Re: evil nodes

[alexyz@xxxxxxxxxx]

On 1 Jun 2005 at 16:29, Chris Palmer wrote:

> alexyz@xxxxxxxxxx writes:
>
> > Is it possible for an exit node to inject malicious javascript code
> > on http requests?
>
> It's possible for any intermediary to modify content in any way. Is
> your ISP trustworthy? What about the other 10 ISPs your web requests
> go through?
>
> There's no substitute for end-to-end integrity checking, such as that
> provided by SSL.

Trustworthiness is dificult to measure but there is less and there is more. While I wouldn´t
put my life on the line for my ISP, it is bound by a contract with me and is accountable by
law for certain behaviours. That relation enforces some trust that I will never have with any
Tor node. And obviously not all of them are alike. Based on your information I may decide
to enforce my communications through specific exit nodes that I deem more trustworthy.
But that will not be effective if middle and entry nodes can attack the same way. Will the
encryption between the nodes somehow deter this?

Threre is risk in everything we do, I just wish to understand those risks so I can manage
them. SSL is a great tool to deal with this situation but it is not always available. What do
you think is more likely, that an attacker uses statistical analysis on big portions of the
internet or inject code in the streams to allow him later to have a trojan phone home and
identify the computer?