Re: [tor-talk] Is this still valid?
Seth David Schoen writes: If you read the original Tor design paper from 2004, censorship circumvention was actually not an intended application at that time: https://svn.torproject.org/svn/projects/design-paper/tor-design.pdf (Tor does not try to conceal who is connected to the network.) The connection to censorship circumvention is that, on a censored network, people are normally not allowed to connect to censorship circumvention services (that the network operator knows about). So if you allow the network operator to easily know who is connecting to the service -- as the 2004 version of Tor always did -- they can block it immediately (as several governments did when they noticed Tor was becoming popular in their countries). Now that Tor also has censorship circumvention as a goal, there are several methods it can use to try to disguise the fact that a particular person is connected to the Tor network. -- Seth Schoen sch...@eff.org Senior Staff Technologist https://www.eff.org/ Electronic Frontier Foundation https://www.eff.org/join 815 Eddy Street, San Francisco, CA 94109 +1 415 436 9333 x107 -- tor-talk mailing list - tor-talk@lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Is this still valid?
U.R.Being.Watched writes: http://www.deseret-tech.com/journal/psa-tor-exposes-all-traffic-by-design-do-not-use-it-for-normal-web-browsing/ There are some mistakes in the article -- for example the notion that Tor was built for a specific purpose, which was the circumvention of restrictive firewalls like the Great Firewall of China. If you read the original Tor design paper from 2004, censorship circumvention was actually not an intended application at that time: https://svn.torproject.org/svn/projects/design-paper/tor-design.pdf (Tor does not try to conceal who is connected to the network.) That has subsequently changed, the project adopted anticensorship uses as an additional goal, and nowadays Tor does sometimes try to conceal who is connected to the network, when they ask it to. (Sometimes this succeeds against a particular network operator, and sometimes not.) But the original design goal was privacy in a particular sense, and not censorship circumvention. My colleagues and I made an interactive diagram a few years ago to try to explain the same concern that this article presents. https://www.eff.org/pages/tor-and-https One part of it is that if you use Tor without additional crypto protection to your destination (like HTTPS), a different set of people can eavesdrop on you than if you didn't use Tor at all. That's definitely still true and is always a basic part of Tor's design. You might think those people are better or worse as eavesdroppers than the nearby potential eavesdroppers. The faraway eavesdroppers might be more organized and malicious about it, but they also might start out not knowing who you are. Whereas the nearby eavesdroppers might physically see you, or have issued you an ID card, or have your credit card. As we thought when we made that diagram, probably the best solution for this is more and better HTTPS. At some point (which may already be in the past), it might even be a good idea for Tor Browser to refuse to connect to non-HTTPS sites by default, although that might be a difficult policy to explain to users who don't understand exactly what HTTPS is and how it protects them, and just see that Tor Browser stops being able to use some sites that Internet Explorer can work with. -- Seth Schoen sch...@eff.org Senior Staff Technologist https://www.eff.org/ Electronic Frontier Foundation https://www.eff.org/join 815 Eddy Street, San Francisco, CA 94109 +1 415 436 9333 x107 -- tor-talk mailing list - tor-talk@lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Is this still valid?
http://www.deseret-tech.com/journal/psa-tor-exposes-all-traffic-by-design-do-not-use-it-for-normal-web-browsing/ -- tor-talk mailing list - tor-talk@lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Is this still valid?
Your traffic is visible to the exit node. The exit node has to transmit your traffic in plaintext if your destination doesn't support TLS. Same goes for your ISP, country, company firewall and so on. This vulnerability can't be fixed without proper end-to-end encryption. You are much safer with just the NSA spying on you than all the people you invite to spy when you utilize Tor indiscriminately. This is questionable as the NSA is known give lethal drone strike targets while your average cyber criminal only steals your facebook accounts for spam U.R.Being.Watched wrote: http://www.deseret-tech.com/journal/psa-tor-exposes-all-traffic-by-design-do-not-use-it-for-normal-web-browsing/ -- tor-talk mailing list - tor-talk@lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Is Tor still valid?
On 08/05/2013 06:53 PM, Crypto wrote: On 8/5/2013 1:29 PM, Andrew F wrote: Is Tor still Valid now that we know the nsa is actively exploiting holes in technology anonymity tools? We know that Tor and hidden services has issues, not to mention the whole fingerprinting problems. Is Tor too vulnerable to trust?Watch the video below. XKeyscorehttp://www.youtube.com/watch?v=TSEbshxgUas I'm curious as to why everyone is so intent on blaming Tor itself? Tor was not exploited. It was a hole in FF 17 in conjunction with the application running behind the hidden service. It's like saying My car got a flat tire! Should I ever drive again? I agree that the exploit was a bad one and in turn it's a big security issue. But if we're going to point fingers let's not point at Tor. Let's focus on the underlying issue(s) that caused this to happen. FF 17 was the target, not Tor. Mozilla has addressed the issue. How did the exploit occur? Let's look at the application(s) that were running behind the hidden service. That was not my focus. My concern is for known Tor venerabilities that are documented and know by all. If we know that Government agencies are actively and successfully attacking soft technology targets. then how can we assume the know Tor Venerabilities are not being used at this very moment. The Tor Venerabilities are going to be dealt with one day.. but what about right now. We know about them, therefore everyone knows about them. -- tor-talk mailing list - tor-talk@lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Is Tor still valid?
This is one of the reasons I only use tails. As tails is a live cd every time you boot up you get a fresh system. So any viruses are wiped away. Of course they have already done there work in the last session. But with windows.. every time you fire up Tor, they could be watching with this exploit. At least with tails you gotta make them work for it and install fresh every time. On Tue, Aug 6, 2013 at 5:00 AM, Andrew F andrewfriedman...@gmail.comwrote: On 08/05/2013 06:53 PM, Crypto wrote: On 8/5/2013 1:29 PM, Andrew F wrote: Is Tor still Valid now that we know the nsa is actively exploiting holes in technology anonymity tools? We know that Tor and hidden services has issues, not to mention the whole fingerprinting problems. Is Tor too vulnerable to trust?Watch the video below. XKeyscorehttp://www.youtube.com/watch?v=TSEbshxgUas I'm curious as to why everyone is so intent on blaming Tor itself? Tor was not exploited. It was a hole in FF 17 in conjunction with the application running behind the hidden service. It's like saying My car got a flat tire! Should I ever drive again? I agree that the exploit was a bad one and in turn it's a big security issue. But if we're going to point fingers let's not point at Tor. Let's focus on the underlying issue(s) that caused this to happen. FF 17 was the target, not Tor. Mozilla has addressed the issue. How did the exploit occur? Let's look at the application(s) that were running behind the hidden service. That was not my focus. My concern is for known Tor venerabilities that are documented and know by all. If we know that Government agencies are actively and successfully attacking soft technology targets. then how can we assume the know Tor Venerabilities are not being used at this very moment. The Tor Venerabilities are going to be dealt with one day.. but what about right now. We know about them, therefore everyone knows about them. -- tor-talk mailing list - tor-talk@lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Is Tor still valid?
On 08/06/2013 05:20 AM, Andrew F wrote: This is one of the reasons I only use tails. As tails is a live cd every time you boot up you get a fresh system. So any viruses are wiped away. Of course they have already done there work in the last session. But with windows.. every time you fire up Tor, they could be watching with this exploit. At least with tails you gotta make them work for it and install fresh every time. If this exploit had included a Linux component, Tails would not have protected you. To be safe, apps and tor client must be in different machines, or at least in different VMs. Whonix and Qubes do that. Or you can do it yourself. SNIP -- tor-talk mailing list - tor-talk@lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Is Tor still valid?
On Mon, Aug 5, 2013 at 11:41 PM, intrigeri intrig...@boum.org wrote: mirimir wrote (06 Aug 2013 05:46:37 GMT) : If this exploit had included a Linux component, Tails would not have protected you. I've not studied the attack code but this appears to be mostly correct. I believe it would have had to also include a local privilege escalation exploit and tails specific code to do the bypass. This is basically the threat model that whonix's isolation is intended to address, it would be good to see tails improve wrt this. -- tor-talk mailing list - tor-talk@lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Is Tor still valid?
Hi, mirimir wrote (06 Aug 2013 05:46:37 GMT) : If this exploit had included a Linux component, Tails would not have protected you. I've not studied the attack code but this appears to be mostly correct. Our shortest-term plan to address this is to contain [1] the web browser; this is part of the 2.0 milestone on our roadmap [2]. On the longer term, we are interested in evaluating how VM-based approaches can be put to good use within our design goals. If you're interested, help [3] is much welcome! [1] https://labs.riseup.net/code/issues/5525 [2] https://labs.riseup.net/code/projects/tails/roadmap [3] https://tails.boum.org/contribute/ Cheers, -- intrigeri | GnuPG key @ https://gaffer.ptitcanardnoir.org/intrigeri/intrigeri.asc | OTR fingerprint @ https://gaffer.ptitcanardnoir.org/intrigeri/otr.asc -- tor-talk mailing list - tor-talk@lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Is Tor still valid?
Hi, Gregory Maxwell wrote (06 Aug 2013 06:47:03 GMT) : This is basically the threat model that whonix's isolation is intended to address, it would be good to see tails improve wrt this. Sure. The Live environment and our wish to support not-so-powerful hardware may get in the way, but I'm curious to see someone check what is our actual workable margin. (Annoyingly, we depend to some degree on whether Intel go on using the VT-x feature, or lack thereof, to segment their stuff.) Did I mention we need help? :) Cheers, -- intrigeri | GnuPG key @ https://gaffer.ptitcanardnoir.org/intrigeri/intrigeri.asc | OTR fingerprint @ https://gaffer.ptitcanardnoir.org/intrigeri/otr.asc -- tor-talk mailing list - tor-talk@lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
[tor-talk] Is Tor still valid?
Is Tor still Valid now that we know the nsa is actively exploiting holes in technology anonymity tools? We know that Tor and hidden services has issues, not to mention the whole fingerprinting problems. Is Tor too vulnerable to trust?Watch the video below. XKeyscore http://www.youtube.com/watch?v=TSEbshxgUas -- tor-talk mailing list - tor-talk@lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Is Tor still valid?
On 8/5/2013 1:29 PM, Andrew F wrote: Is Tor still Valid now that we know the nsa is actively exploiting holes in technology anonymity tools? We know that Tor and hidden services has issues, not to mention the whole fingerprinting problems. Is Tor too vulnerable to trust?Watch the video below. XKeyscore http://www.youtube.com/watch?v=TSEbshxgUas I'm curious as to why everyone is so intent on blaming Tor itself? Tor was not exploited. It was a hole in FF 17 in conjunction with the application running behind the hidden service. It's like saying My car got a flat tire! Should I ever drive again? I agree that the exploit was a bad one and in turn it's a big security issue. But if we're going to point fingers let's not point at Tor. Let's focus on the underlying issue(s) that caused this to happen. FF 17 was the target, not Tor. Mozilla has addressed the issue. How did the exploit occur? Let's look at the application(s) that were running behind the hidden service. -- Crypto Keywords: terrorism, bombs, jogging, suntan lotion, nails, pellets, knives, shoes, underwear, milk, socks, hair, toenails, masturbation, gasoline, cooking oil, mayonnaise, bananas, Obama, Clinton, EFF, NSA, FBI, PGP, USA, pressure cooker, marathon, fertilizer Keywords are not necessarily in order of importance -- tor-talk mailing list - tor-talk@lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Is Tor still valid?
this may be a bit of a tangent to your firefox/TBB exploit question, but it is an answer regarding the validity of TOR: TOR is not designed to withstand global passive attackers. it tries to select relays from different AS to create circuits that leave the area of influence/surveillance of local passive attackers like ISPs or (smaller) countries. if you look at the distribution of guard and exit nodes around the globe ( https://compass.torproject.org/ ), you will notice that quite a lot of them are positioned inside western countries, like the US, Sweden, Germany or the UK. this means that there is a good chance for systems that sit at the crossroads (TEMPORA comes to mind) to see all connections that make up a tor circuit, elevating the scope of said surveillance system from a local passive attack to a global one. whether GCHQ and friends have figured out how to stitch TOR connections together is another question, but they should have access to enough data to deanonymize a large percentage of all tor traffic. in regards to evading western surveillance, TOR seems pretty much fucked unless there was an influx of relays in places that do not cooperate with the western snooping systems AND that do have secure direct sea-cables between them. if places like that even exist anymore. cheers :S -k On 05.08.2013 20:53, Crypto wrote: On 8/5/2013 1:29 PM, Andrew F wrote: Is Tor still Valid now that we know the nsa is actively exploiting holes in technology anonymity tools? We know that Tor and hidden services has issues, not to mention the whole fingerprinting problems. Is Tor too vulnerable to trust?Watch the video below. XKeyscore http://www.youtube.com/watch?v=TSEbshxgUas I'm curious as to why everyone is so intent on blaming Tor itself? Tor was not exploited. It was a hole in FF 17 in conjunction with the application running behind the hidden service. It's like saying My car got a flat tire! Should I ever drive again? I agree that the exploit was a bad one and in turn it's a big security issue. But if we're going to point fingers let's not point at Tor. Let's focus on the underlying issue(s) that caused this to happen. FF 17 was the target, not Tor. Mozilla has addressed the issue. How did the exploit occur? Let's look at the application(s) that were running behind the hidden service. -- tor-talk mailing list - tor-talk@lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Is Tor still valid?
* krugar tor-ad...@krugar.de wrote: cheers :S I fully concur :-/ -- tor-talk mailing list - tor-talk@lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Is Tor still valid?
On 08/05/2013 06:53 PM, Crypto wrote: On 8/5/2013 1:29 PM, Andrew F wrote: Is Tor still Valid now that we know the nsa is actively exploiting holes in technology anonymity tools? We know that Tor and hidden services has issues, not to mention the whole fingerprinting problems. Is Tor too vulnerable to trust?Watch the video below. XKeyscore http://www.youtube.com/watch?v=TSEbshxgUas I'm curious as to why everyone is so intent on blaming Tor itself? Tor was not exploited. It was a hole in FF 17 in conjunction with the application running behind the hidden service. It's like saying My car got a flat tire! Should I ever drive again? I agree that the exploit was a bad one and in turn it's a big security issue. But if we're going to point fingers let's not point at Tor. Let's focus on the underlying issue(s) that caused this to happen. FF 17 was the target, not Tor. Mozilla has addressed the issue. How did the exploit occur? Let's look at the application(s) that were running behind the hidden service. That was not my focus. My concern is for known Tor venerabilities that are documented and know by all. If we know that Government agencies are actively and successfully attacking soft technology targets. then how can we assume the know Tor Venerabilities are not being exploited at this very moment. The Tor Venerabilities are going to be dealt with one day.. but what about right now. We know about them, therefore everyone knows about them. -- tor-talk mailing list - tor-talk@lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Is Tor still valid?
Crypto: On 8/5/2013 1:29 PM, Andrew F wrote: Is Tor still Valid now that we know the nsa is actively exploiting holes in technology anonymity tools? We know that Tor and hidden services has issues, not to mention the whole fingerprinting problems. Is Tor too vulnerable to trust?Watch the video below. XKeyscore http://www.youtube.com/watch?v=TSEbshxgUas I'm curious as to why everyone is so intent on blaming Tor itself? Tor was not exploited. It was a hole in FF 17 in conjunction with the application running behind the hidden service. It's like saying My car got a flat tire! Should I ever drive again? I agree that the exploit was a bad one and in turn it's a big security issue. But if we're going to point fingers let's not point at Tor. Let's focus on the underlying issue(s) that caused this to happen. FF 17 was the target, not Tor. Mozilla has addressed the issue. Because The Tor Project (TPO) ships the Tor Browser Bundle, which includes Firefox. TPO is being blamed for leaving javascript enabled by default. And for not shipping a hardened text-only browser. And for not shipping the most secure operating system (yet to be implemented). On the other hand, if TPO focused on security in past at cost of usability, the people complaining know maybe wouldn't even know that Tor existed. See this attack as an reminder and reality check. Tor is not as safe as many people kept preaching. We need safer anonymity networks, safer operating systems, more educated users and probably a lot more stuff. To make it happen, it needs your contribution and/or your money. -- tor-talk mailing list - tor-talk@lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Is Tor still valid?
Adrelanos, Would the exploit have worked with Whonix? On 08/05/2013 10:30 PM, adrelanos wrote: Crypto: On 8/5/2013 1:29 PM, Andrew F wrote: Is Tor still Valid now that we know the nsa is actively exploiting holes in technology anonymity tools? We know that Tor and hidden services has issues, not to mention the whole fingerprinting problems. Is Tor too vulnerable to trust?Watch the video below. XKeyscore http://www.youtube.com/watch?v=TSEbshxgUas I'm curious as to why everyone is so intent on blaming Tor itself? Tor was not exploited. It was a hole in FF 17 in conjunction with the application running behind the hidden service. It's like saying My car got a flat tire! Should I ever drive again? I agree that the exploit was a bad one and in turn it's a big security issue. But if we're going to point fingers let's not point at Tor. Let's focus on the underlying issue(s) that caused this to happen. FF 17 was the target, not Tor. Mozilla has addressed the issue. Because The Tor Project (TPO) ships the Tor Browser Bundle, which includes Firefox. TPO is being blamed for leaving javascript enabled by default. And for not shipping a hardened text-only browser. And for not shipping the most secure operating system (yet to be implemented). On the other hand, if TPO focused on security in past at cost of usability, the people complaining know maybe wouldn't even know that Tor existed. See this attack as an reminder and reality check. Tor is not as safe as many people kept preaching. We need safer anonymity networks, safer operating systems, more educated users and probably a lot more stuff. To make it happen, it needs your contribution and/or your money. -- tor-talk mailing list - tor-talk@lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Is Tor still valid?
andrfew: Adrelanos, Would the exploit have worked with Whonix? For a discussion of this, please have a look at our forum: https://whonix.org/wiki/Special:AWCforum/st/id50/Latest_javascript_exploit_againshtml -- tor-talk mailing list - tor-talk@lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
