Formerly u/CanadaPlus101 on Reddit.

  • 23 Posts
  • 8.14K Comments
Joined 3 years ago
cake
Cake day: June 12th, 2023

help-circle















  • I mean, it’s not that expensive to start an exit node, and requires “only” knowhow to mess with someone’s unencrypted browsing, which is what the first and third did. I can’t remember now if Onymous actually managed to break Tor anonymity - I’m pretty sure good-old-fashioned stings turned out to be a big part of it.

    IIRC the two-node timing attack I was thinking of was an academic demonstration. Because it’s too non-specific to be very useful.



  • Post the next paragraph too.

    Moreover, the algorithm had been shown to be insecure in 2007 by Microsoft cryptographers Niels Ferguson and Dan Shumow, added Mr Clayton.

    “Because the vulnerability was found some time ago, I’m not sure if anybody is using it,” he said.

    But your comment implied that because it is open source it automatically means that it is safe and trustworthy and that isn’t true.

    Well, your comment implied that OP shouldn’t trust Tor. OP should trust Tor at least as much as they trust their own device, which almost certainly has closed-source components I’d rather target if I was the NSA. (Or the Chinese, or…)

    Since this user wanted an in depth conversation on the topic I don’t feel like its “ritualistic purity” to disclose all that I said above.

    Except in-depth isn’t what was offered. This reply appears all the time in regards to Tor, and it never comes with alternative suggestions. So yeah, I suspect something irrational is motivating it.


  • But most people who looked at the NSA’s backdoored encryption noticed it was sus and didn’t use it (as I remember it, that was a decade ago). Per your link, at the time of publishing it was unclear if anyone was using the effected version.

    Okay, sure. Open source doesn’t mean completely safe, but if it’s a well-known package it does mean much, much safer. Public public affiliations don’t even say much about who authored whatever thing; here’s a another near-miss that illustrates that - which is why this can feel more like ritual purity than an actual security argument.

    So what should OP use?