how-to block ads
|
Daniel
Premium,MVM
join:2000-06-26
Pleasanton, CA
clubs: 
| reply to Daniel
Re: Anonymnity: Introduction To The Tor Network
1. You have to be on the exit node for that to work, as the other two hops only see encrypted traffic.
2. You have to hope that the user doesn't notice/ignores certificate errors.
--
dmiessler.com - grep understanding knowledge | |
Wildcatboy
Premium,Mod
join:2000-10-30
Toronto, ON |
In other words Tor doesn't have anything in place to prevent that? | |
novaflare
The Dragon Was Here
Premium
join:2002-01-24
Barberton, OH
| reply to Daniel
said by Daniel  :1. You have to be on the exit node for that to work, as the other two hops only see encrypted traffic. 2. You have to hope that the user doesn't notice/ignores certificate errors. Most often no warning is given over a cached page. Neww egg gives no warrnign hell even my bank first merit likly doesnt. Often times what you see on your raw unproxied connection is a page fead to you by your isp. Many dsl providers do this and alot of dialups do. 75% of au broadband for example is provded by a single company. This one company uses a squid proxy set to cache all web pages. No cert warnings are ever given by most web sites. Thos that do give a warning end up essentialy being off limits as they will flat out refuse a ip that has a proxy shown to be a caching proxy. These sites have known for years how dangerous such proxies truely are.
I only see tor being used for one purpose and that is for trolls on irc in games and on forums to dodge bans.
--
DSLR security chat at us.ausirc.net chanel #dslr_sec lets pack this channelopen source dns server for *nix and windows »powerdns.com | |
jp10558
Premium
join:2005-06-24
Willseyville, NY
| reply to Wildcatboy
said by Wildcatboy :I think what novaflare has been trying to say and hasn't been successful in conveying it, is that each Tor server belongs to a totally unknown and most likely untrusted user. The fact that the communication is encrypted won't be enough to stop compromise of your data. I too haven't had a chance to read the complete overview of Tor but it would be great if someone could clarify this for me: Let's say I build a Tor server and I also run a proxy server on it that directs all requests for paypal.com, eBay.com, major banks, etc... to my own version of those web pages residing on my server. What in Tor system prevents me from redirecting you to may page? You as a user try to go to paypal, you see my version of it which by the way is quite convincing and you enter your username and password. You can't login and you say to yourself "Oops, Paypal must be down." and move on. I have your password and the encryption didn't do anything. So can someone tell me how Tor prevents me from doing that and what safeguards are in place? This is a question that novaflare has been asking and I haven't seen an answer for it yet or perhaps I missed it. Well, with paypal - it is SSL before you ever enter your password. So, paypal prevents it with or without tor. eBay is the same. So, unless you somehow get a verisign SSL cert claiming you are eBay or Paypal, I don't get the problem...
Every financial site I've seen is like this - and if you are in the habit of paying for things without it being secure, TOR isn't going to help - but I doubt it will hurt either.
So, yes, I suppose you could spoof yahoo e-mail, but who's using TOR to access their e-mail anyway? I mean, if you have to authenticate yourself to the end site, I don't see how it was worth all the anonymizing steps...
And if you mean to say you're spoofing google search, you're not getting private info that way...
--
Opera 8.02(Build 7680); Windows XP Pro SP2;Athlon 64 3400+; 1GB PC3200 DDR; 1M/128k DSL; NOD32(Version 2.5.25); Sygate Pro 5.5(Build 2637);Proxomitron 4.5j Grypen 7/26/05(Opera mod),GPG ID:0x0A1C6EE3 | |
novaflare
The Dragon Was Here
Premium
join:2002-01-24
Barberton, OH
| said by jp10558 :said by Wildcatboy :I think what novaflare has been trying to say and hasn't been successful in conveying it, is that each Tor server belongs to a totally unknown and most likely untrusted user. The fact that the communication is encrypted won't be enough to stop compromise of your data. I too haven't had a chance to read the complete overview of Tor but it would be great if someone could clarify this for me: Let's say I build a Tor server and I also run a proxy server on it that directs all requests for paypal.com, eBay.com, major banks, etc... to my own version of those web pages residing on my server. What in Tor system prevents me from redirecting you to may page? You as a user try to go to paypal, you see my version of it which by the way is quite convincing and you enter your username and password. You can't login and you say to yourself "Oops, Paypal must be down." and move on. I have your password and the encryption didn't do anything. So can someone tell me how Tor prevents me from doing that and what safeguards are in place? This is a question that novaflare has been asking and I haven't seen an answer for it yet or perhaps I missed it. Well, with paypal - it is SSL before you ever enter your password. So, paypal prevents it with or without tor. eBay is the same. So, unless you somehow get a verisign SSL cert claiming you are eBay or Paypal, I don't get the problem... Every financial site I've seen is like this - and if you are in the habit of paying for things without it being secure, TOR isn't going to help - but I doubt it will hurt either. So, yes, I suppose you could spoof yahoo e-mail, but who's using TOR to access their e-mail anyway? I mean, if you have to authenticate yourself to the end site, I don't see how it was worth all the anonymizing steps... And if you mean to say you're spoofing google search, you're not getting private info that way... when your entering info in to a moded cached page it does not matter how secure the real site is. SSL never plays a part. Hell why even bother presenting the user with a cert fake or real. Most will asume this is normal and just enter and submit away. Url will show correct anti fishing apps and meathods will be no good etc.
--
DSLR security chat at us.ausirc.net chanel #dslr_sec lets pack this channelopen source dns server for *nix and windows »powerdns.com | |
jp10558
Premium
join:2005-06-24
Willseyville, NY
| said by novaflare :said by jp10558 :said by Wildcatboy :I think what novaflare has been trying to say and hasn't been successful in conveying it, is that each Tor server belongs to a totally unknown and most likely untrusted user. The fact that the communication is encrypted won't be enough to stop compromise of your data. I too haven't had a chance to read the complete overview of Tor but it would be great if someone could clarify this for me: Let's say I build a Tor server and I also run a proxy server on it that directs all requests for paypal.com, eBay.com, major banks, etc... to my own version of those web pages residing on my server. What in Tor system prevents me from redirecting you to may page? You as a user try to go to paypal, you see my version of it which by the way is quite convincing and you enter your username and password. You can't login and you say to yourself "Oops, Paypal must be down." and move on. I have your password and the encryption didn't do anything. So can someone tell me how Tor prevents me from doing that and what safeguards are in place? This is a question that novaflare has been asking and I haven't seen an answer for it yet or perhaps I missed it. Well, with paypal - it is SSL before you ever enter your password. So, paypal prevents it with or without tor. eBay is the same. So, unless you somehow get a verisign SSL cert claiming you are eBay or Paypal, I don't get the problem... Every financial site I've seen is like this - and if you are in the habit of paying for things without it being secure, TOR isn't going to help - but I doubt it will hurt either. So, yes, I suppose you could spoof yahoo e-mail, but who's using TOR to access their e-mail anyway? I mean, if you have to authenticate yourself to the end site, I don't see how it was worth all the anonymizing steps... And if you mean to say you're spoofing google search, you're not getting private info that way... when your entering info in to a moded cached page it does not matter how secure the real site is. SSL never plays a part. Hell why even bother presenting the user with a cert fake or real. Most will asume this is normal and just enter and submit away. Url will show correct anti fishing apps and meathods will be no good etc. Ok, I don't know about IE, but in Opera, there's this big yellow bar that shows up in the address bar when the site is secure. It's not there if the site isn't SSL authenticated. If you have a spoof that pulls up that bar without a SSL Cert, I want to see it, so I can report the vulnerability to Opera.
At some point, you can't protect ignorant people. If these are the people falling for the nigerian scams etc... it doesn't matter if they have TOR or not. As I said before, there are numerous equivelent methods to phish them, and they are at equal risk without TOR.
Moreso, I'm guessing the people who even know about TOR, much less can manage to set it up, aren't technical neophytes, nor the best targets for phishing. IE, the people who don't use IE, and who know to look for SSL auth before inputting their CC#.
I'd also guess that these people would realise there is little point of using TOR to then tell the site who you are, where you live, and your CC# to order something on a legit site. There's little point using TOR to check yahoo e-mail, as I said before, if you are going to ID yourself to the end site, don't wast the time or overhead with TOR. It's pointless.
OTOH, if you aren't going to those sites for the reasons above, then the possible spoof sites aren't going to garner much information - One, you'll be seeing/spoofing the equivelent of google search, two, you'll only get 1-2 minutes of data before TOR yanks them to a different endpoint, so not enough to do much data anylsis on searches or whatever...
--
Opera 8.02(Build 7680); Windows XP Pro SP2;Athlon 64 3400+; 1GB PC3200 DDR; 1M/128k DSL; NOD32(Version 2.5.25); Sygate Pro 5.5(Build 2637);Proxomitron 4.5j Grypen 7/26/05(Opera mod),GPG ID:0x0A1C6EE3 | |
BeesTea
Network Janitor
Premium,VIP
join:2003-03-08
00000
| reply to Wildcatboy
said by Wildcatboy :In other words Tor doesn't have anything in place to prevent that? Nothing on the internet does. This was the point of people mentioning SSL. Routing as a whole is subject to this attack, TOR or otherwise. Stream hardening, other than hiding the source IP, is not an intended function of Onion Routing. That's the application's job to ensure.
--
"I can't stand the package managers that come with Linux. RPM, Portage, and the rest don't even let you build from source. The ports collection was all I needed." - Some FreeBSD jackass | |
B
Premium,MVM
join:2000-10-28
| And again, I find that a disingenuous stance, precisely because by using Tor you seem to be ADDING an entire layer of significantly untrustworthy "routers" (possibly compromised individual PCs) to your packets' data path.
It's not at all comparable to the normal set of Internet routers your packets would otherwise traverse. As I said, I generally (and relatively) trust those.
It's not a huge problem as long as Tor users understand that, but I don't like to see this rather significant failing glossed over with a wave of an https-encrusted hand. 
-- B
--
In a realm outside causality and function | |
Wildcatboy
Premium,Mod
join:2000-10-30
Toronto, ON
Host:
Security Product V..
Security
| reply to BeesTea
said by BeesTea :Nothing on the internet does. Yes, I'm aware of that but as B mentioned, in this particular instance, this is a problem that using Tor will create for me so it's reasonable to expect Tor to attempt to remedy it.
The thing is that when I see a thread promoting something as at least interesting, it's willingly or unwillingly promoting its use and that's when we need to make sure people understand the whole concept before start loving something. I also see questions by novaflare that are being brushed off as irrelevant or unrelated but they're not. Instead of actually answering those concerns I see him being portrayed as someone who doesn't know what he's talking about.
In terms of the vulnerability I mentioned, SSL does nothing. We've all seen successful phishing attempts and this one is no different and is guaranteed to be successful on the Tor network. The fact that the world is an insecure place does not make Tor's vulnerability OK.
The point I was trying to convey is that although a few attempts have been made to make Tor Network a bit more anonymous, No serious attempt has been made to make it more secure than the average anonymous proxy server on the Internet.
Again I haven't had a chance to read everything there is about the Tor Network but I assume those of you who promote it know enough about it to help me understand.
Another thing that would be interesting to know is whether middle hops can masquerade as last hops. If hop 3 can effectively masquerade itself as being the last hop, then the encryption is useless too. In that case every single node can compromise the data and not only the last hop. Not sure if that's possible with how the Network is designed but someone might be able to shed a light on that.
In addition to that using fancy words like "Onion Routers" in my view mask the fact that those are nothing but home computers with a Tor server installed and put up by the average Joe. There's no organization that oversees the Network and takes responsibility for what happens on the Network. These are not your ISP's routers that you can trust to a certain point. These are practically all untrusted home computers run by untrusted and in some cases incompetent or malicious users.
People in this forum worry about minute problems to a point of paranoia. They talk about man in the middle attacks that may never, ever happen in a lifetime of an average home user and then we're talking about intentionally directing your own traffic to an untrusted computer?
--
You can catch the Devil, but you can't hold him long. | |
BeesTea
Network Janitor
Premium,VIP
join:2003-03-08
00000
| reply to B
said by B :I don't like to see this rather significant failing glossed over with a wave of an https-encrusted hand. I don't understand how it is a failure. It isn't an intended purpose, therefore cannot be a failure.
I also don't recommend trusting routers on the internet. They're no more trustable than anything else you don't control. It has always been that way and why there are things like SSL, PGP, etc.
--
"I can't stand the package managers that come with Linux. RPM, Portage, and the rest don't even let you build from source. The ports collection was all I needed." - Some FreeBSD jackass | |
lawrence171
Evilly Yours - Evilness
join:2001-12-24
Canada | reply to Daniel
So, this is just bouncing connections around... How does this prevent people from tracing the source of the packets/data?
--
What I used to be I no longer am... God, why can't you freeze time for my sake? | |
B
Premium,MVM
join:2000-10-28
| reply to BeesTea
Of course it's a failing for those who might want to use it for normal plain text yet personal Internet access. You simply can't separate the service from its implementation! It's intended to be used by real people on the real Internet, right?
On the real Internet, thousands of routers owned by ISPs (most with a vested interest in their network) pass your packets for you.
With The Onion Routing network, thousands of individual PCs (of no known provenance and owned by individuals or corporations with no vested interest in the viability of the network, without even mentioning the obvious implications of a compromised PC that can run malware unheard of on a common Cisco or Juniper router) pass your packets for you.
They're not comparable. We always talk about security in layers. We talk about levels of verifiability and trust.
Sending packets over any network of proxies is almost by definition submitting your data to additional possible risk over and above that of compromised Internet routers.
Your stance almost seems to be "it doesn't matter what other risks Tor adds, as long as it fulfills its IP address obscuring purpose". And that just seems silly to me. If it's only suitable for SSL connections, we should say so. Or if it adds only moderate risk to unencrypted Internet communications, we should simply acknowledge that.
Saying the last hop exposure is not a failing because it's not intended to protect unencrypted communication is a little like saying a race car with no seat has no failing as long as it can go fast.
-- B
--
In a realm outside causality and function | |
BeesTea
Network Janitor
Premium,VIP
join:2003-03-08
00000
| reply to Wildcatboy
said by Wildcatboy :Yes, I'm aware of that but as B mentioned, in this particular instance, this is a problem that using Tor will create for me so it's reasonable to expect Tor to attempt to remedy it. TOR doesn't create that problem any more than someone making a router advertise a route that doesn't belong to them. That happens every day.
said by Wildcatboy :I also see questions by novaflare that are being brushed off as irrelevant or unrelated but they're not. Instead of actually answering those concerns I see him being portrayed as someone who doesn't know what he's talking about. They're as relevant as arguing that some text editor is a failure because it doesn't play mp3's. Arguing that something doesn't do something it's not intended to do is pointless.
said by Wildcatboy :In terms of the vulnerability I mentioned, SSL does nothing. We've all seen successful phishing attempts and this one is no different and is guaranteed to be successful on the Tor network. The fact that the world is an insecure place does not make Tor's vulnerability OK. It isn't TOR's vulnerability. If someone can redirect IP traffic to a host, fake the CN including DNS, and present a cert signed by a CA in your browser, then sure, SSL does nothing. That's the same with any routing, not TOR specific.
said by Wildcatboy :The point I was trying to convey is that although a few attempts have been made to make Tor Network a bit more anonymous, No serious attempt has been made to make it more secure than the average anonymous proxy server on the Internet. It's advantage over the random proxy server is that it automatically links multiple proxies together and encrypts the data between the middle hops. Nothing more.
said by Wildcatboy :Again I haven't had a chance to read everything there is about the Tor Network but I assume those of you who promote it know enough about it to help me understand. I don't promote it, infact I think it's a huge mistake for other reasons that I can't discuss here. I only posted regarding that because it was infact a pointless argument.
said by Wildcatboy :Another thing that would be interesting to know is whether middle hops can masquerade as last hops. If hop 3 can effectively masquerade itself as being the last hop, then the encryption is useless too. In that case every single node can compromise the data and not only the last hop. Not sure if that's possible with how the Network is designed but someone might be able to shed a light on that. Middle hops are end hops are first hops and middle hops. It is only for the purpose of making a trace to the source IP that encryption is used at all. Not to secure data.
said by Wildcatboy :In addition to that using fancy words like "Onion Routers" in my view mask the fact that those are nothing but home computers with a Tor server installed and put up by the average Joe. There's no organization that oversees the Network and takes responsibility for what happens on the Network. These are not your ISP's routers that you can trust to a certain point. These are practically all untrusted home computers run by untrusted and in some cases incompetent or malicious users. The org responsible is the EFF, and they set no higher standards than ICANN does for putting a router on the internet. The name is something you'll have to take up with them. Personally, I think it describes it rather well.
said by Wildcatboy :People in this forum worry about minute problems to a point of paranoia. They talk about man in the middle attacks that may never, ever happen in a lifetime of an average home user and then we're talking about intentionally directing your own traffic to an untrusted computer? How is this different than normal routing ?
IP is not a secure end to end protocol as it is. That's why cryptography has been applied to it in hopes of securing the data it carries.
I guess I don't understand where the idea that TOR is anything but a bunch of routers that scrambles the hops comes from. It isn't in the spec for the project.
--
"I can't stand the package managers that come with Linux. RPM, Portage, and the rest don't even let you build from source. The ports collection was all I needed." - Some FreeBSD jackass | |
BeesTea
Network Janitor
Premium,VIP
join:2003-03-08
00000
| reply to B
said by B :Your stance almost seems to be "it doesn't matter what other risks Tor adds, as long as it fulfills its IP address obscuring purpose". And that just seems silly to me. If it's only suitable for SSL connections, we should say so. Or if it adds only moderate risk to unencrypted Internet communications, we should simply acknowledge that. It doesn't add any risk, that risk is already there.
I think you guys should read the TOR paper that describes what it does. It isn't SSH, it's a routing project subject to all the same risks as regular routers. Router compromise, misconfiguration, etc are all still problems and TOR makes no attempt to fix them.
--
"I can't stand the package managers that come with Linux. RPM, Portage, and the rest don't even let you build from source. The ports collection was all I needed." - Some FreeBSD jackass | |
NeOmega
join:2004-11-18
| reply to BeesTea
I don't get it.
You can use a technique where you ping out looking for a usable proxy one by one... or you can use Tor.
Tor will not make you any more secure... except it will make you anonymous in most senses of the word, and it will hide your activity, (unless the FBI were to one day subpeona a Tor server, which has not happened yet, according to the FAQ)
Here is a list of other things Tor will not do:
•mow your lawn
•Do your integral calculus homework
•cook a duck a l'orange
•post witty lists on BBR for you
•make you smarter
I can't even imagine why you would want to be anonymous, while entering a CC card with your name on it, unless you were attempting fraud. | |
Daniel
Premium,MVM
join:2000-06-26
Pleasanton, CA
clubs:
| reply to Daniel
Hmm, well let me just say...crow tastes good. This isn't to say that the issue is major, but it most definitely is worthy of discussion. And now, thanks to WCB, I see what novaflare's been trying to say all this time.
My apologies to novaflare for lumping him into the troll category.
Now that I see the point, let me see if I can articulate it. The problem is not different than everyday routing in the sense of the technology, but it is fundamentally different in one major way. You can't ever set up an Internet router on your own machine and have people route through it.
In other words, the sniffing of Internet routers isn't headline news because it's not particularly easy. This system, however, makes it so that if you happen to have a Tor server that's in the exit router role, you do get to act like an Internet router.
WCB, as for your ability to pretend you're a third hop, I don't think that's how it works. Bascially, there is encryption with each hop, and the chain is setup beforehand. So even if you were able to switch your role somehow in the middle, you wouldn't be able to decrypt the traffic. That's my understanding as of right now.
But yes, this is definitely something interesting...my regrets again for not trying harder to see the diamond from within the rough.
--
dmiessler.com - grep understanding knowledge | |
NeOmega
join:2004-11-18
| reply to NeOmega
from one of my favorite sites, »www.searchlores.org/anonion.htm
Paranoid? - yes, you are which doesn't mean you're wrong: someone may indeed be trying to monitor the traffic that passes through the anonymous proxies that you're using. Why else would they set up free proxies, duh?
Now, unless you're a ruthless criminal, your browsing is safe. Just don't use anon proxies to do anything really stupid that could land you in a sea of trouble, anon or no anon. Anon proxies should be used like gloves (to touch sites/servers you don't trust) and/or shades (stay anonymous in the crowd), not like weapons. | |
jp10558
Premium
join:2005-06-24
Willseyville, NY
| reply to Daniel
said by Daniel :Hmm, well let me just say...crow tastes good. This isn't to say that the issue is major, but it most definitely is worthy of discussion. And now, thanks to WCB, I see what novaflare's been trying to say all this time. My apologies to novaflare for lumping him into the troll category. Now that I see the point, let me see if I can articulate it. The problem is not different than everyday routing in the sense of the technology, but it is fundamentally different in one major way. You can't ever set up an Internet router on your own machine and have people route through it.In other words, the sniffing of Internet routers isn't headline news because it's not particularly easy. This system, however, makes it so that if you happen to have a Tor server that's in the exit router role, you do get to act like an Internet router. WCB, as for your ability to pretend you're a third hop, I don't think that's how it works. Bascially, there is encryption with each hop, and the chain is setup beforehand. So even if you were able to switch your role somehow in the middle, you wouldn't be able to decrypt the traffic. That's my understanding as of right now. But yes, this is definitely something interesting...my regrets again for not trying harder to see the diamond from within the rough. Ok, I sort of get the idea - most people cannot setup an internet router because of cost, location, and peering issues. However, most people could set up a TOR router, because that only requires an internet connected PC + some knowledge.
For this reason, you trust the TOR endpoints less. Specifically because they aren't professionally maintained.
I get that. However, I guess I don't see how it matters much - I don't trust the internet routers either - there are DNS poisoning attacks, shifty companies, hackers, IOS vulnerabilities etc, which all together don't make me think they are even close to immune to being hijacked.
The best I can see is that you think the probability of being redirected or sniffed is greater from a TOR router than from an Internet Router. I grant that is likely true.
I still don't get how that really matters in the big scheme of things. All of you crying doom - please respond to my last post where I bring up things like phishing, SSL, and the outright stupidity of using a anon proxy chain to then authenticate yourself and why anyone would bother.
To me the whole argument against TOR seems so far to be - TOR may open you up to a phish attempt.
My response is still - so what? So does just being online. So does reading your e-mail. So does getting spyware/malware. Etc.
--
Opera 8.02(Build 7680); Windows XP Pro SP2;Athlon 64 3400+; 1GB PC3200 DDR; 1M/128k DSL; NOD32(Version 2.5.25); Sygate Pro 5.5(Build 2637);Proxomitron 4.5j Grypen 7/26/05(Opera mod),GPG ID:0x0A1C6EE3 | |
novaflare
The Dragon Was Here
Premium
join:2002-01-24
Barberton, OH
| reply to BeesTea
I was gona try to edit beesteas qoute in my post but its um huge and its to early in the morning so ill copy paste and use reg old " marks.
"It's advantage over the random proxy server is that it automatically links multiple proxies together and encrypts the data between the middle hops. Nothing more."
i never expected to run in to this isue so soon but last night around 10 30 pm est i did. Last night at that time a player in a game for wich i am a gm was banned. With in 10 minutes of getting the suspension he was in irc throughing a fit. So i banned him in irc. secounds later he was back banned gain again secounds later he was back. Over a period of 10 minutes i banned him 18 times. I finaly did a port scan on the ports used by privoxy squid and tor on a couple of his ips. And sure enough they were all tor.
So i used this ip list.
»proxy.org/tor.shtml and banned all of them this finaly stopped him.
Spo tors main advantyage is for irc trolls forum trolls and game trolls. They can use this crap to bypass legitimate bans so that they can cause more trouble. Ill be monitoring that list and adding to it as i find more tor ips.
--
DSLR security chat at us.ausirc.net chanel #dslr_sec lets pack this channelopen source dns server for *nix and windows »powerdns.com | |
Daniel
Premium,MVM
join:2000-06-26
Pleasanton, CA
clubs:
| said by novaflare :So tors main advantyage is for irc trolls forum trolls and game trolls. They can use this crap to bypass legitimate bans so that they can cause more trouble. Goodness. There are a myriad of systems in place in the world -- especially those designed to protect privacy -- that offer an advantage to those who would do us harm. This is not a reason to decide that the tool itself is evil. Encryption is the perfect example of this. Just because it can be used by bad people against law enforcement doesn't mean it should be made illegal. It's a specious argument.
The bottom line is that if you support organizations like the EFF then you know why projects like Tor are important. If not, then you're likely to only see the negative and label it as a tool for miscreants.
--
dmiessler.com - grep understanding knowledge | |
|
