2

Tor's current CAPTCHA implementation is easily crackable through bots - whether through paid human labour or automatic algorithms with 99.8% accuracy[1]. Although the algorithm by Google is for reCaptcha, the same results could plausibly be applied to Tor's CAPTCHA, which isn't necessarily as secure or hard to read. Can this be done? And surely the NSA and other government agencies have more resources than Google.

So is Tor's Bridge-getting system or are we all being spied on?

  1. Any captcha can be cracked through manual human labour
  2. Government agencies have resources to perform massive amounts of human labour
  3. Therefore any CAPTCHA cannot be used

ispo facto we're all being spied on

And IP-limiting services wouldn't work because you could just use Tor to keep changing your IP. Perhaps we could block Tor end nodes, but there are always private end nodes.

Example CAPTCHA for reference:

enter image description here

  • Any captcha system is "easily crackable" "through paid human labour". "the same results can be applied to Tor's CAPTCHA" where is this stated? "the NSA and other government agencies have more resources than Google" why do you think this is true? – cacahuatl Aug 3 '16 at 18:43
  • @canonizingironize 1. Yes, tor needs more than a captcha 2. Google's algorithm is public 3. they have billions of dollars to spend on cracking Tor, Google has a few million – noɥʇʎԀʎzɐɹƆ Aug 3 '16 at 18:45
  • 1
    And even given all the seemingly baseless assumptions, you then ask a loaded question "is captcha secure or are we being spied on", it presumes that the result of captcha being insecure is that we can be spied on which isn't the case. the captcha protects a subset of the bridges in bridgedb, it's not part of any property that prevents "spying". – cacahuatl Aug 3 '16 at 18:47
  • Please review the entire premise of your question, kthx. – cacahuatl Aug 3 '16 at 18:48
  • @canonizingironize I have references in the links, thank you very much – noɥʇʎԀʎzɐɹƆ Aug 3 '16 at 18:48
5

Any captcha system can be broken by paying people.

The captcha has been attacked in the past by a nationstate adversary.

The captcha isn't critical to the security of Tor, it does present problems for censorship circumvention.

Breaking it would net you a subset of the bridges on bridgedb, it is partitioned so that a break on any one of the distribution methods will not compromise the entire set of bridges.

There are infact many (and cheaper) ways to discover bridges with less work and effort, see for example this report by arma.

So "ispo (sic) facto we're all being spied on" doesn't hold. The previous "fact" (the captcha is defeatable) does not lead to the conclusion that we're being spied on, merely that powerful adversaries can use a largely redundant method to discover some of the bridgedb bridges.

The captchas purpose is limited, and it's limitations well acknowledged. Worrying about the difficulty of the captcha is bikeshedding, at least against NSA level adversaries.

I'm not even going to waste time trying to deconstruct some of the other faulty logic and assumptions in your question. Even if they were right, the result is mostly irrelevant.

  • then how come China isn't able to block Tor? – noɥʇʎԀʎzɐɹƆ Aug 3 '16 at 21:43
  • best thing I've read on stack exchange today, cheers – jamescampbell Aug 4 '16 at 1:59
  • @uoɥʇʎPʎzɐɹC They do. That's why Tor users in China need to use pluggable transports and bridges to access the network. – SuperSluether Aug 19 '16 at 1:53
  • @SuperSluether yes, and the bridges are behind a weak captcha. China will do anything for national security. – noɥʇʎԀʎzɐɹƆ Aug 19 '16 at 13:23
  • Obviously not, otherwise they would have blocked all the bridges by now. – SuperSluether Aug 19 '16 at 13:25
0

1.Any captcha can be cracked through manual human labour 2. Government agencies have resources to perform massive amounts of human labour 3. Therefore any CAPTCHA cannot be used

ispo facto we're all being spied on

The point of bridges is to circumvent network blocking of tor. If the operator of the network knows more tor guard nodes, they can make it harder for you to connect to tor.

This doesn't really help them with surveillance. It lets them know that you're using tor, but the network is designed with the assumption that an attacker already knows that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.