Is it worth it to donate, or to just pool a little cash and start your own? Like, how do I know any of those links aren't the NSA?

I ask because I have 5-6 Raspberry Pis, a couple retired Supermicro boxes, and old Cisco gear that isn't doing much...

>Like, how do I know any of those links aren't the NSA?

Well, I've only linked to communities listed by the Tor Project itself.

Otherwise, the same way you would check whether HN or your local tea store is the NSA. You do your own research, run your own risk analysis, and if you want to stay sane, by default you give people the benefit of the doubt.

Generally, it's best not to run Tor relays from home as services will start to blacklist your IP as a proxy.

If you are going to be an exit node, then you should inform yourself about he legal challenges you might face, since you don't know what people will access with your IP address.

https://blog.torproject.org/tips-running-exit-node

https://www.eff.org/torchallenge/faq.html

Being an entry or middle-level node is less of a problem but some uncertainties remain, so this depends on your local laws.

> by default you give people the benefit of the doubt

I actually tend to assume websites like HN are the NSA or at least the NSA have read access to their databases. Maybe it's my tinfoil hat tendencies but instead of giving them the benefit of the doubt I would rather not give them any data I don't mind the NSA having.

Everyone has read access to HN.. there are no private messages that I'm aware of, anyone can search this site using google

HN contains a lot of information that isn't visible on the public web. Ban lists, point counts, user access history, etc.

> Everyone has read access to HN

No, not to their databases as OP is discussing. It would be definitely a crime if any of us had that info as it would imply we broke in and stole it - but OP is suggesting that they assume NSA already has it (a potentially paranoid but also reasonably fair thing to do, IMO).

From a personnel standpoint, isn't Thiel on the board of HN/YC and doesn't Thiel have basically uncountable NSA/CIA/etc connections? I'm not saying Thiel has anything to do with HN's security - but clearly, saying HN's databases might be accessed by someone like CIA (while a board member of YC is active in sales & partnerships to CIA etc) isn't that crazy.

> isn't Thiel on the board of HN/YC

He is not.

I think the HN database is available publicly for download.

It's not.

None of us know how many points your comment has, or if you have an email address on file, or how many times you visited HN today, or what IP you're using, etc. But all of those things are in the HN database(s) I'm sure!

I'm normally the tinfoil-hat guy in any given discussion.

I'll go out on a limb and predict that my HN internet points score is not a signal of interest to NSA selection criteria.

Wait, why not? Knowing who votes for what content, when, and in coordination with whom else seems like it would be extremely useful indeed! Aren't techniques like this already used by FBI etc on Twitter when investigating illegal content and coordination of its' dissemination? Bot networks are taken down on Twitter and other sites all the time using voting data.

Social voting data is a rather sizable and useful dataset for surveillance agencies. HN has a high concentration of current-high-impact and future-high-impact individuals and is therefore a reasonably interesting trove of information.

I realize all this is indeed tinfoil-hat-ish stuff. But I'd be shocked in NSA/CIA/FBI etc was disinterested in online social voting habits of users.

Also, you latched on to a single example I gave. HN may have your email address privately (if you gave it to them) and they also have your IP/access logs. This is all stuff that they save but is not publicly available information.

I'm sure there's more as well. It's not just "internet points" and reducing the discussion down to simply dismissing a single one of my thoughts isn't going to get us anywhere.

> HN may have your email address privately (if you gave it to them) and they also have your IP/access logs. This is all stuff that they save but is not publicly available information.

I'm pretty certain there's nothing the NSA doesn't already have. See the Swowden gifts on MUSCULAR[1] the better-known PRISM[2], and XKEYSCORE[3]. There are other relevant programs, but I don't have my notes on that stuff with me at the moment.

Anyway, I won't argue about how much the NSA values internet scores. Let's just say I can imagine a targeted extortion campaign against a specific individual using such inputs, but I can't see how the Great Hoover would use them as any sort of actionable signal.

[1] http://apps.washingtonpost.com/g/page/world/how-the-nsas-mus...

[2] https://en.wikipedia.org/wiki/PRISM_%28surveillance_program%...

[3] https://en.wikipedia.org/wiki/XKeyscore

GP said "score", so my guess is they weren't even thinking in that direction, just their posts that others voted on.

> just their posts that others voted on

But you can't calculate the 'score' without knowing who those people are, when they voted, and what else they voted on too. The score is a summary generated from lots of information. It's not just some number that carries no value.

A small sampling of as few as 10 Facebook "likes" gives analysts a better picture of you than your friends. As few as 300, a better image than your life partner, should you have one.

(And if you don't, APTs, will assign one to you....)

https://www.wired.com/2015/01/facebook-personality-test/

Err, all the NSA needs to do to get access to our HN posts is scrape the site. National Security Letters are probably more effort to arrange than a copy of BeautifulSoup. I hope ...

Not really, there's a lot of content that isn't public, like upvoted submissions, but can give a lot of information about a person political opinions and interests.

> Like, how do I know any of those links aren't the NSA?

No communication channel can be guaranteed to be 100% secure in the broad sense, i.e. even One-Time Pads can be stolen, recipients of messages can be watched to see what they’re up to, etc.

Users of Tor should assume that the whole channel (not just the Tor part) can be compromised by a willing and capable adversary, and take additional precautions if they feel it’s necessary, e.g. “tradecraft” https://en.m.wikipedia.org/wiki/Tradecraft

> Generally, it's best not to run Tor relays from home as services will start to blacklist your IP as a proxy.

Conversely, if you're engaging in illegal online behavior from your home IP, intermittently running a TOR exit node could be a useful mechanism for creating plausible deniability.

IANAL, and I wouldn't try explaining that to a prosecutor or a federal judge...

"TOR was developed by the United States Naval Research Laboratory and funded by DARPA to help U.S. intelligence and foreign freedom fighters communicate under oppressive regimes. I run this exit node to support their patriotic work to protect freedom abroad. I have no control of the traffic that emerges, and I don't collect logs in order to protect covert intelligence operations."

what's stopping someone running an exit node through a "no logs" VPN? (serious question)

Nothing.

> Generally, it's best not to run Tor relays from home as services will start to blacklist your IP as a proxy.

I think this also specifically refers to exit nodes, no ? Running an intermediate relay should be fine as you'll only be shuffling encrypted tor traffic to other relays.

That should be fine, but seriously check with your ISP first. They tend to not really understand the difference between middle relay and exit node, and in their heads, tor == bad.

Do you confuse relays with exit nodes? Which services block relays?

Exit nodes are relays. Node and relay are synonyms in context of the Tor circuit (guard/bridge - middle - exit). https://miro.medium.com/max/2560/1*j2aTFBQTd9e1PlFDjeKw1g.jp...

Being a Tor relay you participate in a public proxy network, so you automatically run risk that someone will harvest your IP address for whatever reason, e.g., lists for companies trying to prevent browsing via tor, etc.

Donations are probably better, because while that hardware is helpful, it's the ISP connections that are hard to come by. If you host a Tor exit node on your home network connection, Comcast is likely going to shut down your service for abuse/TOS violations. Having some rack space in a datacenter is far more valuable and better supported by donations.

The network needs both. Too much centralization is a threat to anonymity so it needs users running nodes. At the same time you shouldn't run an exit at home on a consumer connection. Relays are fine though.

Saying you shouldn't run an exit node at home is accepting that Tor has mainly fraudulent uses. More people need to run it from home so it becomes accepted as a normal Internet usecase.

It doesn't have to be even close to "mainly fraudulent uses". If just 0.01% of users use it for illegal stuff that will get your home network connection shut down, and an exit node sees a thousand different users a month, then it would be unwise to host an exit node at home.

Also, an exit node WILL use all of your bandwidth. You're going to quickly hit those 1TB caps.

When I was hosting a exit node I was getting over 50GB/day

That's easily configurable: https://2019.www.torproject.org/docs/faq.html.en#BandwidthSh...

Also the "limiting bandwidth" section here: https://trac.torproject.org/projects/tor/wiki/TorRelayGuide#...

How does this use case differ from (legal) distributed file sharing, like Bittorrent, which people do at home all the time?

In terms of non-exit Tor relays, it doesn't. In fact, for anyone looking at your traffic, Tor relaying is opaque, unlike legal torrents.

As for exits, you'll be dealing with abuse reports from countless parties, including the off-chance that someone sends a death threat through your exit and you have may to fend off law-enforcement that still hasn't gotten the memo on Tor. In countries, like the US where any police encounter might turn deadly, I'd highly advise against running exits at home.

As a Tor exit operator, I can in fact honestly tell you not to run exits on production business networks, or basically anywhere where you're not prepared to be a recipient of a lot of unwanted attention.

Even non-exit nodes can put you in a bad spot (my ISP didn't like it), you'll get blacklisted by quite a few places (because not everyone got the memo that middle nodes != exit nodes)

Yeah. If your ISP is manned by dipshits, they won't like Tor relays, just because.

It's also worth setting up a Tor relay to use a different external ip address. Because VPN/Procy whitelists employed by dumb web firewall products will temporarily blacklist all publically listed Tor relay IPs.

Here's a typical residential setup: ISP-provided broadband modem in bridged mode + some sensible home router with security patches you should be using anyway and the Tor relay server connected to the modem with a non-managed switch (if needed).

Please note that Bridges give help directly to individuals who can't access Tor, due to blockage in their home country. They don't use a lot of bandwidth and aren't listed publicly, so bad actors on the firewall market won't block them.

So, if you only have one IP address available and you want to do the internet at large a huge solid, just run a Bridge.

For anyone interested in running Tor relays, here's an intro to why your new box won't use all available bandwidth for a while https://blog.torproject.org/lifecycle-new-relay

In principle, pretty much any crime you can commit over tor, you can also commit over BitTorrent. For instance, you could advertise your assassination services by writing up a document, making a torrent of it, and then distribute the magnet link for that torrent on floppy diskettes... or whatever.

In practice, though, TOR is more convenient for such things because a resource's name (the onion address) doesn't change when the content does. This difference makes it rather unlikely that you're going to find the lets-make-an-illegal-deal crowd gathering around BitTorrent.

But legally, and from the ISP's perspective, seeding a torrent with incriminating content is no different than running a TOR exit node that happens to be trafficking that content--it's just that since they attract different crowds, one is more likely to attract the wrong kind of attention than the other.

Also, you get to choose what you seed on BitTorrent, but when you run an exit node, you don't. So you're unlikely to even know what kind of incriminating content is going through your internet connection.

Exit nodes are the points at which traffic goes from the encrypted TOR network to the clear net, and since many people like to use TOR to do legally questionable things you will likely very quickly be flooded with law enforcement requests, if not just blocked by your provider.

Well it’s a open project of the naval intelligence unit and it’s primary designed case was a deep cover operative in foreign countries reporting back info to the CIA, etc .

The (non CIA ) people who use it primarily act as traffic in order to improve the security for operatives . Your Mileage May very

The CIA actually has its own v3 onion, http://ciadotgov4sjwlzihbbgxnqg3xiyrg7so2r2o3lt5wz5ypk4sxyjs...

Both if possible. A Pi 3 can saturate its ethernet adapter (~50Mbps) running a Tor relay. It's reasonably straightforward to setup.

You shouldn't run exit nodes from a home connection due to possible abuse. If a person uses it to do something illegal you may end up with law enforcement busting down your door. Relays are safe though.

At least in the US law enforcement can't charge you with anything. More people need to run exit relays, especially from home, so it becomes an accepted use.

> At least in the US law enforcement can't charge you with anything

Citation please? Last I checked people get charged with things they didn't do, or weren't responsible for, in just about every system of justice - that's why we have courts.

Ah, fair point, I meant convicted. However ISPs threatening to cut off your service for running a Tor relay is a good indication you won't even be charged, as the ISP (and the local authorities) should know you have safe harbor.

This leads to the other issue of your service being cut...

If you want to run an exit node do it on a hosting service. You can get a VPS for $5/m. Why risk getting arrested by running it at home?

Because the hosting service and its IP block are all geographically constrained. This makes correlation attacks easier, as well as attacks requiring physical access.

I thought the consensus was that law enforcement can "crack" Tor these days (a la tracing the illegal traffic back to the source, not just the exit node)

Is this not the case, or is it not a black/white answer?

No, that's not true.

Tor's anonymity depends on distributed control of its nodes. If one entity, say a government org, controls a large portion of entry and exit nodes it may be able to trace some requests. That's an attack that has been known since the beginning though, it's not new.

https://2019.www.torproject.org/docs/faq.html.en#AttacksOnOn... It's not 100%, but the more of the connection your attacker can see, the worse your odds. If you're in the USA and you're using nodes in the Five Eyes https://en.wikipedia.org/wiki/Five_Eyes and you're being tracked by the NSA, they might be able to see everything. Maybe. Also check point #4 on this answer https://2019.www.torproject.org/docs/faq.html.en#EverybodyAR...

People will hack the sites that are proxied behind Tor .onion domains. Hacking a site is also a crime, so you won't find too many documents revealing how a crime network was exposed. Instead, they gather data from the hacked servers and hand it over as anonymous tips.

Tor is just a proxy. A fancy proxy that uses onion routing, but a proxy nonetheless. Think of it as a CDN that does not have to hand over customer details because they have plausible deniability about who you are. Unlike commercial CDN's however, Tor does not try to prevent hacking. That exercise is left to the people running the servers that Tor is routing to. As it turns out, some criminals may be lazy or inept.

The number of machines you have doesn't matter nearly as much as unique IP addresses, as far as network security is concerned

What is wrong with this picture.. that the NSA is used as the villain vs. getting around the great firewall in China?

The real question is the kind of liability you take on when running a tor node on a machine that "belongs" to you (for some definition of belong).

Another is to find a place that will agree to power your machine and allow it to hook in to the ethernet if it runs a tor node.

At any rate, running a tor node isn't as simple as running apt-get.

Running an entry or exit node is kinda risky since your IP will be associated with a lot of illegal content. Running an intermediary node is much safer. All kinds of nodes are important for the network.

The amount of configuration you need to run a node isn't terribly difficult. There is plenty of documentation online and really it's just changing a few lines in the config file. The Tor daemon is pretty good about pointing out potentially undesirable configuration options if you watch the log file on startup.

Just exit nodes are dangerous. FYI All relays are entry nodes.

I run two relay nodes. It is exactly as simple as running apt-get and editing the config.

BBC fights censorship in China, you would do the same by running a tor node.

When the secret police show up at your door, be sure to tell them that. I'm sure they will leave you alone.

I wonder what other places the BBC is blocked in. I know there's a DNS block in Viet Nam.

Is it possible to operate a TOR node through a corporate entity? The corporation assumes liability as does insurance.

That's not how liability works. People within the business will be on the line if the business is acting criminally.

You aren’t liable as a tor exit operator. That doesn’t mean you won’t get involved in nonsense or won’t be forced to get a lawyer to prove that but in the end you aren’t liable.

How do I know that my computers won’t be used to traffic child porn, if I donate a server and some bandwidth?

I believe you can choose to be an exit relay or a middle relay. A middle relay only connects to other relays, it does not allow "outgoing" connections, i.e. you won't appear to be browsing child porn from the outside if that's what you mean.

If you mean that you don't want to relay traffic that carries child porn, than you can't do that, since you can't see what you are relaying (and even if you did, you'd need to automatically recognize it which is not easy afaik).

You can't.

It creates an interesting moral problem. If people who view such material are in the wrong because they support the harm it causes, then are not people who support Tor in general also guilty of the same? Yes, they have more noble reasons for doing so, but do the ends justify the means, especially when dealing with such a topic?

> If people who view such material are in the wrong because they support the harm it causes, then are not people who support Tor in general also guilty of the same?

How is this any different than FedEx or USPS? They don't read your mail to see what it is. To a near certainty at least some of what they deliver contains child pornography.

And what about roads? I bet child pornographers sometimes use roads for child pornography related purposes. Does that mean we're all complicit as taxpayers? Or maybe it's that the child pornographers are the guilty parties and common carriers are not the police.

Moral issue aside, thanks to the unwisely expanded reach of the law via FOSTA (at least in the United States), a person who merely hosts such data might be liable:

https://www.esquire.com/lifestyle/sex/a19573460/craigslist-s...

Because of the hypothetical impedance of some unknown (but likely very small) amount of trafficking, millions of people found it more difficult to find partners for their entirely consensual acts.

Tor is e2e encrypted connection, currently censors address such systems by requesting your private key, not by shutting down the whole thing.

>And what about roads? I bet child pornographers sometimes use roads for child pornography related purposes. Does that mean we're all complicit as taxpayers?

Congratulations you've spawned another decade's worth of sov-cit arguments

Since they do it for noble reasons, they aren't guilty.

You can't, you're in the same moral quandary an ISP finds itself in.

They almost certainly will

legal question here for someone who knows what they're doing, if you run a node and illegal activity is performed, are you complicit to the illegal activity?

Obviously not all of the time because otherwise ISPs, VPNs, postal services could not run. I think what is more of an issue is constantly having to prove you were not involved when police come investigate.

Answered in tors faq. No.

It can be as easy as

    sudo snap install tor-middle-relay

You could also find a relay family, email their contact information, and offer to donate on Tor's Metrics page:

https://metrics.torproject.org/rs.html#toprelays