Slashdot Mirror
How Shari Steele Plans To Take Tor Mainstream
blottsie writes: Over her career, Shari Steel has taken on United States Department of Justice, the National Security Agency, and the Federal Bureau of Investigation. She built the Electronic Frontier Foundation into an international powerhouse for protecting online rights. Today, she has a new mission, perhaps her heaviest challenge yet: Take the Internet's most powerful privacy tool mainstream. From the Daily Dot article linked, a hint of one reason that bringing Tor mainstream isn't straightforward:
At the heart of Tor's image problems are what's known as "hidden services" -- sites that are only accessible through the Tor network. Hidden services have been home to drug and gun marketplaces, child pornography forums, fraud and hacking sites, and sites where you can place bets on when a high-profile target may be assassinated. While the media tends to focus on the nefarious elements Tor enables, hidden services make up only about 1 percent of the Tor network, according to Steele, and are in no way operated by the Tor Project.
"I'm trying to teach everyone that we need to recognize that we are doing the work of the angels," Steele says. "What we are providing is really important and really great, and there happen to be uses that are residual that aren't what we're doing. We're not creating this for [illegal activity]. And OK, maybe it's being used for that, but that's not what we're about!"
"I'm trying to teach everyone that we need to recognize that we are doing the work of the angels," Steele says. "What we are providing is really important and really great, and there happen to be uses that are residual that aren't what we're doing. We're not creating this for [illegal activity]. And OK, maybe it's being used for that, but that's not what we're about!"
Great, we will have geeks getting stomped by bikers for wearing 1%ers patches.
In God we trust, all others require data.
Oh, I'm sure in their efforts to take Tor 'mainstream', they'll also poke holes in it's otherwise inherent security 'for the sake of security and FOR GODS SAKE THINK OF THE CHILDREN!'. Politicians, police, and especially the intelligencia (aka secret police) already want all encryption banned, so obviously this new 'mainstream' version of Tor will include a way for all of them to determine who is using Tor, when, for what, and especially who is running exit nodes. May as well just abandon it now, unless you want to get put on a watchlist (if you aren't already). Of course it's not lost on me that Tor likely has already been compromised to the point where it's basically useless for the purpose it was originally intended. Oh well maybe someone else will start up something similar and manage to keep a lid on it longer before government assholes get their mitts on it and fuck it all up.
For how someone uses the gun.
But still, you have to wonder about a large-scale gunrunner who knows that his guns are being used to kill civilians in some civil war.
SJW's don't eliminate discrimination. They just expropriate it for themselves.
...set up a Tor relay node. Easy peasy.
Blaming Tor for the illegal sites is like blaming Microsoft or Apple for letting people use those computers for illegal activity.
I'm fairly sure that I read somewhere quite a while back that Tor was already broken by one or other of the organs of the US government, and some people doing something illegal via Tor got caught and prosecuted. No?
What does my mom need Tor for?
Not me. When I saw her photo, I thought at first that it was Bruce Jenner!
Sorry, I calls 'em as I sees 'em.
Seems awfully philanthropic for something capable of being so lucrative. Follow the cheese. I really want to believe this is truly altruistic intent but I'm sensing otherwise.
Do I mod you up? Do I mod you down? Funny or Troll? Fuck it, I'll just post and admit that was my very first thought too.
Brought to you by Carl's Junior.
Oh we are on reddit now.
Angels are the, some times murderous, henchmen of the universal dictator. Biblical metaphors are never a good idea, except in sermons to people that welcome being preached at.
Yeah ... it's important that women - particularly those in the public eye - match up to expectations on sexual attractiveness. Otherwise, how will guys know who to mate with?
Why can't people be even a little bit nice?
Actually, I was thinking of Roger Daltry.
I'm a big advocate for TOR and what they try to do but there are some big obstacles.
* Speed sucks.
* There are no good search engines.
* Exit nodes are widely blocked and/or monitored.
I saw a good BBC documentary that explains TOR in laymen's terms https://www.youtube.com/watch?v=rZhmuGVSdaY if anyone is interested.
Tor's issues with respect to going mainstream, in my opinion, are as follows:
1.) It's complicated. Yes, it can be streamlined, which is the goal, but even if it were, it's still inherently more complicated than "not using Tor".
2.) No need. "I'm just browsing Facebook and paying bills online...and if someone is really snooping that traffic, what difference does it make?"
3.) Location data is convenient. As much as I hate Google tracking me, I'd much prefer knowing about restaurants near me when I'm hungry, than ones in Malaysia.
4.) Many people's first encounters with Tor are the result of ransomware...which are usually a traumatic experience. That's not exactly great marketing.
5.) Tor slows down browsing significantly; adding additional users would exacerbate the issue.
6.) Even the "good guys" have questions about the utility of Tor (compromised exit nodes, honeypots, etc.)
7.) Tricky on mobile devices.
Honestly, I see Tor's problems having much less to do with technological problems than with sociological ones. For most people, Shari would have to establish a need for them to use Tor. I don't see her being effective in that - not because of who she is, but because of her audience.
Heh... Glad I scrolled down. I was gonna say, "That guy from The Who. I can't remember his name."
They need to petition large/multinational corporations like BK, MickyD, Pepsico, Walmart, etc to install tor exit nodes at all their retail locations and make available something like an all inclusive raspberry PI package with a rolling distro configured to auto-update to keep it secure. Maybe with a bitcoin full node as well. Call it a the Raspberry Freedom with the audio catch phrase "PHHHHHHHT" raspberry sound (distinctly discernible from the farting apps constituting so much of whats available for apple products, please).
There is no right to feel safe thru security vaudeville at the expense of everyone's freedom, privacy and tax money.
Make it 5 and I'll fire up Photoshop.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I'd say there's a problem with how the mainstream perceives tor. "A browser for illegal websites" is how one of my most tech-savvy friend described it.
From the article:
"a recent attack on Tor, led by Carnegie Mellon University and funded by the FBI, allowed law enforcement to unmask users."
Then why setup any new "hidden service" within TOR instead of I2P?
I wonder if any of these new block chain distributed decentralized files systems technologies get implemented with hidden services in TOR or I2P, such as filecoin or Storj.
So unrelated to the story specifically, but this is a discussion about a woman in technology who actually does stuff? She's not complaining about SJW issues; she's out there fighting the fight with us-- for us! So for once, we can relax and not have a big feminism discussion just because a woman is doing something tech-wise.
Thank you, Shari.
Tor's problem is not hidden services.
Tor's problems:
1. Speed sucks. Since *ANY* node can be used in the pathway, your speed is limited to the upload speed of the slowest node you are using. Since you have no control by default over which nodes are used, you cannot prevent this.
Scarily, when I was playing/using Tor, the best results came from limiting my usage to only half a dozen nodes. Never mind the goal of security here.
The work-around: Use an IP-like system, where your stream is sent over many links, and re-assembled at the end. Even if one link is slow, it will only handle a few packets.
2. The goals are in conflict. Tor has *at least two different goals*.
Goal #1: Prevent your neighbor/public lan/ISP from seeing what you are doing. This is as simple as a one-hop channel. Instead of talking to my destination, I talk to a single forwarder. Done.
Goal #2: Prevent tracking. If I talk to a single forwarder, then a single node knows who I am, and who I am talking to. This can be prevented by a two-hop. Node #1 knows that a connection is going in from site H, and out to site 2, but doesn't know that H is the requesting host. Node #2 knows that it is talking to destination D, and host #1, but doesn't know who the requesting host is. "Perfect", right? Well, not if node 1 is doing the splitting.
Goal #3: Provide real privacy. There's a good analysis that I don't have a link to showing that the two-hop is traceable. And if the first hop is splitting (instead of the host splitting), then the two hop doesn't have enough security. Basically, if I remember correctly: If you always change the entry and exit nodes, you will eventually have a pair controlled by an attacker, so you have to limit your switching of those. To prevent being tracked, you need a random third node in-between.
The more nodes? The slower the speed, and a different set of attacks being defended against.
For most people? A single hop suffices.
For those that want light security? Two hops.
For those that want speed? Have multiple paths, and assembly at the end.
What kills Tor, beyond these, are things you, as a user, cannot control:
** Stupid websites that assume anything coming from a Tor node are attacks and delete them **.
I mean, **stupid**. I can actually log in, with name and password, and still get "Sorry, we don't accept hackers using Tor" type messages.
As long as sites are going to say "We can arbitrarily deny service to people who are concerned about privacy", then nothing will get fixed.
As far as "splitting" paths go? Here's what the Tor docs say:
> You should split each connection over many paths.
>
> We don't currently think this is a good idea. You see, the attacks we're worried about are at the endpoints: the adversary watches Alice (or the first hop in the path) and Bob (or the last hop in the path) and learns that they are communicating.
Tor is concerned about the security of your communication. Tor is not concerned about the speed of your communication. As long as "Use the best possible security, regardless of speed cost" is the goal, then Tor will only be focused on people who need to best possible security -- namely, those who are taking actions against a government or large corporation.
From the OP: "We're not creating this for [illegal activity]. And OK, maybe it's being used for that, but that's not what we're about!"
https://www.youtube.com/watch?...