[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-talk] FBI cracked Tor security
-----BEGIN PGP SIGNED MESSAGE-----
On 07/18/2016 06:11 AM, Jon Tullett wrote:
> On 17 July 2016 at 05:11, Mirimir <mirimir@xxxxxxxxxx> wrote:
>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
>> On 07/16/2016 08:21 PM, Jonathan Wilkes wrote:
>>>> I'm hardly asking for perfection. Just a little heads up for
>>>> the sheep.
>>> You're unwilling to even describe non-technical users as human
>>> beings, yet you want Tor to suggest a vastly more complex
>>> alternative for them?
>> OK, they're naive and trusting. For which "sheep" is common
>> Running VirtualBox and Whonix is hardly "vastly more complex".
> It is, you know. More complex, and probably not suitable.
More complex? Sure. But vastly so? That's debatable.
> Haroon Meer, who I greatly respect in the security space, describes
> UX complexity in terms of his mum. As in, "could my mum do this?"
> and if the answer is no, it's too complex for the average user. I
> like that.
His mum probably shouldn't be using Tor.
> Fact is, security is a spectrum. "No security consideration at all"
> is at one end of that spectrum. Tor, the TBB and the associated
> documentation, is someway further along the spectrum, Whonix is
> somewhat further still, but there's a lot more room beyond that.
> Even that's a gross oversimplification - "no browser security
> except NoScript" is more secure but less private than TBB in its
> default configuration.
> Because of that, I don't think it's possible, much less desirable,
> to describe the entire spectrum of use-cases. And even less
> possible to actually document the toolset appropriate for every
I'm not calling for that.
> It's probably far more meaningful to help users understand that
> spectrum, self-assess where they fall on it and what their risk
> profile may look like as a result, and pointers to resources which
> would align with that.
That sounds good to me. Except that there's nothing on the Tor Project
site about Whonix, and virtually nothing about proxy-bypass leaks.
> "Just use VirtualBox and Whonix" is not meaningful advice. It's a
> great fit for a very specific subset of users, but many (I would
> guess "most") users are not in that subset, and for everyone else
> it'd just be some combination of confusing, overwhelming,
> unnecessary, or insufficient.
I'm not arguing that all Tor users should use Whonix. I'm arguing that
the Tor Project ought to mention that as an option.
> The key question to you, as someone advocating that specific
> toolset, would be: for what type of user is VirtualBox+Whonix the
> optimum solution, and how would Joe Random identify if he is that
> sort of user?
1) Specify how much ones time is worth: X USD/hr.
2) Estimate pwnage cost (lost income, legal fees, prison, etc): Y USD.
3) Divide Y by X to get time investment justified to avoid pwnage.
Anyway, what does Tor Project gain by not mentioning Whonix?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
-----END PGP SIGNATURE-----
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to