Slashdot Mirror
Executive Director Andrew Lewman Answers Your Questions About Tor and Privacy
A while ago you had a chance to ask Executive Director of the Tor project Andrew Lewman about fighting laws and technology that threaten anonymity and the importance of privacy. Below you'll find his answers to your questions.
The NSA TrueCrypt Ploy Again?
by TechForensics
How can we ever be sure Tor has not morphed into an eviscerated TrueCrypt and that at some point, after achieving their means of compromise, the NSA won't force a version they can easily backdoor on the public?
They like to compromise software and then put it back, so it becomes an intelligence asset. In my understanding only a legal technicality allowed TrueCrypt to issue a cryptic public announcement which effectively let the public know TrueCrypt was potentially compromised. I wonder whether the NSA will even allow Tor to recommend a transparently ineffective alternative.
Lewman: No agency has ever asked Tor to put in lawful intercept access, also known as a “backdoor.” Tor is not subject to the same legal requirements as other Internet service providers or content providers to incorporate that into the system. Our FAQ answer states this clearly.
How can strategies be drawn so if Tor is easily, possibly undetectably breached, the public will have some inkling of it?
Lewman: Tor maintains an open community and believes in transparency. We always strive to report out as quickly as we can about any issues affecting the Tor network.
Cryptowall 2.0
by Anonymous Coward
Cryptowall 2.0 is using state of the art cryptographic services like Tor, Bitcoin, and file encryption, combined with standard exploits to hold data ransom. I think it's among the more sophisticated attacks I've ever seen. How do you think more malware of this type will pressure you to change the service?
Lewman: Tor is used by millions of people for legitimate purposes and certainly anytime someone uses technology in a way that harms other people, we are disheartened. Our approach to this is, and has been, to work with malware researchers and law enforcement to help people remove the malware or to change the incentives behind including Tor in the malware at all.
Tor connections
by Anonymous Coward
Why hasn't TOR moved towards a connectionless routing between the client and the exit node? A permanent connection is being established each time with the same pattern: computer -> entry node -> middle node -> exit node -> website. This can lead to a traffic pattern analysis, given an observer with enough "peer exchange nodes" under his monitoring. In some cases all the connections could be monitored with only country/continent level entry points. Wouldn't a bunch of state-less P2P like connections between the client and the exit node be better suited against such traffic inspection?
Lewman: We would love to get to the point that Tor could provide a connectionless routing between client and exit node that does not compromise anonymity. It is something that we have thought about for a while and started research on a while back. More research on this needs to be done in order to roll it out to the Tor network. We would love for someone to help further study that and help us figure out how to make that happen.
Have you used I2P...
by Anonymous Coward
And what are your thoughts on its design compared to Tor and as a complement to it?
Lewman: We try to keep up with any new technology that emerges and have tried many of the different online privacy products and software out there- I2P, Freenet, Retroshare, GNUNet and others certainly have some interesting work and research about online privacy. We are open to collaborating with anyone that shares our mission of protecting online security and anonymity for users.
Balance between simple privacy and lawlessness
by TWX
Tor can be used for good and for evil. How do you go about attempting to design the features of Tor to maximize one and minimize the other?
Lewman: The Tor network is designed to provide protection online for ordinary citizens, victims of abuse, and individuals in dangerous parts of the world share information over public networks without compromising their anonymity. Most of the people that use Tor have legitimate uses for wanting privacy such as activists or reporters that need to keep their locations private. Criminals can already do bad things and there are certainly lots of options available to them for breaking the laws.
Re:Balance between simple privacy and lawlessness
by mlts
Along the lines to this question, how can Tor's PR be helped? As of now, part of an IT person's job is to block Tor's exit nodes, on the application, kernel, and router level, because those nodes to be a source of many attacks. So, because of the bad reputation, it gets entirely locked out of many websites. This can be fixed by running a VPN over Tor so the exit comes from the VPN's servers, but there goes the anonymity for the most part.
Lewman: With so much concern these days about people’s privacy being compromised online, I would love more businesses to take a look at how Tor could help them protect their confidential documents like patents, product development ideas, or financial documents. Even in some situations when a company is doing competitive intelligence research online and it's important that the competitor does not know, it keeps the competitor from knowing that someone is looking at them online.
What is your biggest fear?
by AmiMoJo
What is your biggest fear? After the TrueCrypt developers were apparently threatened or otherwise convinced to abandon development, does the NSA worry you? The FBI has been complaining about encryption lately too, as have law enforcement agencies in other countries. Or is there something else that concerns you?
Lewman: My biggest concern is making sure that the 2.5 million people around the world that currently use Tor and the thousands of new people that download it every day, have a safe, reliable way to protect their privacy online.
Tor has been compromised
by kheldan
News stories I've read lately seem to indicate that the Tor exit nodes have been and still are being compromised by organizations and some oppressive governments. What are you doing about this?
Lewman: The Tor network has been around for 10 years and it has never been successfully hacked. Many have tried and many more will try. We work with researchers all the time to improve the network.
Darknet takedowns.
by brokenin2
Do you know how the takedown of so many "darknet" sites was accomplished recently, or do you at least have some suspicions? The government seems to by lying about how they took down the original Silk Road site, and I'm wondering if you believe this is to: a) Hide a technical solution that they have at their disposal, or b) Hide the egregiously illegal/inadmissable things they did to accomplish this, or c) some of each.
Lewman: We have no knowledge of how the agencies working together "took down” silkroad and other darknet sites but news reports vary widely on the actual number of sites that were taken down. We've been watching carefully to try and learn if there are any flaws with Tor that we need to correct. Nothing so far about this case makes us think they found a way to compromise the Tor software or network. The FBI says that their suspect made mistakes in operational security and was found through actual detective work.
by TechForensics
How can we ever be sure Tor has not morphed into an eviscerated TrueCrypt and that at some point, after achieving their means of compromise, the NSA won't force a version they can easily backdoor on the public?
They like to compromise software and then put it back, so it becomes an intelligence asset. In my understanding only a legal technicality allowed TrueCrypt to issue a cryptic public announcement which effectively let the public know TrueCrypt was potentially compromised. I wonder whether the NSA will even allow Tor to recommend a transparently ineffective alternative.
Lewman: No agency has ever asked Tor to put in lawful intercept access, also known as a “backdoor.” Tor is not subject to the same legal requirements as other Internet service providers or content providers to incorporate that into the system. Our FAQ answer states this clearly.
How can strategies be drawn so if Tor is easily, possibly undetectably breached, the public will have some inkling of it?
Lewman: Tor maintains an open community and believes in transparency. We always strive to report out as quickly as we can about any issues affecting the Tor network.
Cryptowall 2.0
by Anonymous Coward
Cryptowall 2.0 is using state of the art cryptographic services like Tor, Bitcoin, and file encryption, combined with standard exploits to hold data ransom. I think it's among the more sophisticated attacks I've ever seen. How do you think more malware of this type will pressure you to change the service?
Lewman: Tor is used by millions of people for legitimate purposes and certainly anytime someone uses technology in a way that harms other people, we are disheartened. Our approach to this is, and has been, to work with malware researchers and law enforcement to help people remove the malware or to change the incentives behind including Tor in the malware at all.
Tor connections
by Anonymous Coward
Why hasn't TOR moved towards a connectionless routing between the client and the exit node? A permanent connection is being established each time with the same pattern: computer -> entry node -> middle node -> exit node -> website. This can lead to a traffic pattern analysis, given an observer with enough "peer exchange nodes" under his monitoring. In some cases all the connections could be monitored with only country/continent level entry points. Wouldn't a bunch of state-less P2P like connections between the client and the exit node be better suited against such traffic inspection?
Lewman: We would love to get to the point that Tor could provide a connectionless routing between client and exit node that does not compromise anonymity. It is something that we have thought about for a while and started research on a while back. More research on this needs to be done in order to roll it out to the Tor network. We would love for someone to help further study that and help us figure out how to make that happen.
Have you used I2P...
by Anonymous Coward
And what are your thoughts on its design compared to Tor and as a complement to it?
Lewman: We try to keep up with any new technology that emerges and have tried many of the different online privacy products and software out there- I2P, Freenet, Retroshare, GNUNet and others certainly have some interesting work and research about online privacy. We are open to collaborating with anyone that shares our mission of protecting online security and anonymity for users.
Balance between simple privacy and lawlessness
by TWX
Tor can be used for good and for evil. How do you go about attempting to design the features of Tor to maximize one and minimize the other?
Lewman: The Tor network is designed to provide protection online for ordinary citizens, victims of abuse, and individuals in dangerous parts of the world share information over public networks without compromising their anonymity. Most of the people that use Tor have legitimate uses for wanting privacy such as activists or reporters that need to keep their locations private. Criminals can already do bad things and there are certainly lots of options available to them for breaking the laws.
Re:Balance between simple privacy and lawlessness
by mlts
Along the lines to this question, how can Tor's PR be helped? As of now, part of an IT person's job is to block Tor's exit nodes, on the application, kernel, and router level, because those nodes to be a source of many attacks. So, because of the bad reputation, it gets entirely locked out of many websites. This can be fixed by running a VPN over Tor so the exit comes from the VPN's servers, but there goes the anonymity for the most part.
Lewman: With so much concern these days about people’s privacy being compromised online, I would love more businesses to take a look at how Tor could help them protect their confidential documents like patents, product development ideas, or financial documents. Even in some situations when a company is doing competitive intelligence research online and it's important that the competitor does not know, it keeps the competitor from knowing that someone is looking at them online.
What is your biggest fear?
by AmiMoJo
What is your biggest fear? After the TrueCrypt developers were apparently threatened or otherwise convinced to abandon development, does the NSA worry you? The FBI has been complaining about encryption lately too, as have law enforcement agencies in other countries. Or is there something else that concerns you?
Lewman: My biggest concern is making sure that the 2.5 million people around the world that currently use Tor and the thousands of new people that download it every day, have a safe, reliable way to protect their privacy online.
Tor has been compromised
by kheldan
News stories I've read lately seem to indicate that the Tor exit nodes have been and still are being compromised by organizations and some oppressive governments. What are you doing about this?
Lewman: The Tor network has been around for 10 years and it has never been successfully hacked. Many have tried and many more will try. We work with researchers all the time to improve the network.
Darknet takedowns.
by brokenin2
Do you know how the takedown of so many "darknet" sites was accomplished recently, or do you at least have some suspicions? The government seems to by lying about how they took down the original Silk Road site, and I'm wondering if you believe this is to: a) Hide a technical solution that they have at their disposal, or b) Hide the egregiously illegal/inadmissable things they did to accomplish this, or c) some of each.
Lewman: We have no knowledge of how the agencies working together "took down” silkroad and other darknet sites but news reports vary widely on the actual number of sites that were taken down. We've been watching carefully to try and learn if there are any flaws with Tor that we need to correct. Nothing so far about this case makes us think they found a way to compromise the Tor software or network. The FBI says that their suspect made mistakes in operational security and was found through actual detective work.
The "people" that come up with and enforce these fucking so-called laws like a bunch of disgusting thugs need to be fucking exterminated in cold blood with extreme cruelty. Death to the nanny-stater control freak scum.
Wow, this guy just ducks every question. My trust in Tor goes down after reading this.
The /. mobile site needs some way to collapse the answers, or to make it easy to jump past them to the comments. It takes forever to scroll past them when using a smart phone. I've already read the answers, so I don't want to see them again when I'm trying to read new comments.
Tor's integration with systemd, if any, would be very very tiny. Basically systemd would be responsible for managing the start/stop cycle of Tor and collecting any log files.
This is entirely optional, though. You can always run Tor without it being integrated into systemd's service management facility at all. If you need it in the background and headless, just run `screen -mdS tor [tor_cmdline]`.
I do not believe that Tor would be automatically running on a default Fedora install. You would have to enable it yourself.
How do you feel about longtime bullshit contributor Bennet Hasselton?
The style of answers itself is a message: they are already indoctrinated and under control.
Not even a politician could have given more non-answers.
That's what I got out of it too.
It's hard to say. To be honest, to me they sound exactly like the non-answers I'd expect any executive officer to give. The fact they don't mention PRISM at all in reference to recent US government capability is definitely interesting, given that they used to openly state that TOR is weak against such widespread surveillance.
If I have been able to see further than others, it is because I bought a pair of binoculars.
I would have been more impressed if he said "we're considering ways to limit lawlessness without compromising the premise of protection of citizens in dangerous parts of the world" "Tor can be used for good and for evil. How do you go about attempting to design the features of Tor to maximize one and minimize the other? Lewman: The Tor network is designed to provide protection online for ordinary citizens, victims of abuse, and individuals in dangerous parts of the world share information over public networks without compromising their anonymity. Most of the people that use Tor have legitimate uses for wanting privacy such as activists or reporters that need to keep their locations private. Criminals can already do bad things and there are certainly lots of options available to them for breaking the laws."
I've been running tor using system without any issue at all for many months now. Like you say, it just starts/stops your network.
Maybe if you wanted to route ALL your network traffic over it you'd need to play with networkd and a proxy and all that, but this isn't a typical use case. It really wouldn't be any different than doing the same thing with any init/network-manager/etc.
So this must be partially in response to the knowledge that Steve Gibson was going to be talking about some problems with Tor in this week's Security Now: http://twit.tv/show/security-n...
Would you explain what other answers you would have expected to be given to those lame, sometimes ridiculous "questions", some of them starting from blatantly false premises (e.g., the one who says that TrueCrypt is compromised) ?
Documents leaked by Snowden prove that the NSA itself admits to not being able to break Tor. Is it enough or you are one of the guys who think that Snowden himself is a giant PR conspiracy by the NSA itself to promote compromised software?
Tor's integration with systemd, if any, would be very very tiny
Systemd would of course integrate to make sure your (alread undreadable binary) log files were now firmly encrypted and, like any good onion router, not decryptable by you but only by nodes at least 2 hops away.
I don't even know if I'm joking.
Socialism: a lie told by totalitarians and believed by fools.
I tried to post a comment similar to the one below under this thread. Not at all surprising that the moderator didn't allow it through:
Given Tor's "Solidarity against online harassment", how long until the Tor network is intentionally compromised by the developers at the behest of the SJWs and the Cathedral (a term coined by Mencius Moldbug used to describe the Harvard-US government axis) to unmask and dox those engaging in so-called "harrassment", defined as 'anyone who expresses mere disagreement with an SJW or the political Left in general'?
undreadable binary) log files
I saw what you did there, Roberts.
You are not a brain: http://books.google.com/books?id=2oV61CeDx-YC
There, fixed that for you
I've listened to cell phone calls before just screwing around with a scanner. I've heard a person confirming a reservation and give their credit card number. This was mid 90's. So know how easy it is - or was at that time.
I found this post looking for something else, it's off topic for the thread. This pertains to Wifi as well as a PC.
"If you have to use public Wifi then use free VPN service like Hotspot Shield, CyberGhost, OkayFreedom, Spotflux, SafeIP or SecurityKISS which will provide the same security as your home router." http://malwaretips.com/threads...
-Below is something I've written up for well family.-
I've done the leg (finger?) work here. All are free with varying limited data usage. Reading the privacy policy of each, SecurityKISS is my choice and the only one that offers true anonymity if you wish (absolute only with the free service), and the only one that doesn't require a registration. But ones call is routed to Ireland, (and it's jurisdiction), it's noted that they have never given any information out to anybody. http://www.securitykiss.com/ab...
---End
Then checked out out their Facebook page, NSA has compromised their system or service, This found due to a Snowden release. "Starting with 2014/12/17 SecurityKISS discontinued the PPTP service." The CEO made mention they may have the data but it's still has to be decrypted, something I can only assume has been.
https://www.facebook.com/pages...
Damn odd it's not listed in their Privacy policy, but then PPTP is still being offered as a service..
Nobody asked about the possible integration with default Firefox that has been hinted, potentially expanding Tor's userbase from 2.5 million to 100 million??