Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

>Now, I also encourage people to not use Tor. I feel it is backed-doored and mostly controlled by Nation State actors to identify 'interesting' subjects via meta-data analysis alone.

No, you should encourage them to use it as much as possible to increase the anonymity set. Tor is not 'backdoored' (it is Free Software) and it is incredibly unlikely for most relays even to be malicious. Rather, Tor has a defined threat model and in the interest of offering high performance with low latency at a low cost, eschews the so-called 'Anonymity Trilemma' and it is thus possible to trace connections through the network if you can monitor the entry stream as well as the exit stream. There are a large number of entities who control various parts of the physical infrastructure between each link of your Tor circuit, from your router, to your ISP, to the local internet exchange point, and every other hop along the way to a destination. If an adversary controls even one of these entities in between you and your chosen guard relay, and between your chosen exit relay and the destination (including even the destination logs), it may be possible to perform correlation attacks to confirm whether or not a particular user connected to a given host (something which is easier to do if the stream is more 'distinct' from other streams, as well).

Tor is a tool which serves to significantly increase the cost of undermining user privacy, and while it is true that it should not be treated as some end-all-be-all of internet privacy, I fail to understand why it should be discarded, rather than treated as just one of a number of tools in the toolkit. For example, if you are attempting to make it more difficult for these global adversaries to trace you, you may consider physical indirection (driving around), adding a layer of wireless relays before the connection to the Internet backbone, exclusion of relays in countries which your own nation can more easily influence in your torrc file, inducing dummy traffic in some capacity, preferring anonymity over pseudonymity, and a myriad of other techniques.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: