10

What do there revelations mean for us? http://www.theguardian.com/world/2013/oct/04/tor-attacks-nsa-users-online-anonymity

  • 1
    I suggest you read blog.torproject.org/blog/yes-we-know-about-guardian-article and wait for the promised detailed analysis. – mrphs Oct 5 '13 at 2:12
  • 1
    Can you edit and bring in the main points from the article that you have a question about? On Stack Exchange, it's a good idea to keep posts self-contained so that future readers will benefit from what we post. If The Guardian ever takes down that link, your question will be useless. Good luck! :) – jmort253 Oct 5 '13 at 3:26
2

It means little to the average user - for the moment - execpt that they are automatically flagged as targets by NSA. That being said, they are also the greatest threat to the Tor network in existance.

There are hundereds of thousands of users daily (according to this, I have read it doubled after Snowden leaks in an article talking about total, not daily users). I have read in the Snowden documents that the NSA has tested experimental techniques to de-anonymize 50 or so users (not have the specific source for this number. Not a threat unless they are specifically targetting you above other Tor users.

However, the NSA is considering methods that would mean the end of the Tor network as we know it - such as diverting people into unsafe channels (they don't seem concerned about dissidents getting rounded up and shot, as long as they get their access) or disrupting the network.

The amount of information on the battle between NSA and Tor is enough for a week long course to be taught on. I suggest everyone read up on this. Even if NSA is not your threat model, the battle between Tor and NSA will determine the ultimate survival of the Tor Network. This rest in large part with the developers, but ordinary users can make a difference s by making themselves harder to identify, thus raising the overall difficulty of attacking the Tor Network.

Here are links to key presenations and articles. Read not just the technical information, but also study how they think and perceive things. Don't expect to sleep well afterwards. Follow the links and do your own searches - this is a big subject. (It will take several temporarily allow all this page to get these to work - the guardian can't store the stuff on their own servers. The GCHQ had them destroyed. The Snowden Files as source for that.)

This is a small sample - there could be a several hour class to understand just NSA - Tor interaction. http://www.theguardian.com/world/interactive/2013/oct/04/tor-stinks-nsa-presentation-document http://www.theguardian.com/world/interactive/2013/oct/04/egotistical-giraffe-nsa-tor-document http://www.theguardian.com/world/2013/oct/04/nsa-gchq-attack-tor-network-encryption http://www.theguardian.com/world/2013/oct/04/tor-attacks-nsa-users-online-anonymity

http://www.washingtonpost.com/blogs/the-switch/wp/2013/10/04/everything-you-need-to-know-about-the-nsa-and-tor-in-one-faq/

Long and highly technical: http://apps.washingtonpost.com/g/page/world/gchq-report-on-mullenize-program-to-stain-anonymous-electronic-traffic/502/

http://apps.washingtonpost.com/g/page/world/nsa-research-report-on-the-tor-encryption-program/501/

1

My understanding of that article is summarized nicely by this paragraph (from the same article):

The very feature that makes Tor a powerful anonymity service, and the fact that all Tor users look alike on the internet, makes it easy to differentiate Tor users from other web users. On the other hand, the anonymity provided by Tor makes it impossible for the NSA to know who the user is, or whether or not the user is in the US.

Basically, it is easy for any packet-sniffer to be able to tell Tor traffic from regular traffic. They can also analyze the traffic data easily over http and not-so-easily over https. But they should not be able to tell who is on either side of the communication.

  • 1
    Except they do have the ability to identify users, not all of them but under certain situations they seem to be able to redirect users to malicious sites, install malware and/or drop persitint cookies. – Garrett Fogerlie Oct 5 '13 at 5:20
  • 2
    Generally, it seems that they use the same sorts of exploits, droppers etc that other attackers use for building botnets etc. As I read the presentations in the Guardian articles, they were having little luck with fundamental traffic attacks. – mirimir Oct 5 '13 at 5:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.