[tor-relays] [Important] Update on an upcoming German broadcasting story about Tor/Onion Services

[lists at for-privacy.net]

On Montag, 16. September 2024 12:31:24 CEST isabela fernandes wrote:

> On September 9, 2024, The Tor Project received a press inquiry from
> Norddeutscher Rundfunk (NDR, part of ARD, a German public broadcaster) with
> The reporter claims to have "evidence that shows that in several cases
> German law enforcement authorities were able to locate the Tor entry node
> of onion services and thus successfully deanonymise Tor users. V2 and V3
> onion addresses were affected at least between Q3/2019 and Q2/2021." The
> reporter further claims that "law enforcement agencies used so-called
> timing analyses and broad and long-term monitoring of Tor nodes in data
> centres."
:-)
I will definitely watch that. NDR is known for high-quality investigative journalism.

> As of today, The Tor Project has not been granted access to supporting
> documents, and has not been able to independently verify if this claim is
> true, if the attack took place, how it was carried out, and who was
> involved.

It will probably be about Operation Liberty Lane.
(United States, Brazil, Germany, and the United Kingdom)

Some court documents are linked here, in the google sheets:
https://safereddit.com/r/TOR/comments/19benkx/operation_liberty_lane_le_running_gaurd_and/?rdt=40060
Gus may have gotten some more documents.

We already had this on the agenda at 2 Relay meetups.

> In the absence of facts, it is hard for us to issue any official guidance
> or responsible disclosures to the Tor community, relay operators, and users
> at this time.
> 
> We are calling for more information from you.
> 
> If you have any information that can help us learn more about this alleged
> attack, please email security at torproject.org.
> 

> Your assistance will help all of us take the necessary steps and
> precautions to keep Onion Services safe for the millions of users that rely
> on the protections Tor provides.

For my Onion Services I use Vanguards with a list of over 1000 trusted nodes
in EntryNodes, HSLayer2Nodes and HSLayer3Nodes.

https://github.com/mikeperry-tor/vanguards



-- 
╰_╯ Ciao Marco!

Debian GNU/Linux

It's free software and it gives you freedom!
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 3872 bytes
Desc: This is a digitally signed message part.
URL: <http://lists.torproject.org/pipermail/tor-relays/attachments/20240916/62837c84/attachment.sig>