Slashdot Mirror
Tor Eyes Crowdfunding Campaign To Upgrade Its Hidden Services
apexcp writes The web's biggest anonymity network is considering a crowdfunding campaign to overhaul its hidden services. From the article: "In the last 15 months, several of the biggest anonymous websites on the Tor network have been identified and seized by police. In most cases, no one is quite sure how it happened. The details of such a campaign have yet to be revealed. With enough funding, Tor could have developers focusing their work entirely on hidden services, a change in developer priorities that many Tor users have been hoping for in recent years."
To our contributors, even though we don't know who you are *wink wink*
..than to have the FBI wondering why I'm contributing money to this cause. I applaud the goal, but I'll let someone more altruistic than me step up to bat.
Save me the "When Good Men Do Nothing," I have family and other considerations outside Slashdot idealism.
Letter To Iran
If tor has 3 hops from source to hidden service, and perhaps there are 10,000 nodes, how hard is it for a government to have 25% of those nodes under its control? and if you own all the hops, you know where the hidden server is.
The government connects to the kiddy porn site and downloads a 500mb video, they have PRISM tell them the computer that transferred 500mb of data to their computer, the computer that transferred 500mb of data to that computer, and so on. It's metadata all the way back to the actual hidden service where the 500mb file came from. As a bonus, they can have PRISM tell them everyone else that connected to a computer that connected to a computer that connected to a computer that connected to the kiddy porn site, too. Works for data of any size and type, not just kiddy porn, as long as the filesize is unique enough or you don't give a shit about false positives or perjury.
Tor has to do something about the timing and metadata attacks if it is to remain relevant. The only issue is whether they can do something about it without making it even slower than it already is.
Finally the world has a way to give their respective government a mighty middle finger after all the bullshit that's been going on lately. I hope they get millions from every corner of Earth.
Buy your next Linux PC at eightvirtues.com
Traffic analysis and other techniques make you trivially de-anonymized by the NSA.
TOR is NOT anonymous, and anyone who thinks it is deserves what they get. But what it IS good for is hiding from non-5-eyes countries. Say you are in the middle east and your third world government doesn't like you reading pr0n. No problem, the NSA isn't gonna hang your ass out to dry for that, and they certainly wont compromise their capabilities for stupid political shit. So TOR away all you want, to keep yourself safe from your local tinpot dictator.
That's what TOR is for. It's NOT for somehow magically keeping your identity secret from the people who invented it and own much of the network.
...Because now they'll need a few good tax attorneys.
The feds had no problem ferreting out the Silk Road operators, but it seems they're completely unable to do anything against the cryptolocker extortionists. Despite the damage being by some margin bigger.
One really has to wonder where the priorities are...
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
These were US agencies that have funded creation of TOR; CIA and NSA, you name it.
Obviously, the decision has been made that if encryption and anonymity cannot be controlled, then it needs to be led, and there are many ways to stay on top:
a) controlled nodes b) code flaws
Rule #1 that should be enforced: contrary to all popular docs, the hidden service should never, ever, be on the same logical machine as the tor daemon. The latter needs connectivity to arbitrary IPs, which means as soon as any part of the service is pwned -- or just sports a data leak -- the bad guys can learn who you are. If the hidden service machine doesn't know its IP nor other kinds of data that can be used to identify it, it can't leak that.
This won't avoid traffic analysis, but (most likely) the majority of hidden service breaches so far has been done by exploiting some bug in a http daemon and making it query http://home.spooks.gov/ outside tor.
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
In most cases, no one is quite sure how it happened. The details of such a campaign have yet to be revealed.
Could it have been the Fed's control of the whole network? Or perhaps it was an analysis of router traffic flow records, which supposedly reveals 81% of tor users, according to researchers...
No matter how much effort goes into securing the transport layer, it means absolutely nothing if the end nodes themselves are insecure. Something as simple as a SQL injection or remote code execution could easily deanonymize an end node. With how quickly many of those sites sprung up, one of the current theories is lack of security on the end-points themselves is what was attacked, not the Tor network itself.
Bennett Hasselton was once bitten by a snake. After 3 hours of excruciating pain, the snake died.
Tor is centered on one single tech: onion routing.
They seem to refuse to consider adding or adopting other techs, like using chaff in the network and trivial delay/random queues to at least defeat some timing and observation attacks.
It's like they're hooked and stuck on their unilateral approach.
And when people bring up alternatives they point to anonbib and disclaim them.
Well yeah, nothing's a total solution, but what some people voice is helpful.
They're also way too quiet about their position whether personal or corporate or project about being for or against govt surveillance, the fact of where they get their funds, all these quiet LEA liasons they must be interacting with.
Come on guys, everyone has opinions, show some balls, vent a little.
Anymore I'd bet I2P and some other networks are in a better position anonymous-service wise.
As I understand it Tor is between you and some other place on the public internet. I2P is not made to go out to the internet. It's more like Tor without exit and only hidden sites, like a secret internet on top of the public internet.
Will they accept Flooz?
I'm sure we all are thinking the exact same thing at this moment.
Spare a second and join us.
Why are people over looking the money?I thought silk road went down because Roberts wasn't careful where his money went.