How Shari Steele Plans To Take Tor Mainstream

blottsie writes: Over her career, Shari Steel has taken on United States Department of Justice, the National Security Agency, and the Federal Bureau of Investigation. She built the Electronic Frontier Foundation into an international powerhouse for protecting online rights. Today, she has a new mission, perhaps her heaviest challenge yet: Take the Internet's most powerful privacy tool mainstream. From the Daily Dot article linked, a hint of one reason that bringing Tor mainstream isn't straightforward: At the heart of Tor's image problems are what's known as "hidden services" -- sites that are only accessible through the Tor network. Hidden services have been home to drug and gun marketplaces, child pornography forums, fraud and hacking sites, and sites where you can place bets on when a high-profile target may be assassinated. While the media tends to focus on the nefarious elements Tor enables, hidden services make up only about 1 percent of the Tor network, according to Steele, and are in no way operated by the Tor Project.

"I'm trying to teach everyone that we need to recognize that we are doing the work of the angels," Steele says. "What we are providing is really important and really great, and there happen to be uses that are residual that aren't what we're doing. We're not creating this for [illegal activity]. And OK, maybe it's being used for that, but that's not what we're about!"

Comments

Re:1 percenters

[VernonNemitz]

Nevertheless, the fact remains that anything that can be used can also be abused. A pillow can be a murder weapon or help you sleep better. An H-bomb can deflect a dangerous asteroid or destroy a city. Water is problematic. :) Government can be tyrannical or ...hmmm!. And so on.

Re:Well, I don't blame the gunmaker

[Krishnoid]

I'll bet he gets maimed by one of his own munitions, then captured by guerilla forces, and has to wear an electromagnet in his chest to keep metal from entering his heart. Hopefully he learns from this and uses his knowledge for good instead of evil. You know, an ironic sort of punishment.

Re:Well, I don't blame the gunmaker

[DogDude]

Sir, put down the the Glenn Beck, and slowly walk away.

Re:Didn't the NSA already break Tor?

[Iamthecheese]

No. I'm not saying it's not broken, I read a paper some years ago showing that Tor can be compromised by anyone owning 50% of the nodes. Using fast nodes can cut that percentage significantly. At the time there were, IIRC, 2400 total Tor nodes. So to say Tor wasn't compromised would be to say the US government didn't have the means and will to set up 1200 systems in various places as Tor nodes. I don't know how many nodes there are now but if it's not in the hundreds of thousands, I would bet my ass the whole network is compromised.

But the people who were caught were caught because they leaked personal information in various forms, or downloaded a script that directly leaked their IP's. It wasn't a weakness in the network. My guess is Tor intelligence is mostly being used for actual national security work: tracking down known terrorists who are dumb enough to rely on Tor for anonymity. There's got to be some parallel construction happening as well, but I think they only use it for serious stuff.

My problems with it.

[waspleg]

I'm a big advocate for TOR and what they try to do but there are some big obstacles.

* Speed sucks.
* There are no good search engines.
* Exit nodes are widely blocked and/or monitored.

I saw a good BBC documentary that explains TOR in laymen's terms https://www.youtube.com/watch?v=rZhmuGVSdaY if anyone is interested.

1/3 Image, 1/3 Society,1/3 Tech

[Voyager529]

Tor's issues with respect to going mainstream, in my opinion, are as follows:

1.) It's complicated. Yes, it can be streamlined, which is the goal, but even if it were, it's still inherently more complicated than "not using Tor".
2.) No need. "I'm just browsing Facebook and paying bills online...and if someone is really snooping that traffic, what difference does it make?"
3.) Location data is convenient. As much as I hate Google tracking me, I'd much prefer knowing about restaurants near me when I'm hungry, than ones in Malaysia.
4.) Many people's first encounters with Tor are the result of ransomware...which are usually a traumatic experience. That's not exactly great marketing.
5.) Tor slows down browsing significantly; adding additional users would exacerbate the issue.
6.) Even the "good guys" have questions about the utility of Tor (compromised exit nodes, honeypots, etc.)
7.) Tricky on mobile devices.

Honestly, I see Tor's problems having much less to do with technological problems than with sociological ones. For most people, Shari would have to establish a need for them to use Tor. I don't see her being effective in that - not because of who she is, but because of her audience.

Re:1/3 Image, 1/3 Society,1/3 Tech

[tnk1]

Tor is useful when you need it and really have no better choice, but its not going to be a mass solution. There's too many things you have to get right for it to work the way it is intended and not expose you to discovery.

And yes, it is slow. Painfully slow.

Another thing I consider when I look at encrypted or otherwise more purposely "secure" transmission methods is that if you're using them, you're now in a group of people that is passing more "interesting" traffic. Observers may or may not be able to read what you are saying, but they're a whole lot more interested in whatever it is you are saying, if you show that you're taking more than the usual precautions with it.

It also means that even if they can't see you, there are specific Tor .onion sites which are only a small subset of the Internet, and those sites can become infected with malware that talks back to the investigators, as it has been seen in the past. In that way, a Tor user may be more likely to get caught in the dragnet and investigated. And it doesn't have to be something like a Silk Road type of site either, although you're certainly a target if you look at one of those kind of sites.

So, when I hear of people trying to take this sort of thing mainstream, I can totally see why you'd want to do that. It makes it less likely that you're a higher priority surveillance target just for using it.

Unfortunately, most people have to have a good reason to be inconvenienced in this manner during normal transmission of data because they just want to send a message or look at a site and don't care who knows where they browse. We'll need something a lot more user friendly (and more secure) than Tor for that sort of adoption.

Re:Didn't the NSA already break Tor?

[KGIII]

Gotta be honest here... You're really being the dick in this situation. Read their post again. Note the question mark? Heaven forfend, someone try to learn something when we're always telling people that if they don't know they should ask and learn. (Or just directing them to the manual.) However, in all fairness, a number of articles have made it a bit confusing and one might believe that TOR has been broken. By all accounts, it hasn't so long as you remain on the .onion domains. Exiting the network might be visible with traffic shaping and timing detection methods. It also confers no benefit to those who do not secure their browser and are leaking personal information. I can see how that would be confusing.

You could have, of course, just told 'em that but you had to feel superior, huh? Kids these days. ;-) But yeah, you're kind of a dick tonight.

Re:1 percenters

[Maritz]

Show me the safety standard-compliant pillow that cannot be used to suffocate someone.