Think bigger, say what?
Certain of the world's biggest and most well-funded intelligence agencies hate personal privacy on the internet so much that they've been going to extreme efforts to destroy it. They are packet sniffing the NAPs and fiber backbones to pull out everything they can, they hacked/broke HTTPS, they are backdoored into the big content providers, they hacked the banking system, they are apparently 'in' some hardware crypto chips - the list goes on -
They infiltrated the tech groups which were designing software and hardware and sabotaged their work, making their crypto be weaker/breakable and their systems easier to hack into. They use the vulnerabilities they created to their own ends.
As of today, Tor appears to provide privacy, at least as far as the .onion sites goes. Maybe it even works for it's entire function of providing anonymous internet browsing.
'They' would definitely want to be IN this thing, because they either want to compromise it, or if that doesn't work well enough, destroy it. 'They' are known to infiltrate and be influential in getting what they want. Literally, they are professionals at this. 'Getting to know' the exit relay operators and identifying their bank accounts would help facilitate things when it came time for them to make their move.
In the context of September 2013, this whole thing is scary. It was perhaps not scary in September of 2012, when we didn't know anything.
Also. It makes me wonder things when, for example, you say "Think bigger" while pointing to a couple of potential dollars in someone's pocket. Safeguarding the operators of the exit relays is a bigger deal than chump change. I'm not making an honest accusation but, to the people who are the most vocal in approving of this - you don't work for the NSA, right? :)
On Wednesday 18/09/2013 at 6:08 pm, Roger Dingledine wrote:
On Wed, Sep 18, 2013 at 08:10:25AM -0400, tor@t-3.net wrote:
The Wau Holland Foundation can currently only reimburse via wire transfer.
This seems to be end-of-story in terms of who, in the end, is ultimately getting liability/risk, and points to practically no chance at anonymity
Think bigger --
While I believe you have a good point....
On Wed, 18 Sep 2013 19:29:26 -0400, tor@t-3.net wrote:
Think bigger, say what?
Certain of the world's biggest and most well-funded intelligence agencies hate personal privacy on the internet so much that they've been going to extreme efforts to destroy it. They are packet sniffing the NAPs and fiber backbones to pull out everything they can, they hacked/broke HTTPS, they are backdoored into the big content providers, they hacked the banking system, they are apparently 'in' some hardware crypto chips - the list goes on -
They infiltrated the tech groups which were designing software and hardware and sabotaged their work, making their crypto be weaker/breakable and their systems easier to hack into. They use the vulnerabilities they created to their own ends.
As of today, Tor appears to provide privacy, at least as far as the .onion sites goes. Maybe it even works for it's entire function of providing anonymous internet browsing.
'They' would definitely want to be IN this thing, because they either want to compromise it, or if that doesn't work well enough, destroy it. 'They' are known to infiltrate and be influential in getting what they want. Literally, they are professionals at this. 'Getting to know' the exit relay operators and identifying their bank accounts would help facilitate things when it came time for them to make their move.
In the context of September 2013, this whole thing is scary. It was perhaps not scary in September of 2012, when we didn't know anything. Also. It makes me wonder things when, for example, you say "Think bigger" while pointing to a couple of potential dollars in someone's pocket. Safeguarding the operators of the exit relays is a bigger deal than chump change. I'm not making an honest accusation but, to the people who are the most vocal in approving of this - you don't work for the NSA, right? :)
....this is probably about making it easier for big exit operators to afford lawyers for when 'they' come around using the law as 'their' tool. :/ If your BW bill is paid, more $$$ to keep you out of jail.
Best, -Gordon M.
On Wed, 18 Sep 2013 19:29:26 -0400 tor@t-3.net wrote:
In the context of September 2013, this whole thing is scary. It was perhaps not scary in September of 2012, when we didn't know anything.
Just a point that many in the tech community knew what was happening, at some level, for the past decade. It's now that we have more data to back it up. Three years ago, many in the Tor community were called pathologically paranoid for our talking about stalking with technology (some call this tracking, advertising, snooping, packet sniffing, etc) on a global scale. It doesn't seem so far fetched now. In fact, some countries have been honing these practices for a decade or so.
Torservers, Noisebridge, and others have been taking money in exchange for running exit relays for a few years. For the vast majority of people (which includes organizations), it's far easier to transfer money to someone who can run an exit relay than it is to setup one themselves. I'm sure there will be sketchy orgs trying to turn currency into exit relays. It's a fact of growing an ecosystem.
I suspect most of the cost of running a relay isn't the relay itself, but the people to keep it running.
Hi all!
On Wed, 2013-09-18 at 19:29 -0400, tor@t-3.net wrote:
Also. It makes me wonder things when, for example, you say "Think bigger" while pointing to a couple of potential dollars in someone's pocket. Safeguarding the operators of the exit relays is a bigger deal than chump change. I'm not making an honest accusation but, to the people who are the most vocal in approving of this - you don't work for the NSA, right? :)
I am quite new to tor but I decided a few days ago that it is not just "something for people in far far away countries". I simply decided that I have to support this if I do not want to be in the risk that I am asked later: "What did you do when they took the control over the net?".
So I started a tor node on a dedicated root server. But now you scared me a little bit: Is there a need to be safeguarded as a tor node operator? - At least the hosting company might know me. At least it should be easy for the government to track me down even if I tried to hide because all they have to do is follow the money. - I even used my Name and Email address inside the contact information. Just check out the "idkneitzel" Node. - Reverse DNS even points back to my private domain.
Was this something that I shouldn't have done? Is it something that I should change?
Would be nice to hear your opinions on this topic.
With kind regards,
Konrad
On Thu, 19 Sep 2013 07:45:17 +0200 Konrad Neitzel konrad@neitzel.de wrote:
I am quite new to tor but I decided a few days ago that it is not just "something for people in far far away countries". I simply decided that I have to support this if I do not want to be in the risk that I am asked later: "What did you do when they took the control over the net?".
So I started a tor node on a dedicated root server. But now you scared me a little bit: Is there a need to be safeguarded as a tor node operator?
- At least the hosting company might know me. At least it should be easy
for the government to track me down even if I tried to hide because all they have to do is follow the money.
- I even used my Name and Email address inside the contact information.
Just check out the "idkneitzel" Node.
- Reverse DNS even points back to my private domain.
Was this something that I shouldn't have done? Is it something that I should change?
You are not running an Exit node, all of this is irrelevant to you.
On Thu, Sep 19, 2013 at 11:56:22AM +0600, Roman Mamedov wrote:
Just check out the "idkneitzel" Node.
You are not running an Exit node, all of this is irrelevant to you.
Right.
But for those here who are wondering about running large exit relays, check out https://trac.torproject.org/projects/tor/wiki/doc/TorExitGuidelines for advice.
Thanks! --Roger
Hi all.
Thank you for the quick replies. I understood, that there is no need to change the node configuration regarding these points.
Even that I am not in focus right now: I am really thinking about further steps that I would like to do (And at the moment I think about ways how I could explain encryption and tor to others).
On Thu, 2013-09-19 at 02:04 -0400, Roger Dingledine wrote:
But for those here who are wondering about running large exit relays, check out https://trac.torproject.org/projects/tor/wiki/doc/TorExitGuidelines for advice.
The link is interesting but I still do not see the point. Even if there is a non profit organization created which might have an address at a lawyer (I come from Germany) it is not really safeguarding the operators.
The organization must be registered so someone who can see where money went is always able to check the registration of the organization which is even public.
So I think that I simply misunderstood the point about safeguarding operators completely. Of course it would be nice if someone could help me to understand this point. But you already helped me with my main concern regarding the node that I started so I happy already. (And maybe it is still best to further check out Zwiebelfreunde / Torservers.)
Thank you again for your time and explanations!
With kind regards,
Konrad
On 09/19/2013 08:50 AM, Konrad Neitzel wrote:
The link is interesting but I still do not see the point. Even if there is a non profit organization created which might have an address at a lawyer (I come from Germany) it is not really safeguarding the operators.
Creating an organization around *exit* relays is not about hiding, it is about the difference is treatment of companies versus individuals. You are more likely to be treated as suspect as an individual. So far, from all organizations that I know of that run exit nodes, they were treated simply as ISPs, and did not get any trouble for not having any logs.
For non-exit relays, there's currently nothing on the horizon that makes me think you need additional protection. But in the end, you're forwarding encrypted traffic, which may or may not end in strange court rulings like the one around Retroshare in Germany [ http://www.internet-law.de/2012/11/lg-hamburg-erlasst-einstweilige-verfugung... ] All I can say at this point in time is that we (Torservers/Zwiebelfreunde) will try help to fight any such case. For US operators, EFF is still waiting for a good court case. So far, nothing bad has happened in the legal respect.
The organization must be registered so someone who can see where money went is always able to check the registration of the organization which is even public.
If you're that worried, you can register your company in $thirdworldcountry. Someone told me, a company registration in Africa is around $100.
On Thu, 19 Sep 2013 07:45:17 +0200, Konrad Neitzel konrad@neitzel.de wrote:
Hi all!
On Wed, 2013-09-18 at 19:29 -0400, tor@t-3.net wrote:
Also. It makes me wonder things when, for example, you say "Think bigger" while pointing to a couple of potential dollars in someone's pocket. Safeguarding the operators of the exit relays is a bigger deal than chump change. I'm not making an honest accusation but, to the people who are the most vocal in approving of this - you don't work for the NSA, right? :)
I am quite new to tor but I decided a few days ago that it is not just "something for people in far far away countries". I simply decided that I have to support this if I do not want to be in the risk that I am asked later: "What did you do when they took the control over the net?".
So I started a tor node on a dedicated root server. But now you scared me a little bit: Is there a need to be safeguarded as a tor node operator?
- At least the hosting company might know me. At least it should be easy
for the government to track me down even if I tried to hide because all they have to do is follow the money.
- I even used my Name and Email address inside the contact information.
Just check out the "idkneitzel" Node.
- Reverse DNS even points back to my private domain.
I do all the same things, and only recently *started* using real contact information and my real name on these lists, as a principled stand.
Was this something that I shouldn't have done? Is it something that I should change?
If you are an exit node operator, you have some things to consider. If you are a relay node operator, likely far fewer things to consider. Then again, I only operate relays and ran into my first website block (retailmenot.com) today due to the site blocking *all* Tor nodes, exit or otherwise. :P
Would be nice to hear your opinions on this topic.
You're probably fine, especially if not running an exit. You didn't list your home country, though; I'm assuming United States.
If you are concerned, arrange transactions to purchase a server offshore with anonymous means and run an anonymous node there.
Best, -Gordon M.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
Hy all.
Offshore sounds like outsourcing :)
In EU I had some discussions with providers of KVM servers, dedicated and collocation based systems.
Tor should know William Weber and his company. I had a little chat with him, and principally his company provides two options for exit node ops.
Dedicated with own whois and legal advisement. Collocation and as above.
Due to laws in the EU, his company is forced to hand out information about the "owner" of the exit node to government organisations without information of the exit node owner itself.
So that leaves two options.
1.) Dedicated, collocation with secret handout to government organisations. 2.) Homeserver with the option of a houseseeking.
Pick yours ;)
Gordon Morehouse gordon@morehouse.me schrieb:
On Thu, 19 Sep 2013 07:45:17 +0200, Konrad Neitzel konrad@neitzel.de wrote:
Hi all!
On Wed, 2013-09-18 at 19:29 -0400, tor@t-3.net wrote:
Also. It makes me wonder things when, for example, you say "Think bigger" while pointing to a couple of potential dollars in
someone's
pocket. Safeguarding the operators of the exit relays is a bigger
deal
than chump change. I'm not making an honest accusation but, to the people who are the most vocal in approving of this - you don't work for the NSA, right? :)
I am quite new to tor but I decided a few days ago that it is not
just
"something for people in far far away countries". I simply decided
that
I have to support this if I do not want to be in the risk that I am asked later: "What did you do when they took the control over the
net?".
So I started a tor node on a dedicated root server. But now you
scared
me a little bit: Is there a need to be safeguarded as a tor node operator?
- At least the hosting company might know me. At least it should be
easy
for the government to track me down even if I tried to hide because
all
they have to do is follow the money.
- I even used my Name and Email address inside the contact
information.
Just check out the "idkneitzel" Node.
- Reverse DNS even points back to my private domain.
I do all the same things, and only recently *started* using real contact information and my real name on these lists, as a principled stand.
Was this something that I shouldn't have done? Is it something that I should change?
If you are an exit node operator, you have some things to consider. If you are a relay node operator, likely far fewer things to consider. Then again, I only operate relays and ran into my first website block (retailmenot.com) today due to the site blocking *all* Tor nodes, exit or otherwise. :P
Would be nice to hear your opinions on this topic.
You're probably fine, especially if not running an exit. You didn't list your home country, though; I'm assuming United States.
If you are concerned, arrange transactions to purchase a server offshore with anonymous means and run an anonymous node there.
Best, -Gordon M. _______________________________________________ tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
- -- We don't bubble you, we don't spoof you ;) Keep your data encrypted! Log you soon, your Admin elrippo@elrippoisland.net
Encrypted messages are welcome. 0x84DF1F7E6AE03644
- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.11 (GNU/Linux)
mQINBFH797MBEAC0Y0NeI7lmDR9szTEcWuHuRe0r/WjSRC0Nr5nXsghuMcxpJ3Dd BOBimi4hdMMK4iqPVMwNw6GpKYR3A9LHHjbYRXHUKrJmB+BaJVyzJXN5H6XvxTTb UfX+DaXAGJW/G+3cBB3qm/QaU8QGkBKfXq0DLTaTGPkGKxEAldj/8onGZhawdJs+ B92JrW+S2HDh15pIuXzSqe7eCcIOdvvwfWe0fJi2AraA7LYGpxP6GcC/b9JJpbq5 Y6DfE2Aun9ZK3iHqURyrms0Whbv1CgmUahL2MVYCsTsXwe0GwlAxxKvjXAiXuo+R 9wO5wsXvVVSVNqsk9Yqi+wYzdPKndTU0GyxSApQHroF+cxaZ8Lk0xloj18+LdCSs e5IiTSXH0MMsDdWWdHlrgk+bgDG+0Gu3ne4vMwGdKO7AhYgQW/ueMy4RnkG/nsV9 jry5BO4gGAI1Ij8KvqUzEnvJFGE3ptJogU+zazWWDUWmL3ecKb3aDRlJFnZ3kJ5h q8GolZVjpk99V+4B5WVRPXdej/p5J19tXycK/jdNmr4oC8NyUhIpe8xHELnfoB4z +rxiTx+KMnW0rY8EQg8O2ixEYt5my90IwQkxcxIxextVrqjJjYn8extc2/v8yGzI KmTEJxdADB5v/Jx4HiLHNDSfBUb8gfONCkNSTYvTcSwTjWzHOkXeE/9ZbQARAQAB tD5lbHJpcHBvIChrZWVwIHlvdXIgZGF0YSBlbmNyeXB0ZWQpIDxlbHJpcHBvQGVs cmlwcG9pc2xhbmQubmV0PokCOAQTAQIAIgUCUfv3swIbLwYLCQgHAwIGFQgCCQoL BBYCAwECHgECF4AACgkQhN8ffmrgNkT8+BAAoAXBqu4/O2Cs5FSWWZpzgScNEgq7 uHhOKeYmRfgKlOUPoYlPB1DBqdOAXSKb9OvsmyOvpoGnqijB7aAJBoyQYW/OCQgd U8L4eTCf4yRZnfFLdgskcPfN1p0Rs/yinGEooBJFtYa7mT6J0UTW2JjCLZK2AFCW oF+KBu5JICXGBXigb2ZbX1jWjxP5H1RidQw6HF5z4z34SjLWAOOeZ8B/Xfz6Fs0s IAuLu2O4HE4DI8Qu196LhSVHHgr3uMTkvN1t5nKwyjrRQztwXXk9qIomII3ydNYb BYAGdWNNMfLb1kmDwC5wQHAFvSP1aiMF3aKAY+gl2wXSGO6JqM0SteJS3dytIljI kzu0atc9HuGs/HDQgdmpAS4WU2YefEr/WieltSiAKlwuC+3wg+CONJ6TE1vgNDU/ axerttb0jq7UQb/nAp05bsrB7XH1Vs+1ON9lUPEfWRmwQcrVK5JUrUWa/4tA/UeM XvFcPFtFluGTlLewgJIqcvjPXFwpbDZprXJsMkwew/A6B6n3+0sbgf7p3QSGkVbi dwQAymTbHdYqLnbcnKZhjto3Wjw1J5QB2wuiRYlpjV3i7AWTGlqoSTOWCCV+HamQ qeFYNYAWNFx3+J/oi7xDi8t9bHVNA205equ+y2sj3G5uGJ6LSHQ8AXp9uOipUUvU 1MJN0yLXr9PIwvi5Ag0EUfv3swEQAL0+MnxHGrTjSYdfdua4SBpmytDONM1EngeY s+WyaC/760MughKbaysI/nK2LB1vnwEY7f3NM4fxBx8u2T7VBm6Ez6Fs23Bb8Rkz f97bPSdxCmg64GPHfLA9uwTIXcYS+MpI86WOf6eWY0rRpf7Y9Nl7YoUNvzOyUPqc ggdcnHce8zYv7A/WS8flZDm8tVFPsHrQDEwNMws7ZhiNnHkeZeRJrvCuB7oEVich O/ROYoA5o6NozWYQbjxe1f6Yur4Q10qgVcxVnyLFJSbg6vZSzL7KYh3Z5iBOzPHt 7cwEDrW8W4Kl2Qj8rhJ4Wxs94CAtua7IXK44sVZWQbyHcOXRikgGMZKkEZzVCQa5 KD1u1ZrcBCyuMAir0hsmS3jhCUwpiE2c3SRk8O8CgixhTcBk0X/k9ZFu3Hbi1JMB FLzs/Nq3tYAYvVivhPloSxmYBPsafYHCZM83yBNNsralXh5zjB+di90G+AMXt2PN LTcdovZuWtC0s8/jrx+zv/AA4FAGYU9OVl+YL9ybFX8gSdMEcixyzQcKfiFBjpWv 5iFrwIuDlaXMcheyrhc9aGOxfx44OXc505+VjO/1Q/8EOWlJ6UwOi6GMkj5T+RFJ MDyP0UixS7dt6wTuD5t6PRuyWWxZswgrbL9hjwGFr154Z19TWeNWc23pWtUvQJos UCxl2nFHABEBAAGJBD4EGAECAAkFAlH797MCGy4CKQkQhN8ffmrgNkTBXSAEGQEC AAYFAlH797MACgkQJEPd69lQ0evA+Q/+M7lSFlrQWiRsFqDjh+kTJc+0OEBCvnfo N2KPyXXbfc//qup55PfEygE6C60zvrlv3WE33GZ5GS5MLuDMP82b+a5Yt16NQU7L WtAg1g0S0BvazW+28TgnfO8bhbGaFeE9ccw3xLmlbwZQ3f3LtMKdwFIROiG6hvAs 9U54QYti3tv9DowRYYWpdr0Ga8RqeGNtCKc0v2opy51MpzKWjwUW0i3XlSlyY8Lj 1KT8PyznNPw32nYpmDizz+0OUJNnn/kT+GnFoR3DJnFosTOrnxFJp+N+nejMp/gW r9NM0/E7H+P53IiytBOt5/0vsOaCFGdYGhKEjmJi3dHS4Xk1ObD1mjdD1YDOlWWU 3Md6BDHd4W7Q8gT7oQfTIMLd3HzV+WNPIdocPLBaeA/tRD8Pg5CCmncAmSub4F5T An7FlnACtSOv3cIWQ0TymS42DihDaJ5d1RvNzKw+zHYdPvf471JFZR3TDhkPbLIr 9czR7kbpnXRwchgwXQn306NVWf37TgA8wpbnFTazZ38iOeqcb9oKprqnbgEdr3PN OhKSlMTkzAqf3MEi2Fyua4BADMhS3oBwCRgDTlt6wquEytpNSlZaHnyiyIgOpekF Uy5K3w8NhHqeifRPrNb/UcCbXtXz+puqIEZHMenpv6FRlTTKpdoHoVXSkp1TPMGN /VaCiLbP4Z3xEw/9EbAJJkhmmx1Qw3ueoqc4h1MmhUtIdxSZ/oA9SjwlnY++zvaZ 6w1wTS4P+OUkETNDtItdpxXMJ9qfSy9voAQc2K43WMZCCmpPJYSdqaZZNPFj+Ne8 6FNtNKuUkXREybpHwlVAXnHzInmFOOM9RAmF70r3zEmKt77W1ztBLo2o9X79gPgL u9ThgrH6Oc2k46n+9nc3joccr7miiX/bp976DNWcWdOYThiSSOCb8Zw9/Zs935i1 wUVkYTj24tmBH4H5ov9ib7RPmU21ru458RbUKG0ONAqBtAHNyXHzUnXsrke+D4VW MI06YcXSk8YeYgQ8GxgHQc+W2bb8LIbKN1hEYJ0wzM62vKR2/Oiwuf8lXutIKTuz +v7Vj1PQd66DGHsxtWRaWnr1c54JTL2wICHJYKFH4grp7864+GL/uQ1O/Z/XxVku E1JQ/AnwBGU1M1S6otwWGWVRjzEzQtxsfcCEPvV/9td3FIFQAbGTPb+48XFU+TY9 8AlcXBlDzXq7c5f8Evn/oSIsZDt63K4HNTmMGqOTl/p1aA0e4eyX76LczY06rDP5 GMSNs+AHmYgZiS4RYhRUIvS9uLXMnnDAMYst0SDl2orDUUeHBTzu0rchyknBZMGP p5wQuWQ9CFlV+dj3UYbrBwC1lTkAMXRG2vlhA0V0TZqos7A5D4VHgSUQQjE= =otlL - -----END PGP PUBLIC KEY BLOCK-----
tor-relays@lists.torproject.org
-
Andrew Lewman -
Elrippo -
Gordon Morehouse -
Konrad Neitzel -
Moritz Bartl -
Roger Dingledine -
Roman Mamedov -
tor＠t-3.net