This seems like it could be a bigger deal than it seems at first. Tesla sold partially on having much better range than competitors . If they used tactics to cover up the real world performance and had a team to specifically deny and deflect customers concerns other auto makers could get in the fray. Even a 10% variance would swing a consumer.
I’m looking for an ev and $ vs range mile is a big factor in my judgement. I’m not the only one.
Tor can be used for any internet browsing you usually do. The key difference with Tor is that the network hides your IP address and other system information for full anonymity.
The company behind a VPN can still access your information, sell it or pass it along to law enforcement. With Tor, there’s no link between you and your traffic, according to Jed Crandall, an associate professor at Arizona State University.
I don't know if it's even possible, but it would be cool if I could use the fediverse over TOR just for the sake of supporting TOR. Not sure if there would have to be specific .onion instances, if normal instances could just be mirrored with a .onion address, or if a .onion instance would even be able to federated in the first place. I just don't know how it works.
Other use cases may include keeping the identities of sensitive populations like undocumented immigrants anonymous, trying to unionize a workplace without the company shutting it down, victims of domestic violence looking for resources without their abuser finding out or, as Crandall said, wanting to make embarrassing Google searches without related targeted ads following you around forever.
I'm certain an all-out legislative war would be waged against TOR if it were to become popularized for most of those reasons, under the more convenient guise of "criminals and children!"
Well any instance owner could also get an onion link and host the instance over tor.
Of course the instance itself can't really hide. Since it needs to federate with others that are not onions. But your accesses would all show as from localhost.
I’m certain an all-out legislative war would be waged against TOR if it were to become popularized for most of those reasons, under the more convenient guise of “criminals and children!”
I guess we’ll have to see what happens after that right wing Twitter account posted CSAM, Twitter suspended the account, then Elon said they removed the posts and reinstated the account 🤷🏽♂️
Tor can be used for any internet browsing you usually do. The key difference with Tor is that the network hides your IP address and other system information for full anonymity
Also, this isn’t true. MANY sites and services block access from Tor, including major ones that people use everyday.
I've noticed that just as the most aggressive ad blocker blockers are news media websites, the most aggressive tor-exit-node blockers are retail sites such as lowes.com. My working hypothesis is that they view anonymous transactions (or perhaps even anonymous window shopping) as stealing. When it comes to actionable data for market research, data about actual finalized transactions where actual money changed hands is the holy grail. It's the data that has skin in the game. As for window shopping online, you know the drill, you do that, you hear about it on Fecebook. Until recently I searched retail sites with the site: filter of a search engine (the one that works on Tor, of course), but until recently, most site searches were even more enshittified than most of the two search engines. Now search engines are out and Tor is out. Perhaps offline shopping is in. BTW, just for shits and giggles, try carrying a clipboard next time you visit a brick and mortar retail establishment and see what happens, or better yet, whip out your cell phone and start photographing not merchandise but shelf tags. Information is power, my friends.
the most aggressive tor-exit-node blockers are retail sites such as lowes.com.
Lowes doesn’t care about anonymous window shopping - they care about the transactions. Transactions coming from a tor exit node are more likely to be fraudulent than those from a regular shopper not trying to mask their origin.
The cost of implementing a tor exit node blocker is much less than the costs associated with fraudulent orders (and the corresponding increase in chargebacks from those fraudulent orders and the impact that has on the usage fees from the credit card processing companies).
I’ve also found that many ones that are blocked aren’t completely blocked, I can access them by using a new circuit (lots of these sites seem to really hate European Exit nodes but anything else has typically worked).
Is that what it is? Every once in a while I have to Ctrl+Shift+L it to get into something, but I’ve never watched that closely. What did Europe do to these guys?
I think it might have something to do with the fact that much of Europe has privacy laws that protect their citizens and also makes it so people running nodes there don’t have to kiss up to US companies. Hence why they block those nodes or just give them a huge amount of challenges to solve in hopes to frustrate them. Same with how they put annoying privacy pop-ups on the website in European locations which re-appear every time you login or visit the site.
I know they require them, it’s is the way that they’re implemented that I’m referring to. Like they made it deliberately frustrating. Some of them one a few websites even pop up twice or even three times and you have to click them multiple times to get them to go down.
The best site to read about what is actually mandated and to see how they implement it is gdpr.eu … which has a privacy pop up on it that shows up each time.
We use cookies to ensure that we give you the best experience on our website. If you continue to use this site we will assume that you are happy with it.
If you read it a bit, it pretty much lays out what you see everywhere. They can only make you use strictly necessary cookies, and everything else has to be easily opted into or out of. I’m not sure why their own website is different, maybe it has no trackers in the first place.
Now, that doesn’t mean it has to be presented in a series of popups.
Last I tried you couldn’t access social media, Google constantly forces you through captchas because it thinks you’re a bot, and anything on a CDN will either constantly force captchas or just doesn’t work. Financial institutions absolutely are all inaccessible.
Also. Those running an exit node can and do sniff traffic.
It’s bad practice to login to stuff that’s important (like banking) over tor. Or login to anything over for you have logged into over the clear.
Also, nation states can track you using a variety of techniques from fingerprinting to straight up working together to associate connection streams. A large number of tor nodes are run by alphabet agencies. Hell the protocol was developed by the us navy.
Also. Those running an exit node can and do sniff traffic.
Sure, but if you stop there with that statement you’re just FUD-scaring people from using the service that does more for their privacy than conventional direct clearnet usage. Every connection that matters uses TLS so the exit node honeypot only sees where the traffic is going, not what’s in the traffic and not where it comes from. IOW, the exit node knows much less than your ISP.
It’s bad practice to login to stuff that’s important (like banking) over tor.
It’s the other way around. You should . It’s a bad practice to let your ISP track where you do all your banking.
Also, nation states can track you using a variety of techniques from fingerprinting to straight up working together to associate connection streams.
And your thesis is what, that we should make snooping easier for them by not practicing sensible self-defense?
A large number of tor nodes are run by alphabet agencies.
Let them work for it - and let them give the Tor network more bandwidth in the process.
Every connection that matters uses TLS so the exit node honeypot only sees where the traffic is going, not what’s in the traffic and not where it comes from. IOW, the exit node knows much less than your ISP.
That’s not a magic bullet for secuirty. There are so many ways to exploit connections. Look at what happened here on lemmy with vulns leading to takeovers of instances with xss of session cookies . Or what happened to Linus Sebastian and his YouTube channel, which has one of the largest, most security conscious companies backing it.
The primary difference is your ISP is not generally actively hostile. They may want to sell metadata but they aren’t actively trying to exploit you. And all it takes is a bad auto fill page, or even a fake/spoofed one on an account without mfa or a service with xss vulns etc.
And your thesis is what, that we should make snooping easier for them by not practicing sensible self-defense?
To your own point. Everything is TLS now right? That argument swings both ways. If your ISP (or in some cases a nation state is your isp) is actively tracking you, then there are other alternatives that may be better. Mullvad would sooner be used for banking than tor. Tor is also not all that often used en masse. If my township only has a single tor user (me) that makes me less private. An ISP can easily see who is enterting tor unless you are using more obfuscation like bridges and obfsproxy. It’s the same reason why checking the do not track box in your browser is less privacy oriented. It adds entropy to your fingerprint there.
But to answer my your question my thesis is tor is not necessarily a privacy panacea. The threat model an American or European has is much different than someone from Vietnam or turkey or China, which is also much different than someone from the Nordic countries.
It wasn’t presented as such. Good security comes in layers (“security in depth”). TLS serves users well but it’s not the only tool in the box.
There are so many ways to exploit connections. Look at what happened here on lemmy with vulns leading to takeovers of instances with xss of session cookies.
Tor Browser includes noscript which blocks XSS.
The primary difference is your ISP is not generally actively hostile. They may want to sell metadata but they aren’t actively trying to exploit you.
Selling your metadata is exploiting you. And this exploit happens lawfully under a still-existing Trump policy, so you have zero legal protections. Contrast that with crooks stealing money from your bank account, where, if it’s a US account, you have regulation E legal protections.
If your ISP (or in some cases a nation state is your isp) is actively tracking you, then there are other alternatives that may be better.
Different tools for different threat models. If you are actually targeted by a nation state, Tor alone is insufficient but it’s still in play in conjunction with other tech. But from context, you were giving general advice to the general public telling them not to use Tor for banking, thus targeting is not in the threat model. But mass surveillance IS (i.e. that of your ISP).
But to answer my your question my thesis is tor is not necessarily a privacy panacea.
Tor is an indispensable tool to streetwise users. Of course it is a tool among other tools & techniques.
The threat model an American or European has is much different than someone from Vietnam or turkey or China, which is also much different than someone from the Nordic countries.
Those threat models all have a common denominator: mass surveillance. It is safe to assume mass surveillance is in everyone’s threat model as a baseline. Of course there are a variety of other threats in each individual threat model for which you couldn’t necessarily anticipate.
Good security comes in layers (“security in depth”). TLS serves users well but it’s not the only tool in the box.
Im glad we agree. Because its the entire point. You are nitpicking where it suits you and thats not really honest conversation. Tor browser isnt the only way to access tor and if you are talking about making tor more accessible using things like phones is going to be needed. There are entire swaths of the world, billions of people, where phones are basically the only gateways to the inter.
And on a device with something like CalyxOS (or built with the app structure like calyxOS android based apps) that opens up a LOT more applications to using tor, some of which arent going to be locked down or configured appropriately. Its riskier. You seem to implicitly agree as you only pointed to a single example of XSS and just ignored other examples I provided…Surely we dont need to iterate through every attack vector out there? Because the point isnt those minutia there.
The point is, again, that Tor and specifically exit nodes are more hostile than normal ISP relays. They are actively malicious and often looking to exploit anything they can. Saying selling metatdata that is unencrypted is the same level of malicious as a nation state going after you (life and death) or having your identity or bank account stolen is clearly pretty naive. Even having your banking comprimised is a giant show stopper and theres no “well i have protections” flag to waive. You still have to deal with getting your funds back and paying for stuff to live in the interim. Its a very invasive process. Comparing that to an ISP selling your DNS queries (which im not even sure happens) is literally apples and orances
Those threat models all have a common denominator: mass surveillance. It is safe to assume mass surveillance is in everyone’s threat model as a baseline.
Thats a bad assumption. MOST people arent really concerned with it in the western world. Its why the apparatus exists. And thats not a Trump thing. its existed WAY before trump. Snowden showed that and it was Obama, not trump, that went after whistleblowers harder than any predecessor before them. Its why Snowden is still in exile to this day. Further trying to make this about “party” sides is a bad idea. Its something all parties, including most countries are not only a party to, but actively collaborating against. And there are some areas where straight access TOR is illegal and can get you in trouble. ANd the mass surveillance one country does (ie: US) is much different than another (ie China) so again its not just a giant brush to paint with there. Piping all data through Tor would make you look more suspicious in some of those latter countries and could increase your risk to fingerprinting or tracking, rather than selectively using it where and only when needed.
Im glad we agree. Because its the entire point. You are nitpicking where it suits you and thats not really honest conversation.Tor browser isnt the only way to access tor
TLS is useful very specifically in the case of banking via Tor Browser, which is the most likely configuration the normal general public would use given the advice to access their bank over Tor.
There are entire swaths of the world, billions of people, where phones are basically the only gateways to the inter.
I do not recommend using a smartphone for banking. You’re asking for a huge attack surface & it’s reckless. People will do it anyway but to suggest that people should avoid Tor for banking on the basis that you’re assuming they are using a phone is terrible advice based on a poor assumption. Use Tor Browser from a PC for banking. That is the best advice for normies.
The point is, again, that Tor and specifically exit nodes are more hostile than normal ISP relays.
And again, those hostile nodes get less info than ISPs. They have to work harder to reach the level of exposure that your ISP has both technical and legal privilege to exploit.
Saying selling metatdata that is unencrypted is the same level of malicious as a nation state going after you (life and death) or having your identity or bank account stolen is clearly pretty naive.
Wow did you ever get twisted. You forgot that I excluded targeting by nation states from the threat model as you should. If someone has that in their threat model, they will know some guy in a forum saying “don’t use Tor for banking” is not on the same page, not aligned with their scenario, and not advising them. You don’t have to worry about Snowden blindly taking advice from you.
It’s naive to assume your ISP is not collecting data on you and using it against you. It’s sensible to realize the risk of a honeypot tapping your bank account and getting away with it and regulation E protections failing is unlikely enough to be negligible.
You still have to deal with getting your funds back and paying for stuff to live in the interim.
If you’re in the US, you have ~2-3 bank accounts on avg, and 20 credit cards (US averages). Not to mention the unlikeliness of an account getting MitM compromised despite TLS in the 1st place. Cyber criminals choose the easier paths, just as 3 letter agencies do: they compromise the endpoint. Attacking the middle of a tunnel is very high effort & when it’s achieved they aren’t going to waste it on some avg joe’s small-time bank acct. At best you might have some low-tech attempts that result in no padlock on the user side. But I’ve never seen that in all my years of exclusively banking over Tor.
Thats a bad assumption.
Not in the slightest. Everyone is subject to mass surveillance & surveillance capitalism.
MOST people arent really concerned with it in the western world.
Most people don’t even have a threat model, or know what it is. But if you ask them how they would like it if their ISP told their debt collector where they bank so the debt collector can go do an unannounced legal money grab, you’ll quickly realize what would be in their threat model if they knew to build one. A lot of Corona Virus economic stimulus checks were grabbed faster than debtors even noticed the money arriving on their account.
And thats not a Trump thing. its existed WAY before trump. Snowden showed that and it was Obama, not trump, that went after whistleblowers harder than any predecessor before them.
You missed the source I gave. Obama banned the practice of ISPs selling customer data without their consent. Trump reversed that. That is wholly 100% on Trump. Biden did not overturn Trump, so if you want, you can put some of the fault on Biden.
W.r.t history, echelon predates Snowden’s revelations and it was exposed to many by Nicky Hagar in the 80s or 90s. But this all a red herring because in the case at hand (banking customers accessing their acct), it’s the particular ISP role of mass surveillance that’s relevant, which Trump enabled. Or course there is plenty of other mass surveillance going on with banking, but all that is orthogonal to whether they use Tor or not. The role of Tor merely mitigates the ISP from tracking where they bank, and prevents banks from tracking where you physically are, both of which are useful protections.
Further trying to make this about “party” sides is a bad idea. Its something all parties
You can’t “both sides” this when it’s verifiable that Obama banned the practice and Trump overturned it. While Obama’s hands are dirty on a lot of things (e.g. Patriot Act continuity), it’s specifically Trump who flipped the switch to ISP overcollection. Citation needed if you don’t accept this.
And there are some areas where straight access TOR is illegal and can get you in trouble.
The general public knows your general advice to use/not use Tor is technical advice not legal advice, and also not specific to their particular jurisdiction.
There are entire swaths of the world, billions of people, where phones are basically the only gateways to the inter.
I do not recommend using a smartphone for banking. You’re asking for a huge attack surface & it’s reckless. People will do it anyway but to suggest that people should avoid Tor for banking on the basis that you’re assuming they are using a phone is terrible advice based on a poor assumption. Use Tor Browser from a PC for banking. That is the best advice for normies.
again, the article is about “normies” using tor to get it to lose its stigma… The only way it gets de-stigmatized is for “normies” to use it. The way “normies” access things is vastly different. There are risks to that. And its not just banking. Getting your email account hacked because you used it on a malicious exit node for one reason or another is just as bad, if not worse. Tor exit nodes are wholesale more malicious than your ISP.
I dont know why you are getting hyper fixated on specific use cases that were used as broad examples. Banking isnt the point its the general use of TOR and the risk it brings. Forest for the trees my guy.
What effect would using Tor browser to access a non onion site have over using a different, privacy-focused browser? Honest question. I assumed Tor browser was no different than other browsers in that aspect.
The difference is that your ISP doesn’t know where your packets are headed, and the destination doesn’t know where your packets came from. The ISP sees you connect to the entrance node and the destination sees you connect from the exit node, and it’s very difficult for anyone to trace the connection back to you (unless they own both the entrance and exit and use traffic coorelation or some other exploit/fingerprint). Regardless, both parties are generally able to tell that you are using TOR if they reference lists of known entrance/exit nodes. Also the anti-fingerprinting measures taken by TB are a bit more strict than other privacy-focused browsers
Thank you for the detailed answer. I’m surprised more people aren’t talking about using tor browser, considering how privacy-minded the community tends to be.
No problem! And yeah, it’s good to see people talking about it over here. I think it’s the best tool for online privacy OOTB (depending on your threat model), and it gets better the more people use it.
It is confusing, Tor is an excellent privacy tool if used properly (don’t log in to stuff), but I guess it’s still a technical hurdle to most. Probably also from a lack of marketing.
I think in countries where the government is decidedly more authoritarian it’s more known. On my relay right now I see a ton of russian and a smaller amount of German connections.
I mean, I’ve used it. It works. But I don’t get why you would bother most of the time. It’s slow as hell and while I’m generally fairly concerned about my privacy there is a point where I can’t be bothered.
It seems like Teslas get way less range when it’s cold, especially the ones without heat pumps. This is no surprise whatsoever but it’s not well covered by EPA range estimates because combustion engines get free heat. So it’s not something people are used to thinking about.
Seems like where Tesla f’d up is by making a team to lie about it instead of just telling people, “yeah that’s what happens.” As usual it’s the cover-up that worse than the crime. Tesla will probably win the case but will look stupid. Should have just been honest about it.
I hate musicals mostly. I think the original Annie was the only one I liked (because I was a kid and didn’t know better :P). I find musicals are a sign that the writers are running out of ideas and it’s the last season but this episode blew my expectations all away. It felt like an episode with singing, and not singing to skate by for an episode.
It’s already in the local Whole Foods. I totally don’t trust it, and probably never will. At some point I’m sure they’ll make it impossible to shop anywhere without it but I plan to hold out indefinitely. No thanks.
Good for you. When I say I won’t use stuff like this my friends and family mock me for being paranoid. It’s disturbing how quickly people will just do something because it seems cool and/or convenient.
You can change your password if it gets compromised. You can’t change your bio-metrics. Once a digital version of your retina, fingerprint, palm print, whatever gets leaked…you’re screwed.
I know they claim these things are locked away in HSM devices, but I don’t care. You’re trusting every single engineer, coder, tester, and mid-level manager with access to these things. It’s a long chain of trust in the typical “rush it out the door” corporate environment.
Real security and QA are the last things on their minds when they develop this stuff.
So when I first learned about TOR almost 10 years ago in uni, it was said to be compromised to a significant extent by secret services holding entry and exit nodes.
I’ve hear something similar. I think I read that the US Air Force has a bunch of nodes or something.
Additionally I don’t really understand what I would use it for if I already have a vpn and how it might put me a risk of legal trouble if I’m using it and someone routes something bad through me while I’m using it…
I’m not even sure how to talk about it.
I am decently technical, I just don’t know this tech.
Disclaimer that I haven’t used Tor in a while, do your own research, etc
The US navy designed and open sourced the Tor network. If all the traffic meant to be anonymous was coming from the US navy it doesn’t work well as an anonymizer. There’s been various claims that they have backdoors over the years, but to my knowledge none have held water.
Unless you’re running an exit node (which requires different software than the Tor browser) other people’s traffic isn’t getting routed through you so you’re fine legally.
VPNs are not very good at protecting you from the websites or services you connect to. They’re best used to hide where you’re connecting to from your ISP. Modern fingerprinting using things like browsing habits, installed software, web browser size, cookies, etc is barely effected by VPNs and the Tor browser takes care of an minimizes lots of those tools.
The biggest issue for day to day use for me is how slow it is. Because your traffic is being routed through 3-5 nodes before getting to its destination overall speed and latency suffer a lot
The biggest issue for day to day use for me is how slow it is. Because your traffic is being routed through 3-5 nodes before getting to its destination overall speed and latency suffer a lot
That’s why I never continued to use it after the times I experimented with Tor.
Modern fingerprinting using things like browsing habits, installed software, web browser size, cookies, etc is barely effected by VPNs and the Tor browser takes care of an minimizes lots of those tools.
But can’t you just spoof most of that if you really want to? If you’re putting in the effort to be concerned with anonymity.
Iirc holding both the entry and exit of a routed connection, you can in theory match traffic going through, which would let you connect a user to the server/site they are connecting to. It might still be encrypted at that point, idk the details anymore.
I also heared that bit about the secret service owning nodes a few years ago. It was trough a teacher that’s also really in the stuff outside of teaching, and has a network of non-teaching proffesionals in the field.
It’s something to keep in mind, at the very least. Tor already has some weaknesses anyways. You shouldn’t trust it blindly just because it’s Tor. If anything, I think it more has a false rep for how strong it is over struggling with a stigma.
I don’t think a single credible source has shown this to be a vulnerability. You’re talking about an attack that would cost, what, millions of dollars to run per day?
Can anyone speak on the state of this game? I’ve never been that curious about it but with all the additions of cult classic characters, I’m starting to get intrigued
I am not sure what he’s hinting at. Just using Tor doesn’t bear any legal risks. Hosting an exit node is different, as depending on the country you might get into serious trouble if certain traffic goes through it.
Yes exactly, and I think there have been stories recently where the exit node host has been held liable for content that’s gone through it.Which is complete bullshit, but the unfortunate reality is that the legal system doesn’t need to understand technology to regulate it.
It’s not bullshit. If A has proof your system launched an attack, or sent CSAM, to another system, but your only defense is “I let anyone use my system in that way”, then at the very least you’re an accomplice.
It is bullshit, because it puts the onus of policing everything on any service provider. If a TOR exit node provider is responsible for all traffic through their node, then an ISP is responsible for all traffic through them to their users - yet it is not reasonable for ISP’s to do this. Nor should it be acceptable by law and even less so if the purpose is for law enforcement to bypass the warrant system by having private parties do the investigation for them.
Well, the law enforcement ship has sailed a long time ago, it’s more of a flotilla by now. Data communication service providers (including ISPs) have some customer identification and data retention requirements in exchange for immunity from the data itself, but otherwise —reasonabke or not— there are more and more traffic policing laws that get introduced for ISPs to abide. By starting a Tor Exit node, you become a service provider, and the same laws start to apply.
It’s no joke that we live in a surveillance state, just that some go “full surveillance” like China, while others go “slightly less in-your-face surveillance” like the US/EU.
Would it be possible to allow exit nodes to blacklist specific kinds of traffic and somehow privately verify that the traffic is not one of the blacklisted kinds (zero knowledge proof perhaps sorry not a CS person)?
An exit node can put in place any filters, blacklists, mitm, exploit injection, logging, and anything else it wants… on unencrypted traffic. Using HTTPS through an exit node, limits all of that to the destination of the traffic, there is no way to get a ZK proof of all the kinds of possible traffic and contents that can exist.
To give you an idea, last time I used Tor, I suddenly started to get a bunch of connection attempts from the FBI. Was I doing anything illegal? Nope. Was TOR a legal liability? You betcha.
I was using peerblock and one of the blocklists contained known governmental IP addresses. Those blocked connections began quickly filling the logs.
Spooked the crap outta me. It’s been a few years since I did that, so I could have that detail wrong. I know it was for sure one of the three letter acronyms, DOD, FBI, CIA, but they were definitely incoming.
That does not sound plausible to me. Typically, your own computer would be behind a router that is either doing NAT or has a firewall (probably the former). Any incoming traffic would be directed to the router without any chance of reaching your computer. Whatever you saw was either outgoing traffic or incoming traffic in response to connections initiated by your own computer.
Consider this, the Tor software was accepting connections from government IPs.
Regardless of whether it was active intrusion or a significant portion of the Tor network, (at that time) had a number of governmental IP ranges in it, It’s enough to dissuade my use, at least without more significant OpSec.
I use peerblock and had some good blocklists set up. The hardest part should be finding peerblock or a more modern fork, the blocklists are mostly public. Helps keep from connecting to known bad actors.
engadget.com
Active