I've heard a lot of people on the left argue that Tor is likely backdoored because it was created by the U.S. Navy for spies to communicate and is still funded by the government. Yasha Levine has written a lot about this:

He also appeared in TrueAnon episode 50 to talk about this.

On the other hand, a lot of people in the crypto and tech community disagree with this. They believe that Tor is not backdoored for one or both of the following reasons:

  • Tor is open-source and has been audited.
  • The U.S. Government would never do such a thing.

They also point to a leaked NSA presentation from 2007 that admits the NSA can't deanonymize Tor users.

What are your thoughts?

    • JoeByeThen [he/him, they/them]
      ·
      4 years ago

      To my knowledge they have their techniques to deanonymize people, in a targeted manner, but at its core I don’t believe the protocol is backdoored.

      Yeah, if I remember correctly, when the feds took down the Silk Road dude they basically had to hack a server inside the TOR network to serve exploit code that forced the browser to bypass the TOR network. There was a couple of months where everyone was freaking out because there was a sudden influx of people complaining that they were unexpectedly making unsecured requests to some server in langley or something like that.

      I'm not even sure if it was a hacked server.... I seem to remember them busting a hosting provider popular for TOR servers on the claim of child pornography and then suddenly all the servers owned by that provider began serving up dodgy code.

          • culdrought [he/him]
            ·
            4 years ago

            Another reminder to never reuse usernames and passwords on the internet.

        • Sushi_Desires
          ·
          4 years ago

          they have actually dropped ** cases in order to hide their methodology.

          Wow.

          Also, damn.

          Edit: thinking about this further, they're probably like "damn Epstein 2.0, do better opsec. Also, come work for us lol."

        • Sushi_Desires
          ·
          4 years ago

          javascript exploits

          To expand upon this, interested parties should look up "canvas fingerprinting." JS HTML5 contains within it certain functions that a server can use to query information about your system, setup, and display (such as resolution of the window loading the resources, custom fonts being displayed by the system, etc.), and if your setup is weird/unique enough, it can form a "fingerprint" of your oddities which can be used to track you across the web. This is why TOR's instructions tell you not to resize the window. If everyone runs the TOR browser at the default resolution, that is one less oddity that can be used to track individuals.

        • JoeByeThen [he/him, they/them]
          ·
          4 years ago

          It’s not so much that they have to get into “a server inside the tor network” but they can go after users of tor hidden services if they somehow track down the server hosting that particular hidden service, but the whole system is built around making that very difficult.

          Yes! Hidden services was what I was talking about. It's been a while. :grinning face with sweat:

          Those links you posted were what I was talking about. I know they claimed to have gotten the Silk Road dude over him using the same username, but I remember at the time (along with the timeline of the hack) that it all stank of parallel construction so they wouldn't have to admit to the hack.

            • JoeByeThen [he/him, they/them]
              ·
              4 years ago

              The case of freedom hosting, however, is more interesting, as I discussed above.

              I mean, the thing about TOR is it relies on its distributed nature to help obfuscate traffic. When you've got access to the literal backbone of the internet, as we know is largely kind of the case. See: Room 641A Hunting down the location of a Hidden Service ceases to be an impossible task. Not easy, but no more impossible than spinning up enough of your own exit relays to map synchronous traffic.

              jfc, this conversation is becoming a total trip down memory lane. I'm remembering years of arguments during the 90's with people over whether or not ECHELON was real. brb gotta go build a Faraday cage in the woods.:grinning face with sweat:

              • Sphere [he/him, they/them]
                ·
                4 years ago

                Exit nodes and hidden services are entirely separate topics. A connection to a Tor hidden service requires both server and client to each form a three-node Tor connection to what's called a Guard node, which acts as an intermediary in the connection between them. At no point are any exit nodes involved in this process. Exit nodes are only involved in connecting to the regular internet through Tor.

                • JoeByeThen [he/him, they/them]
                  ·
                  4 years ago

                  Yeah, I wasn't trying to say they were the same, merely remarking on the scale of what they have access to. Hiding a needle in a haystack is a great technique, but it's important to remember our opponents do still pretty much have access to all the hay.

                  • Sphere [he/him, they/them]
                    ·
                    4 years ago

                    Fair enough, but I think the main way the authorities find hidden services is by hacking the server (over a Tor connection) and then having it ping them in Langley on the clearnet, something that's pretty trivial for any state-level actor. And I thought it was worth clarifying the point about hidden services because this is a point of confusion for most people regarding how Tor actually works.

                    • JoeByeThen [he/him, they/them]
                      ·
                      4 years ago

                      Oh yeah, you're probably right. If I remember correctly from the Snowden dumps, the Alphabets keep a whole bunch of sweet 0 Days.