News for hackers. Stuff that matters.
Re:Tor’s shadowy reputation will only end if we all use it by Spooky23 on Friday July 28, 2023 @01:25PM (#36910222)
Tor doesn’t deliver any of those things. It’s a tool developed for spies that is mostly used to facilitate grifts and move contraband.

I’m not worried about clowns in white vans or terrorists. If you want protection from the government, you need to advocate for protection under the law. Journalists, NGO workers, etc have to figure out how to manage risk and may need to self-censor to avoid those risks. Tor won’t protect you if you irritate MBS.

Re:Tor’s shadowy reputation will only end if we all use it by bratgpttamer on Friday July 28, 2023 @02:06PM (#36910813)
I'm not sure what deliverables you're referring to, but if it's not useful for shielding one's identity from prosecutors/persecutors, why would spies, grifters, traffickers, terrorists, child abusers, and puppy-kickers make such extensive use of it?
Re:Tor’s shadowy reputation will only end if we all use it by bombcar on Friday July 28, 2023 @02:15PM (#36910944)
Tor can protect your identity if nobody knows who you are.

But if a government is already crawling up your ass, it won't help much.

E.g, once you're not anonymous, anonymization tools don't help much.

Re:Tor’s shadowy reputation will only end if we all use it by Spooky23 on Friday July 28, 2023 @04:55PM (#36913187)
If the actual police and not counter-intelligence agencies were actually intercepting all traffic, use of tor would automatically attract attention to you.
Re:Tor’s shadowy reputation will only end if we all use it by bratgpttamer on Friday July 28, 2023 @08:52PM (#36915571)
I think this is the point the OP is making - one that's been made for years: if "everyone" used Tor, simply using Tor wouldn't be a useful indicator.
Re:Tor’s shadowy reputation will only end if we all use it by r3trohack3r on Friday July 28, 2023 @02:08PM (#36910838)
This isn’t true, you’re conflating risk profiles.

There is active targeted surveillance by a nation state. Tor is not going to help you. No crypto or tech alone will help you, you’ll need to develop extreme opsec practices to stand even a remote chance against a well funded and well equipped adversary focusing on targeting you.

Then there is passive mass surveillance, i.e. the presidential surveillance program, which Tor/VPNs/HTTPS etc will absolutely help with.

Re:Tor’s shadowy reputation will only end if we all use it by jgwil2 on Friday July 28, 2023 @03:20PM (#36911896)
Tor/VPNs/HTTPS is a pretty broad spectrum of protections. Everyone on the web now pretty much uses HTTPS all the time. Most people don't use a VPN but I imagine most HN users do or at least know how. Very few people use Tor. What benefits do VPNs bring over just HTTPS? What benefits does Tor bring over VPNs? And do any of these actually solve anything if you continue to use Google, Meta or similar services?
Re:Tor’s shadowy reputation will only end if we all use it by r3trohack3r on Friday July 28, 2023 @06:09PM (#36914023)
If you’re in the United States, a VPN can provide a lot of cover by disassociating the HTTPS packets metadata from your ip address.

I wrote a blog post on tactical privacy a while back that I think is still relevant: https://everytwoyears.org/2020/07/13/tactical-privacy.html

Re:Tor’s shadowy reputation will only end if we all use it by jgwil2 on Saturday July 29, 2023 @03:42PM (#36923792)
Thanks, the blog post is very straightforward and practical
Re:Tor’s shadowy reputation will only end if we all use it by jstarfish on Friday July 28, 2023 @07:06PM (#36914592)
> What benefits do VPNs bring over just HTTPS?

Doxxing/blackmail protection.

If a few people collude to secure moderator positions at different sites and each gains access to IP logs (or someone just bruteforces/exploits the site and dumps logs), anybody can be outed across those sites-- the adversary has effectively compromised the server and can map page accesses directly to your IP.

They don't break HTTPS, they break the weaker link-- the trust of the server owner.

The next step is gaining access to the VPN provider's logs (they don't keep any, right? Right?). They all keep logs. Even if they say they don't, assume they do. Nobody is held accountable for lying about it.

Again, not breaking HTTPS, but breaking the weaker link-- an unscrupulous VPN owner already exploiting the trust of you, the customer.

Tor is the only "safe" way to be anonymous, but even that is dead through fingerprinting, gatekeeping and forced Javascript enabling.