George Shaffer <George.Shaffer@xxxxxxxxxxx> wrote:
> On Wed, 2006-10-18 at 12:47, Fabian Keil wrote:
> > . . . They aren't attacking Tor, but misconfigured applications
> > behind the Tor client.
>
> Which they said quite clearly in different words: "Clearly Tor's
> designers have done a pretty good job: I couldn't find any weaknesses in
> Tor itself . . .
> So instead, I attacked the data which Tor carries the most of: web
> traffic."
Please don't quote out of context. I wrote:
"I also think the title of the paper is intentionally misleading."
^^^^^
> For a user new to Tor, the documentation is often confusing or
> ambiguous, important information is missing, and sometimes minor details
> over emphasized (especially in Tor FAQ). Tor is a young product and
> hopefully these problems will be remedied as it grows. In the meantime
> though, some users are depending on it for anonymity. You can be sure
> that someone in Red China, searching for information his or her
> government does not want them to see, is not likely to have mis
> configured or misused Tor for want of trying to get it right.
I assume you mean the opposite of the last sentence?
Anyway, there will always be some people who don't
understand the documentation, or don't even bother to
read it. That's the case for every product and not a
Tor specific problem.
The risks of JavaScript, Flash and friends are mentioned
several times in the docs.
> > It's also a good idea not to trust any exit nodes,
> > except the ones you run yourself.
>
> If this is true, then the Tor network serves no useful purpose for the
> large majority of users who don't run Tor servers, let alone exit nodes.
Why? Just because you can't trust a exit node, doesn't mean
you can't use it. You just have to be aware that unencrypted
traffic might have been altered.
> Even if in the future, some auditing process is set up for exit nodes,
> anyone using Tor, implicitly trusts whoever does the auditing, and he or
> she is likely to be self selected. Besides technical knowledge and
> connection limitations, there is at least one other valid reason for not
> running a Tor server. Comcast, the largest ISP in the U.S., has Terms of
> Use that very clearly prohibit any and all servers, including p2p, on
> any residential connection. I suspect some other ISPs have similar
> provisions.
That's a rather lame excuse. Even if your local ISP doesn't allow
you to run a Tor server, you can always get your own rootserver
and run your exit node from there.
> Maybe I'm missing something, but except for a large company with many
> valid public IP addresses, what anonymity can you hope to gain by using
> your own exit node, except hiding from a network sniffer in the clutter
> of the other traffic which leaves the node. Whoever you connect to will
> still have the exit node's IP, which can presumably traced back to you.
That's right, but I'm not saying you should only use your own exit nodes.
Fabian
--
http://www.fabiankeil.de/
Attachment:
signature.asc
Description: PGP signature