might be spying on Internet traffic. The IETF is already working to make encryption standard in all web traffic. Stephen Farrell believes that forging Tor into a standard that interoperates with other parts of the Internet could be better than leaving Tor as a separate tool that requires people to take special action to implement. 'I think there are benefits that might flow in both directions,' says Farrell. 'I think other IETF participants could learn useful things about protocol design from the Tor people, who've faced interesting challenges that aren't often seen in practice. And the Tor people might well get interest and involvement from IETF folks who've got a lot of experience with large-scale systems.' Andrew Lewman, executive director of Tor, says the group is considering it. 'We're basically at the stage of 'Do we even want to go on a date together?' It's not clear we are going to do it, but it's worth exploring to see what is involved. It adds legitimacy, it adds validation of all the research we've done.'"

Comments

interesting

[ganjadude]

I like the concept, however If we are going to turn tor into a standard would it not make more sense to start from scratch and create a new standard based on tor instead? for all of tors advantages there are numerous disadvantages.

Re:interesting

[aaaaaaargh!]

Many if not most existing standards have turned out to be fairly mediocre from a security point of view, think of cell phone and wireless encryption for example. There is also some evidence from the Snowden leak that standards procedures and committees have been weakened by members acting overtly or secretly on behalf of government agencies. So they should be really cautious about such offers.

And why re-invent the wheel and make something fro scratch? Tor is working well, even too well in the eye of some people ...

Re:interesting

[jones_supa]

Let's still not forget that even if they end up designing a system which has some disadvantages, it would still be zillion times better than the current system. I just don't want this plan to be discontinued because some perfectionist nerd found some theoretical flaw from it, which can only be exploited by milking a Mongolian horse under full moon. That being said, of course we should still try to make as robust system as possible.

Re:interesting

[jellomizer]

They are disadvantage on almost every thing out there.

You can pine on the disadvantages, or you can rate them and see how to fix them, without cutting into an other advantage, or increasing an other disadvantage.

Normally if a protocol is Fast, it is unsecured. if it is Secure, it is slow. If it is complex and full featured, there are a lot of failures in implementation, if it is solid, there is a lot less features.

Life is full of tradeoffs, Stop pining on the road you didn't take, and work on the road you took to make it better.

Re:interesting

[Kjella]

It's not quite as simple as that, you can do many things that like padding things out to fixed sizes so you can't see JPG of 185254 bytes move through the network, but say only 256kb blocks. You can wait for other packets to come in and only multiple blocks at once so there's no clear link between which come in and which go out. You can pad things with dummy traffic so it appears you're routing it to several different nodes, that you're not the end point when you are and that you're not the starting point when you are. Those things are solvable as long as they only have backbone access.

The much harder problem is if they can run poison nodes and in a public network there's really no reason to think they won't. Particularly if they have the ability to interrupt your connections to non-poison nodes they'll quickly and easily trap you in a net where everyone you're talking to is the NSA and the supposed anonymity in routing and relaying traffic is gone. One compromised server in a TOR circuit isn't so bad, but if they have two - particularly the first and last - then you're pretty much boned. At least as far as anonymity is concerned, you can of course still wrap the actual traffic in https or PGP or whatever else for security.

Re:interesting

[Antique Geekmeister]

Many security projects have also been deliberately crippled by cooperation with US export encryption regulations, and by the laws concerning suveillance capability for audio communications. These laws require "law enforcement" access to the communications. While Tor might skirt these regulations as not serving text, many fundamental encryption and anonymization technologies would directly block such monitoring.

Re:interesting

[Charliemopps]

Yes, but this is currently only a problem because there are very few exit nodes. What if EVERY user was an exit node? What if "Contains TOR Privacy!" would become a sales point on routers? If the exit nodes were in the millions and then chosen at random by the client, it would pretty much be impossible for a Government to gather information from a bogus exit now because they'd statistical only collect data from 1 user, chosen at random, at a time. Not only that, but since everyone would be using it, rather than TOR being a honey pot of people with "something to hide" in the governments opinion, it would now be flooded with Facebook posts and people surfing porn.

I think that the only thing that would do them a lot of good, and I'm not even sure it's possible, but if they could distribute your connection over several nodes, that would be a game changer. If while using TOR you could use the remaining amount of bandwidth in full, you'd be doing great. Currently you're stuck with whatever speed the exit node has, but if you could exit on multiple IPs like some new phones do then you could use several exit nodes.

Re:interesting

[Catbeller]

Where was all this concern about the debt when Reagan and Bush W. were cutting taxes, emptying the Social Security trust fund, and spending madly on military and spy agencies? When Reagan took office, the debt was 3 trillion. When Bush took office, it was 6 trillion. Clinton actually paid the debt down a half trillion in his final year: Bush immediately declared the surplus the people's money and gave the surplus back - then raised spending until he left the country another extra six 6 trillion in debt, with obligations to pay for wars and refund the money stolen from the SS trust fund since 1984. Republicans cut taxes and raise spending, run up the debt, have a rich man's party, then step back and let Democrats take all the blame and make the spending cuts and tax increases to try to repair the damage. This has been a thirty+ year tax-cut-based robbery. And always, always an excuse to cut aid to the poor, never the rich.

Re:interesting

[AmiMoJo]

Tor is resilient to that kind of analysis. For example it will combine packets together and pad them with dummy data before forwarding them. The NSA sees an encrypted packet go in but it never comes out again, only a different packet that may contain one or more other packets and is encrypted with a different key emerges.

Tor only has one major vulnerability, assuming you use it perfectly. That vulnerability is the NSA controlling a significant number of nodes on the Tor network. It would have to be an awful lot though, and current leaks suggest that they have not been able to do it yet. All their current attacks rely on the user making a mistake.

Re:interesting

[UltraZelda64]

While I do agree with you, an interesting negative to that would be:

If everyone runs their own Tor exit node, including unknowingly every dumb Windows and Mac user out there, then malware writers (the NSA?) would have a field day writing bad stuff that attacks and takes advantage of a very large number of exit nodes. So which is better: fewer exit nodes but a few known bad ones as it is now, or shitloads of exit nodes where the vast majority cannot be trusted? All it would take is one major outbreak to basically destroy Tor's purpose...

Re:interesting

[WaffleMonster]

There is also some evidence from the Snowden leak that standards procedures and committees have been weakened by members acting overtly or secretly on behalf of government agencies. So they should be really cautious about such offers.

In some ways IETF is almost a joke. "Consensus" building is supposed to be the key to movement yet there is no barrier to entry other than having sufficient number of brain cells to send a message to a mailing list. I have observed several instances of "ballot stuffing" where hoards of random people who very likely know and have contributed nothing at the last moment express support for x. The arbiter of what consensus means is always WG chair(s) who themselves mostly always work for a corporations with skin in the game.

The IETF process is most successful as a middle ground where there is market incentive to work together. In the case of tor there is no market to speak of to incentivize such behavior.

And why re-invent the wheel and make something fro scratch? Tor is working well, even too well in the eye of some people ...

My guess they might start with existing specification and evolve standard based on IETF process.

An example of this SSL v3 was mostly Netscape's doing while TLS v1 and later were products of the IETF. In this case there were no radical changes between versions and backwards compatibility was retained. There was also huge market incentive for broad compatibility and getting security right.

Re:interesting

[noh8rz10]

There's no such thing as absolute privacy. you need to ask, privacy from whom. If you want privacy at a coffeeshop, use a VPN client so you don't get packet sniffed. If you want privacy at your home (shared) computer, clear your browser cache. If you want privacy from the servers you're connecting to, then TOR may be a good option. If you want privacy from NSA, then forget about it. It's best to assume the entire internet is a military resource, and you have guest privileges.

Re:interesting

[colordev]

Thank's fot the FUDBAR. Now tell us what is safe and what will better promote peoples privacy, democracy and the development of human rights.

> Just to remind you Mr. Anonymous Coward a hundred of million persons were killed by their own governments during the last century. What makes you think govermnents 20 years from now will not execute jews, communists, homosexuals, retards or gypsies like they did in Germany(in 1930-40's), or they will not execute people living in cities or wearing glasses, Buddhist monks, Muslims, Christians, Western-educated intellectuals or educated people in general or people who had had contact with Western countries or with Vietnam, or with any previous government, or disabled people, or the ethnic Chinese, Laotians or Vietnamese like they did in Cambodia (in 1970's), or they will not execute capitalists like they did in Soviet Union(in 1920's), or will not execute muslims like they did in Bosnia-Herzegovina (in 1990's), or will not execute Tutsies like they did in Rwanda(in 1990's), or they will not execute the well educated class like they did in China (in 1960's), or they will not randomly kill people of other religious groups like they did in Iraq (in 2000's) or they will not bomb to pieces urban areas which do appear to be supportive to a currently reigning dictator like is happening in Syria (in 2013).

Now pick your country for the next decade, Are you feeling lucky, punk? or maybe you still like the current development e.g. the great firewall of China and some high profile websites starting to use HTTPS.

I think TOR-like backbone to the future Internet is a great idea. Some tweaking, sweat, toil and tears and it will be a great system.

Re:interesting

[Thor Ablestar]

When I say "reasonably secure" it means that I personally read it's whitepaper and tried to value it's security personally. And I see some methods that can be employed to breach the anonymity of system implemented according to this whitepaper. They exist but they require a disproportional amount of sniffers. The giant NSA/KGB datacenter that diverts and sniffs all the backbone traffic is just not enough. And since the system is totally encrypted and inherently immune to MITM then many popular deanonimization methods will fail, too.

And I look at such systems from deanonymization point of view only since the end to end encryption is trivial now.

Re:interesting

[Jane Q. Public]

"Or let me ask differently: How would you fix it? A web of trusted exit nodes run by the government of choice? :P"

No. Everybody here is missing the point.

If/when exit nodes are everywhere, hosted by everybody, two things happen:

(A) It becomes impractical to the point of impossibility to monitor all the exit nodes, and at the same time

(B) the VALUE of monitoring any given exit node is diluted far past the point of making it worth anybody's time.

Getting this past the censors?

[Jamlad]

But how else then shall they keep us safe from all the Bad Guys, ne'er-do-wells, pedophiles, terrorists, communists, liberals, hippies, criminals, foreigners, pirates, gays, racists, misogynists, thought crimes, neighbors, and YOU?

Re:Getting this past the censors?

[dmbasso]

Cold fjord, is that you?

TOR? Or I2P? Or Freenet? Or something else?

[coder111]

Hmm, TOR is a nice project and all, but it has its benefits and drawbacks. I think IETF need to give quite a bit of thought before adopting some technology as a standard.

I'm all for anonymous communication with encryption though. I hate what corporations and governments are doing to the internet. I do believe internet is the most important human discovery since fire, and its freedoms need to be preserved...

--Coder

Re:Isn't Tor compromised?

[Captain Hook]

Tor's weakness is when one organisation, such as the NSA, controls a large percentage of the exit nodes.

The larger percentage of the exit nodes a single organisation controls the better chance they have to seeing all the packets from any given user.

Becoming an Internet standard would dramatically increase the number of exit nodes making it harder for a single entity to control a decent proportion of them, although the basic attack would still work with enough resources.

Re:Isn't Tor compromised?

[Chrisq]

Wasn't there an article here earlier about how it's not so difficult as earlier imagined to track inputs and output of Tor and connect them to the person using it?

I think that this type of traffic analysis becomes harder as more people use it. The other weakness is if someone controls a large number of exit nodes - if routesr etc all could act as exit nodes it would be safer .... unless someone had a backdoor into the routers!!!

Re:This is people mistaking "want" with "will"

[d33tah]

I'm under the impression that you're confusing things. Noone said that you'd be forced to run an exit node, or even a relay. I believe it's just about making the protocol a standard.

void between chair and keyboard

[Anonymous Coward]

*OMG* no! Tor does nothing if you want to spill your personal guts all over the internet. Also cookies and other nefarious tracking technologies work
wonderfully right through tor. tor doesn't block you if you want to scream your name and credit card number and whatnot to the internet ...
can we just have websites work without javascript and FLASH?!

There comes a time when splits are required.

[Anonymous Coward]

How feasible would it be to split the internet right down the middle but share the same lines?

So on one half you could keep the wild wild west net and on the other all the cry babies and censor-happy types can have their walled wide web.
Then just onion-up the wild wild west side.

Re:There comes a time when splits are required.

[FireFury03]

How feasible would it be to split the internet right down the middle but share the same lines?

So on one half you could keep the wild wild west net and on the other all the cry babies and censor-happy types can have their walled wide web.
Then just onion-up the wild wild west side.

This wouldn't work because you're forgetting the censor-happy people's mentality: they aren't trying to censor the internet so that they can't get to certain material, they are trying to censor it so that _you_ can't get to certain material because the _idea_ of you looking at certain stuff in private offends them. So this kind of split couldn't happen because the censor-happy people still don't want to allow you to get to the "wild wild west" net.

Wide-scale censoring is all about "I find what you do in private to be offensive so you should be locked up for offending me!" and almost never to do with "I find this content offensive so don't want to see it myself". Much the same way as various activities happening between consenting adults in private are illegal - this isn't about protecting anyone from anything other than offense caused by their own narrow-mindedness.

Note, I do think there is a place for local-scale censorship, such as preventing kids/teachers at school from accidentally stumbling across stuff they shouldn't. However, where kids are *actively* trying to get at porn, et-al, censorship is never going to work and it is far better to spot kids doing this so someone can have a talk with them. That's not to say that I necessarilly think kids looking at porn is a bad thing (indeed, it's completely normal), but talking to them about it to put it into context is probably a good plan.

Re:True or False

[jellomizer]

True,
Group think is the Opposite of Synergy.
Well it is the opposite outcome.

Unlike most people I actually know what Synergy means, and see how it is greatly misused.
Synergy is the process where a group of people working on a problem come up with a solution which is greater then the sum of what any individual could make.
Group Think is where the a group of people working on a problem come up with a solution which is less then the sum of what any individual could make.

Obtaining Synergy in an environment is very hard to achieve, because you need to make sure you don't have strong personalities trying pushing bad ideas thew their own force of will, or intimating position. People getting tired out from the process and settling on lesser ideas, reserved personalities not giving their ideas, and a slew of other things going on as well.

Group think is what usually comes out of these events, where the strongly supported stupid idea is forced down the thought, with issues not properly evaluated, and blank assumptions made.

I hope Tor runs away as fast as it can

[pedantic bore]

I've worked with the IETF on several RFCs. I'm also familiar with the challenges that the Tor project faces daily, and what they have to do to stay ahead of the entities trying to break Tor. I think for Tor to even stop to talk to the IETF would be an waste of their time; Tor needs to be nimble, and the IETF standards process is painfully, horribly slow and unable to move quickly on anything. Given that Tor releases updates on a cycle that is shorter than the normal time a draft spends in the AD review queue, by the time an RFC got to the standards track it would already be out-of-date.

Re: Isn't Tor compromised?

[Anonymous Coward]

It would also defeat the main purpose of Tor, which is to access the Web anoynmously.

If you want to build a separate anonymous network on the top the Internet, why would you use Tor and not technology that has been developed with that purpose in mind such as I2P, Freenet or Gnunet?

Re:Isn't Tor compromised?

[fa2k]

Owning exit nodes is not sufficient to reveal the identity of tor users. Owning a large percentage of relay nodes AND exit nodes could compromise the anonymity, as one could just follow the progression of any data throughout the network. If the traffic volume is small enough to be able to statistically separate the streams from various users, it may be sufficient to surveil relay and exit nodes, instead of actually owning the hardware.

There are limitations: the exit node can mess with the data at will, in both directions, and this is how the FBI owned the visitors to a pedo site. They injected some HTML (I'm not positive that it was HTML/JS, but one would assume) to make the browsers of the users connect to FBI servers outside of Tor. It was a bug in firefox that allowed this.

There are two strategies to protect against this,
1) Encrypt everything; only access SSL sites over Tor. This works in theory because the exit node can no longer mess with the data stream. The only way to reliably use this strategy is to *block* non-SSL traffic. There are so many websites with mixed content, which may pull images and ads from non-SSL streams. Also, NSA may be able to break SSL either by a proper MITM attack (completely hypothetical, no evidence exists) or by owning private keys for some CAs.

2) Block any non-tor access from the system used to access Tor. This is possible at the network level with extra hardware, VMs and possibly with SELinux. If the browser *cannot* communicate over the standard internet, only Tor, then one is moderately safe. It's still important to configure the browser to not send identifiable information for fingerprinting and tracking cookies.

By doing 1 and 2 one is quite safe. It may be fine to use a less safe setup for non-secret stuff, like checking facebook, and contributing to flood the tor network with un-interesting traffic. If the "really anonymous" mode required restarting Tor, the NSA would be able to see this from ISP logs, of course.

NSA: TOR Stinks, TOR developers smile

[Press2ToContinue]

Snowden leaked NSA opinion on TOR here:
http://www.theguardian.com/world/interactive/2013/oct/04/tor-stinks-nsa-presentation-document

Slashdot reporting here:
http://slashdot.org/story/13/10/04/162254/how-the-nsa-targets-tor

Re:Isn't Tor compromised?

[Splab]

You really should read up on technologies before making statements like that.

The Pedo busts were not attacking exit nodes, it was an attack on the hidden services within the network, there is no mim attack on hidden services, as no one knows who is talking to who. What the FBI did was compromising the servers hosting the material, serving malware that send a single request out outside the TOR network.

Regarding 2; this only works if your software is perfect, which it won't be. The Pedo bust was abusing a known bug in Firefox 17, which had been fixed for quite a long time, it only takes a single bug in the stack to inject some data, that can be collected at some point later - Even if you only allow data through TOR and using SSL, there is nothing preventing FBI sending enough data about your local network, to help identifying you. (For instance, a quick wifi-scan gives you enough information to place my system somewhere in Denmark, using WIFI databases, like the stuff google collected with street view, you can probably pinpoint it even further)

While forcing SSL is a nice idea, generally, it wont work; as you said, people are doing mixed content - on top of that, it only takes a single compromised request to a CDN like jQuery, to have your system thoroughly compromised, see http://www.youtube.com/watch?v=ZCNZJ_7f0Hk (While they are compromising anonymous proxies, the attack will work just as well on TOR)

Who wants to pay for it?

[Cajun Hell]

One thing you've gotta admit about Tor, is that it's an inefficient way to get packets from point A to point B. If we had Tor built into the all Internet protocols, don't you think one of the first things you would do, would be to look at some case where you didn't like the performance you were getting, and then you'd "invent" a shiny new protocol that directly links two points, providing massive performance improvements at the cost of making traffic analysis easier? And don't you think there are shitloads of applications, where that tradeoff would make sense? Inventing not-Tor would be the biggest thing, ever.

Crypto is good. Modern CPUs can handle it effortlessly, nearly for "free." There are some cases (e.g. shared caches) where you might not want the tradeoff, but overall it's turning out to be a no-brainer, almost always worth the compromise. You just can't say that about onion routing, though. It's subjectively good, at best.

BTW, also: here in America, a lot of us have asymmetric connections for the "last mile."

Re:Isn't Tor compromised?

[fa2k]

Some corrections are in order, hope I caught all my mistakes now..

Hidden serivces seem to have SSL-like protection built-in, thanks to the encryption of Tor,

Probably not, that was made up. there is encryption, but I don't see how they could have authentication (unless the certificate was in the *.onion name, but they're not that long)

The best way seems to be to use VMs or clean installations like booting from CD. There is then a separate computer for the Tor client, blocking anything but the Tor HTTP proxy with a firewall on the interface connected to the client.

To clarify, client & gateway be connected directly, no others computers including no internet

The client shouldn;'t have any unique software

..including language & keyboard layout

(don't know [about blocking] audio / microphone).

OF course block mic. Not only can the malware *hear you speaking*, the mic probably also has a unique noise spectrum, and there may even be outside noises like trains. Speakers probably OK, but could relay information via high frequency signals to other compromised local computers