Slashdot Mirror
UK Parliament: Banning Tor Is Unacceptable and Technologically Impossible
An anonymous reader writes: Months after UK prime minister David Cameron sought to ban strong encryption, a new parliamentary briefing contradicts that, at least when it comes to Tor. The briefing says, "there is widespread agreement that banning online anonymity systems altogether is not seen as an acceptable policy option in the UK. Even if it were, there would be technical challenges." The briefing cites Tor's ability to circumvent such censorship in countries like China as well as looking at both legal and illegal uses of Tor.
Tor works in China? I rarely get Tor or torrents to connect in Beijing, but for some reason it varies depending on where I connect.
The problem is that for Cameron to change his mind on trying to ban strong encryption, would imply that he was somehow wrong to try and ban it in the first place. This of course will not happen. Politicians HATE it when they are shown to be wrong.
A bit of heated rhetoric mentioning Paedophiles, Terrorists and Tor will put paid to this report, and GCHQ will continue on their merry way treating the entire population as enemies/criminals.
Trying to associate Microsoft with "fun" is like trying to associate Satan with aromatherapy. -Tycho
Tor falls into the same category as many other items which can be used for both good and bad.
A knife can be used to cut bread, but also throats. Morphine is be best pain killer there is,
but is also a killer when abused. Bitcoin (& co) can revolutionize the monetary system,
but also be used for non-tracable financing for all sorts of illegal activities.
"Non-tracable financing for all sorts of illegal activities" is also a a well-known property of... cash!
Cash is not really under political questioning (a bit more so from banking): it's common,
under relative control, and it's not new.
This leads me to believe that the banning things which can have adverse side effects
is not primarily motivated by care for the public best, but rather fear of the new/unknown and
fear of loosing control.
Well, to be honest, all it probably means is that they know how to get around tor, and they don't want people to switch to anything else.
But I'm cynical that way.
wouldn't be to ban strong encryption, it would be to make the assumption in Law that there mere *presence* of such an encryption system is enough indication of liability. Much like the assumption made that because something posesses a moving picture display that it is being used as a televisual broadcast receiver even if it isn't actually being used as such. It's easier to assume than it is to carry the burden of proof - with assumption comes the passing of that stick to the accused (who is on a loser because - and you've got to point this out or you're screwed - you can't prove a negative, it's a logical absurdity).
What this means to Granny is that if her computer is compromised with one of those cryptolocker things that encrypts her home folder and holds it ransom, she can't decrypt it because she doesn't have the key.
Strike 1 in English Law: possession being 9/10, if you have hold of a hard drive it is assumed that you have access to the data on it.
Strike 2: if there is an encryption it is also assumed that you have the key (see previous point about proving negatives).
Strike 3: Case that Granny is accused of having kiddie porn, the assumption can now be made that said kiddie porn is inside the encrypted container. Because the Law is now changed so that criminal liability now works on Balance of Probabilities (hence doesn't need a jury to decide Beyond Reasonable Doubt), Granny is going away for a while even if a: there is no kiddie porn - which she can't prove by unlocking the encrypted container, and b: she could prove it by breaking the encryption and opening the container - make the assumption that there are other containers containing the porn, which given the mental status of State prosecutors (and police), being utterly paranoid, she be fucked because the seed thought is there (that Granny is a bad person), and combined with the balance of probabilities, "No Smoke Without Fire" applies. NSWF CANNOT apply in Beyond Reasonable Doubt because BRD REQUIRES physical evidence! And encrypted container with no access to the data is NOT physical evidence. If it were we'd see prisons bursting with people jailed on the basis of unseen contents in sealed black boxes.
Lesson for all: if you're accused of causing harm or damage, DEMAND THAT JURY AND DO NOT BACK DOWN.
</run_on_rantish_rant>
Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
Perhaps someone could explain how Tor creates anonimity. Most places I read stress the more obvious part of Onion Routing which is sort of merry go round tumbler so people can't associate where you got on from where you got off. But What I don't understand is how you preserver anonimity in the getting on part. Two things strike me as give-aways. First It seems like there has to be some zero conf step where you learn where a tor entrance node is and what port it wants to initiate the protocol. It seems like these entrance nodes would have to not change frequently so any determined adversary just needs to program key routers to watch for traffic to that IP address. Lots of diverse traffic to any specific computer with a characteristic port number would be the bread crumbs used to identify the watched IP addresses. Second, since the packets are encoded in some layered way, surely there is some sort of header or something that a deep packet inspector could recognize as a tor format, also giving the game away.
So I could see how tor could obfuscate who is talking to who, it seems like it would have a hard time obfuscating the set of people involved.
Some drink at the fountain of knowledge. Others just gargle.
Cameron is trying to sound "tough" to appeal to voters, especially in the run up to the General Election in May. Of course, sounding tough doesn't require that your stated policy makes any sense technically, logically, economically or in any other sense.
"If you think the problem is bad now, just wait until we've solved it." --- Arthur Kasspe
Their upper class wants to communicate anonymously: http://www.thedailybeast.com/a...
I doubt that actually. POST is a small group of scientists who advise parliament, they're not a part of the government at all and it's extremely unlikely they'd be privy to classified knowledge about secret programmes to intercept tor communication.
THEIR exit nodes.
There's nothing stopping such a high flux of new exit nodes in the face of censorship. Especially as ANY client can be an exit node, in theory.
Banning TOR is not technologically impossible, it is quite easy to do. Enforcing the ban is the problem. Making it a crime may deter some, but of course not the nefarious.
"You can't ban Tor! People might switch to something we can't intercept!"
Nothing posted to
You didn't read his post, banning it is easy, all you have to do is pass a law that says its not allowed. Enforcing the ban is the hard part.
Just leave it alone and think of the bounty of intelligence you will harvest - infiltrate or set up some phony jihadist / paedo / drug & weapons dealing / carding sites and wait for the perps to come to you.
TOR exit nodes are on a public list. Banning them by IP address is quite easy, and it is pretty common for admins to ban or severely restrict services to exit nodes, just because they have a reputation for abuse.
The ideal is to use TOR, then a VPN service past the exit node, so services on the Internet don't give you the middle finger.
TOR is throughly compromised and they don't want people to stop using it, they want them to feel "safe" using it.
"If any question why we died, Tell them because our fathers lied."
> Even if it were [moral], there would be technical challenges
Ha ha oh wow. Since when did this ever start showing up in statements? Last I checked we still have people (from plebs to politicians) saying crap like "We should show everyone's name on the internets!"
And even multi-million corporates saying crap like "Let's base policy around the user's location because we can tell where they are." Then some tech says something about "proxies and VPNs" and the decision makers say something about "Fix it. We'll sue. We'll lobby it into illegal. Do something."
You don't have to know tech, just know that things like "the (federal) LEOs can look the guy up" and "they can be controlled through their ISP" are not hard rules. That there are few hard limits to internet use at all. You can do whatever you want case-to-case but it's different when you try to declare encompassing laws. You don't have to know tech, just look at restrictive countries. You can control most people most of the time (techwise) but don't assume that's a reflection of your power, it reflects people using tech the easy (insecure) way.
Hopefully we'll dodge more bullets in the future. I'm glad we didn't set the wrong precedent on "an IP address is useful evidence but can not be equated to an individual".
From what I hear and the Tor people say, this is not correct: It is an arms-race and you may need to use certain additional measures, but so far neither side has won.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
And with even a modicum of understanding of how Tor works, you would know that this is not relevant.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
From what the Tor folks say, this is not true. It is an arms-race and it may need special measures to get through, but so far neither side has won.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.