Slashdot Mirror
How Shari Steele Plans To Take Tor Mainstream
blottsie writes: Over her career, Shari Steel has taken on United States Department of Justice, the National Security Agency, and the Federal Bureau of Investigation. She built the Electronic Frontier Foundation into an international powerhouse for protecting online rights. Today, she has a new mission, perhaps her heaviest challenge yet: Take the Internet's most powerful privacy tool mainstream. From the Daily Dot article linked, a hint of one reason that bringing Tor mainstream isn't straightforward:
At the heart of Tor's image problems are what's known as "hidden services" -- sites that are only accessible through the Tor network. Hidden services have been home to drug and gun marketplaces, child pornography forums, fraud and hacking sites, and sites where you can place bets on when a high-profile target may be assassinated. While the media tends to focus on the nefarious elements Tor enables, hidden services make up only about 1 percent of the Tor network, according to Steele, and are in no way operated by the Tor Project.
"I'm trying to teach everyone that we need to recognize that we are doing the work of the angels," Steele says. "What we are providing is really important and really great, and there happen to be uses that are residual that aren't what we're doing. We're not creating this for [illegal activity]. And OK, maybe it's being used for that, but that's not what we're about!"
"I'm trying to teach everyone that we need to recognize that we are doing the work of the angels," Steele says. "What we are providing is really important and really great, and there happen to be uses that are residual that aren't what we're doing. We're not creating this for [illegal activity]. And OK, maybe it's being used for that, but that's not what we're about!"
Great, we will have geeks getting stomped by bikers for wearing 1%ers patches.
In God we trust, all others require data.
For how someone uses the gun.
But still, you have to wonder about a large-scale gunrunner who knows that his guns are being used to kill civilians in some civil war.
SJW's don't eliminate discrimination. They just expropriate it for themselves.
...set up a Tor relay node. Easy peasy.
I'm fairly sure that I read somewhere quite a while back that Tor was already broken by one or other of the organs of the US government, and some people doing something illegal via Tor got caught and prosecuted. No?
Do I mod you up? Do I mod you down? Funny or Troll? Fuck it, I'll just post and admit that was my very first thought too.
Brought to you by Carl's Junior.
Oh we are on reddit now.
You don't want to know.
Angels are the, some times murderous, henchmen of the universal dictator. Biblical metaphors are never a good idea, except in sermons to people that welcome being preached at.
Yeah ... it's important that women - particularly those in the public eye - match up to expectations on sexual attractiveness. Otherwise, how will guys know who to mate with?
Why can't people be even a little bit nice?
Actually, I was thinking of Roger Daltry.
I'm a big advocate for TOR and what they try to do but there are some big obstacles.
* Speed sucks.
* There are no good search engines.
* Exit nodes are widely blocked and/or monitored.
I saw a good BBC documentary that explains TOR in laymen's terms https://www.youtube.com/watch?v=rZhmuGVSdaY if anyone is interested.
Tor's issues with respect to going mainstream, in my opinion, are as follows:
1.) It's complicated. Yes, it can be streamlined, which is the goal, but even if it were, it's still inherently more complicated than "not using Tor".
2.) No need. "I'm just browsing Facebook and paying bills online...and if someone is really snooping that traffic, what difference does it make?"
3.) Location data is convenient. As much as I hate Google tracking me, I'd much prefer knowing about restaurants near me when I'm hungry, than ones in Malaysia.
4.) Many people's first encounters with Tor are the result of ransomware...which are usually a traumatic experience. That's not exactly great marketing.
5.) Tor slows down browsing significantly; adding additional users would exacerbate the issue.
6.) Even the "good guys" have questions about the utility of Tor (compromised exit nodes, honeypots, etc.)
7.) Tricky on mobile devices.
Honestly, I see Tor's problems having much less to do with technological problems than with sociological ones. For most people, Shari would have to establish a need for them to use Tor. I don't see her being effective in that - not because of who she is, but because of her audience.
You don't have any idea who/what the EFF actually is/does, do you?
EFF and the ACLU (plus the local chapter) get donations every year - sometimes more often if I read about an issue they're needing help with funding. I am not affiliated with either but I do like to remind folks that both groups are hard at working at helping with our liberties. So, if you've got a buck or two and want to help out, I'm certain they'd appreciate it.
"So long and thanks for all the fish."
They need to petition large/multinational corporations like BK, MickyD, Pepsico, Walmart, etc to install tor exit nodes at all their retail locations and make available something like an all inclusive raspberry PI package with a rolling distro configured to auto-update to keep it secure. Maybe with a bitcoin full node as well. Call it a the Raspberry Freedom with the audio catch phrase "PHHHHHHHT" raspberry sound (distinctly discernible from the farting apps constituting so much of whats available for apple products, please).
There is no right to feel safe thru security vaudeville at the expense of everyone's freedom, privacy and tax money.
Make it 5 and I'll fire up Photoshop.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
So unrelated to the story specifically, but this is a discussion about a woman in technology who actually does stuff? She's not complaining about SJW issues; she's out there fighting the fight with us-- for us! So for once, we can relax and not have a big feminism discussion just because a woman is doing something tech-wise.
Thank you, Shari.
Tor's problem is not hidden services.
Tor's problems:
1. Speed sucks. Since *ANY* node can be used in the pathway, your speed is limited to the upload speed of the slowest node you are using. Since you have no control by default over which nodes are used, you cannot prevent this.
Scarily, when I was playing/using Tor, the best results came from limiting my usage to only half a dozen nodes. Never mind the goal of security here.
The work-around: Use an IP-like system, where your stream is sent over many links, and re-assembled at the end. Even if one link is slow, it will only handle a few packets.
2. The goals are in conflict. Tor has *at least two different goals*.
Goal #1: Prevent your neighbor/public lan/ISP from seeing what you are doing. This is as simple as a one-hop channel. Instead of talking to my destination, I talk to a single forwarder. Done.
Goal #2: Prevent tracking. If I talk to a single forwarder, then a single node knows who I am, and who I am talking to. This can be prevented by a two-hop. Node #1 knows that a connection is going in from site H, and out to site 2, but doesn't know that H is the requesting host. Node #2 knows that it is talking to destination D, and host #1, but doesn't know who the requesting host is. "Perfect", right? Well, not if node 1 is doing the splitting.
Goal #3: Provide real privacy. There's a good analysis that I don't have a link to showing that the two-hop is traceable. And if the first hop is splitting (instead of the host splitting), then the two hop doesn't have enough security. Basically, if I remember correctly: If you always change the entry and exit nodes, you will eventually have a pair controlled by an attacker, so you have to limit your switching of those. To prevent being tracked, you need a random third node in-between.
The more nodes? The slower the speed, and a different set of attacks being defended against.
For most people? A single hop suffices.
For those that want light security? Two hops.
For those that want speed? Have multiple paths, and assembly at the end.
What kills Tor, beyond these, are things you, as a user, cannot control:
** Stupid websites that assume anything coming from a Tor node are attacks and delete them **.
I mean, **stupid**. I can actually log in, with name and password, and still get "Sorry, we don't accept hackers using Tor" type messages.
As long as sites are going to say "We can arbitrarily deny service to people who are concerned about privacy", then nothing will get fixed.
As far as "splitting" paths go? Here's what the Tor docs say:
> You should split each connection over many paths.
>
> We don't currently think this is a good idea. You see, the attacks we're worried about are at the endpoints: the adversary watches Alice (or the first hop in the path) and Bob (or the last hop in the path) and learns that they are communicating.
Tor is concerned about the security of your communication. Tor is not concerned about the speed of your communication. As long as "Use the best possible security, regardless of speed cost" is the goal, then Tor will only be focused on people who need to best possible security -- namely, those who are taking actions against a government or large corporation.
End up? Are you really foolish enough to think the CIA would develop a tool for anonymity and release it to the public before it was thoroughly defeated? It is only good for pirating, anything that would be subversive to the government's ambitions done on TOR will get you killed.
From the OP: "We're not creating this for [illegal activity]. And OK, maybe it's being used for that, but that's not what we're about!"
https://www.youtube.com/watch?...
Thank you. I was, until now, entirely unfamiliar with them. They look like they might be a worthy cause. Free speech means protecting the speech that is not preferred and these folks get funding from the government. So, it's a noble goal and I thank you for bringing it to my attention. I'm in the process of getting some BTC, where I'll wash it, and then I'll push it on to them anonymously in chunks over the weekend and into the coming week*. I need neither a shirt nor recognition. I care not about the tax write-off, I generally exceed the allowed amount anyhow.
I'll avoid mentioning a specific total but they'll get a good chunk - as I may not remember to donate until next year (I have put it into my calendar so it will remind me to check again in a year). But, suffice to say, it's a goodly chunk and would net a number of t-shirts. They look like a worthy cause and, I repeat myself, thank you for bringing them to my attention. They'll be put into the yearly cycle which is usually appreciated by the organizations. I also try to keep to a budget every month - and what's excess gets donated, sometimes at almost random(ish) and between the groups that I keep in mind.
* Why spread out? Meh, it's a privacy thing. I like anonymity with some things. Or at least not being able to make certain attributions. I've found that doing so means that I don't get as many heart-felt requests (even after ensuring I ticked the box to not subscribe to such) from various groups. I know, pretty factually, that more than one group has shared my email address - I use catch-all and then use a custom email address that indicates the source. I've had this happen multiple times and those groups no longer get donations.
"So long and thanks for all the fish."