Re: [tor-talk] If you have access to certain tools, you can completely ignore Tor.
- Original Message - From: Joe Btfsplk Sent: 12/26/11 12:57 AM To: tor-talk@lists.torproject.org Subject: Re: [tor-talk] If you have access to certain tools, you can completely ignore Tor. On 12/24/2011 4:09 AM, grarpamp wrote: to put one in someday, we'll make it obvious and loud that it is so. No Backdoors. No bugdoors. No so-called lawful interception systems. Court orders and duress can be applied to anyone who is reachable by them. The only real solution should that happen is to take things underground on Tor, or any other strong net, and remain open source therein. It is unfortunate in this regard that the current systems employ known authors. But new unknowns will step in place of the old if need be. Good point. I think you're right. They may have to go WAY underground. Everyone knows several countries have already outlawed Tor other internet uses / sites. Julian Assange was way to visible to carry out his mission, whether one agrees w/ his agenda or not. If gov'ts can't stop persons / organizations they deem embarrassing or threats because of free speech rights, they'll invent other charges against them. Again, I just can't see many gov'ts leaving Tor alone, when (unfortunately) it * presumably *allows combatant enemies to easily communicate anonymously. Democratic nations may not ban it, but they have to protect their national security they won't sit idly by while terrorist groups thumb their noses at security agencies. It's unfortunate that the use of Tor for true, non-violent free speech access to info it's use for more sinister purposes get mixed together. It was once unthinkable that US other free countries would listen in on potentially all citizens' conversations or read private mail (electronic or paper) w/o court warrants, but it's here so far, people pretty much accept it. ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk Could you possibly supply a list of truly democratic countries? I don't think anymore exist - in reality. ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] If you have access to certain tools, you can completely ignore Tor.
On 12/24/2011 4:09 AM, grarpamp wrote: to put one in someday, we'll make it obvious and loud that it is so. No Backdoors. No bugdoors. No so-called lawful interception systems. Court orders and duress can be applied to anyone who is reachable by them. The only real solution should that happen is to take things underground on Tor, or any other strong net, and remain open source therein. It is unfortunate in this regard that the current systems employ known authors. But new unknowns will step in place of the old if need be. Good point. I think you're right. They may have to go WAY underground. Everyone knows several countries have already outlawed Tor other internet uses / sites. Julian Assange was way to visible to carry out his mission, whether one agrees w/ his agenda or not. If gov'ts can't stop persons / organizations they deem embarrassing or threats because of free speech rights, they'll invent other charges against them. Again, I just can't see many gov'ts leaving Tor alone, when (unfortunately) it * presumably *allows combatant enemies to easily communicate anonymously. Democratic nations may not ban it, but they have to protect their national security they won't sit idly by while terrorist groups thumb their noses at security agencies. It's unfortunate that the use of Tor for true, non-violent free speech access to info it's use for more sinister purposes get mixed together. It was once unthinkable that US other free countries would listen in on potentially all citizens' conversations or read private mail (electronic or paper) w/o court warrants, but it's here so far, people pretty much accept it. ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] If you have access to certain tools, you can completely ignore Tor.
to put one in someday, we'll make it obvious and loud that it is so. No Backdoors. No bugdoors. No so-called lawful interception systems. Court orders and duress can be applied to anyone who is reachable by them. The only real solution should that happen is to take things underground on Tor, or any other strong net, and remain open source therein. It is unfortunate in this regard that the current systems employ known authors. But new unknowns will step in place of the old if need be. ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] If you have access to certain tools, you can completely ignore Tor.
On Sun, 18 Dec 2011 23:33:13 + Matthew R magick...@gmail.com wrote: SR: If you have access to certain tools, you can completely ignore Tor. You can trap your subject’s IP address without wasting your time busting through Tor. Without revealing too many tricks, for example, it’s easy enough to send someone an e-mail that broadcasts location info back to a server. Someone operating a trap website can grab Evan’s cookies and see his entire browser history and his current IP address. With only a minimal amount of work, you can determine where Evan is viewing a website from. This also requires the user not being very sophisticated. If you load up html emails full of web-bugs, javascript, and your normal browser pointed at Tor, then I believe most of what 'SR' says is correct. I don't believe this is true for Tor Browser users, but I welcome research and proof otherwise. Also, we'll fix any leaks found. If the 'wiretappers ball' has shown anything, there are plenty of well-marketed solutions for surveilling and stalking unsuspecting users. Ask them how well they work against even moderately sophisticated users, like junior agents of foreign agencies, you'll get a different answer and lots of weasel words. I've seen these tools used by abusers against their victims as well. If you can infect the operating system, such as carrier IQ, keyloggers, software to 'know where your kid/spouse/dog are at all times', and the like, you've won. Tor alone cannot protect you if your operating system is compromised. Tails can help in these situations. If your hardware is compromised, tails can still help, with caveats. If you're trying to be anonymous with Tor while someone with an automatic weapon is standing behind you, you've lost in many ways. It's all about understanding and managing risks. -- Andrew http://tpo.is/contact pgp 0x74ED336B ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] If you have access to certain tools, you can completely ignore Tor.
On Sun, 18 Dec 2011 21:02:37 -0600 Joe Btfsplk joebtfs...@gmx.com wrote: Even if partly true, this is one reason I don't understand why TBB has default settings to allow all cookies, seeing as how its main goal is anonymity. Devs are very concerned about not writing anything to cache, but not concerned about cookies. There's a constant set of tradeoffs between usability and privacy. I think we should be erring more on the side of caution. The current design of Torbrowser is here, https://www.torproject.org/projects/torbrowser/design/ 3rd party cookies are not enabled by default. There's also some work on minimal noscript changes that won't break the web for 99% of the users, https://trac.torproject.org/projects/tor/ticket/3461 Under current US other nations' laws, it's possible that gov'ts have already forced developers of any software - incl. Tor - to put in backdoors. And in fact, say it's illegal for the devs of any software to outright disclose such. https://www.torproject.org/docs/faq.html.en#Backdoor. If we're forced to put one in someday, we'll make it obvious and loud that it is so. The world will be in a sad state if this comes true. A forced backdoor in Tor will be the least of your problems. I don't know that it has happened w/ Tor, but it certainly has in other cases. If you want true anonymity, don't use the internet, I parse this as the 'abstinence model of Internets'. It doesn't work for sex education, addictive substances, and it's unlikely to work for anyone in a modern society. We need a better answer than 'all or nothing'. We're trying to make Tor one of these better answers. -- Andrew http://tpo.is/contact pgp 0x74ED336B ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] If you have access to certain tools, you can completely ignore Tor.
From: http://www.wired.com/vanish/2009/09/interview-with-pi-steve-rambam-evan-can-be-found/ Wired: How much can one do with IP addresses that have been run through Tor? SR: If you have access to certain tools, you can completely ignore Tor. You can trap your subject's IP address without wasting your time busting through Tor. Without revealing too many tricks, for example, it's easy enough to send someone an e-mail that broadcasts location info back to a server. Someone operating a trap website can grab Evan's cookies and see his entire browser history and his current IP address. With only a minimal amount of work, you can determine where Evan is viewing a website from. Does this make any sense? I assume that what the PI means is that if you send an e-mail to a non-webmail client (like Thunderbird) which does not go via Tor, then the IP can be determined when it loads the 1x1 HTML pixel from the website. However, if the victim uses webmail then surely all responses would go via Tor? Or does he mean something else? This is exactly why users should be running through an account where non-Tor traffic is blocked. Such attacks can't be performed as the application either goes through Tor or does not get out to the Internet at all. The problem right now is that the TBB makes it difficult to set it up this way. Tor and the TBB (firefox, plug-ins, etc) need to be separate pieces in order to have then run under different user accounts with different levels of permissions. There also needs to be better commercial ties for Tails or any other similar distribution so that users can easily resolve compatibility issues. It is quite easy to configure Thunderbird to run through tor using Vidalia, without leaking DNS requests either...then the received from IP address will be the exit node. (instructions here https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/EMail#SendingmailusingSMTPthenormalwayoverSSH) It's a bit slower of course, but with SSL security, there's no reason why it wouldn't be just as secure (at least up to your web mail server)... once it's on the open Internet, it's free for all ;) ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] If you have access to certain tools, you can completely ignore Tor.
On 12/18/2011 5:33 PM, Matthew R wrote: From: http://www.wired.com/vanish/2009/09/interview-with-pi-steve-rambam-evan-can-be-found/ Wired: How much can one do with IP addresses that have been run through Tor? SR: If you have access to certain tools, you can completely ignore Tor. You can trap your subject’s IP address without wasting your time busting through Tor. Without revealing too many tricks, for example, it’s easy enough to send someone an e-mail that broadcasts location info back to a server. Someone operating a trap website can grab Evan’s cookies and see his entire browser history and his current IP address. With only a minimal amount of work, you can determine where Evan is viewing a website from. Does this make any sense? I assume that what the PI means is that if you send an e-mail to a non-webmail client (like Thunderbird) which does not go via Tor, then the IP can be determined when it loads the 1x1 HTML pixel from the website. However, if the victim uses webmail then surely all responses would go via Tor? Or does he mean something else? I didn't read the entire article yet, but have read of some similar claims like Someone operating a trap website can grab Evan’s cookies and see his entire browser history Even if partly true, this is one reason I don't understand why TBB has default settings to allow all cookies, seeing as how its main goal is anonymity. Devs are very concerned about not writing anything to cache, but not concerned about cookies. Tor wasn't developed for constant, everyday use by millions w/ the idea that anonymity could be provided for the masses. It probably never will achieve that. Authorities hackers will always be looking for holes. People much smarter than me say if you're that concerned about true anonymity, you'd better encrypt everything. Cookies browsing history are another matter. Under current US other nations' laws, it's possible that gov'ts have already forced developers of any software - incl. Tor - to put in backdoors. And in fact, say it's illegal for the devs of any software to outright disclose such. In general, most gov'ts aren't going to allow devising ways that criminals can easily completely avoid detection. (No, Tor isn't only used by criminals - but gov'ts don't care). And if they determine such software / networks could provide 99.9% anonymity, w/ no way for them to crack it or no backdoors, they'd probably outlaw it. I don't know that it has happened w/ Tor, but it certainly has in other cases. If you want true anonymity, don't use the internet, unless you're very well educated in all things related to internet anonymity (hard for one person to do), and taking extreme, well founded measures to thwart those seeking to identify you or your location, gather info, etc. Plus, it would be a full time job constantly testing your methods keeping up w/ newest ways others could crack your system. A handful of people might have the ability ( almost none the time) to do this. if you send an e-mail to a non-webmail client (like Thunderbird) which does not go via Tor, then the IP can be determined when it loads the 1x1 HTML pixel from the website Could you clarify the question? As Phillip mentioned, Tbird can be Torrified, but I've never been impressed or convinced that the methods are fool proof by any means. Web beacons (web bugs) can be stopped in a few ways, that is probably more reliable than any overall anonymity on the web. ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] If you have access to certain tools, you can completely ignore Tor.
From: http://www.wired.com/vanish/2009/09/interview-with-pi-steve-rambam-evan-can-be-found/ Wired: How much can one do with IP addresses that have been run through Tor? SR: If you have access to certain tools, you can completely ignore Tor. You can trap your subject's IP address without wasting your time busting through Tor. Without revealing too many tricks, for example, it's easy enough to send someone an e-mail that broadcasts location info back to a server. Someone operating a trap website can grab Evan's cookies and see his entire browser history and his current IP address. With only a minimal amount of work, you can determine where Evan is viewing a website from. Does this make any sense? I assume that what the PI means is that if you send an e-mail to a non-webmail client (like Thunderbird) which does not go via Tor, then the IP can be determined when it loads the 1x1 HTML pixel from the website. However, if the victim uses webmail then surely all responses would go via Tor? Or does he mean something else? This is exactly why users should be running through an account where non-Tor traffic is blocked. Such attacks can't be performed as the application either goes through Tor or does not get out to the Internet at all. The problem right now is that the TBB makes it difficult to set it up this way. Tor and the TBB (firefox, plug-ins, etc) need to be separate pieces in order to have then run under different user accounts with different levels of permissions. There also needs to be better commercial ties for Tails or any other similar distribution so that users can easily resolve compatibility issues. It is quite easy to configure Thunderbird to run through tor using Vidalia, without leaking DNS requests either...then the received from IP address will be the exit node. (instructions here https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/EMail#SendingmailusingSMTPthenormalwayoverSSH) It's a bit slower of course, but with SSL security, there's no reason why it wouldn't be just as secure (at least up to your web mail server)... once it's on the open Internet, it's free for all ;) An incorrectly configured application should not leak anything. That is why a distribution like Tails is needed where the applications are already configured and it is harder to make these potentially dangerous changes. There are way too many technical people who don't know what they are doing making these configuration changes. The less technical users are making really stupid choices too. I'm talking about downloading applications from random sources (megadownload) and similar. ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
