News for hackers. Stuff that matters.
Re:Tor in 2022 by aws-user on Tuesday December 21, 2021 @05:44AM (#29636053)
isn't tor under the control of US intel agencies now? is there an alternative darknet?
Re:Tor in 2022 by wongarsu on Tuesday December 21, 2021 @07:35AM (#29636768)
Tor never claimed resiliency against large-scale traffic correlation attacks. Anyone who can look at a sufficient portion of all internet traffic has a good chance of deanonymizing TOR users. The Snowden revelations could lead one to believe that the US is sniffing enough traffic to make this viable, but it's anyone's guess if they collect and synchronize enough data to make deanonymization of TOR users viable.

I2P always looked more promising to me, and more open about its threat model [1] and potential mitigations. But it's not built for browsing the open internet, so it has a somewhat different niche.

1: https://geti2p.net/en/docs/how/threat-model

Re:Tor in 2022 by darau1 on Tuesday December 21, 2021 @09:04AM (#29637452)
I wish more people ran TOR nodes. I intend to run one when I can.
Re:Tor in 2022 by pph on Tuesday December 21, 2021 @09:52AM (#29637901)
To be fair it's not like you can run one from your home connection. I mean you could, but it wouldn't be a good idea, unfortunately.
Re:Tor in 2022 by wongarsu on Tuesday December 21, 2021 @09:57AM (#29637951)
Running an exit relay from home would be a very bad idea, and if your IP frequently changes you might not be picked as guard relay. But I don't see why you couldn't run a middle relay from home, as long as you don't have a traffic cap.
Re:Tor in 2022 by R0b0t1 on Tuesday December 21, 2021 @03:50PM (#29641948)
You can run an exit relay from home, at least in the US. There are some ISPs (mostly on the East coast, afaict) that may not help you, but most of them seem to understand how the laws work.

In other countries you may not have such luck.

Re:Tor in 2022 by 8bitbuddhist on Tuesday December 21, 2021 @09:57AM (#29637953)
Running an intermediate/middle node is generally safe. You want to avoid running an exit node.
Re:Tor in 2022 by kentiko on Tuesday December 21, 2021 @10:12AM (#29638084)
Running a middle node got my IP banned from some services, even services provided by my ISP.
Re:Tor in 2022 by post-factum on Tuesday December 21, 2021 @10:34AM (#29638324)
Indeed, some CDNs like Akamai do not bother distinguishing relays from exit nodes and just ban everything.
Re:Tor in 2022 by crazysim on Tuesday December 21, 2021 @10:58AM (#29638606)
Does this apply to snowflake relays?
Re:Tor in 2022 by notriddle on Tuesday December 21, 2021 @12:39PM (#29639844)
The whole point of Snowflake relays is that nobody knows about them. If Akamai knows about it, then it failed.
Re:Tor in 2022 by darau1 on Tuesday December 21, 2021 @01:45PM (#29640572)
I've never heard of snowflake relays. What are they?
Re:Tor in 2022 by chalst on Tuesday December 21, 2021 @02:01PM (#29640750)
Re:Tor in 2022 by haakon on Tuesday December 21, 2021 @03:44PM (#29641895)
I've been running a Tor relay from my home for a decade, at least. It's not an exit relay. Never had any issue.
Re:Tor in 2022 by kmeisthax on Tuesday December 21, 2021 @09:20AM (#29637578)
Tor was originally written by US intel agencies specifically to provide cover for spies. The release of the software to the public was specifically to provide plausible deniability for those spies. So there's always going to be some level of control and knowledge the US has about the network.

If your threat model is anything weaker than a hostile nation state then Tor is still probably good enough to use as a darknet. If you're doing anything illegal over Tor then you probably should be more worried about OPSEC failures or rubber-hose cryptanalysis.

Re:Tor in 2022 by hereforphone on Tuesday December 21, 2021 @11:02AM (#29638643)
Are you sure it was supposed to provide "cover for spies"? AFAIK onion routing was an invention of the US Naval Research Laboratories and was public from the beginning. If you want "spies" to use it, you don't want them connecting to known gateways. High anonymity (simplex) is why number stations are still a thing.
Re:Tor in 2022 by rickdeveloper on Tuesday December 21, 2021 @12:25PM (#29639647)
> If you want "spies" to use it, you don't want them connecting to known gateways.

The best place to hide a tree is in a forest.

If you have both 'normal' users and spies connecting to this host, who will tell who's the spy?

Re:Tor in 2022 by 0xFFFFFFFFF on Tuesday December 21, 2021 @11:11AM (#29638752)
Do number stations still a thing? Here in Europe there are just some beacons that broadcast the same message daily but no other activity whatsoever.
Re:Tor in 2022 by hereforphone on Tuesday December 21, 2021 @11:22AM (#29638862)
They're still a thing as recently as a year or two ago when I looked into it. They're "perfect" in that the receiver can't be identified from the message or its channel (other than catching him with his radio), and that the message cannot be reversed (encoded w/ a one time pad). So they're hard to replace.
Re:Tor in 2022 by DarylZero on Tuesday December 21, 2021 @11:59AM (#29639315)
One time pads aren't perfect. The same secret has to be stored on both sides and can be compromised from either side.

OTP has to be delivered preserving secrecy. Transmitting a public key only needs to preserve integrity.

Re:Tor in 2022 by ravenstine on Tuesday December 21, 2021 @09:50AM (#29637880)
In regards to your second question, yes, there is I2P.

https://geti2p.net

It's better than Tor in a few ways, in particular how it handles DDOS attacks. I2P is also more focused on facilitating hidden services (eepsites) than being a clearnet proxy.

There's also Yggdrasil, although it doesn't seem particularly concerned about anonymity.

https://yggdrasil-network.github.io/

Re:Tor in 2022 by GekkePrutser on Tuesday December 21, 2021 @01:02PM (#29640144)
For i2p, is there something like tails? Like a hardened read-only OS built to avoid the usual client opsec failures?
Re:Tor in 2022 by GekkePrutser on Wednesday December 22, 2021 @04:13PM (#29655290)
To answer my own question: Kodachi linux seems to do this.

https://sourceforge.net/projects/linuxkodachi/

Although it's not nearly as minimalistic as Tails.

Re:Tor in 2022 by zikduruqe on Tuesday December 21, 2021 @12:04PM (#29639383)
https://letsdecentralize.org

Here are a few options.

Re:Tor in 2022 by belorn on Tuesday December 21, 2021 @08:08AM (#29636989)
Mesh networks that don't operate as an overlay network could in theory be pretty effective to avoid large-scale traffic correlation attacks. If we assume that the US has effective control over the whole backbone network, and enough control inside the network of most commercial available ISP's, then there isn't much mixing networks can do. An adversary can always observe, inject, throttle, speed up, block and otherwise disturb the network flow in order to determine who is talking to whom.
Re:Tor in 2022 by jimbob45 on Tuesday December 21, 2021 @11:23AM (#29638883)
Not for us common folk, I don't think so.

Sure, they can listen in on you all they want, but what good is any of that if they can't use it against you in a court of law?

Re:Tor in 2022 by noman-land on Tuesday December 21, 2021 @12:02PM (#29639362)
Ever hear of parellel construction?

https://en.wikipedia.org/wiki/Parallel_construction

Re:Tor in 2022 by schleck8 on Tuesday December 21, 2021 @05:57AM (#29636141)
I hope not. Tor being used for whistleblowing and censorship circumvention is one thing, but the onion network is pure anarchy and probably the worst case scenario of what the internet could become.

https://youtu.be/iItLpwkQMUQ&t=277

Re:Tor in 2022 by ipaddr on Tuesday December 21, 2021 @01:36PM (#29640489)
It is useful as a free-for-all outside of censorship.

You probably don't want an area free from censorship most people don't. I browse with safe images enabled when searching google images. Once in awhile I'll open it up and see a world that didn't exist before. I don't think that world should be removed even if I rarely visit.