Hacker News new | ask | show | jobs
by andoon 3362 days ago
I know this opinion is not going to be popular, but here it goes: by running a Tor exit, you're letting anonymous people do whatever they want in your behalf, because the exit IP address relates their activities to you. I believe it's irresponsible to do so. This kind of stuff is going to happen.

I also don't believe the "an IP address doesn't identify a person" mantra that's so widely used in the privacy-aware circles. Your ISP gives you an IP address for yourself, and if you let others use it, you know you can get yourself in trouble, the same you'd get yourself in trouble if you let anybody who asked you use a rifle of yours, or a car. Would you let someone you don't know at all drive your car? What if he runs over someone? Would you be responsible of it for letting him use your car? Would you risk going to prison?

The alternative is worse: I could be looking at pedophilia or terrorism sites all day and if they catch me say "well I also run a Tor exit node so how do you prove it was me!". Your IP identifies you, so be responsible!

6 comments

> I could be looking at pedophilia or terrorism sites all day and if they catch me say "well I also run a Tor exit node so how do you prove it was me!"

Why would that be a problem, looking at things on the internet?

But advocating to sacrifice anonymity is a problem. It makes those fighting governments very vulnerable and easily silenced. And gives a way for governments to take action against anonymity.

I also agree that merely looking at things shouldn't be illegal, no matter how offensive or disturbing the content is. After all, we wouldn't arrest someone for reading a book, and there are some pretty fucked up books out there. So why is it different with the internet?
In the case of child porn, the typical argument is that even downloading/viewing/possessing it exploits the victim(s).

Personally, I'd prefer the law enforcement emphasis to stay on those creating/buying/selling/distributing child porn, but oh well.

The idea is, if there is demand, there will be offer to match it. War on Drugs all over again. And now with ads, merely watching videos on YouTube makes one an actor in the economy around this kind of videos.

As for child porn, I bet a good chunk (most?) of the content is directly paid. Such transactions do encourage the corresponding offer. This works for regular online stores, so it most likely work for child porn as well.

Now if the downloading or hoarding of the data doesn't imply any direct or indirect transaction to the benefit of the provider… that probably doesn't help exploitation one bit. But you have to be careful not to perform or facilitate such transactions —or just stay the hell away.

"As for child porn, I bet a good chunk (most?) of the content is directly paid."

What I allways heard in this debate (from privacy activists) is, that most of the stuff is actually shared noncomercial in closed circels. And to get into such a circle you would have to provide them with fresh material (made by yourself).

But on a quick check, I could not find reliable numbers(or those claims), but I guess they would be hard to get in the first place.

Anyhow, I agree that total surveillance would for sure reduce horrible crimes ... But I rather have privacy and police focused on the actual crimes happening.

And the actual crime in this case is the production. And even though it does might lower the barriers for some if they can savely pay/consume for CP, and therefore increase production, I can imagine the danger is a kick for others as well.

And even if we could manage to ban all CP from the internet, then those people might want to get their kicks then in real life.

Anyhow, I think that is where society has to focus on - the actual fucked up people. And there are plenty of them around and they won't go away, because you lock them off from their sick internet kicks.

But on the other hand, yes, it might be easier for police etc. to keep track of them, if they are not anonymus. Unfortunately I think that most people wanting to eliminate privacy don't care at all about the children, but rather want plain power.

And there are good reasons to not trust governments who wants to know everything about the people but not wanting the people to know about what they are doing ...

I mean, we are even talking about russia here. Would you trust them?

Again, I'm going to use the War on Drug. They cracked down on users, and it plain didn't work. Do reduce drug demand, you want to help users, not put them in jail. And also help unhappy people in general —in practical terms, this often means helping poor people, that is, having a functioning welfare system.

Child porn may be similar. I don't know.

And of course total surveillance is too high a price to pay. I'd rather have some more child abuse and some more "terrorism" and a little bit more crime, if that's the price we have to pay for privacy (and I'm not even sure we do). As much as I don't like horrible stuff happening, total surveillance is much worse —if only because of the sheer number and comprehensiveness of the effects. I'll take torture over dust speck¹.

http://lesswrong.com/lw/kn/torture_vs_dust_specks/

The internet is faster and more accessible than publishing a book, which makes government critters anxious that people will use it to spread controversial ideas and eventually take down the establishment.
> and eventually take down the establishment.

That last one is kinda inevitable. The internet, even the spied centralised version we see at Facebook and Gmail, has a flattening effect: for the first time in recorded History, people can write. And other people respond to them. Even the printing press failed to achieve that —mostly.

Sure, there are bubbles and such, but there no escaping the fact that public forums train people in public debates. This will have a political effect.

Now I can only hope the transition will not be too bloody.

> and eventually take down the establishment.

>> That last one is kinda inevitable.

It allways is and was. Happened allready many times, it is called human history ;)

> ...the same you'd get yourself in trouble if you let anybody who asked you use a rifle of yours.

You lost me here. This is more like letting someone make a call with your phone. Rifles are inherently dangerous, even gun enthusiasts agree on that. We're talking about information more broadly here.

If I lend my neighbor my rifle and he kills someone or something that wasn't legal to kill, it isn't my problem - as long as he was legal posses a firearm. This isn't the same as sharing your IP address.

A shared IP address can be in use by me and my "friends" on Tor - at the same time. A rifle is only in the hands of one person at a time.

If you put a phone booth on the street in front of your house or business, like a free phone booth, are you liable for the contents of the calls placed on it? What if there were two phones? A hundred?

What if it wasn't a phone but a mailbox? A big chalk board? A bulletin board?

What if it weren't a mailbox but a free parking lot? Bob could put a thumb drive in his glove compartment, park his car, and then have Alice pick it up. Am I liable for what's on that drive because I provided free parking that was used as a medium for illegal information?

That why I think sharing things with strangers cannot logically make you liable for their speech and information.

Having a free-to-use shotgun and a box of shells in front of your house is an entirely different question. That's why I said the analogy was a poor one.

When the police find the weapon, they'll see it's registered by you and knock on the door.

You're not gonna have a fun experience explaining that you lend your rifles to your neighbour at the time of the murder.

> This is more like letting someone make a call with your phone

If someone uses my phone to make a threatening phone call, I'm probably first in line to be investigated. Just because it's not inherently dangerous, or would result in legal consequences for the phone owner, doesn't mean it is a risk-free thing to do.

> If someone uses my phone to make a threatening phone call, I'm probably first in line to be investigated.

Sure. There are practical consequences. But if it's a working phone booth on the sidewalk out front, the prosecutor can't prove much with "it was your phone". Of course, you could be put through the wringer or even convicted based on really flimsy evidence.

For what reason would a person want to use Tor instead of his regular connection?

And before you tell me Tor is nothing more than a privacy tool, remember that most sites ban Tor exits because the majority of users are troublemakers.

Seriously? I imagine >95% of consumers would adopt tor quickly if browsing performance was comparable to standard browsing (hell it would be packaged with firefox). The general public hates being tracked and having their privacy invaded. Just look at the political mess created when congress gave ISP's the right to sell user browsing data at the end of last month.
> hell it would be packaged with firefox

It already is, unofficially. If you download the right version.

>The general public hates being tracked and having their privacy invaded. Just look at the political mess created when congress gave ISP's the right to sell user browsing data at the end of last month.

You gotta be kidding me. If that were the case nobody would ever use Facebook, or browse the web without an ad blocker and blocking 3rd party cookies. I also like privacy but we have to understand that nobody really cares about that. Maybe it's because they are not educated and don't know what the risks are, but whatever the reason, privacy is ignored by most people.

In the case of Facebook, users might very well not know the extent by which Facebook tracks them. In the case of ad-blockers, users (at least those I've met) tend to not know they exist, and are excited to try them out.
I'm not sure the general public sees ad blocking as an ethically green area. More of a grey area so many aren't comfortable doing it even if they love the experience.
You can opt out of Facebook though, or set up a fake account.
>And before you tell me Tor is nothing more than a privacy tool, remember that most sites ban Tor exits because the majority of users are troublemakers.

So... don't tell you the truth, because you've already decided that a bunch of anonymous people are "bad".

Have you ever considered a career in law enforcement or politics?

What's the truth? Most websites require you to fill a captcha, confirm your mobile number, or simply block you if you happen to use the service from a Tor exit. That's something you can check yourself, go to the big sites (Alexa top for example), and see it. Even Hacker News shows you a captcha if you register from Tor.

Do you believe those sites are in some kind of major plot to bother Tor users, or they simply are fed up with the abuse coming from Tor? Ockham's razor.

> Ockham's razor

state actors are annoyed by whistleblowers. tor is useful to whistleblowers. tor is bad.

Are you talking about most websites worldwide, or most websites in US specifically, or the West in general?

Because if it's the latter, then your sample suffers from rather extreme selection bias.

> For what reason would a person want to use Tor instead of his regular connection?

If I'm doing some background research for my work, I don't want to have to wonder if my ISP will sell me out, allowing a competitor to know what I've been up to.

If I'm hanging around gear head websites and letting people know just what a drooling fanboy I am for the products of a particular car company, I really don't want my ISP to sell me out and let the local car dealer know.

> because the majority of users are troublemakers

This statement is actually wrong. The majority of users are probably normal people. The majority of the traffic coming from exit nodes, though, may come from scripts/bots ; but that is a really small percentage of users.

IP address is too weak point of such failure. Your wifi password can leak or be guessed, and wired connection can have mitm so easily. Trojans may operate as exit nodes of some dark network. IP should not be used as identity in any way even in investigation process (not to mention courts). IP doesn't identify you, it simply leads to your connection point.

In practice though, these clinical cretins can throw you into russian jail for two months without taking counter-evidence into account. Just because.

> the same you'd get yourself in trouble if you let anybody who asked you use a rifle of yours.

If someone borrows my car and crashes into someone else, I'm not legally responsible. Same goes for companies that let anyone use their cars, like rental services.

This story illustrates why Tor will never actually bring down a repressive regime. Tor appears to be based on the idea that if you can't prove who actually said something, then you can't punish them. Repressive regimes can punish those people anyway.
You're missing a key point. Consider North Korea. I doubt that there are many Tor exits there. But if North Koreans can access Tor, they can use exits elsewhere. And it's unlikely that the North Korean government will be assassinating Tor exit operators. So there's nobody for it to punish.
North Koreans, outside of a select few, can't access the internet, and thus can't access Tor anyway.
OK, so make it Americans. I don't believe that the US is prosecuting foreign Tor relay operators, either.
I know ​the US isn't perfect, but is it the kind of repressive regime that the Tor project talks about? Or, to put it another way, should Tor consider it a success that they can take down regimes no more repressive than the US?
I won't be drawn into a debate on relative repressiveness. But consider how LGBT activists were generally harassed a decade or two ago. And still are, in some parts of the US. Or the War on Drugs.

I'm sure that some Tor supporters in the CIA are hot on taking down particular regimes. But I don't recall seeing that as an official Tor Project use case.

Regarding the example of North Korea, I'm sure that there are ways of hitting Tor. At least, if you can reach the Internet at all. Maybe it's not worth the risk, however.

Honest question, its not illegal to run an unrestricted wifi access point, and you can't be held accountable for others using that ip for illegal means in court today. So how does this differ from running a TOR exit node?
Well, in Russia it is illegal to run an unrestricted wifi access point - since 2014 you're technically supposed to verify identities of everyone you give access. Many don't, but it's technically illegal - so if they don't like you for whatever reason, then that wifi will be valid reason to punish you, by making you accountable for others using that for illegal means.

And people in Russia have went to jail literally for pressing 'Like' on a single post.