http://www.torproject.org/

Can you explain this to me? Is it worth it? What about email programs? any that are truly secure an unimpinged by marketing dredging?

It is slow and offers only anonymity, and ONLY if you do not use it for information that can be tied to you.


Basically, it provides a system where you can be sending and receiving data on the internet, and the area between you and the servers that you are communicating with is simply untraceable.

The thing that people don't often understand is that the data comes out of the other end of the TOR network is then available on the internet, exactly like it would have been anyway. If that data is not also encrypted in some other way, then it is readable. So people sometimes use it for getting to web mail, thinking that it is protecting them in some way, but their username and password are still readable by snoopers.

Anyone can run a server on the TOR network (the NSA probably has quite a few, for example). Any data coming out of the network through that particular server can be recorded and kept by whoever owns that server. They will also be able to catch all of the data that is being sent back to you from who or what you are communicating with.

So, it provides anonymity in general, if

• you don't want someone to know who you are
  
• you don't unwittingly reveal who you are in your communications
  
• you get lucky and don't end up using a node controlled by a "bad" person
  
• there is not already someone who is intercepting your traffic immediately upstream from you
  
• the government doesn't come in and serve warrants which might just get them enough info to figure out who you are anyway
  

So, what do you want to be able to do?

"there is not already someone who is intercepting your traffic immediately upstream from you"

Unless i'm missing something about how it works that's one of the elements that specifically it's meant to help with. (it encrypts the the transport stream between your computer and some random end node in the tor network. meaning that if some one was sniffing the wireless network you were on, or had control of and up stream router)

Its an awesome idea flawed by a complete lack of speed.

Posted by seany "there is not already someone who is intercepting your traffic immediately upstream from you"

Well, yes. You're right. Intercepting encrypted traffic won't help the interceptor much. I was thinking about someone who is doing a man-in-the-middle attack upstream from you.

Hey peeps.

I'm new to this board, but not new to tech. I'm a big privacy/security nut. Mandias had a good summary on TOR there.

I have a couple main points to drive in:

*** TOR is great for anonymity, but HORRIBlE for security.
That means when used property and you don't transmit any data that will identify you, you're golden and even though someone can see your traffic, they cannot without a shadow of a doubt confirm that you were the origination point or destination point of the data.

BUT, a big misconception is that if no one can tell it's you, that your transmissions are secure. THEY ARE NOT. So that means you shouldn't send bank information, logins/passwords, soc security numbers, etc across it. Because the people that run the TOR routers are just average joe's like us. There is nothing stopping a router operator from sniffing your traffic that is exiting the TOR network and out the the final destination location. There was a big article that came out on this a couple years ago. Some guy just setup a router and had a bunch of confidential running through his TOR router.

Use TOR for this:
-Anonymity and plausible denyability.
-Using the internet to view content that would embarras you if your name was ever linked to it.

Don't use TOR for:
-Security
-Confidential information transfers



Background info.

TOR stands for 'The Onion Router'. It was originally developed by the US Navy. I forget exactly why. Now the technology is in the public domain. It's called the onion router due to the layers of routing that you can keep peeling, like an onion.

What makes TOR different than a normal internet router is that each router 'forgets' where it gets its traffic from. So for example, if you run a website and you see traffic from IP A.A.A.A and want to identify the actual user, you contact the operator of A.A.A.A and request their logs. But the thing is, the traffic on your site didn't actually originate from router A.A.A.A, the traffic actually came through a different router before that. But since A.A.A.A is a TOR router, you can't find out that it really got its traffic from B.B.B.B who 'forgot' that it got it's data from C.C.C.C, who forgot the traffic came from D.D.D.D who forgot the traffic came from your computer.

Also, each of those routers is also most likely in a different country and on different continents. That way if any of the routers are compromised, there are still more layers of the onion that aren't and your anonymity is still maintained.

Posted by trent BUT, a big misconception is that if no one can tell it's you, that your transmissions are secure. THEY ARE NOT. So that means you shouldn't send bank information, logins/passwords, soc security numbers, etc across it. Because the people that run the TOR routers are just average joe's like us. There is nothing stopping a router operator from sniffing your traffic that is exiting the TOR network and out the the final destination location. There was a big article that came out on this a couple years ago. Some guy just setup a router and had a bunch of confidential running through his TOR router.

wow...yuck...I really thought that TOR used an encryption tunnel similar to VPN.

I don't know if TOR has changed now or anything, but last time I used it, it was so slow that it was completely unusable and impractical. But I love the concept.

Man, I cannot wait until people decide to hurry the fuck up about switching to IPv6, which adds encryption at the OSI layer 3. You would think with all the ridiculous legal stuff going on right now involving P2P networks, this would motivate people to finally start making the switch. Apparently not...

::sigh::

Encrypt your data. Hope your lines are clean between your NIC and the internet backbone your ISP uses - you have little control over that routing. Don't act like you when in 'top seekrit' mode. Paranoia has its price!

I wasn't being paranoid, just curious.