Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Messages - OT

Pages: [1]
1
Anonymity and Privacy / Re: The Art of Anonymity
« on: March 07, 2014, 04:02:30 pm »
Have you seen The grugq's speech "OPSEC for hackers" at Hack in the Box 2013? It mat be of interest to you and others, there are slides to go along with it. He's an internet security researcher and lately has been focusing on OPSEC (from hackers to spies) and he runs a blog that focuses on OPSEC. I found it interesting, maybe someone else will too.

2
Anonymity and Privacy / Re: The Art of Anonymity
« on: March 07, 2014, 07:20:53 am »
Quote
I don't like Tor because it's slow for one thing. Not to mention it's very easy to expose who a person is and what they are doing, it's easy to slip and leak some information about yourself. Plus the .onion net isn't as interesting as people make it out to be. Endnodes can sniff and hijack your session. It's no where near a perfect anonymity service. Don't ever use it for any serious hacks or anything like that.

Care to provide a source or elaborate on the part where you said that it is very easy to expose a person and what they are doing, or that its easy to slip and leak some information? As far as I know this is untrue for normal use cases, the only leaks I know of are associated with people using bittorrent.

Endnodes can be sniffed if you're not using encryption, but if you're sending sensitive data unencrypted you have enough problems as it is.

It seems to me it would be alot closer to anonymity than say a VPN or proxy provider who could be logging you on their own or under order of the law.

Quote
The feds fund 60% of its budget, it originated as DARPA technology, the exit nodes are best assumed as compromised, most Tor users use 1024-bit RSA/DH keys that the NSA can feasibly crack, the FBI recently made headlines for using a JavaScript exploit to infiltrate onion services, some protocols and poor browser configurations inadvertently leak information and so on.

Tor being mostly funded by the feds doesn't make it compromised, neither does it originating as DARPA technology.  If you use an outdated version of the Tor browser bundle you are taking the chance of being exploited, just like if you're running any other outdated software. The outdated encryption was fixed a while ago, as people update that will correct itself.


I'm not saying Tor is a perfect solution to anonymity because I don't think there is one, I just think its the best solution for the majority of use cases. VPN's and proxies are vulnerable to the same problems and introduce new ones.

Pages: [1]