[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: funneling a wireless net's outbound connections through tor
On Mon, 01 Oct 2007 16:35:29 +0100 Mike Cardwell <tor@xxxxxxxxxxxxxxxxxx>
wrote:
>Scott Bennett wrote:
>
>>> If they use an Internet cafe, their traffic is subject to being
>>> monitored. If they use Tor it is *also* subject to being modified.
>>
>> If they go to a coffee shop or other location with free wireless
>> access, their traffic is also subject to being modified, but at *any
>> and every* hop between their computer and the destination, unless they
>> use end-to-end encryption anyway.
>>> Example 1:
>>>
>>> [deleted as not unique to the tor environment --SB]
>>>
>>> Example 2:
>>>
>>> [deleted as not unique to the tor environment --SB]
>>>
>>> Scary huh?
>>
>> Of course. But in my intended setup, the only places that could
>> happen would be in my equipment, the exit node, the destination, or the
>> hops between the exit node and the destination. It's not going to happen
>> in my equipment because I don't do that sort of thing and wouldn't have
>> the time or energy to devote to it even if I did do that kind of thing.
>> That leaves the exit node, the destination, and the hops between them.
>> If the traffic does not go through tor, then those things could
>> happen at any of the up to 32 hops normally allowed for a TCP connection.
>> I do not see how reducing the number of potential points of attack
>> increases the risk.
>>> Of course, you could argue that the person running the Internet cafe or
>>> the ISP could do that, but I am inclined to believe it's much more
>>> likely to occur on the Tor network than in those cases.
>>
>> So could anyone along the path of an ordinary, unencrypted TCP link.
>> Some governments apparently do this sort of thing already, most likely
>> including the U.S. government.
>
>1.) People that can perform these attacks if you just use a normal
>Internet connection: Governments, people working for ISPs
...and anyone running a destination site being accessed with or
without tor, and anyone with a wireless card in a laptop in the same
public location, etc.
>
>2.) People that can perform these attacks if you use Tor: Governments,
>people working for ISPs and anyone who know how to install Tor.
>Including some wannabe hacker 13 year old kid living on the other side
>of the World.
>
Governments are incomparably more dangerous than any 13-year-old or
even ISPs. Also, given the number of teenagers who have cracked well
funded web servers, I'd say that said teenager is still not out of the loop
without tor.
>If you use Tor, you considerably increase the number and range of people
>that could potentially attack you. You also make yourself a tastier target.
>
>This is not a bad thing if you know how to deal with it. It *is* a bad
>thing if you don't. For example, I have only ever had attempted MITM
>attacks against my ssh sessions when using them over Tor.
>
>>>> Aside from that, the only IP addresses that could conceivably be
>>>> discovered would either be the one temporarily assigned to my connection
>>>> or the one assigned on a private network by my wireless router via DHCP.
>>>> In any case, I still would appreciate helpful information, so I'll
>>>> repeat my questions here, quoting from my original query:
>>> The anonymity of the IP address is not at issue here. The issue is, by
>>> using Tor, you allow the possibility of exit nodes monitoring and
>>> modifying traffic, so you should only use Tor if you truly understand
>>> these issues and how to deal with them.
>>
>> I see. The elitist approach to limiting use of damned good software.
>> Reminds me of David Sternlight claiming that there was no reason for anyone
>> to use PGP and therefore people shouldn't bother with it. It was ridiculous
>> on its face, yet he persisted in trolling the PGP news groups with it for
>> years. Do you work for the NSA by any chance? (Like you would really say
>> so if you did. Right.)
>
>Your interpretation of what I said is quite hilarious.
That line would certainly be in character for Sternlight.
>
>Hopefully nobody will help you use Tor for something that is dangerous
>and that you clearly don't understand. For your users sake.
>
I understand it fine. I just evaluate the dangers differently from
you. Not using tor at all is far more dangerous in my view.
If it worries you so much, then I guess you need to convince the tor
development team to remove the support for TransPort and DNSPort. Maybe
you should also get them to stop making tor freely downloadable from the
tor.eff.org web site, perhaps limiting downloads only to people who have
passed a course on subjects you deem pertinent, so that the great unwashed
will be "protected".
Yet again, I'd appreciate any *helpful* information regarding my two
questions. It would save me a lot of headaches getting to it by trial and
error.
BTW, I didn't come up with the idea to provide wireless service to
neighbors via tor. I first read about it on this list, IIRC, where the
person posting the start of that thread had an old 802.11b router that he
wanted to put to use rather than add to his paperweight collection or
whatever. I've been thinking about it ever since I first read it here.
People on this list seemed to have no problem with the idea then. And this
time, although a couple of people have voiced their dislike of the idea,
no convincing arguments have yet been presented against the idea.
Scott Bennett, Comm. ASMELG, CFIAG
**********************************************************************
* Internet: bennett at cs.niu.edu *
*--------------------------------------------------------------------*
* "A well regulated and disciplined militia, is at all times a good *
* objection to the introduction of that bane of all free governments *
* -- a standing army." *
* -- Gov. John Hancock, New York Journal, 28 January 1790 *
**********************************************************************