Your points make sense when configured in a vacuum, but when compared to the alternatives, they're less of a worry.
> I'd be hesitant in expressing your faith in such open-source projects. Do you
> recall that in 2003, JAP was backdoored by the German BKA?
> (http://www.securityfocus.com/news/6779)
True, a german court ruled that JAP collect data in relation to a child pornography operation. However i) the backdoor was relatively trivial to 99.9% of JAP users as it regarded a single website (not terribly comforting) and ii) as an open-source project, the backdoor was noticed almost immediately (much more comforting). Compared to any kind of closed-source or commercial privacy service, the process was relatively transparent.
> As for TOR, most forums I've visited seem to make a habit of blocking the TOR
> servers. In fact, this site seems to be doing the same thing.
A lot of IRC channels block access from TOR nodes - I've never had problems with forums using TOR. I'm using TOR to browse the shroomery right now. I'd be surprised if this forum blocks access from TOR nodes - Ythan has gone so far as to write a proxy finding script to help users remain pseudonymous around here.
> You should never send personal data. Do never ever enter any personal data
> into any website while using such a service. Their goal is to hide your
> identity, so I'm sure it's obvious why it would be a bad idea to enter such
> information while using such a service. You can do that during normalbrowsing.
Broadly sound advice in so far as it's a good general rule not to send personal data to servers you wish to remain anonymous from - but if you're using the TOR network, there's no reason not to send personal data to websites after you've completed an anonymous activity, as TOR changes nodes. You're personal data is also in some ways more secure through TOR - while your end TOR node and the end server will be able to see your data, people on your local network and intermediate nodes won't be able to access the cleartext.
> Never ever enter any usernames or password trough non-SSL connections. The
> TOR/JAR-exit-node could sniff on his network-interface and grab the
> username/password pair.
True, sending passwords in cleartext is generally a bad idea. True, if you send a cleartext password through TOR, the end node can see the cleartext.
However, people on your local network and intermediate nodes won't. If you send a password in cleartext over a normal http connection, everyone on subnet can see your cleartext, your ISP can see your cleartext, and every intermediate server between you and your end server can see your cleartext.
It depends who you want to keep your data private from. I find it far more convincing a scenario that a government agency will require an ISP spy on your connection and log all packets than a government agency performing a corelation attack on the entire TOR network.
It's a calculated risk, either way.
> Also, do not fully trust open-source projects such as TOR and JAP. Their
> network is run by volunteers and that there’s absolutely no guarantee that one
> or more nodes could be compromised.
Theoretically true, although once again I find it hugely more convincing that your ISP or a commercial privacy service would be mandated by government to spy on your traffic without telling you than a lone TOR developer somehow sneaking some rogue code into a build and no-one noticing. With open source, you can open up the source code yourself and examine what's going on before you compile, or at least rely on a peer that has programming knowledge to do it and share any surprising results.
It's also true that end nodes can see cleartext. However, there's no way to show who's cleartext it is. The end node does not know the source node. If a government agency did backdoor a TOR node, or even several in their state, they still wouldn't know who any of the traffic was from, and they couldn't gaurentee that any one person would use one of their backdoored node. If you want to break the TOR network right down, you need to perform a corelation attack - and for that, you need to see a large part of the network. If a hostile agency wants your data badly enough to perform a corelation attack on teh entire TOR network, then they want your data badly enough to break into your house and seize your computer, or plant hidden cameras, or torture you, or do any of the other things hostile agencies do. I think, at present, the TOR network is fit for purpose.
> You seem to be very intelligent regarding this subject, Odium, you just seem
> to have a little too much unwarranted trust regarding such services.
Thank you, but I'll trust any code that I can view, edit and compile myself a hell of a lot more than an unknown binary. If we accept that sending data over the net is necessery, TOR and JAP present in my opinion the safest and most private method of doing so. Don't forget that anything you don't send through a secure service is in essence viewable by your ISP and therefor the government. I trust volunteer efforts by universities and open source code more than I trust my ISP and government.
|
Threaded
Previous
Index
Next
jccc 
OJK 
Edit 
Reply 
1 2 all )
Meph
SillyWilly
niteowl
socratesmind
ichbinkiffer
trippysmurf
Lana