News for hackers. Stuff that matters.
Re:Is Tor still safe to use? by bragr on Wednesday September 18, 2024 @06:52PM (#41586517)
>This could cost less than $5000 for a month

I ran a bunch of nodes for a couple years and that's optimistic by perhaps an order of magnitude. No $5 a month VPS provides enough bandwidth to sustain the monthly traffic of a Tor node, and nodes need to be continuously online and serving traffic for about 2-3 months[1] before they will be promoted to guard relays. Throttling traffic to stay in your bandwidth allocation will just get you marked as a slow node and limit the number of connections you get. Sustaining just 1 Mbps will blow your monthly transfer allocation on the cheap tiers of both Digital Ocean or Linode.

[1] https://blog.torproject.org/lifecycle-of-a-new-relay/

Re:Is Tor still safe to use? by teaearlgraycold on Wednesday September 18, 2024 @07:29PM (#41586750)
Still easily within the budget of the US, Russia, China, Israel, etc. I wouldn't be surprised if a majority of nodes are ran by intelligence agencies.
Re:Is Tor still safe to use? by andai on Wednesday September 18, 2024 @07:58PM (#41586948)
They say the internet is just someone else's computer. With Tor it's the computer of a person who wants you to think it's not their computer, and also that they aren't paying attention to (or somehow can't see) what you're doing on it.
Re:Is Tor still safe to use? by bawolff on Wednesday September 18, 2024 @07:35PM (#41586795)
I think the threat model is that the majority are not run by cooperating malicious parties.

Russia, china and usa all dont like each other much so are probably not sharing notes (in theory).

Re:Is Tor still safe to use? by aftbit on Wednesday September 18, 2024 @08:31PM (#41587170)
Or perhaps they _are_ sharing notes about tor users with each other, as part of a global club of intelligence agencies (a sort of new world order) who would rather not be overthrown. How are we to know?
Re:Is Tor still safe to use? by anticorporate on Wednesday September 18, 2024 @09:07PM (#41587404)
Because if they each only have incomplete information, they each wouldn't know whether the information they have is relevant to preventing overthrow of their collective order, or intelligence that is only going to help their geopolitical adversary.

Basically, a variation of the prisoner's dilemma.

Also, those nukes we have pointed at each other are a pretty healthy hint.

Re:Is Tor still safe to use? by Imustaskforhelp on Thursday September 19, 2024 @12:35AM (#41588532)
the last sentence really just gave me a chuckle
Re:Is Tor still safe to use? by jrochkind1 on Thursday September 19, 2024 @10:13AM (#41592093)
Or perhaps someone with secret quantum computing can break all our encryption and has full transparency on all communications on the internet. Perhaps extraterrestrials are eavesdropping on everything I say in my living room, and sharing it with the KGB. How are we to know?
Re:Is Tor still safe to use? by rrrix1 on Thursday September 19, 2024 @12:17PM (#41593436)
Occam's Razor definitely applies here.

"The simplest explanation is usually the best one."

Conspiracy theories are a logical reasoning black hole.

I personally feel it's generally best to avoid the mental Spaghettification.

Re:Is Tor still safe to use? by darby_nine on Wednesday September 18, 2024 @07:37PM (#41586806)
In fact, you should assume they are. This doesn't imply the network doesn't have utility for a given actor.
Re:Is Tor still safe to use? by chr_1 on Wednesday September 18, 2024 @10:31PM (#41587898)
Before 2020 when /r/privacy stimulated conversation that was worthy of good discussion you learned Tor the software made less available nodes accessible with newer deployments, that’s why it got faster. Regardless of how many nodes existed. The routing shifted. Now it’s way faster and there's specifically designated guard nodes seemingly pinged repeatedly out to the same allied nations.
Re:Is Tor still safe to use? by giantg2 on Wednesday September 18, 2024 @10:35PM (#41587913)
The interesting thing is, the more agencies that run relays, the more they interfere with each other. So having something like US, Russia, and China a each running 25% of the network reduces the chances of any one getting all three relays.
Re:Is Tor still safe to use? by droopyEyelids on Wednesday September 18, 2024 @11:10PM (#41588112)
This would help negate that interference. https://en.wikipedia.org/wiki/Five_Eyes
Re:Is Tor still safe to use? by giantg2 on Wednesday September 18, 2024 @11:32PM (#41588224)
Specifically what I chose US (allies implied), China, and Russia. These should be three competing factions.
Re:Is Tor still safe to use? by pasabagi on Thursday September 19, 2024 @01:11AM (#41588725)
I think even Russia and the US still do intelligence sharing on a lot of stuff - and that's before you consider that the US seems to be in everybody's networks anyhow, so non-sharing is probably just sharing with a bit more skullduggery.
Re:Is Tor still safe to use? by giantg2 on Thursday September 19, 2024 @06:38AM (#41590436)
I don't think they share on the bulk data. I would highly doubt they routinely cooperate on cyber crimes given Russia's stance on the matter (basically encouraging it).
Re:Is Tor still safe to use? by trompetenaccoun on Thursday September 19, 2024 @05:12AM (#41589980)
Russia and China are allies. And I'm not sure if Beijing would even be interested in spying on TOR users since it's blocked so thoroughly it's basically unusable for Chinese residents.
Re:Is Tor still safe to use? by giantg2 on Thursday September 19, 2024 @06:35AM (#41590419)
I don't know they are that aligned to be sharing bulk data like that. I don't think the are considered formal allies.
Re:Is Tor still safe to use? by bluGill on Thursday September 19, 2024 @08:56AM (#41591385)
China is for sure interested in spying on people in the US. I'm not sure if TOR users are of special interest though.
Re:Is Tor still safe to use? by Workaccount2 on Thursday September 19, 2024 @10:05AM (#41592000)
China and Russia are decidedly not allies.

They are neighbors with some overlapping interests and sort of similar goals if you squint. It wasn't very long ago that they were killing each other over border conflicts and annexed territory.

China right now is just using Russia for cheap energy, they don't actually care about the health of the state.

Re:Is Tor still safe to use? by trompetenaccoun on Thursday September 19, 2024 @11:37AM (#41593003)
>It wasn't very long ago...

If that's how geopolitics worked China would still be an American ally, vice versa. But alliances can change. Once an enemy always an enemy isn't a thing.

>they don't actually care about the health of the state

That's true but it's not a requirement for Xi to care about Russia. In fact I'm very sure he doesn't care about the Chinese people either. Russia needs China and the CCP uses Russia, not just for cheap energy but for fighting a war that many Westerners haven't even realized that it has begun already. Russia and China have a common enemy, that enemy is NATO.

Re:Is Tor still safe to use? by Aerbil313 on Thursday September 19, 2024 @01:50PM (#41594415)
I get scared reading that wiki page. The fact that the Australians are powerless[1] to stop US operating Pine Gap on their own soil, says something about how important the stuff the NSA & co. is doing there. (Surveillance) Horrors beyond our understanding.

1: A good video explaining history & status quo: https://www.youtube.com/watch?v=XHMa-Ba-2Mo

Re:Is Tor still safe to use? by markus_zhang on Friday September 20, 2024 @11:10PM (#41607183)
Thanks, that's a fun video.
Re:Is Tor still safe to use? by belorn on Wednesday September 18, 2024 @08:23PM (#41587116)
Now to add additional problems. 1000 tor nodes on a single platform would be very noticeable and geographically limited. Platforms also have different weight attached to them in the consensus, which adds further time requirements before a node is promoted. The developers do not want a single platform provider to be able to observe a large portion of all the traffic, so there are counter measures.

The attacker could try to create a handful of accounts on hundreds of platforms in as many countries as possible, assuming one verify that the platforms accepts tor and do not share underlying providers and data centers. The cost would then be the average price of said providers, which is going to be a fair bit more than the cheapest providers out there. Managing and spreading them out is also going to cost a lot of man hours. Also the secops need to be fairly on the point and need to be maintained quite strictly across all the providers.

Re:Is Tor still safe to use? by qb1 on Thursday September 19, 2024 @08:18AM (#41591025)
Pagers and the next day handheld radios exploded on their users! This can be done.
Re:Is Tor still safe to use? by aesh2Xa1 on Thursday September 19, 2024 @08:52AM (#41591349)
I think the news about that particular counter example is too recent to be easily understood.

https://www.schneier.com/blog/archives/2024/09/remotely-expl...

Still, I think your point is excellent. The sort of group interested in tracking someone(s) over Tor certainly might have the capability to do so despite the difficulty.

Re:Is Tor still safe to use? by maicro on Thursday September 19, 2024 @09:44AM (#41591757)
Yeah, too recent to understand (though I've also been out of the loop a bit) - so thank you, that's...a good one.
Re:Is Tor still safe to use? by hiatus on Thursday September 19, 2024 @10:58AM (#41592602)
> Let's say I as a private individual fund 1000 tor nodes

Was the operation against Hezbollah funded by a private individual? Otherwise I'm not sure the relevance of your statement to the comment that started this thread.

Re:Is Tor still safe to use? by ranger_danger on Thursday September 19, 2024 @09:48AM (#41591797)
Considering multiple world governments have already shown in leaked documents that this is exactly what they do, I personally wouldn't trust my secrets with tor.
Re:Is Tor still safe to use? by halJordan on Thursday September 19, 2024 @03:29PM (#41595451)
But and God forbid you read TFA, those leaked techniques were all done before the latest mitigations that the Tor Project is writing the blog about.
Re:Is Tor still safe to use? by ranger_danger on Thursday September 19, 2024 @09:56PM (#41598114)
There's not much technique involved in running tons of nodes.
Re:Is Tor still safe to use? by chatmasta on Wednesday September 18, 2024 @08:24PM (#41587123)
You don’t technically need separate nodes, just separate IP addresses. Although Tor has some marginal protections against circuits sharing relays with similar IP, so you couldn’t just get a /24 and hope they all get the same circuit.
Re:Is Tor still safe to use? by tga_d on Wednesday September 18, 2024 @09:56PM (#41587695)
Not only would you need the node to expose IPs with a wide enough distribution to allow the right path selection, you'd also need to have enough bandwidth available to look like distinct hosts, and ensure any losses in connectivity aren't correlated enough to draw attention (people monitor metrics.torproject.org pretty diligently, and would notice if there was a chunk of bandwidth coming and going in lockstep). At that point, the difference in cost to just actually running legitimately separate hosts is negligible. All empirical evidence points towards the status quo that has existed for most all of Tor's existence: if you want to identify Tor users, there are cheaper ways to do it than dominating the network (and those ways are expensive enough to be outside most people's threat models).

That said, any bandwidth anyone wants to contribute to mitigate such attacks is always appreciated, even if it's more useful for performance reasons in practice. ;)

Re:Is Tor still safe to use? by Terretta on Wednesday September 18, 2024 @09:54PM (#41587682)
Re:Is Tor still safe to use? by alfiedotwtf on Wednesday September 18, 2024 @08:34PM (#41587192)
If it’s that expensive to run Tor nodes, who is actually paying for them? I’ve heard individuals getting doors kicked in for participating in the network, so it’s not individuals. Corporates too wouldn’t want this type of burden… so is it really just spy-vs-spy
Re:Is Tor still safe to use? by 0points on Thursday September 19, 2024 @02:45AM (#41589225)
> I’ve heard individuals getting doors kicked in for participating in the network, so it’s not individuals.

It's individuals

Re:Is Tor still safe to use? by autoexec on Thursday September 19, 2024 @12:11PM (#41593355)
Unless something has changed, one of the issues with Tor is that it tries to send traffic through servers that have the most bandwidth which are pretty much certain to be servers owned by the state a lot of the time because a random person's residential cable modem is going to be a lot less capable.
Re:Is Tor still safe to use? by input_sh on Thursday September 19, 2024 @01:02PM (#41593924)
Run by individuals doesn't necessarily mean run on potato hardware. I ran a highly reputable (non-exit) node on a beefy but underutilised dedicated server for at least half a decade.
Re:Is Tor still safe to use? by p4bl0 on Thursday September 19, 2024 @02:47AM (#41589237)
Many individuals contribute to running relays. And there are non-profit organizations collecting donations to operates Tor exit nodes:

- https://www.torservers.net/

- https://nos-oignons.net/

Re:Is Tor still safe to use? by idiotsecant on Thursday September 19, 2024 @02:31PM (#41594868)
This is probably strictly true but it smacks to me of 'many people say'. I wonder what % of TOR nodes are run by people with an ideological allegiance for the network vs how many are run by nation-state actors.
Re:Is Tor still safe to use? by akimbostrawman on Thursday September 19, 2024 @02:54AM (#41589284)
only exit nodes get there door kicked in and they are the minority and not needed for the tor network to function
Re:Is Tor still safe to use? by zerd on Thursday September 19, 2024 @01:47PM (#41594396)
They are pretty essential, without them you can only access onion services.
Re:Is Tor still safe to use? by akimbostrawman on Friday September 20, 2024 @02:42AM (#41599435)
exit nodes aren't used for the onion services. only when interacting with the clearnet.
Re:Is Tor still safe to use? by tylervigen on Saturday September 21, 2024 @06:59AM (#41609150)
You are both saying the same thing, you just differ on the degree to which you see that as a problem.
Re:Is Tor still safe to use? by immibis on Thursday September 19, 2024 @03:34AM (#41589457)
I run a non-exit node any time I have the spare resources. I2P too. This means they're on the same popular providers that have too many other nodes, though.

Sometimes I set it up as a bridge (hidden entry node) instead.

Re:Is Tor still safe to use? by voldacar on Wednesday September 18, 2024 @10:37PM (#41587926)
I started a tor relay on a spare vps about a month ago and it got guard status around 2-3 weeks in, so that info seems to be out of date.
Re:Is Tor still safe to use? by arktos_ on Wednesday September 18, 2024 @11:08PM (#41588102)
Pardon my ignorance, but I thought it fruitful to ask: Are there any issues that can arise by doing this on a VPS?

I ask because I know of stories of law enforcement sending inquiries to owners of, say, exit nodes requiring certain information about given traffic. I don't know if this happens for middle-nodes (or whatever they're called).

Moreover, are there any issues with associating a node to, you know, your name and billing information?

I don't know much about this, and although I could look it up, I think that my questions - and your respective answers or those of others - might do some public service of information sharing here.

Re:Is Tor still safe to use? by voldacar on Wednesday September 18, 2024 @11:46PM (#41588303)
I'm not an exit node.

You can buy a vps with xmr if you're worried about privacy from law enforcement.

Re:Is Tor still safe to use? by Imustaskforhelp on Thursday September 19, 2024 @12:33AM (#41588523)
most vps don't support xmr though. any suggestions to whom I can trust (I basically only trust hetzner in vps space)
Re:Is Tor still safe to use? by akimbostrawman on Thursday September 19, 2024 @02:52AM (#41589268)
>I basically only trust hetzner in vps space

https://notes.valdikss.org.ru/jabber.ru-mitm/

Re:Is Tor still safe to use? by ranger_danger on Thursday September 19, 2024 @10:42AM (#41592438)
What's more alarming to me is that they (the jabber operators) seemingly stopped caring about it. Whatever this intercepting proxy did (including from the sound of it, spoofing ACME challenges from their domain to get a certificate) could be illegal and they didn't even attempt to do anything about it, AND they are assuming that continuing to use the service after the attack stopped is somehow safe now.

Either they are grossly negligent/incompetent (IMO unlikely given the extent of their research), or they knew it was intercepted on purpose (either by law enforcement, the provider itself or one of their upstreams) and intentionally aren't saying so. They could also be withholding or lying about any number of things, including the exact response from the hosting providers.

Re:Is Tor still safe to use? by Imustaskforhelp on Saturday September 21, 2024 @12:51PM (#41611138)
interesting.

I am kind of shocked because I really got positive feedback of hetzner from what I heard from people.

I need to post about this on r/vps and hear about people's opinion.

Re:Is Tor still safe to use? by beeflet on Thursday September 19, 2024 @12:51AM (#41588615)
Some do though. I got started a minecraft server the other month that i paid for in xmr. You can go to like a VPS aggregator like serverhunter.com and filter those that allow altcoins as payment

https://www.serverhunter.com/#query=stock%3A%28in_stock+OR+u...

Re:Is Tor still safe to use? by voldacar on Thursday September 19, 2024 @12:45AM (#41588584)
https://monerica.com/

ctrl-f for web hosting

Re:Is Tor still safe to use? by GTP on Thursday September 19, 2024 @01:57AM (#41588972)
I never operated a TOR node, but as far as I know and heard from other sources, TOR realays don't get much attention from law enforcement, it any attention at all. Which makes sense: all they're doing is getting encrypted traffic in and giving encrypted traffic out. It would hard for them to link a relay node to a specific connection, and even if they do, you can't help them in any way: even you as the node operator are only able to see encrypted traffic.

Edit: there's a youtuber called "Mental Outlaw" that published a while ago some videos about setting up and operating TOR nodes. He sometimes gives inaccurate information regarding more theoretical topics, so I don't follow him much. But I think he can be trusted for this practical topics.

Re:Is Tor still safe to use? by WHA8m on Thursday September 19, 2024 @08:07AM (#41590936)
Just a quick note on the Youtube channel you mention: I follow his videos for a while and it seems to me, that he's half a shill. My impression is, that he re-models popular HN threads into Youtube videos. Just watch the latest video on the MrBeast topic and you'll basically get the same info as all the popular 'root' comments (was on HN front page last week). Not the first time I noticed a suspicious connection.
Re:Is Tor still safe to use? by GTP on Thursday September 19, 2024 @08:50AM (#41591326)
It would be funny if he makes a new video about TOR and ends up mentioning your comment :D
Re:Is Tor still safe to use? by PawgerZ on Thursday September 19, 2024 @09:04AM (#41591452)
Wow, I was about to comment the same thing. Glad to have my assumptions validated by someone else.
Re:Is Tor still safe to use? by maxrecursion on Thursday September 19, 2024 @09:47AM (#41591780)
While that is a crappy thing to do, I bet tons of YouTubers are doing just that. Hell, most political YouTubers just read articles and make stupid comments about them.

It would be impossible to create daily content if you weren't just rehashing, or taking, information from somewhere. Again, not defending it at all, just saying it's probably a very common thing. Like how some crappy news articles are just a bunch of reddit comments, like that qualifies as news.

Re:Is Tor still safe to use? by Workaccount2 on Thursday September 19, 2024 @09:55AM (#41591868)
If you ever fall into "hustler-get-rich-quick" shorts/reels/tik-toks, it is full of people laying out the same exact scheme:

Make a channel

Find popular reddit/social media post

Use AI tools for text to speech

Use AI tools to generate pictures

Stitch it all together

Post on channel.

Re:Is Tor still safe to use? by WHA8m on Thursday September 19, 2024 @10:24AM (#41592241)
Agreed. Extra: I'd generally say, that comments on HN are often interesting and insightful (that's why we're here, no?). With the current state of social media, I'd wish for a little more HN flavor. But at least credit your source. The information you provide doesn't get less valuable only because someone else did the work.
Re:Is Tor still safe to use? by gspencley on Thursday September 19, 2024 @10:33AM (#41592337)
> While that is a crappy thing to do,

I haven't watched this particular channel so maybe it's obviously shady, but I'm curious: why is this conceptually a crappy thing to do?

I mean, if you take the IP of others and redistribute it verbatim then I definitely see the ethical issue. So if the claim is that he's reading peoples' comments or posts verbatim without credit then yeah that's crappy. Don't get me wrong.

But if all we're talking about is "mining" websites like HN for topics and then creating original content that covers those topics in a different format for a different audience... where's the issue?

A few years ago I was feeling pretty burned out in the tech industry and created a tongue in cheek "luddite" channel called TechPhobe where I took an overly pessimistic view of the industry. At the time Elizabeth Holmes was on trial and a lot my videos involved me reading ArsTechnica articles on the subject (credited) while offering my personal opinions on the matter. While not successful, those videos got more views than anything else I ever created. Was that a crappy thing to do? I didn't think so at the time and I don't think so now.

I didn't stick with the channel because I realized pretty quickly that if I'm dealing with burnout the last thing I should be doing in my spare time is focusing on tech content lol

Re:Is Tor still safe to use? by digging on Thursday September 19, 2024 @02:53PM (#41595074)
> But if all we're talking about is "mining" websites like HN for topics and then creating original content that covers those topics in a different format for a different audience... where's the issue?

Plagiarism, generally. I really enjoyed the semi-recent hbomberguy video on why it matters, and a later response (from another channel) on "The Somerset Scale of Plagiarism" for a more rigorous explanation of what the different kinds of "content reuse" can be. Those are generally where my current model of plagiarism comes from.

A specific concern would be the inaccurate telling of information that isn't understood. A video saying, "Here I will summarize this HN thread," is perfectly ok, and a good thing. A video saying, "Here I will tell you how $thing works," should be well researched and cited. Doesn't matter if the content's entirely from an HN thread for from 40 different SEO farms, it's low-quality content and it's wasting everyone's time at best, and probably actively misinforming people. (Because how true and complete is information gleaned from HN comments anyway?)

Re:Is Tor still safe to use? by asmor on Friday September 20, 2024 @02:58AM (#41599516)
Mental Outlaw definitely doesn't know how to threat model anything. Keeps assuming you'll be targeted specifically, but then tries to evade that with i2p and Tor. Most people aren't going to be specifically targeted though, especially if they keep a low profile (i.e. don't be one of ~50k i2p users, that's sure to be a selector) and especially not for torrenting content illegally (as opposed to illegal content).

If your threat model is actually three letter agencies coming after you specifically... that's an entirely different problem not (just) solved by software.

Re:Is Tor still safe to use? by immibis on Thursday September 19, 2024 @03:31AM (#41589445)
Non-exit nodes are generally considered safe to run. it's only exit nodes that system enforcement keeps trying to shut down.
Re:Is Tor still safe to use? by dunghill on Thursday September 19, 2024 @07:00AM (#41590551)
There was a recent HN topic where person running exit nodes run into quite a lot of issues because of it.
Re:Is Tor still safe to use? by INTPenis on Thursday September 19, 2024 @08:27AM (#41591109)
I ran tor exit nodes on Linode and Digitalocean for years. No real issues, but you will get regular abuse complaints.

The support teams always understood once I explained it was a tor exit node. I co-operated with the Cloud provider and added any IP-address that requested it to my list of exempt addresses.

Re:Is Tor still safe to use? by ranger_danger on Thursday September 19, 2024 @09:51AM (#41591829)
> The support teams always understood

But they don't have to. It could also be against their ToS, and many other providers would not have been ok with it. Accounts and domains have been taken away for much less.

Re:Is Tor still safe to use? by jrochkind1 on Thursday September 19, 2024 @10:09AM (#41592050)
Right, which is why it's informative to hear a report that DO and linode did!
Re:Is Tor still safe to use? by layer8 on Thursday September 19, 2024 @10:20AM (#41592184)
So read the ToS and ask support beforehand?
Re:Is Tor still safe to use? by immibis on Friday September 20, 2024 @01:59AM (#41599197)
Not to mention, armed police raiding your home, especially if you live in Germany.
Re:Is Tor still safe to use? by ForHackernews on Thursday September 19, 2024 @05:25AM (#41590036)
These costs explain why most of the nodes are probably run by the FBI.
Re:Is Tor still safe to use? by zorrn on Thursday September 19, 2024 @03:10PM (#41595252)
We also recently saw the xz backdoor wich was worked on for many years so I think it could be possible if you really have on target.