[tor-talk] BlackHat2014: Deanonymize Tor for $3000
cb736 at yahoo.com
Fri Jul 4 04:52:37 UTC 2014
It also has to be a hollow claim. To actually "deanonymize" someone would mean making a list of every website that was visited by that client. Not just identify one client that visited one website. And how many clients were you planning on doing that with? It would take an NSA size budget not a $3000 budget to try to do that for everyone. And the NSA apparently can not do it for everyone.
about:tor starts out by saying "Tor is NOT all you need to browse anonymously! You may need to change some of your browsing habits to ensure your identity stays safe" and has some tips at https://www.torproject.org/download/download.html.en#warning which says at the bottom "This list of pitfalls isn't complete, and we need your
help identifying and documenting
all the issues" with a link to https://www.torproject.org/getinvolved/volunteer.html.en#Documentation
Basically we know that Tor is pretty robust, and yes it is being improved. I certainly benefit from using it every day. And all I really care about is no one making a list of my searches and sending me targeted advertising, which is very offensive. But others have much more serious reasons for using Tor.
From: Yuri <yuri at rawbw.com>
To: tor-talk at lists.torproject.org
Sent: Thursday, July 3, 2014 10:01 PM
Subject: Re: [tor-talk] BlackHat2014: Deanonymize Tor for $3000
On 07/03/2014 16:17, Adrian Crenshaw wrote:
> Best guess, many client side and web app attacks Tor can't do much about.
> (My talk at Defcon will cover a bunch of folks that got Deanonymized, but
> in every case it was not Tor that was really broke)
This actually depends on what to mean by "Tor". If just the network
level part, then yes. But tor project also provides and promotes TBB,
which attempts to prevent various client side exploits and web app
attacks, but apparently can't prevent all of them. If tor project went
one step further, and developed security-by-isolation approach (using
virtual machines, like Whonix does), this could prevent practically all
client side exploits. And pretty much the only way user could be
deanoned is if he himself typed in his personal information, or logged
into some service shared with other identities.
tor-talk mailing list - tor-talk at lists.torproject.org
To unsubscribe or change other settings go to
More information about the tor-talk