Tor’s shadowy reputation will only end if we all use it

Re:Tor’s shadowy reputation will only end if we all use it by r3trohack3r on Friday July 28, 2023 @02:08PM (#36910838)

This isn’t true, you’re conflating risk profiles.

There is active targeted surveillance by a nation state. Tor is not going to help you. No crypto or tech alone will help you, you’ll need to develop extreme opsec practices to stand even a remote chance against a well funded and well equipped adversary focusing on targeting you.

Then there is passive mass surveillance, i.e. the presidential surveillance program, which Tor/VPNs/HTTPS etc will absolutely help with.

[ Parent | on HN ]

Re:Tor’s shadowy reputation will only end if we all use it by jgwil2 on Friday July 28, 2023 @03:20PM (#36911896)

Tor/VPNs/HTTPS is a pretty broad spectrum of protections. Everyone on the web now pretty much uses HTTPS all the time. Most people don't use a VPN but I imagine most HN users do or at least know how. Very few people use Tor. What benefits do VPNs bring over just HTTPS? What benefits does Tor bring over VPNs? And do any of these actually solve anything if you continue to use Google, Meta or similar services?

[ Parent | on HN ]

Re:Tor’s shadowy reputation will only end if we all use it by r3trohack3r on Friday July 28, 2023 @06:09PM (#36914023)

If you’re in the United States, a VPN can provide a lot of cover by disassociating the HTTPS packets metadata from your ip address.

I wrote a blog post on tactical privacy a while back that I think is still relevant: https://everytwoyears.org/2020/07/13/tactical-privacy.html

[ Parent | on HN ]

Re:Tor’s shadowy reputation will only end if we all use it by jgwil2 on Saturday July 29, 2023 @03:42PM (#36923792)

Thanks, the blog post is very straightforward and practical

[ Parent | on HN ]

Re:Tor’s shadowy reputation will only end if we all use it by jstarfish on Friday July 28, 2023 @07:06PM (#36914592)

> What benefits do VPNs bring over just HTTPS?

Doxxing/blackmail protection.

If a few people collude to secure moderator positions at different sites and each gains access to IP logs (or someone just bruteforces/exploits the site and dumps logs), anybody can be outed across those sites-- the adversary has effectively compromised the server and can map page accesses directly to your IP.

They don't break HTTPS, they break the weaker link-- the trust of the server owner.

The next step is gaining access to the VPN provider's logs (they don't keep any, right? Right?). They all keep logs. Even if they say they don't, assume they do. Nobody is held accountable for lying about it.

Again, not breaking HTTPS, but breaking the weaker link-- an unscrupulous VPN owner already exploiting the trust of you, the customer.

Tor is the only "safe" way to be anonymous, but even that is dead through fingerprinting, gatekeeping and forced Javascript enabling.

[ Parent | on HN ]