Hacker News new | ask | show | jobs
by geofft 2432 days ago
Why not use Tor? Isn't its whole purpose to solve this problem in a trustworthy way?
3 comments

I'm no expert on Tor but when I researched it years ago, it seemed like your privacy on tor was only as safe as the exit node you happen to go through. If you're in North Korea trying to get out and happen to go through an exit node run by the NK government, they could theoretically decrypt your traffic in some cases. If all the nodes you're going through are theirs, then they know exactly who you are even if they can't inspect the traffic.

Edit: I must stress I'm not an expert, and would love to hear if the above is wrong.

No, that's not entirely true. No single node in a Tor circuit knows both who the user is and what site they are going to. In order to compromise a user's anonymity, you need to do a traffic correlation attack (where you look at packets going through both the guard node and the exit node and match up the timing of packets). There are some protections against this attack in Tor (guard nodes are not changed often by clients, relays need to be running for a long time in order to be permitted to be guards, and there is some randomised traffic sent to the guard by the client) but it is definitely not a solved problem.

But of course, if you aren't using TLS then your traffic is not encrypted as it leaves the pipe. So obviously you should use TLS over Tor.

This is more or less true. The vulnerability of Tor is certainly the exit point.

Incredibly difficult to pinpoint you as the responsible party - but that information could certainly be outputting virtually anywhere, depending on the exit node.

If you are living in a repressive regime with a lot of control over the internet backbone Tor won't protect you.

If you read the original paper the researchers spell out the weaknesses, many of which were made in the name of performance over security.

Tor doesn't work for torrenting and anything high bandwidth.
thats not true, its well documented how various bittorrent clients can work through tor. the main drawback is that its slower than a direct connection, but that does not mean it doesn't work...
https://blog.torproject.org/bittorrent-over-tor-isnt-good-id...

Also, when I said doesn't work, I only meant that it's not an acceptable alternative to VPNs.

I got the impression that it's considered bad etiquette to torrent over Tor.