Re: Ultimate Anonymity

Alvin Schurman <gth789m@xxxxxxxxxxxxxxx> wrote:
> >> I've also heard that the individual server
> >> maintainers can mess with the code/implementation and defeat the
> >> anonymity of the system in certain cases.
> > I cannot see that a single server maintainer can do this.
> As far as I know, a maintainer can snoop all plain text leaving the
> router and has access to the tor logs.
> ref1:<http://tor.eff.org/cvs/tor/doc/tor-doc-server.html#three>
> ref2:<http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#head-7a7d28a84593aa8a2cb3419c311a09313e389783>

Your references are not showing this. And, having a look onto how Tor
works, I cannot see that any Tor server has access to the plaintext,
but the last one in a route (which must have). But this one cannot see,
from where the traffic is.

And using encryption, say: SSL or SSH, even will prevent this.

> >> It sounds like there are
> >> certain nodes you'd be wary of using. Can you say which nodes are areas
> >> of nodes?
> > This is a general question: to make onion routing work, you need at
> > least one node in the chain you can trust in.
> It actually wasn't a general question. my question was in response to
> this remark by you:
> "Additionally, you can define, which nodes will _not_ be used."
> That led me to think that you had a list of servers that you didn't
> trust or that you knew something interesting.

Sorry, I'm not a frequent Tor user (more often, I'm using AN.ON), so I
did not have a closer look onto the concrete nodes yet. I'm just talking
about security considerations.

> >> Did you glean all of your data from the manual or is there a website or
> >> resource you could recommend?
> > I did receive this information by reading the documentation, having a
> > look on the source code, and trying it out.
> Having a look on the source code and trying it out???

Yes.

> Do you have any references for me to read?

http://tor.eff.org/cvs/tor/doc/design-paper/tor-design.html

Very interesting in this paper i.e. is 7. Attacks and Defenses.

Here you can get the source code: http://tor.eff.org/download.html.en

> I want to learn why you recommended AN.ON as an anonymity solution and I
> want to know why you then implied that tor, like JAP, also has a backdoor?

I don't think, that Tor already has a backdoor (in fact, I didn't find
one yet ;-)

I just wanted to remember, that attacks on directory servers for legal
interception purposes quickly could lead into a solution for intelligence
services.

> Are you a Phd, CISSP, grad student?

While I'm teaching at a small university, and I'm CTO and software architect
in a software developing company, as a matter of fact I did not complete a
study myself. Most of my engineers and developers have, though ;-)

> Do you have any professional
> security credentials?

What? ;-)

> You could be anyone, so without references for me
> to read I'm just going to go on believing that tor is the best single
> non-invasive anonymity solution we have at present.

BTW: I agree with you here. And AN.ON is not worse, if you have one
node in it you can trust.

I just wanted to discuss the borders, both are facing.

BTW: the reason, why I'm more often using AN.ON/JAP and not Tor, is
performance.

Yours,
VB.
--
maximum inquementum tum biguttam egresso scribe. meo maximo vestibulo
perlegamentum da. da duo tum maximum conscribementa meis listis. dum listis
decapitamentum damentum nexto fac sic nextum tum novumversum scribe egresso.
lista sic hoc recidementum nextum cis vannementa da listis. cis.
.

Relevant Pages

  • Re: trilightzone.org & trighost.org == privacy.li
    ... >>which ip/url from the server and so on. ... > the same as all the other sock puppets before you. ... >>Then there is also Tor available for even more anonymity ... ...
    (alt.privacy)
  • Re: trilightzone.org & trighost.org == privacy.li
    ... > which ip/url from the server and so on. ... > Then there is also Tor available for even more anonymity ... ... You need to say "if you want SOME anonymity". ... That's why you and all you other sock puppets tell people to sign up ...
    (alt.privacy)
  • Re: Bad news about Tor
    ... But why would any anonymity server keep any ... Who cares if Tor servers keep logs? ...
    (alt.privacy)
  • Re: anonymous proxies
    ... >> Second, if you are connecting to anyone else's computer, as the proxy, ... >> then you have no real expectation of anonymity. ... > As far as Tor is concerned, only the first layer of the onion (i.e. the ... Let's call that server N. N+1 ...
    (alt.computer.security)
  • RE: Anonymizing Packets yet ensuring 0 % packet loss
    ... IBM, SUN SOLARIS, CISCO & MICROSOFT ... Tor is an open network you can use for this - this is frowned upon by Tor ... exit server traffic and block them the minute they see probes/attacks from ... enumerate the services, administration subnets, department subnets, ...
    (Pen-Test)