|
Space Gopher posted:Tor is glacially slow, it's an active target for the FBI, NSA, and other surveillance organizations, and exit nodes are a perfect place to run man-in-the-middle attacks. The point isn't to keep your information secure; it's to keep you anonymous (which you immediately throw out the window if you're accessing a bank account tied to your personal information). Avoid Tor, and Tails, unless you have a very good reason to use it. For what it's worth, it's not terribly slow anymore (you can get a couple megabytes of download, which is enough to saturate my lovely Internet) and MITMs aren't an issue if you use HTTPS or hidden services only. I would definitely hope a banking website is using HTTPS. I encourage everybody to use Tor, but I would never encourage anybody to use plaintext communication like HTTP. If your primary concern with Tor is its speed, consider running or sponsoring a relay (not an exit node) to increase the amount of bandwidth available. You can contribute to increasing the speed of the network without any chance of legal repercussions: relays never see plain text.
|
#
¿
Aug 2, 2014 21:12
|
|
|
|
| # ¿ May 20, 2024 23:36 |
|
|
Space Gopher posted:The MITM concern with Tor is that you're letting a single untrusted node control your communication with the internet at large. Even if you're running an SSL implementation with some vulnerability, the chances for someone to exploit it are generally pretty small - either the attacker needs to have control over the local network (router, DNS server, or something similar), or national-agency level resources to pick your traffic out of backbone networks and gently caress with it. When you use Tor, the "local network" includes some node that you don't know, who can do whatever they please to your traffic. You're right, and in fact Tor seizes every opportunity to remind you that using it alone is not enough to make you safe. Anybody using Tor should augment it with encryption, be it HTTPS, SSH or GPG. There is still the danger that an exit node recording all traffic could retroactively crack your encrypted data if they later discover the keys or a vulnerability in the cipher, but your ISP, the sysadmin or any number of other people could just as easily do the same thing. I've been using full-system Tor for ideological reasons for over a year now and feel safe, because I would never send data over a plaintext protocol anyway. The irritating thing is the small but growing number of websites that indiscriminately block Tor users, which I feel is a lazy alternative to proper network security. Cloudflare, Cloudfront and Google either block me or make me fill out a CAPTCHA, so I made a key bind to establish a new Tor identity and hit it until I get an IP address they haven't seen yet. To be more on-topic regarding Tails, I would also suggest people check out Liberte Linux, a different Linux in the same realm.
|
|
#
¿
Aug 2, 2014 22:06
|
|
|
It's definitely possible that Tor is backdoored, but because leaked internal slides reveal candid frustration with Tor, and their only attack on Tor to date was an exploit in an old version of Firefox, we don't have any reason to think it's a honeypot. They could be very good liars and not want to show their hand, but I would feel much much more safe placing a bet on the security of HTTPS than the competence and integrity of my ISP or VPN provider. It's a matter of "could be attacked by a government's concerted effort" versus "absolutely definitely all traffic being logged." All that said, the relay early attack in the news right now is interesting and may be the first practical attack on the Tor network to successfully deanonymize users. Exciting times for cryptography nerds.
|
|
#
¿
Aug 3, 2014 17:06
|
|