Here’s research conducted years ago about this matter: https://www.vice.com/en/article/mgbdwv/badonion-honeypot-mal...
Effectively they set up a honeypot and used clear text passwords to log in, and plenty of exit nodes picked up on this and those credentials were later used to (attempt to) log in into the honeypot.
only found this paper going over systematic process of exposing bad relays - http://www.cs.kau.se/philwint/spoiled_onions/pets2014.pdf
Here's the link for first one:https://web.archive.org/web/20150705184539/https://chloe.re/...
yes thats the one. interesting, seems they caught 15 unique relays harvesting logins. There seems to be scope to improve reporting and detection of malicious actors like this. They also have a block list on Tor's gitlab repo but doesn't seem to be up to date.
Unfortunately, not as much as you might hope.
For good reasons, the Tor browser doesn't store your browsing history - so there's no 'recently visited sites', no address bar autocomplete, no cached redirects, no cached HSTS, and no colour-changed 'visited' links.
So if you're visiting a site that isn't HSTS-preloaded - for example bitcoinknots.org - you'd better remember to type in the https:// explicitly, as that's your sole protection against getting MITMed.
>Tor Browser already comes with HTTPS Everywhere, NoScript, and other patches to protect your privacy and security.
And more broadly, neither HSTS preloading or HTTPS Everywhere include a list of every single site on the internet.
I use this on my main PC. Once or twice a day I might visit some old or especially cantankerous site that doesn't do HTTPS, I get a full page interstitial explaining the problem, I can decide if I'm OK with that. Otherwise every single link, typed URL, etc. is HTTPS regardless of whether that was what was originally written.
I wouldn't recommend it in its current state for my mother, but it's definitely what someone using Tor would want, and it's only getting more ubiquitous.
You should use a slug[1] if you need assurance that you’re staying on your vpn/protocol/exit.
It would be very simple to create a "tor only" network slug.
[0]: https://gitlab.torproject.org/tpo/applications/tor-browser/-...
So if you're talking about "everyone in a giant group of people" and doing it routinely, existence of those secret subpoenas seem like they'd get leaked eventually. Especially if it's hard to tell which of the 300 people leaked it.
And knowing this, the jail time or personal life destruction that would almost inevitably occur isn’t worth it for almost anyone.
This seems obvious but it is a constitutional right that has been cited as a reason to not comply with extra-judicial pressure to assist the government with an investigation.
This is why some projects do not accept donations and have a canary.
Had the authors of Truecrypt been paid, they could had been compelled to modify their source code to the government's will.
By not accepting payment, they are protecting themselves.
but they can force people to work with pay https://www.wbay.com/2022/01/20/thedacare-seeks-court-order-...
Ahem... "terrorism!"
Poof! Now your Constitutional rights no longer exist.
No, because the police will tell you to not tell anyone about the court order. If you do so (for example using a warrant canary), you will be in big trouble. Those canaries were always a convenient fiction, almost to the point of it being entirely in question whether or not this fiction was created in good faith.
( https://www.eff.org/deeplinks/2014/04/warrant-canary-faq )
Your life quality will take a sharp negative dive if you don't conform to the spirit of what they ask you. Whether or not such things are legal really is immaterial: You will be in trouble anyway. As such, I dislike advice that leans on what the law says.
Which can mean "no company has tried" or "no TLA has tried".
If the canary doesn't receive a signed message within X amount of days, the canary sings.
Nobody can force someone to do work or self-incriminate.
Seems like a catch 22 that it's a lose-lose.
If you don’t want any MITM possibilities, that’s what the onion services are for (both client and server are speaking over tor connections)
Is there any evidence that the majority of exit nodes aren't malicious? There's only 300 or so in the US, 300 or so in Germany, and in other countries even less. What would it take for three letter agencies to compromise most of it?
I mean, suppose all of the existing nodes weren't malicious. Could a government agency plausibly run 1000 exit nodes in a way that doesn't give away they are government-run? This would make the majority of exit nodes malicious.