[tor-talk] Question for those who say "Tor is pwned"

[juan]

On Mon, 20 Jun 2016 18:07:12 -0500
Anthony Papillion <anthony at cajuntechie.org> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
> 
> I see a lot of people talking about how Tor is pwned by the US
> Government and is insecure 'by design'. I'm assuming that they know
> this from a thorough analysis of the source code,


	No. You don't need to look at the source code to know that
	'people'(the US gov't) who can monitor traffic going into the
	tor network and out of it can correlate the traffic and
	'deanonymize' users. 

	It should also be obvious, for instance, that if an attacker
	happens to control the 3 nodes used to build a circuit, he can
	also 'deanonymize' the user. 
	
	All that has nothing to do with any 'vulnerabilities' or
	'bugs' in the code. 

	Other basics facts about tor, like the users are being abused
	as cover by the US military, are matters of basic logic. If
	you are the US military and create an 'anomity' network, and
	you're the only user, your network is useless. You NEED a
	'diverse user base' to hide your criminal activity.

	If you are the US military, you want an 'experimental'
	'anonimity' network over which you have control.

	Et cetera.


> which I freely admit
> I haven't done. So, since you guys actually have taken the time to
> audit the source and find the vulnerabilities that would allow Tor to
> be so easily pwned, could you explain it to me and, preferable, post
> relevant sections (or links to sections) of the source you're basing
> your statements on?


> 
> I'd really like to investigate these vulnerabilities myself but the
> code is too massive for one person to realistically audit by
> themselves so links would be very helpful.
> 
> Thanks!
> Anthony
> 
> - -- 
> OpenPGP Key:    4096R/0x028ADF7453B04B15
> Other Key Info: http://www.cajuntechie.org/p/my-pgp-key.html
> XMPP?Jabber:    cypher at chat.cpunk.us
> SIP:            cajuntechie at sip.linphone.org
> 
> -----BEGIN PGP SIGNATURE-----
> 
> iQIcBAEBCgAGBQJXaHcgAAoJEAKK33RTsEsVXzkP/1Pk47AhZUMjzGbKivACMWaE
> HnmWeuGE7ORdmHuc5ex7tKpNHGoryHrLoLWWRCAcdqAs0UD84X9JlVMB9o9gUk+m
> Y0gtMQFQEuS3gyaLKnOEBWgog4Ir+uI7CBFSo5pJ/Ch+mH2tORb3eXo5liUOXjxQ
> hZeK3dTDD3tbFpZw9/nkhQPgiPajaF8iBoQZbdpslnITXNOH/ML7E8YPmzkG5g/V
> l9vpsLCO1FXLiGADLOMTaCKRnAjA1rhNF8g8a1qYz95yJm4f7o6TyUA0fc7Hd3BP
> qcloz0fOo2AQqpAkUGeRVvsCcdL63zo5Tu3AJH8LwuivBjeTQG4jVfHQyJLFfLZA
> H7Vg7tg/Lc/sDB9fu/f1Q5sFm983TZoWZzpYkkGClHkLOWxeE8v4YNEBbuuhHdFe
> zwsQaOxefJP/fUym/CuOqnZbLdEHGQxVwhAKDjTYz2H1CPKDyBcmVXD3SLL4SGvo
> rWRf3Fjg44E7cVMGAXgbhAeIgZbnLDjdfvhJh9fcq+xy9fnBfDg0Bvn7xSlfOXnS
> 8rzTIxCkHL1pj8y+5bHiivVeZcHNeKiYzHn0pFEYRsml2JlRki7beUWkdHP4TDjh
> 1itbC3QG3gHbVLZ+ZKyeve/nX1V/Bqqhgao6g+rL8rZUTqG8jEp/lpkRg6wcPRGK
> YVlaF2yMZsBKBi7PRyAT
> =KXtj
> -----END PGP SIGNATURE-----