Slashdot Mirror
Tor Eyes Crowdfunding Campaign To Upgrade Its Hidden Services
apexcp writes The web's biggest anonymity network is considering a crowdfunding campaign to overhaul its hidden services. From the article: "In the last 15 months, several of the biggest anonymous websites on the Tor network have been identified and seized by police. In most cases, no one is quite sure how it happened. The details of such a campaign have yet to be revealed. With enough funding, Tor could have developers focusing their work entirely on hidden services, a change in developer priorities that many Tor users have been hoping for in recent years."
To our contributors, even though we don't know who you are *wink wink*
..than to have the FBI wondering why I'm contributing money to this cause. I applaud the goal, but I'll let someone more altruistic than me step up to bat.
Save me the "When Good Men Do Nothing," I have family and other considerations outside Slashdot idealism.
Letter To Iran
If tor has 3 hops from source to hidden service, and perhaps there are 10,000 nodes, how hard is it for a government to have 25% of those nodes under its control? and if you own all the hops, you know where the hidden server is.
The government connects to the kiddy porn site and downloads a 500mb video, they have PRISM tell them the computer that transferred 500mb of data to their computer, the computer that transferred 500mb of data to that computer, and so on. It's metadata all the way back to the actual hidden service where the 500mb file came from. As a bonus, they can have PRISM tell them everyone else that connected to a computer that connected to a computer that connected to a computer that connected to the kiddy porn site, too. Works for data of any size and type, not just kiddy porn, as long as the filesize is unique enough or you don't give a shit about false positives or perjury.
Tor has to do something about the timing and metadata attacks if it is to remain relevant. The only issue is whether they can do something about it without making it even slower than it already is.
Finally the world has a way to give their respective government a mighty middle finger after all the bullshit that's been going on lately. I hope they get millions from every corner of Earth.
Buy your next Linux PC at eightvirtues.com
No one is quite sure how it happened??
Oh, c'mon, guys!
Who is actually behind the "TOR" project?
The Fed, specifically, the spooks !
TOR is a tool created and funded by the spooks to trick you guys in believing that it is something that you guys can hide yourself under, that no one can find you, that your identity is totally hidden
But it is not
"TOR" is a honeypot, man, a very well executed honeypot!
Traffic analysis and other techniques make you trivially de-anonymized by the NSA.
TOR is NOT anonymous, and anyone who thinks it is deserves what they get. But what it IS good for is hiding from non-5-eyes countries. Say you are in the middle east and your third world government doesn't like you reading pr0n. No problem, the NSA isn't gonna hang your ass out to dry for that, and they certainly wont compromise their capabilities for stupid political shit. So TOR away all you want, to keep yourself safe from your local tinpot dictator.
That's what TOR is for. It's NOT for somehow magically keeping your identity secret from the people who invented it and own much of the network.
...Because now they'll need a few good tax attorneys.
I have become addicted to Bennet Haselton's reasoned argument and mastery of science, business, algorithms and statistics. I find that without him, I no longer have the ability to form thoughts on any subject.
I was going to email Bennet to ask him to weigh in on this, but then I realized why he never comments. He is the Chuck Norris of armchair science. Once he comments, he will say everything there is to be said, ever. The website we all love will die because there will be no more discussion, just a final singularity-inducing comment from frequent Slashdot contributor Bennet Haselton.
The feds had no problem ferreting out the Silk Road operators, but it seems they're completely unable to do anything against the cryptolocker extortionists. Despite the damage being by some margin bigger.
One really has to wonder where the priorities are...
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
These were US agencies that have funded creation of TOR; CIA and NSA, you name it.
Obviously, the decision has been made that if encryption and anonymity cannot be controlled, then it needs to be led, and there are many ways to stay on top:
a) controlled nodes b) code flaws
Rule #1 that should be enforced: contrary to all popular docs, the hidden service should never, ever, be on the same logical machine as the tor daemon. The latter needs connectivity to arbitrary IPs, which means as soon as any part of the service is pwned -- or just sports a data leak -- the bad guys can learn who you are. If the hidden service machine doesn't know its IP nor other kinds of data that can be used to identify it, it can't leak that.
This won't avoid traffic analysis, but (most likely) the majority of hidden service breaches so far has been done by exploiting some bug in a http daemon and making it query http://home.spooks.gov/ outside tor.
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
In most cases, no one is quite sure how it happened. The details of such a campaign have yet to be revealed.
Could it have been the Fed's control of the whole network? Or perhaps it was an analysis of router traffic flow records, which supposedly reveals 81% of tor users, according to researchers...
I thought it was well known by now. Tor is a honeypot. The exit nodes are more than half owned by the FBI and cooperating agencies around the world, and they're very good at de-anonymizing people on there. They won't bother for petty stuff, though.
That, and using it gets you flagged for "special attention".
Most of it is funded by the government also. People who are complaining about the government that work on this project, are getting paid by the government. Well, that's what I heard anyways.
http://pando.com/2014/11/14/tor-smear/
No matter how much effort goes into securing the transport layer, it means absolutely nothing if the end nodes themselves are insecure. Something as simple as a SQL injection or remote code execution could easily deanonymize an end node. With how quickly many of those sites sprung up, one of the current theories is lack of security on the end-points themselves is what was attacked, not the Tor network itself.
They dont need to use TOR weaknesses, when the web browser and the web servers are chock-full of exploitable bugs.
Having said that, if they really, really* want to get you, NSA will throttle traffic in order to imprint a meta-signal** onto the packet flow so that they can correlate that signal with all end-user traffic flows.
*imagine publishing military secrets
** a side channel using either packet size modulation or packet flow rate modulation as the "signal". Mixnets CAN combat this, it is just that TOR is rather simplistic in this aspect.
http://www.idigitaltimes.com/best-alternatives-tor-12-programs-use-nsa-hackers-compromised-tor-project-376976
...you consume too much craptastic Hollywood stuff. Let me say this as a practitioner: They make your life miserable but they dont easily knock over people. For some reason, police would rip a second opening into them*, if they did.
Their tactic is to let you hurt yourself in one of 275 ways. That usually works, as we have seen with Assange. It did certainly work with myself, but you know what ? You only learn from real combat.
*including the top guy who ordered it.
1.) Stay under the surface. If they cannot get hold of you, they cannot force you to insert shite, consciously or through stress. Do NOT be a publicity whore - or leave it to more disciplined fighters. Sign your stuff using GPG on a DISCONNECTED machine.
2.) TOR is of course simpletonistic. We need something much better.
3.) Having a single "onion route" is easy to attack with things like bandwidth modulation.
4.) Build dozens of routes instead of one.
5.) Have a Constant Flow rate through all routes; send chaff if your node has nothing useful to transmit. This defeats Bandwith Modulation.
6.) Chop payload packages in lots of small crypto-packages, similar to the I2P Garlic Routing concept
7.) Make the number of hops user-configurable. TOR is setting it on a fixed number of just THREE. Nicht gut.
8.) Don't use C. This language has specifically been invented* in order to make those computers-cum-cipher-machines easier to subvert. There are much more robust languages like Ada, Pascal and the like out there. You might also use C++ with full bounds checking, smart pointers and so on. Do NOT use C patterns.
* by a branch of U.S.G. with very close finance and technology ties to NSA - AT&T Bell Laboratories.
The first step of mastering something is to go to the library. Here is a starting point:
http://www.ee.washington.edu/research/nsl/papers/proceedings-06.pdf
I always wanted to donate to Truecrypt project, but knew that if I did, I'd be put on one of those US lists.
Will they accept Flooz?
It isn't only about the code. The code can be 100% perfect, but if 90% of the exit nodes (or internal nodes) are run by your nemesis, TOR is vulnerable. It is a multi-part security issue here.