Slashdot Mirror
User Error Is the Primary Weak Point In Tor
blottsie (3618811) writes with a link to the Daily Dot's "comprehensive analysis of hundreds of police raids and arrests made involving Tor users in the last eight years," which explains that "the software's biggest weakness is and always has been the same single thing: It's you." A small slice: In almost all the cases we know about, it’s trivial mistakes that tend to unintentionally expose Tor users.
Several top Silk Road administrators were arrested because they gave proof of identity to Dread Pirate Roberts, data that was owned by the police when Ulbricht was arrested. Giving your identity away, even to a trusted confidant, is always huge mistake.
A major meth dealer’s operation was discovered after the IRS started investigating him for unpaid taxes, and an OBGYN who allegedly sold prescription pills used the same username on Silk Road that she did on eBay.
Likewise, the recent arrest of a pedophile could be traced to his use of “gateway sites” (such as Tor2Web), which allow users to access the Deep Web but, contrary to popular belief, do not offer the anonymizing power of Tor.
"There's not a magic way to trace people [through Tor], so we typically capitalize on human error, looking for whatever clues people leave in their wake," James Kilpatrick, a Homeland Security Investigations agent, told the Wall Street Journal.
GIGO
Table-ized A.I.
It is really easy to miss this, but all security is about people. Good security software guides users into the most secure behavior. Bad security software just sets up a bunch of rules that the user must memorize and follow without error. Users will always be the weakest link, but you can make it easy for them to make good decisions and hard for them to do the wrong thing.
If security is too hard for criminals to use, it's too hard for normal people to use.
Parallel Construction.
It is virtually certain TOR is compromised by the NSA by listening at all entry and exit points at a minimum. However, the only cases that come to trial are those where they can estabish an alternative ( parallel ) path to the evidence.
If there is a primary weak point its that anyone can make an exit node or a routing node, the government has the resources and expertise to make as many as they want, if they owned enough of the nodes there is a high probability that what you send will go through every node that they own, and they have a map right to you. it shouldn't even be hard to find out who hosts hidden services if they probe the system enough.
information can never be hidden, cast off your delusions of privacy and freedom.
Seriously this has to be a trap, TORs secure keep going we have no secret tricks seriously.. not a trap trust me
I don't agree that it's hard, just that human nature will always try and take the path of least resistance. Most security is actually pretty easy for users, just follow these X steps and you will be safe. Users read the first and last step because it's easy. Other users may perform all the steps a few times, and jump to using step 1 and finish because the don't remember the point in performing all the steps. There are others that believe the propaganda fed to them by media and government and consider all security a waste of time.
To back my point, go back and reread all of the examples they give. Every single one of them was a result of someone missing a step, not because a step was hard.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
If people who have serious security preoccupations (drug dealers, pedophiles, etc...) are dumb enough to get caught due to human error (and probably not doing their homework), why exactly do the NSA, FBI, CIA, MI6, GCHQ, DGSE, FSB, BND, etc... etc... have to trace everything we do or say online?
In other words, what, on earth, is the purpose of these gigantic spying programs for, if all that is needed is good old fashioned gumshoe work? You know, like, waiting for the bank robbers to brag of their exploits to a police informants, painstakingly tracing money flows from dodgy businesses, or gathering evidence and finger prints on a crime scene?
Sure, security is hard, everyone makes a mistake once in a while, yadda yadda yadda, but what about the rights of the innocent average citizen? We are all being spied on, while police forces are perfectly able to catch the criminals, even if they use Tor! There is simply no justification, none whatsoever, for these agencies to spy on everyone. Think about that for a second.
The right to offend is far more important than the right not to be offended. (Rowan Atkinson)
The argument should not be whether or not data can be hidden from the Government, but rather that the Government should not be attacking it's own citizens all of the time. I'm not claiming that the Government of the USA is currently acting within their Constitutional limits. Any 3rd grader that can read the Constitution should be able to tell you that they are not currently within their legal limits. Yes, searching all of your data all of the time is attacking your Constitutional rights. Whether they take action on what they find is similarly the wrong argument.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
User Error is the Primary Weak Point In Software.
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
Because if you know you are being watched you will control you behavior and self-censor not only what you say online, but thoughts in your own head.
The Government can control people without any effort.
The premise of this is wrong. It was never meant to be secure, or for public use.
Built for spooks, by spooks. Public use is just a way to hide the spooky within the child porn.
http://pando.com/2014/07/16/to...
They're digital now.
Of course, the mass spying exists to detect and develop information for extortion and blackmail. If you run for office, become a popular figure, or become a threat to certain entrenched interests - let's use the military-industrial-surveillance complex as a catch all phrase - you can be neutralized.
Further, if the NSA.CIA/whatever says you are a commie, pedophile, adulterer, drug dealer, etc., how can you answer that accusation? These are plenty of press outlets more than happy to publish anonymous leaks of salacious material about a public figure and many "reporters" who act as stenographers for government agencies. And you, do you have all the records, all the emails, all the posts to rebut this? Do you have all you need that you can use to prove the accusations are false and the emails, photos, etc., are bogus or manufactured? We all know the government has it all, so you must be guilty.
Oh well, you can take solace in the fact that if you've done noting wrong, then you have nothing to fear.
In a related story from Brian Krebs, Silk Road was not outed by a badly configured CAPTCHA, as the FBI said. They seem to have another way to peek in TOR: http://krebsonsecurity.com/201...
A major meth dealer’s operation was discovered after the IRS started investigating him for unpaid taxes, and an OBGYN who allegedly sold prescription pills used the same username on Silk Road that she did on eBay. Likewise, the recent arrest of a pedophile could be traced to his use of “gateway sites” (such as Tor2Web), which allow users to access the Deep Web but, contrary to popular belief, do not offer the anonymizing power of Tor.
I'm a Tor fan, and think it serves a real need. But seriously .. am I the only one on Slashdot that is ok with busting the meth dealer, the OBGYN dealer and the pedophile?
Generally speaking, it's been the other way. It's the fake fanning of the flames of a -potential- drug dealer or pedophile that law enforcement brutally abuses to make everyone guilty until proven innocent and collect power unto themselves. But here, here we are are with actual bad people, doing actual bad things that got caught, and the /. response is to fix Tor.
It's true, Tor should be fixed. But can't we cheer a little that some bad guys went down?
https://www.reddit.com/r/SilkR...
If you don't want to be unmasked you should probably not download sexy-chick-oh-no-she-di'nt.exe.
Please read Brian Krebs' paper. The SR machine was behind a firewall and could not communicate directly with the outer world, it had to go through TOR.
Submit this as a slashdot story.
Doesn't matter. If the host of the software firewall could be traced, maybe that could be traced back to DPR.
Further, if the NSA.CIA/whatever says you are a commie, pedophile, adulterer, drug dealer, etc., how can you answer that accusation?
With the truth, via the criminal justice system.
If you actually are a pedophile/drug-dealer (not sure that being a commie or adulterer is illegal any more) and the government have actual evidence against you, tough, you have broken the law.
To have a right to do a thing is not at all the same as to be right in doing it
s/Tor/Security Technology/g
Tor, encryption, any kind of tunneling... Basically any kind of security or privacy enhancing technology is one wrong move away from breaking. Check your Facebook on the Tor connection? Oops... Type your disk encryption key into the wrong window? Oops... Etc.
If "they" are listening to the entry and exit points they would not be able to deduce what hidden service and what hidden sites a user is accessing. All they would know is that the user is using Tor through entry point X but they would not be able to trace the traffic after that. However, if the user is using Tor to go to a standard website on the publicly available internet, then -yes- the NSA would be able to connect the dots and follow the trail back.
And the sun will come up in the morning.
The truth will protect you.
The courts are not a corrupt arm of the government.
Everyone in Guantanamo is guilty.
Moron
Nothing to see here, move along. I had to put something here by demand of the CMS, sorry.
I like my spaghetti with source.
this should have been the reply to the "What does that mean?" post below. By the way: https://en.wikipedia.org/wiki/...
I like my spaghetti with source.