Slashdot Mirror
Tor Promises Not To Build Backdoors Into Its Services (engadget.com)
An anonymous reader quotes a report from Engadget: Tor has published what it calls a "Social Contract" comprised of promises to users and the principles the team believes in. Whatever the reason is, its social contract contains one interesting pledge: "We will never implement front doors or back doors into our projects," the team wrote. Tor's ability to keep users anonymous made it the go-to browser of people looking for drugs, illegal firearms, hitmen, child porn and other things you won't find on eBay or YouTube. If there's a browser law enforcement agencies would want a backdoor to, it's Tor, especially since its main source of funding is the U.S. government. That's right -- the famous anonymizing network gets most of its money from a government known for conducting mass surveillance on a global scale. Loudly proclaiming that it will never build a backdoor into its services might not even matter, though. The government already proved once that it's capable of infiltrating the dark web. If you'll recall, the FBI identified 1,500 users of a child porn website called "Playpen" by deploying a Tor hacking tool. It led to numerous court battles that opened up the discussion on the validity of evidence obtained without warrant through malware. "We believe that privacy, the free exchange of ideas, and access to information are essential to free societies. Through our community standards and the code we write, we provide tools that help all people protect and advance these rights," Tor writes in the contract.
I promise! Anyway, I2P looks better, so perhaps it doesn't matter.
I'm a nerd because I said 'bazinga' first!
Tor doesn't need back doors when the FBI runs all the exit nodes.
Seven puppies were harmed during the making of this post.
Extra-judicial killings.
Sometimes technology is just too much for the justice system. There needs another way.
The United States Naval Research Laboratory. If it didn't have a backdoor when it was developed in the mid 1990s, it surely does by now.
http://thenextweb.com/insider/2016/01/28/how-the-fbi-became-the-worlds-largest-distributor-of-child-sex-abuse-imagery/
Keep it real.
Also, don't use any Tails later than 1.4.1 ...
This was posted earlier today... and now you see this front page story about promises by CIA/FBI infiltrated TOR.
https://yro.slashdot.org/comments.pl?sid=9515909&cid=52687215
Notice how Ed Snowden never had his traffic intercepted?
Use Tails 1.4.1. Tails 1.5 and later is ALL SNOOPABLE. Traffic AND timestamps.
Only legit torrent is here.
http://www.sendspace.com/file/w35ddl
It is a Live ISO of Tails Linux 1.4.1 and includes the correct sig from when it was originally distributed from boum.org .onion url's. Debian is also easy to stumble upon, that is because the FBI infiltrated Debian as well. They killed Ian Murdock. They also are running Slashdot now. Notice the CA server is not GeoTrust Inc today? Now it is Let's Encrypt. Why? FBI.
They infiltrated boum.org and every version from 1.5 and later is compromised. They even lure you into newer versions on
the whole domain kat.cr was taken down simply because that torrent was live and seeded fast. It still is. Get it and seed it.
Isn't that exactly what a fully compromised entity would say?
The Contract
“He’s not deformed, he’s just drunk!”
"Tor Promises Not To Build Backdoors Into Its Services"
What they mean is they won't knowingly allow anyone to build a backdoor in. But one or two people with any kind of access to the code could conceivably add something that the team as a whole wouldn't know anything about.
With that said, good on them for taking this position. I still don't know if I can trust them or Tor itself, but taking this position was a good thing to do.
Just cruising through this digital world at 33 1/3 rpm...
What a bunch of creepers.
5 eyes and 'friendly' nations.
UK and France both definitely doing so (run TBB and see how long it takes you to end up on a UK, US, or French entrance node that seems to build a substantial amount of its connections through the same country's nodes, or a collection of likely affiliated nations nodes (ex: UK, US, UK) Happens far too often to be considered statistically unlikely, and Tor has already stated that the node exclusion lists have been relegated to soft filters in the event that a connection cannot be created due to your exclusions a circuit may then bypass the exclusions in order to get online. Seems to be happening quite often in my experience. I don't have much more than forum posts to worry about, but for anybody who might be drawing government (esp Western) scrutiny I wouldn't recommend them to trust tor to actually provide partial, nevermind full, anonymity even if all precautions they list on their site are followed.
The era of Tor as a platform is dead. Unfortunately there is nothing ready to replace it. The next best anonymity system is I2P (which BTW has both java and c++ implementations available, so it's not a monoculture, unlike Tor!) But it isn't built to support outproxy/exit node shuffling like Tor does, and there is only a single outproxy being run at this time, causing extreme congestion for anyone needing clearnet access.
the operating system itself has backdoors in to it, plus keyloggers and trojans and who knows what else...
but i give tor an E for effort for trying to be good while surrounded by and buried neck deep in vulnerable software
Politics is Treachery, Religion is Brainwashing
No personal information that you submit to Thefacebook will be available to any user of the Web Site who does not belong to at least one of the groups specified by you in your privacy settings.
Facebook's Privacy Policy circa 2005
Facebook's Eroding Privacy Policy: A Timeline
It's also a potentially useful canary phrase. If it disappears then...
However, by now I'm sure any warrant/order would contain language that prevents them from removing it.
They can promise all they want, but with NSL gag orders it is a promise they simply can't keep.
Quick! Fork it!
It's more than just the exit nodes I think.
Javascript turned 'on' in the browser bundle, disabled sometimes by a 3rd party app not in their control. Directory server problems never addressed: too easy to become a authoritative directory server, why no DHT type approach? 100 attack nodes ignored, it was an outside university that spotted those, yet anytime TOR setup a test server it would have been attacked by those nodes, and somehow they didn't notice all the attack traffic before anyone would know the node???? That seems unlikely. A layer of crappy obsfucation added, since the entry and exit nodes are mappable from the choices made by the team, they added obsfucation Bridges nodes.... send via email no less! So you could get a PRISM friendly smaller list of servers to use.... how sweet is that?
"by sending mail to bridges@bridges.torproject.org with the line "get bridges" by itself in the body of the mail. You'll need to send this request from a Gmail, Riseup!, or Yahoo! account, "...
i.e. You send an easy to datamine email to a server known to be controlled by a PRISM interface, and request which specific man-in-the-middle server to use for your TOR connection! This is the state of those nodes *today*, even knowing Snowden leaks, they know they can't trust those emails, and yet continue to offer that as a way to get Bridges.
The upshot is simple. China has essentially rigged the Hong Kong election by barring politicians from standing if it doesn't control them. Do you see the verbal protests from HK citizens online? No?... They have no outlet due to the Chinese surveillance, and don't trust TOR to keep their privacy.
i.e. TOR has failed in its primary mission of permitting free speech.
I think Bruce Schneier was brought in as a credible face, but I'm counting the months till he gets accused of sexual harassment. Then I'll officially stick a fork in it and call it done.
Seriously, is TOR so unbreakable that you shills need to bad-mouth it at any opportunity?
First, the promise to not backdoor is ages-old. Second, who finances it has been known since shortly after the beginning of the project. I asked Roger Dingledine more than a decade ago about it and his answer makes a lot more sense than the often repeated "The gobbermet founds it, it has backdoor!" that never comes with any additional details. And as to backdoors, it is very hard to keep backdoors in FOSS projects with active communities hidden for a long time. Add to that that anybody that finds a working backdoor in TOR has instant fame, backdoors in TOR are rather unlikely. And as to "TOR was broken in the past by the FBI", that is just a shameless lie. What was broken was the JavaScript engine of Firefox that served as basis of an outdated TOR browser bundle that the users did not upgrade despite very clear warnings each time they started it. That is right, the FBI simply implemented that attack against Firefox after the vulnerability was fixed (and likely they did it form the documentation of that vulnerability) and caught these 1500 idiots that way, no vulnerability in TOR and only a FF vulnerability that had already been patched in the current TOR browser bundle.
Now, despite these facts, the same idiotic anti-TOR propaganda keeps going. I can only speculate that this is intended to drive people away from TOR and to less-secure alternatives that are a lot easier to break.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Knowingly?
To sum up, your browser connects to an owned server, from which it knows a list of owned directory servers and owned onion servers. It picks an owned route and encrypts with the owned keys of the servers along that route. U R Owned!
Then there are Bridges. These are extra servers tacked onto the list of servers to obfuscate the entry nodes, because the entry nodes are known and too easy to intercept.
To obtain a Bridge server detail, you send an email request to Gmail or Yahoo, or RiseUp email. Two (and likely alll 3) of which are revealed to have PRISM interfaces in the Snowden documents. i.e. you will be given a specific bridge server just for you, which makes the backdoor a certainty and makes it easy to pick you out from the traffic.
TOR has front back and side doors and it should be clear to you that TOR project knows this, just by looking at how Bridges are sent via those Gmail/Yahoo email servers. Snowden revealed the PRISM interface, did you see TOR project replace those US based backdoored email servers when Snowden's leak came out? No. So TOR Project knows the doors are there, and did nothing.
You are seriously advising people to use an old, known-vulnerable version of Tails? Well, some utter morons may fall for that...
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
I love how most articles about Tor equate it with use of illegal activity when most people just want to use it for privacy. Most people are tired of getting spied on. "If you are not doing anything wrong then you do not have anything to hide". That's what guards say to prisoners... I want to be left alone, I like privacy and freedom of speech. Mass surveillance is an illegal search and infringes upon many of my rights. Go watch "Swing Kids" or "Lives of Others". It starts out small then becomes pervasive and oppressive.
Not saying that some using Tor aren't doing illegal activity, of course they are, but the same goes for anything else in life. Some people use cars to rob banks... doesn't mean the rest of us can't drive them. Some people use guns to kill people, doesn't mean we can't use them for self protection. Tor is a means to defend our privacy against the onslaught of personal habit stalkers in the name of "advertising". If you had someone follow you around all day logging exactly where you went, what you did, who you talked to.. they would be a stalker. If it's online then it's ok right? Stalking is stalking and it's creepy as hell especially if it's a corporation with resources doing it to you.
"will never" != "have never".
Now that it's got all the backdoors the NSA needs, they can promise not to add any more.
Privacy is dead. Get over it already. The panopticon is a reality and it was inevitable the moment it became technically and economically feasible. There's nothing you can do.
We will never implement front doors or back doors into our projects,...
The mailing address of the Tor Project is in Seattle, WA, USA. If they mean it then it makes sense to check where's the nearest Consulate of Ecuador. Better be safe than sorry.
Tor of all projects should be structured in a manner where nobody needs to promise anything. If there is a tangible entity in the situation to meaningfully make such a promise, there is a tangible entity to blackmail or slap with an NSL or compromise in other manners.
when they were more rapey and less sjwarriory
Whereas the smart child-rapists like you will be perfectly safe.
"We will never implement front doors or back doors into our projects..."
Isn't the whole point of the "back door" idea that people are expressly permitted to enter through the front door if they have a key? Why are they hating on legitimate receivers of encrypted data?
</pedantry>
I knew I needed to stop reading Slashdot and finish my PhD when I started to miss articles by Bennett Haselton.
Actually it said "TOR Stinks" and then listed ways they planned to take over TOR.
http://www.theguardian.com/world/interactive/2013/oct/04/tor-stinks-nsa-presentation-document
So they said, they'd get more nodes to ensure they controlled the route: Newtons Cradle.... DONE.
Cookie leakage... aka Egoistic Giraffe... DONE.
Ronin tracks node lifetime to match up with end point connections.... DONE.
Hidden servers.... GCHQ was working on ONION BREATH attack.... DONE.
REMATION II... GCHQ sets up TOR nodes on Amazon AWS.... DONE.
Keep in mind this was 2012, it doesn't take them long to set up more nodes and you can see from the node numbers they did that. It wouldn't take them long to use those nodes to cross match times. You can see from the way hidden servers drop quickly that ONIONBREATH was done.
Hilarious I'm sure for the spooks, but Hong Kong and (other) could use TOR right now. I doubt anyone in UK will spill the beans on any illegal GCHQ surveillance using TOR, it simply wouldn't be trustable at this point. It isn't that TOR would be attacked by domestic actors, that was inevitable. It was that TOR *foundation* itself has been undermined to the extent that it does not fix clear problems.
Translation: Tor has back doors in its services.
Actually, no. I understand why you'd think that, because adversaries should lie to each other.
But if you look around, you'll see that companies who write software intended to work against their users usually either admit it (in their terms of service), or at least refrain from saying they're for the users. Lying would be dangerous because it would just risk lawsuits when/if they got caught.
(And then with Free Software projects like Tor, what would be the point in lying? They definitely would get caught, since people actually do read that code.)
I think it's great the Tor team is doing this, because so much user-hostile software doesn't claim to primarily advance the users' interests. Instead of using words like "Free" or "Open Source" (since these terms apparently have limited appeal) it comes down to "for the user" vs "for someone else at the user's continuous expense" and those are concepts that almost any user can understand.
Projects merely asserting their good intentions could create selection pressure which overall increases the quality of software.
You're never going to see a "social contact" from companies like Apple or Facebook, or if you did, it would be mercilessly critiqued for its lawyerese way of not really promising to behave well, so the bullshit would backfire.
Or, maybe in the distant future, they could develop using a meaningful social contract, but would be a result of an industry-wide reform toward a pro-user agenda, brought about by users selecting software developed under social contracts!
So you believe TOR is used by "child rapists"? Funny. How would you even rape a person using a piece of software? I guess the rest of the mental activity you are capable of is of similar quality.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Was Ed Snowden vulnerable you stupid mother fucker? Do you think a live DVD of Tails is vulnerable you dumb mother fucker?
Do you know what a Live DVD is?
Yes, use the old version not the new compromised version you idiotic mother fucker. Do you think since he wasn't snooped they took out the snoops or added snoops?
You retarded mother fucker.
Fascinating. New heights of stupidity of the AC are revealed. A true cave-man, and one of the non-smart ones.
Do you even know what a "known vulnerability" in software is? Here is a hint: Loading it from a DVD does not help one bit it is still vulnerable.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.