3

Tor's current CAPTCHA implementation is easily crackable through bots - whether through paid human labour or automatic algorithms with 99.8% accuracy[1]. Although the algorithm by Google is for reCaptcha, the same results could plausibly be applied to Tor's CAPTCHA, which isn't necessarily as secure or hard to read. Can this be done? And surely the NSA and other government agencies have more resources than Google.

So is Tor's Bridge-getting system or are we all being spied on?

  1. Any captcha can be cracked through manual human labour
  2. Government agencies have resources to perform massive amounts of human labour
  3. Therefore any CAPTCHA cannot be used

ispo facto we're all being spied on

And IP-limiting services wouldn't work because you could just use Tor to keep changing your IP. Perhaps we could block Tor end nodes, but there are always private end nodes.

Example CAPTCHA for reference:

enter image description here

Improve this question
6
  • Any captcha system is "easily crackable" "through paid human labour". "the same results can be applied to Tor's CAPTCHA" where is this stated? "the NSA and other government agencies have more resources than Google" why do you think this is true?
    – cacahuatl
    Commented Aug 3, 2016 at 18:43
  • @canonizingironize 1. Yes, tor needs more than a captcha 2. Google's algorithm is public 3. they have billions of dollars to spend on cracking Tor, Google has a few million
    – noɥʇʎԀʎzɐɹƆ
    Commented Aug 3, 2016 at 18:45
  • 1
    And even given all the seemingly baseless assumptions, you then ask a loaded question "is captcha secure or are we being spied on", it presumes that the result of captcha being insecure is that we can be spied on which isn't the case. the captcha protects a subset of the bridges in bridgedb, it's not part of any property that prevents "spying".
    – cacahuatl
    Commented Aug 3, 2016 at 18:47
  • Please review the entire premise of your question, kthx.
    – cacahuatl
    Commented Aug 3, 2016 at 18:48
  • @canonizingironize I have references in the links, thank you very much
    – noɥʇʎԀʎzɐɹƆ
    Commented Aug 3, 2016 at 18:48

2 Answers 2

Reset to default
6

Any captcha system can be broken by paying people.

The captcha has been attacked in the past by a nationstate adversary.

The captcha isn't critical to the security of Tor, it does present problems for censorship circumvention.

Breaking it would net you a subset of the bridges on bridgedb, it is partitioned so that a break on any one of the distribution methods will not compromise the entire set of bridges.

There are infact many (and cheaper) ways to discover bridges with less work and effort, see for example this report by arma.

So "ispo (sic) facto we're all being spied on" doesn't hold. The previous "fact" (the captcha is defeatable) does not lead to the conclusion that we're being spied on, merely that powerful adversaries can use a largely redundant method to discover some of the bridgedb bridges.

The captchas purpose is limited, and it's limitations well acknowledged. Worrying about the difficulty of the captcha is bikeshedding, at least against NSA level adversaries.

I'm not even going to waste time trying to deconstruct some of the other faulty logic and assumptions in your question. Even if they were right, the result is mostly irrelevant.

Improve this answer
6
  • then how come China isn't able to block Tor?
    – noɥʇʎԀʎzɐɹƆ
    Commented Aug 3, 2016 at 21:43
  • best thing I've read on stack exchange today, cheers
    – james-see
    Commented Aug 4, 2016 at 1:59
  • @uoɥʇʎPʎzɐɹC They do. That's why Tor users in China need to use pluggable transports and bridges to access the network.
    – SuperSluether
    Commented Aug 19, 2016 at 1:53
  • @SuperSluether yes, and the bridges are behind a weak captcha. China will do anything for national security.
    – noɥʇʎԀʎzɐɹƆ
    Commented Aug 19, 2016 at 13:23
  • Obviously not, otherwise they would have blocked all the bridges by now.
    – SuperSluether
    Commented Aug 19, 2016 at 13:25
0

1.Any captcha can be cracked through manual human labour 2. Government agencies have resources to perform massive amounts of human labour 3. Therefore any CAPTCHA cannot be used

ispo facto we're all being spied on

The point of bridges is to circumvent network blocking of tor. If the operator of the network knows more tor guard nodes, they can make it harder for you to connect to tor.

This doesn't really help them with surveillance. It lets them know that you're using tor, but the network is designed with the assumption that an attacker already knows that.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .