Quote from user last night: >"The 5 Eyes Alliance has a total network graph overview. This renders trying to hide useless. You should assume they have developed ways to fool the Tor relay finding algorithm in order that their spook controlled relays are chosen and they basically can see you in realtime and just assemble all that metadata into a big picture. So as long as your adversary is not the 5 Eyes Alliance, or any country that is clients of their services such as NATO countries then you don't need to worry about this and can just focus on remote problems."
This is pretty much what I thought. They need not even do that, since the NSA watches the entire internet, everywhere, by agreement or force, they can see what passes through it and what connects to what at different times. How on earth could they not? It would be trivially easy to see Bob's connection connecting at specific times to a Tor entry, and then see end node connections connecting at those exact times to [Website].
Are connections through hidden services somehow immune from this? Why or why not?
Say someone sets up VPN>Tor and downloads torrents or views YoutTube videos non-stop over the VPN (but not Tor) while using Tor to browse. Doesn't that obfuscate their Tor traffic from timing attacks? Why or why not?
Discuss please.
PS: To the user I quoted, you also said Virtualbox is shit/insecure. What is the best/most secure VM then? Also, how would YOU best hide your online activity from Five Eyes? And is Qubes your chosen OS? What are your other choices, if not Qubes?
Just be happy CIA FreeVPN is still around and don't use it for anything stupid.
Sebastian Perez
Dude you will not win against an intelligence agency
Jacob Allen
VPN > TOR = jail TOR > VPN = jail, but maybe
Brody Diaz
Quite the opposite, if anything. Tor>VPN creates horrible metadata and stands out, especially since the NSA, etc. watch which connections connect to Tor. There are 10,000 times more people using VPN>Tor than Tor>VPN, and you'd want to mix in with them as best as possible. And the ability for a VPN to "turn you in" is just as non-existent as using it either way, as, in either scenario, you would have to trace back through Tor to either the VPN provider, or to the Tor user.
Logan Ortiz
Stop listening to people here. They're retards that don't know anything about TOR or how it works. The NSA doesn't have a super secret math formula to track users through the network. Traffic correlation takes weeks at minimum and is rendered worthless if you never leave the onion network because they'll be no exit node. It also gives a shitload of false positives and won't hold up in a court of law. There has also never been a virtualbox exploit observed in the wild. Use KVM or Xen(the same one qubes uses) if you don't want to use virtualbox. Qubes as of course the most secure system out of the box but the least convent. Stop listing to the advice of smug morons on Jow Forums. Whonix, Tails , and Qubes all have great resources to teach you about Tor.
Cameron Phillips
Pretty much this. If you are small fish and aren't doing something very illegal, you are likely to be in a clear. CIA only works to catch the very big stuff. Although, just using tor might put you on some sort of watch list.
Caleb Edwards
What you're talking about OP is just a correlation attack, and it's why you should create your own exit nodes and bridges.
Jonathan Scott
>he doesn't know Carabineros de Chile Intelligence Agency
Thomas Harris
I'm even just using a VPN in certain places so I can connect to Tor at all.
Adrian Green
>Stop listening to people here. They're retards that don't know anything about TOR or how it works. TOR is supposed to be Tor, m8.
>The NSA doesn't have a super secret math formula to track users through the network. No, but they have tens of billions of dollars every year, and thousands of the best people working for them, and the cooperation of 4/5ths of the world, and the ability to hack and own the other 1/5th (which they do).
>Traffic correlation takes weeks at minimum How do you know this? More so, how do you know the NSA takes this long with it, and that an automated system isn't in place?
>and is rendered worthless if you never leave the onion network because they'll be no exit node. But what if you do leave the onion network, as 99.9% of Tor users specifically seek to do?
>It also gives a shitload of false positives and won't hold up in a court of law. False positives are easily weeded out in that the other 300 connections to a certain site at certain times will match still.
>Qubes as of course the most secure system out of the box but the least convent. I thought Qubes was convenient, though? Is it not easy enough for an average Windows user to use? What exactly is hard about it? I was looking forward to trying it, but that discourages me.
>Stop listing to the advice of smug morons on Jow Forums. Whonix, Tails , and Qubes all have great resources to teach you about Tor.
Am I wrong in assuming that using Whonix via VirtualBox in a Qubes VM would be more secure than using Qubes-Whonix (as packaged together), because an attacker would have to jump through VirtualBox in addition to KVM/Xen?
Thank you.
Daniel Martinez
> You should assume they have developed ways to fool the Tor relay finding algorithm in order that their spook controlled relays are chosen 1) Assuming something is always useful if you're going to be paranoid, and yes, you should not trust an outgoing node. 2) That's why you should use your own encryption on top of that. 3) If you talk about timing attacks, well... it's possible, but hard, considering it relies on the amount of data you sent through. That's why you shouldn't torrent over it, the more data, the easier timing attacks are.
Alexander Torres
This is mostly accurate. Lets not forget the idea that TOR was developed to be secure against state level actors like China and Russia, so it isn't like it can have a very easy NSA BACKDOOR ONLY DO NOT STEAL method to de-user or otherwise mess with TOR or it would mean putting people and info the US gov't would rather keep secret, vulnerable. Having something that requires one state level actor's abilities only means you need to consider other state level actors are also capable if around the same power level so to speak. No matter how great the US thinks it might be, there's nothing leaked or demonstrated that suggests they're so far ahead in capabilities of other top-tier tech powers like Russia and China, not to mention our allies like the EU and "allies" like Israel
Especially after all that is happened, leaks etc... the "we can be the only one with X exploit, or control the network or etc..." is NEVER a good choice. It would take monumental stupidity to try with that gameplan.
Andrew Powell
Just a daily reminder that Qubes is developed by a "girl"
> is NEVER a good choice. It would take monumental stupidity to try with that gameplan Or just recklessness. Remember when dh vulnerabilities in CIsco were patched. Or samba v1 vulnerabilities in WIndows, they had existed for a long time.
Luis Flores
TAKE THAT BACK.
JOANNA IS A QT AND SHE IS A REAL WOMAN, NOT A TRANS (SRS)
Anyway, why do you retards worry about the NSA? You aren't their target. Worry about Amazon, Cloudfront, Google, Facebook, and Microsoft. Tor will protect you from those fags.
Levi Gonzalez
just dont use it from your home connection or too close to your home if you are doing something that would get those after you.
James Garcia
>samba >Windows user...
Adrian Nelson
nah desu, his name is Jan Krzysztof Rutkowski, he has papers from back when he was studying in Warsaw University of Technology He also attended Black Hat a few times with his male name
I run Tor relays and I keep up with the proposals, to the best of my knowledge Tor is the safest easy to use anonymity system around. It's not designed to work against a global adversary, but in practice it is a pain in the NSA's collective asses that they can not easily break (source: leaked slides).
>It would be trivially easy to see Bob's connection connecting at specific times to a Tor entry, and then see end node connections connecting at those exact times to [Website]. Traffic analysis if far from being that simple. Tor always has several circuits open, so when you connect to a site it doesn't open a new connection except between the exit node and the site. Meaning the only thing traffic analysis can see is 512 bytes blocks of data moving from you to a guard. Then the guard constantly sending blocks to other relays, any of which could be your middle relay. Then all of those relays continuously talking to exit nodes. And when you get to the exit node, the fact that it connects to the website at a time t+guard+middle+exit is practically impossible to trace back to the 512 byte packet you sent to your guard at time t.
>Say someone sets up VPN>Tor and downloads torrents or views YoutTube videos non-stop over the VPN (but not Tor) while using Tor to browse. Doesn't that obfuscate their Tor traffic from timing attacks? No, not at all.
Easton Nelson
this cuck trusts his vpn as if they would actually wouldnt give up his data
Faggot, the most they could give up is "this encrypted Tor connection left this IP address at these times, to a destination that we don't know." The same would be with Tor>VPN, in that the VPN would still sell you out, but would still only be able to say "this Tor end node IP went to this site at these times" and then investigators would go to the ISPs to see which connections in America were going to Tor at those times, or something rather. And if you weren't using HTTPS, they would possibly be able to see what you sent and received from that site.
Thanks, m8. What do you think of Tor over Tor (but with nodes from certain countries disabled so that the problems of Tor over Tor don't happen). For example, in the first instance of Tor, you mandate only Russian, Icelandic, Panamanian, and Hong Kong nodes can be used, and then in the second instance of Tor, you exclude all of those same countries and the US. Possibly even changing the current 10 minute time that Tor re-assigns and reconfigures nodes to a lesser number of minutes, but leaving it as default 10 minutes in one instance of Tor? That might cause extra headaches.
Grayson Turner
ill go over a couple of your points, but first i want to comment on tor over tor (tor -> tor)
tor -> tor is very dangerous. the parts of tor that guard your connection are the entry guards, by going tor over tor youre adding 3 more entry guards - those same guards who may very well be compromised by the fbi or whoever else has a compromised exit node. by going tor over tor, no matter the other potential benefits, the bottom line is that youre getting 3 more guards, which means 3 more chances to be connected to a compromised node, and thus is highly, HIGHLY discouraged
now yes you are right. lets say the vpn sells you out -- now the government knows that someone was using tor and they can catch you that way. but using tor isnt illegal. thats the point. ALWAYS assume the vpn will sell you out, you should NEVER rely on them to be your last line of defense. that should always be tor. vpn -> tor is only good for when youre in china or somewhere else and using obfs3 with tor or whatever is out today just wont do.
for the rest of us in america and europeland, tor -> vpn is the way to go. always. especially if youre really a smarty, and set up whonix to protect yourself from more attacks than the average lad, and even more based is qubes + whonix
Jackson Robinson
>What do you think of Tor over Tor (but with nodes from certain countries disabled so that the problems of Tor over Tor don't happen). There's multiple problems with Tor-over-Tor really. If you limit the countries, then clearly you're going to pick relays from a much smaller pool wich in and of itself is dangerous. Next the longer the relay chain you use, the more it opens some new opportunities for traffic analysis. If one of the relays on your chain for example decides to freeze circuit X for 200ms every 1s, and that happens to be your circuit, the unnatural pattern becomes easy to spot. Only going over 3 relays is good. And then there's the more abstract idea that you're outside the safe well-known use case, the big advantage of Tor over everything else is that it has **considerable** amounts of research backing it, the moment you step out of the nominal scenario, all of those proofs and safety mechanisms no longer apply to you. So you're really just blindly hoping that your nonstandard scheme doesn't introduce any vulnerabity or break any security assumptions.
Austin Robinson
Thanks for the detail m8. I'm debating Qubes+Whonix or OpenBSD+Whonix, as Linux is pretty full of hidden security bugs, supposedly. And if you were to be hacked and Whonix jumped, you'd want them on an OS that has next to no bugs, and has built-in security, such as auto-checking for malware and changes via checksums (OpenBSD). But with how hard OpenBSD is to use, I want to try Qubes more, I think.
Thanks for that info too.
BTW, wouldn't Ungoogled Chromium over Tor be better to use than Firefox/Tor Browser, as Chrome (which is what Ungoogled Chromium is largely comprised of) is almost bug-proof?
I like this thread.
Charles Nguyen
>BTW, wouldn't Ungoogled Chromium over Tor be better to use than Firefox/Tor Browser, as Chrome (which is what Ungoogled Chromium is largely comprised of) is almost bug-proof? Tor browser has a lot of patches to prevent tracking and fingerprinting, de-googling Chromium is not enough. Instead of you want to be safe/paranoid run the Tor Browser in a sandbox (e.g. bubblewrap)
Michael Brown
Can Qubes' DE be easily customized to, say, look like this?
Maybe some VM OS, but the main dom0 isn't ever supposed to touch the internet, or something rather. I don't think you can choose a DE/theme/customization for dom0.
Julian Powell
no, because tor is about anonymity, hence why they tell you to not even adjust the size of your window when youre using tor browser. i still disable javascript, but thats the ONLY thing i do to it. the reason for this is so that all tor users have the same browser fingerprint, which is another layer of anonymity. you using some ungoogled chromium over tor is just asking to get caught, assuming they take your computer. you use the tor browser, but suspect A has a chromium fingerprint? youre free to go. suspect A has a normal everyday tor browser fingerprint and so do you? well you still have plausible deniability.
Carson Reed
this -> if youre using qubes and whonix dont you have better things to be worrying about than ricing, like making sure your router has pfsense and making sure your computer doesnt have some bios backdoors?
Eli Powell
Tor was untrustworthy the second there was a blatent attempt to character assassinate and remove Appelbaum.
Jackson Peterson
what is this meme
Henry Morales
>especially if youre really a smarty, and set up whonix to protect yourself from more attacks than the average lad, and even more based is qubes + whonix
Consider OpenBSD too. A simpler system has less components to compromise and is much easier to reason about.
Mason Carter
using openbsd as your vm in the qubes+whonix setup?
Alexander Rogers
Stop being a degenerate pedo OP
Easton Mitchell
Used directly and regularly reinstalled from a clean backup. Qubes is good, but Xen has had several security holes, so it's not infallible.
Grayson Murphy
This is true. A lot of the current project leaders are glow in the dark CIA niggers. They probably had some legal formality that required them to eject him to stay compliant with their illegal wiretapping orders. Like maybe his activism in other countries created some sort of conflict of interest in the CIA for involving themselves with the TOR project.
One thing is for sure though. Once somebody controls enough nodes on the network, traffic is instantly compromised.
David Mitchell
>They probably had some legal formality that required them to eject him to stay compliant with their illegal wiretapping orders.
Or some members were deliberately introducing security holes and he was picking up on them.
Samuel Brooks
>Tor relay Pedo?
Jason Baker
TOR is literally sponsored by the US gov. Pretty sure it was started by the US gov too. You're surprised that some CIA US gov agents are working on a US gov project?
k kid
Isaac Mitchell
>Stop being a degenerate pedo OP
Christian Carter
>implying OP isnt just trying to buy some canada weed
What is a safe alternative to accessing the onion without tor
Lucas Sullivan
Real world.
Connor Johnson
quads of TRUTH
Isaiah Price
Quads never lie. CIA niggers exposed
Jackson Diaz
no i2p nerds in here? I wish more exit nodes existed :'(
Adrian Taylor
I2P, Greener, Zeronet and so on is dead. Tor is soon too
Nicholas Harris
Freenet* Fucking shit botnet Google phone won't allow me to type that shit
Christopher Cooper
I2P is great, but unfortunately it doesn't allow you to browse the regular internet except for one or two horrendously slow exit nodes to the internet.
Why are they all dead? Why is Tor soon dead?
Jace Anderson
technically it's not anonymous. it's just that the organizations in control of it, don't have the resources to waste money on some junkie buying drugs
by those means you can protect yourself. but if the NSA wanted you, they would have by now
Juan Martinez
ITT: FUD
Cameron Wood
Normies don't give a fuck, Jow Forumsentlemen only care about ricing and "free software", not free internet. The only ones who care about it is criminals and hackers basically
Brayden Hall
Then there is the underaged fags who watched some "EPIC DARKNET STORIES" on YouTube and think it looks HELLA COOL XD, but they don't host any notes. I personally host an exit note, but that's only because I live in Scandinavia where they basically can't do shit. I do get calls from the police every now and then, but I just explain that I have an exit note and then they leave me alone
Kevin Powell
I figured since you can't solve traffic shape may as well make an IP level onion routing network. I LIKE WATCHING THE WORLD BURN :D
Henry Brooks
tl;dr do you host a note? No? Then chances are that 98% of the other users aren't either. That's why it's dying
Landon Nelson
Node* fucking shit phone
Anthony Ramirez
>blaming the phone for your shit typing
Nicholas Gutierrez
Hold up, are you saying the police in Scandinavia actually telephone call, letting you know that you may be under investigation? .. or .. are you using the term "call" as in the police making a physical visit? . . . to tip you off that you may be under investigation.? whaaaat?
David Scott
>I’m comfortable and happy being a woman, although I do realize the absurd of the rigid classification of human beings into two simple subsets: males and females, and always surprised how deeply this influences people.
Tor is just a Free Software VPN but times 3 (at least), since this chan is basically filled with dataminers (hell, it IS a dataminer) the """""""anons""""""" here will try to prove you that it is pwn'd (because it's not like drug/gun dealers, Snowden (former NSA agent that proved to us that botnet is real) Assange (Founder of WikiLeaks, also known as that smug motherfucker that tries to destroy goverments, he's cool tho, no bulli), people in countries like China, 1337 haxxors, pedophiles, etc. are using it) also, even IF something something, it's all encrypted™, yo
Looks like this faggot has made enough money to get a lot of plastic surgery. Can't hide those hands and shoulders in the picture above though
Dominic Gonzalez
no one wants to host exit nodes because they will be abused and most people wont want to deal with that
Camden Parker
They call me asking about large suspicious amounts of activity coming from my network. Tell me they got logs they can refer to and if I know anything about it. If I say no they will probably come visit me in person, but explaining the situation usually works
Jayden Gonzalez
Bump. Fags.
Brandon Miller
first reasonable response in this thread.
Camden Lopez
You're fucking retarded
yes it's safe but only if you disable everything and don't browse like a retard. Stop watching movies and shit. The government is incompetent as fuck irl
Juan Lewis
>ITT: Idiots thinking they understand Tor. Lol, Jow Forums is such a shitfest now.
Gavin Brooks
Just so you know, that isn't how Tor works.
Julian Gomez
>He doesn't understand VPN, or the fact that no non-logging VPN company has ever been used as a source of evidence in any case, ever. Why is Jow Forums full of Jow Forumstards now?
Bentley Rogers
Nice valid and credible sources you linked there OP. Oh... wait... You don't have any.
Ethan Cruz
You'd think people would know the actual design/engineering flaws that are present in Tor and not these unsolved problems that are pretty insignificant in comparison (correlation attacks).
Don't argue about VPN->Tor or Tor->VPN; if you have a brain fix these open problems and research areas. But neither you nor I have a brain.
Connor Stewart
Don't use a VPN with tor. There are attacks that may be possible on the tor network, but they are generally not feasible in the real world thanks to the size of the network and the level of noise that appears in a network that large. The internet is pretty large, and while you could collect a fuckton of timing data, there simply isn't enough processing power to really do enough with it. The best we have is probabilities. A maybe.
The best sign though is that if there's CP still on it, it still works.
Oliver Kelly
It probably still needs to use clearnet stuff like routing protocols to get to the proxy nodes
Jonathan Adams
The devs of tor care about anonymity very much, especially against state actors. A summary is that their intended users live in countries like Iran, North Korea, etc, where if your identity is discovered, you get murdered by the state. Although murdered by the state sounds like something the US does a lot too.
Anyway the point is that state actors rarely share state secrets with each other. For example, if a tor node is in russia and one is in the us, the NSA would need to know the russian switch backdoors and the cisco backdoors (I really want to find the backdoors since they'd be great for pen testing) to really do anything about it.
Problem is that then you have 'this guy uses tor' as the information extractable. For a timing attack to work you need to have compromised every single node in the chain, including the target. Not really possible. Especially since you'd need to find out what the nodes where in the first place.
Jason Bailey
Bump
Matthew Taylor
all the people publicly deanonymized despite using tor have been traced through other channels, never tor itself. the most effective way for nation states to attack tor is to tell people it is insecure, because actually breaking its security is insanely resource-intensive relative to the cost of letting an individual break the law with tor.
if you're just a regular guy or low-level criminal on tor, you're effectively anonymous. if you stole national security secrets from the americans then you should be a bit more worried, but not because of tor itself - your opsec is probably lacking in other areas and made you traceable.
Mason Bell
Desperate disinfo.
Charles Brooks
t. NSA
Carson Long
Dude you will not win against a colonial empire spanning the entire globe
Connor Rodriguez
>in order to connect to Tor you first usually establish a clearnet connection >Tor requests are easily distinguished from clear web >when you connect to Tor you contact all the nodes you're connecting to >if you connect to a malicious/NSA exit node (or any node, really) they know the exact time of connection >ISPs know exactly when you're connecting to Tor >NSA can easily get this information from ISPs >your ISP knows exactly the packet sizes of shit you download, and so do all nodes you're connected to >NSA can easily narrow you down since they know the ping and download sizes of data you're getting from Tor, if you're connected to their node >by using this information taken from ISPs about every user they can figure out your exact identity and it only gets easier the longer you're connected >therefore nobody using Tor is truly anonymous unless you reset your connection every 30 seconds
Dylan Watson
Tor is compromised since 2012 Sage & cage this trash
Benjamin Walker
If i wanted to contribute to tor what do i run, an entry node or exit node or what?
Justin Gomez
Either. Try exit node first.
Carter Baker
I wrote a toy onion routing protocol, i am convinced that it's impossible to get rid of tagging attacks just because of the nature of onion routing.
Joseph Harris
Ya'll niggas need to chill. The government really isn't this strong or has this kind of reach.
Anthony Ward
Found the CIA cuck. They probably already have quantumm computers
