Remove the Tor Browser from the recommendations because it's a security catastrophy and puts people at risk #296

New Issue

Closed

opened 2017-07-20 22:04:40 +00:00 by ghost · 61 comments

ghost commented 2017-07-20 22:04:40 +00:00 (Migrated from github.com)

Copy Link

And before you laugh at me, here are some leading experts in infosec, cryptography, ... advising against it because of its laughable security:

@dguido [emphasis mine]

There’s a couple of issues. First off, the network itself can’t be trusted. It’s very easy for random people to set up what are called exit nodes. Those exit nodes are the routers in the Tor network that actually a lot of network traffic passes through.

It’s an opportunity for somebody to sniff that traffic, to modify that traffic. In the past, there’s been many documented cases where this has happened. Almost every time you go looking, it’s easy for researchers to find what are called malicious exit nodes or basically a person that’s monitoring traffic through the Tor network and manipulating it.

It’s span the gamut from state-sponsored attackers, like there’s been a Russia based APT group that was adding malware into people’s downloads. There have been individual hackers that have been sifting through data to find passwords that were going through it and unencrypted network communication.

Even WikiLeaks, when it first started, the original document set that WikiLeaks put on the Internet were documents they collected by running a Tor exit node. The network itself, no matter how you access it, is hostile. You should assume that when you’re sending traffic in the Tor network, that there’s somebody that’s looking at it.

That’s different because I can sit down and I can run a Tor exit node. I can offer to the Tor Foundation, like, “Hey, I have, you know, a box of co-lo and I’d be happy to let you pump like 10 megabits per second of traffic through it. Here’s what you need to hook me up. Go ahead and send some traffic.”

I can do that and I can get access to tens of thousands of people’s network traffic that way. What I can’t do is I can’t call up Verizon and say, “Hey, can you route customer x, y, z’s Web browsing through my machine now?” I would have to break into Verizon to do that.

You actually put yourself at more risk and a greater likelihood that you’re being surveilled by going through Tor than if you just stick on your regular home ISP. That’s the case for most people that are using Tor.

Then there is a problem of accessing the Tor network. The software that most people use to access the Tor network is the worst, most insecure set of browser components available. I’m talking about the Tor browser bundle. It is an out-of-date version of Firefox that lacks proper exploit mitigation like sandboxing, that has a unique network signature that a network owner can detect.

It makes you stick out like a sore thumb. It’s also because it’s out-of-date and because it’s easy to exploit, people do exploit it. If you’re browsing the Internet through the Tor browser, it is easier for people to write exploits that break into your computer when you use that, as compared to using the latest version of Chrome or the latest version of Internet Explorer.

Not only that, but it also creates a model culture. Everybody uses the same copy of the Tor browser bundle, means that I only need to write one exploit, instead of writing maybe 10 or more than that. I know that all the sketchy people on the Internet are using the Tor browser bundle, so I just need one exploit to get them all.

https://georgianpartners.com/the-problem-with-the-tor-network-and-commercial-vpns/

"Tor Browser is an abomination." All the audits in the world won't fix something that's broken by design. https://news.ycombinator.com/item?id=8468442

https://twitter.com/dguido/status/523238566294732800

Read the Tor design doc and ctrl+f for “does not.” Many pushing for use cases that don’t make sense.

https://twitter.com/dguido/status/494571338821279744

Tor levels the playing ground for bad actors. Anyone can intercept your traffic and no one uses a browser sandbox.

https://twitter.com/dguido/status/844196671747776514

for a multitude of reasons, it is trivial for network administrators to separate Tor traffic from non-Tor traffic.

https://twitter.com/dguido/status/755102215795273728

Final thoughts: the Tor Browser Bundle is unable to protect those that need it most. If you rely on it, strongly reconsider your choices.

https://twitter.com/dguido/status/803840526260797440

Consider the difficulty of running a Tor exit node that injects this exploit into every HTTP session. ¯_(ツ)_/¯

https://twitter.com/dguido/status/803845309373808640

@thegrugq

He has an article on the Tor Browser Bundle in his medium: https://medium.com/@thegrugq/tor-and-its-discontents-ef5164845908#.6gwjjg57l

[Tor Browser Bundle] collapses state-level targeting of browsers to a small set of Firefox versions; TBB is the most risky browser you can possibly run

— Thomas Ptacek

@matthew_d_green

Tor browser

https://twitter.com/matthew_d_green/status/830609724106276864

@tqbf

An extremely commonly held position among experts: Tor Browser is the least safe common browser.

It’s built on Firefox’s design, not Chromes, so it’s inferior at an architectural level. BUT, WORSE:

Matthew Green‏ @matthew_d_green Feb 11

Not to mention a slow rewrite/update schedule. Chrome rewrites kill 0days more reliably than @citizenlab.

@attractr @bartongellman @matthew_d_green Worse than Safari?

Thomas H. Ptáček‏ @tqbf Feb 13

Yes, far worse.

https://twitter.com/tqbf/status/830511154950766595

"An extremely commonly held position among experts: Tor Browser is the least safe common browser." was even retweeted by @rootkovska

And even their defenses against exploits are utter complete fails,

@halvarflake's presentation on exploit mitigation,

Important take-away: "users may choose Tor Browser over better alternatives. Verdict: Near-zero or negative benefit"

AS Thomas H. Ptáček‏ @tqbf SAID YOU'RE HURTING PEOPLE BY PUSHING THEM TO THE LEAST SECURE BROWSER IN THE MARKET.

NOTE: I'm NOT arguing against using Tor (although @dguido makes very well thought arguments about making own VPN with AWS or DigitalOcean is far better), I'm arguing against using the abomination that is the Tor Browser.

SOLUTION: Recommend Chrome with own made VPN (here's an easy guide that I recommend https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-that-works/ using Algo - which is better than Streisand - https://github.com/trailofbits/algo/)

And before you laugh at me, here are some leading experts in infosec, cryptography, ... advising against it because of its laughable security: @dguido [emphasis mine] > There’s a couple of issues. First off, the network itself can’t be trusted. It’s very easy for random people to set up what are called exit nodes. Those exit nodes are the routers in the Tor network that actually a lot of network traffic passes through. > > It’s an opportunity for somebody to sniff that traffic, to modify that traffic. In the past, there’s been many documented cases where this has happened. Almost every time you go looking, it’s easy for researchers to find what are called malicious exit nodes or basically a person that’s monitoring traffic through the Tor network and manipulating it. > > It’s span the gamut from state-sponsored attackers, like there’s been a Russia based APT group that was adding malware into people’s downloads. There have been individual hackers that have been sifting through data to find passwords that were going through it and unencrypted network communication. > > Even WikiLeaks, when it first started, the original document set that WikiLeaks put on the Internet were documents they collected by running a Tor exit node. The network itself, no matter how you access it, is hostile. You should assume that when you’re sending traffic in the Tor network, that there’s somebody that’s looking at it. > > That’s different because I can sit down and I can run a Tor exit node. I can offer to the Tor Foundation, like, “Hey, I have, you know, a box of co-lo and I’d be happy to let you pump like 10 megabits per second of traffic through it. Here’s what you need to hook me up. Go ahead and send some traffic.” > > I can do that and I can get access to tens of thousands of people’s network traffic that way. What I can’t do is I can’t call up Verizon and say, “Hey, can you route customer x, y, z’s Web browsing through my machine now?” I would have to break into Verizon to do that. > > You actually put yourself at more risk and a greater likelihood that you’re being surveilled by going through Tor than if you just stick on your regular home ISP. That’s the case for most people that are using Tor. > > **Then there is a problem of accessing the Tor network. The software that most people use to access the Tor network is the worst, most insecure set of browser components available.** ***I’m talking about the Tor browser bundle. It is an out-of-date version of Firefox that lacks proper exploit mitigation like sandboxing, that has a unique network signature that a network owner can detect.*** > > **It makes you stick out like a sore thumb.** ***It’s also because it’s out-of-date and because it’s easy to exploit,*** **people do exploit it. If you’re browsing the Internet through the Tor browser, it is easier for people to write exploits that break into your computer when you use that,** ***as compared to using the latest version of Chrome or the latest version of Internet Explorer.*** > > **Not only that, but it also creates a model culture. Everybody uses the same copy of the Tor browser bundle, means that I only need to write one exploit, instead of writing maybe 10 or more than that.** I know that all the sketchy people on the Internet are using the Tor browser bundle, so I just need one exploit to get them all. https://georgianpartners.com/the-problem-with-the-tor-network-and-commercial-vpns/ > "Tor Browser is an abomination." All the audits in the world won't fix something that's broken by design. https://news.ycombinator.com/item?id=8468442 https://twitter.com/dguido/status/523238566294732800 > Read the Tor design doc and ctrl+f for “does not.” Many pushing for use cases that don’t make sense. https://twitter.com/dguido/status/494571338821279744 > Tor levels the playing ground for bad actors. Anyone can intercept your traffic and no one uses a browser sandbox. https://twitter.com/dguido/status/844196671747776514 > for a multitude of reasons, it is trivial for network administrators to separate Tor traffic from non-Tor traffic. https://twitter.com/dguido/status/755102215795273728 > Final thoughts: the Tor Browser Bundle is unable to protect those that need it most. If you rely on it, strongly reconsider your choices. https://twitter.com/dguido/status/803840526260797440 > Consider the difficulty of running a Tor exit node that injects this exploit into every HTTP session. ¯\_(ツ)_/¯ https://twitter.com/dguido/status/803845309373808640 @thegrugq He has an article on the Tor Browser Bundle in his medium: https://medium.com/@thegrugq/tor-and-its-discontents-ef5164845908#.6gwjjg57l > > [Tor Browser Bundle] collapses state-level targeting of browsers to a small set of Firefox versions; TBB is the most risky browser you can possibly run > > — Thomas Ptacek @matthew_d_green > Tor browser > >  https://twitter.com/matthew_d_green/status/830609724106276864 @tqbf > # An extremely commonly held position among experts: Tor Browser is the least safe common browser. > > It’s built on Firefox’s design, not Chromes, so it’s inferior at an architectural level. BUT, WORSE: > > Matthew Green‏ @matthew_d_green Feb 11 > > Not to mention a slow rewrite/update schedule. Chrome rewrites kill 0days more reliably than @citizenlab. > > > > @attractr @bartongellman @matthew_d_green Worse than Safari? > > Thomas H. Ptáček‏ @tqbf Feb 13 > > Yes, far worse. https://twitter.com/tqbf/status/830511154950766595 "An extremely commonly held position among experts: Tor Browser is the least safe common browser." was even retweeted by @rootkovska And even their defenses against exploits are utter complete fails, @halvarflake's presentation on exploit mitigation,  Important take-away: "users may choose Tor Browser over better alternatives. Verdict: Near-zero or negative benefit" # AS Thomas H. Ptáček‏ @tqbf SAID YOU'RE HURTING PEOPLE BY PUSHING THEM TO THE LEAST SECURE BROWSER IN THE MARKET. NOTE: I'm NOT arguing against using Tor (although @dguido makes very well thought arguments about making own VPN with AWS or DigitalOcean is far better), I'm arguing against using the abomination that is the Tor Browser. SOLUTION: Recommend Chrome with own made VPN (here's an easy guide that I recommend https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-that-works/ using Algo - which is better than Streisand - https://github.com/trailofbits/algo/)

👍 3 👎 3

ghost commented 2017-07-20 22:20:30 +00:00 (Migrated from github.com)

Copy Link

I'd recommend avoiding TPB completely for most uses, but that's just my opinion.

Tor is a high-value target that's sponsored mainly by the US government, and whoever controls 51% of the few nodes controls over 13% of all circuits.

But, like everything else, this depends on your threat model. Tor is perfect for some people.

I'd recommend avoiding TPB completely for most uses, but that's just my opinion. Tor is a high-value target that's sponsored mainly by the US government, and whoever controls 51% of the few nodes controls over 13% of all circuits. But, like everything else, this depends on your threat model. Tor is perfect for some people.

ghost commented 2017-07-20 22:21:15 +00:00 (Migrated from github.com)

Copy Link

@C-O-M-P-A-R-T-M-E-N-T-A-L-I-Z-A-T-I-O-N thoughts?

@C-O-M-P-A-R-T-M-E-N-T-A-L-I-Z-A-T-I-O-N thoughts?

C-O-M-P-A-R-T-M-E-N-T-A-L-I-Z-A-T-I-O-N commented 2017-07-21 16:44:19 +00:00 (Migrated from github.com)

Copy Link

@Shifterovich
Wrote a comment addressing some things there here: https://github.com/nylira/prism-break/issues/1760#issuecomment-317050248

Tor is a high-value target that's sponsored mainly by the US government,

AFAIR OTF is the one that gives the majority of the funding for Tor Browser development, unless you consider the OTF to be part of the US gov, and unless you include other projects that are/were sponsored by OTF such as Qubes OS, then that argument doesn't hold.

and whoever controls 51% of the few nodes controls over 13% of all circuits.

How did you work out this calculation? It doesn't make sense.

@Shifterovich Wrote a comment addressing some things there here: https://github.com/nylira/prism-break/issues/1760#issuecomment-317050248 > Tor is a high-value target that's sponsored mainly by the US government, AFAIR OTF is the one that gives the majority of the funding for Tor Browser development, unless you consider the OTF to be part of the US gov, and unless you include other projects that are/were sponsored by OTF such as Qubes OS, then that argument doesn't hold. > and whoever controls 51% of the few nodes controls over 13% of all circuits. How did you work out this calculation? It doesn't make sense.

dnguyen01 commented 2017-07-21 17:15:56 +00:00 (Migrated from github.com)

Copy Link

So a couple things ... I would do a long explaination but I feel like you are just another person trying to evoke some emotion and trolling on purpose, hence why you already deleted your account and not trying to engage in an actual conversation. Also, you are quoting a lot with no actual proof of anything. For a very technical user base, why do we resort to no proof?

@C-O-M-P-A-R-T-M-E-N-T-A-L-I-Z-A-T-I-O-N has a good link with some of the debate there.

So first off. Why don't you just abandon the PrivacyToolIO project ... every project is gonna be insecure. Why even have this project at all? I can just go back to a life of giving up my privacy and security and not worry about a thing. Why is Windows so flawed and a security concern? Because lots of people use it, too much effort to move to another OS, etc. So where does Tor Browser stand then? It's because lots of people use it, too much effort to move another OS .. you get the point. And isn't this project about taking back some of their privacy and security? This is a starting point for people; taking back privacy comes in steps not full blown commitments. First the Tor browser on insecure OS, then a more secure OS running Tor browser, then maybe Tails.

Second thing. Tor Browser is run on Firefox 52 ESR. ESR meaning Extended Support Release, which focuses on security and bugs and less on features. If you actually did some research, why would you would say or quote someone who knows nothing about browsers "It’s also because it’s out-of-date and because it’s easy to exploit, people do exploit it.". Exploits happen because of setup errors. JS, out of date OS and other software, etc.

Third thing. Understand the use of Tor. It is not meant for everyday use but more to provide temporary anonymity. Anyone who understands security or takes a course knows the purpose of security - textbook definition - security is to provide a degree of resistance to, or protection from, harm. The purpose of security is to deter targets that have neither time, effort, or money. Security isn't perfect nor is it absolute. Tor browser is exactly that, allowing users to protect their identity from targets that have neither time or effort or money to gather, exploit, and reveal their identity in that immediate instance.

Fourth thing. "Sticking out like sore thumb". Again, another "proof"-less argument. All Tor browsers carry a similar fingerprint so they all may stick out BUT together so you can't identify whose who.

Recommending Chrome and a VPN to reclaim privacy. Why don't I just drop all this privacy nonsence and go back to my normal life? Chrome calls back to Google and a VPN always sees who you are; so what's the point of this project again?

Anyways, @Shifterovich, if this position of removing Tor and the Google/VPN combo is actually considered, I'd consider not running this project anymore. There's absolutely no point, it's just a waste of time and wasted effort. We all complain about Signal revealing your phone number but the ultimate reason is to provide solid security and privacy for those who wouldn't know better. And Tor Browser is the same way, providing an easy to use solution for people who absolutely need it; for the rest of us, we will always keep up-to-date with the news, stay above the curve, and use solutions that maybe inconvient for others.

So a couple things ... I would do a long explaination but I feel like you are just another person trying to evoke some emotion and trolling on purpose, hence why you **already deleted your account** and not trying to engage in an actual conversation. Also, you are quoting a lot with no actual proof of anything. For a very technical user base, why do we resort to no proof? @C-O-M-P-A-R-T-M-E-N-T-A-L-I-Z-A-T-I-O-N has a good link with some of the debate there. So first off. Why don't you just abandon the PrivacyToolIO project ... every project is gonna be insecure. Why even have this project at all? I can just go back to a life of giving up my privacy and security and not worry about a thing. Why is Windows so flawed and a security concern? Because lots of people use it, too much effort to move to another OS, etc. So where does Tor Browser stand then? It's because lots of people use it, too much effort to move another OS .. you get the point. And isn't this project about taking back some of their privacy and security? **This is a starting point for people; taking back privacy comes in steps not full blown commitments.** First the Tor browser on insecure OS, then a more secure OS running Tor browser, then maybe Tails. Second thing. Tor Browser is run on Firefox 52 ESR. ESR meaning Extended Support Release, which focuses on security and bugs and less on features. If you actually did some research, why would you would say or quote someone who knows nothing about browsers "It’s also because it’s out-of-date and because it’s easy to exploit, people do exploit it.". Exploits happen because of setup errors. JS, out of date OS and other software, etc. Third thing. Understand the use of Tor. It is not meant for everyday use but more to provide temporary anonymity. Anyone who understands security or takes a course knows the purpose of security - textbook definition - security is to provide a degree of resistance to, or protection from, harm. The purpose of security is to deter targets that have neither time, effort, or money. Security isn't perfect nor is it absolute. Tor browser is exactly that, allowing users to protect their identity from targets that have neither time or effort or money to gather, exploit, and reveal their identity in that immediate instance. Fourth thing. "Sticking out like sore thumb". Again, another "proof"-less argument. All Tor browsers carry a similar fingerprint so they all may stick out BUT together so you can't identify whose who. Recommending Chrome and a VPN to reclaim privacy. Why don't I just drop all this privacy nonsence and go back to my normal life? Chrome calls back to Google and a VPN always sees who you are; so what's the point of this project again? Anyways, @Shifterovich, if this position of removing Tor and the Google/VPN combo is actually considered, I'd consider not running this project anymore. There's absolutely no point, it's just a waste of time and wasted effort. We all complain about Signal revealing your phone number but the ultimate reason is to provide solid security and privacy for those who wouldn't know better. **And Tor Browser is the same way, providing an easy to use solution for people who absolutely need it; for the rest of us, we will always keep up-to-date with the news, stay above the curve, and use solutions that maybe inconvient for others.**

ghost commented 2017-07-21 20:37:29 +00:00 (Migrated from github.com)

Copy Link

We shouldn't focus just on the tools that provide a lot of usability. We should recommend the most secure options as well.

We all complain about Signal revealing your phone number

I wouldn't trust anything that runs on Android/iOS, but again, we're trying to cover the whole spectrum of threat models.

Tor is perfect for some, awful for others. We shouldn't remove it, but we should recommend good alternatives.

We shouldn't focus just on the tools that provide a lot of usability. We should recommend the most secure options as well. > We all complain about Signal revealing your phone number I wouldn't trust anything that runs on Android/iOS, but again, we're trying to cover the whole spectrum of threat models. Tor is perfect for some, awful for others. We shouldn't remove it, but we should recommend good alternatives.

👍 2

C-O-M-P-A-R-T-M-E-N-T-A-L-I-Z-A-T-I-O-N commented 2017-07-21 21:24:50 +00:00 (Migrated from github.com)

Copy Link

We shouldn't focus just on the tools that provide a lot of usability. We should recommend the most secure options as well.

When you have only one choice (in this case the Tor Browser, which as mentioned in my other post is the only browser that has good defenses against browser fingerprinting and for first party isolation) the answer to that question becomes straightforward isn't it?

Tor is perfect for some, awful for others. We shouldn't remove it, but we should recommend good alternatives.

The alternative suggested by OP is to setup leaky Chrome with an own made VPN, do you really think that can provide a good alternative?

> We shouldn't focus just on the tools that provide a lot of usability. We should recommend the most secure options as well. When you have only one choice (in this case the Tor Browser, which as mentioned in my other post is the only browser that has good defenses against browser fingerprinting and for first party isolation) the answer to that question becomes straightforward isn't it? > Tor is perfect for some, awful for others. We shouldn't remove it, but we should recommend good alternatives. The alternative suggested by OP is to setup leaky Chrome with an own made VPN, do you really think that can provide a good alternative?

Atavic commented 2017-07-21 22:01:18 +00:00 (Migrated from github.com)

Copy Link

Tor network is for anonymity. From the grugq article:

Anonymity is essentially a property of a system that ensures any user is equally likely to be the source of an event (communication, transaction...) This is one of the reasons that Tor Browser Bundle is pushed so heavily :  it creates a large pool of homogeneous users. That is good for anonymity.

Google Chrome, with MS Edge, is the less private browser ever made.

Algo officially supports DigitalOcean, Amazon Web Services, Microsoft Azure, and Google Cloud Engine.

I see no privacy in those services.

Tor network is for anonymity. From the grugq article: > Anonymity is essentially a property of a system that ensures any user is equally likely to be the source of an event (communication, transaction...) This is one of the reasons that Tor Browser Bundle is pushed so heavily :  it creates a large pool of homogeneous users. That is good for anonymity. Google Chrome, with MS Edge, is the less private browser ever made. > [Algo](https://github.com/trailofbits/algo) officially supports DigitalOcean, Amazon Web Services, Microsoft Azure, and Google Cloud Engine. I see no privacy in those services.

dguido commented 2017-07-21 22:02:41 +00:00 (Migrated from github.com)

Copy Link

I see no privacy in those services.

Algo is a VPN installer. You can place the server where ever you want. It has convience methods for those cloud providers but it works just as well on your own server.

I'm not sure the value of a privacy technology if using it results in compromising your security.

> I see no privacy in those services. Algo is a VPN installer. You can place the server where ever you want. It has convience methods for those cloud providers but it works just as well on your own server. I'm not sure the value of a privacy technology if using it results in compromising your security.

Atavic commented 2017-07-21 22:12:32 +00:00 (Migrated from github.com)

Copy Link

I see Algo VPN is based on Ubuntu.

I see Algo VPN is based on [Ubuntu](https://github.com/trailofbits/algo/blob/master/docs/deploy-to-unsupported-cloud.md).

ghost commented 2017-07-22 20:59:29 +00:00 (Migrated from github.com)

Copy Link

@C-O-M-P-A-R-T-M-E-N-T-A-L-I-Z-A-T-I-O-N

Imagine two groups of nodes: those controlled by one party, and the rest. That one party controls 50% of all nodes, so the chance that you'll pick either group is 50%. The chance that you'll pick the group again is 0.50^2. The chance that you'll pick the group yet again (Tor's case) is 0.50^3.

Note that the chance lowers by a single node each time, since you won't use the same node for one circuit twice/thrice (so it's controlled/total * controlled-1/total * controlled-2/total).

Obviously, to apply this to my previous example, just change 50% to 51%.

Note: I hope my math is correct.

@C-O-M-P-A-R-T-M-E-N-T-A-L-I-Z-A-T-I-O-N Imagine two groups of nodes: those controlled by *one* party, and the rest. That one party controls *50%* of all nodes, so the chance that you'll pick either group is 50%. The chance that you'll pick the group *again* is 0.50^2. The chance that you'll pick the group *yet again* (Tor's case) is 0.50^3. Note that the chance lowers by a single node each time, since you won't use the same node for one circuit twice/thrice (so it's `controlled/total * controlled-1/total * controlled-2/total`). Obviously, to apply this to my previous example, just change 50% to 51%. Note: I *hope* my math is correct.

dnguyen01 commented 2017-07-22 21:05:03 +00:00 (Migrated from github.com)

Copy Link

Well the problem is much tougher than you make it out to be and I guarantee the website as of right now can't handle that information. Right now, the website just has a bunch of links to possible software you can download. Just like preserving your privacy, security is a process. Tor Browser is as secure as the person using it so I'm not sure how Google Chrome + VPN is anymore secure and private for a person. Yes, Google Chrome is secure but it's just not private; that's the whole reason why we tell people not to use Facebook and Google yes? Like come on man, you're not even trying anymore. If the whole project is security, I'd trust my life with Google & Facebook yes? I can trust Google will make an effort to write secure software because they are the biggest targets to the world. But this is also a privacy project, which funny enough, they don't provide.

I can be on board with Algo because it's neutral - it's open source software and can be deployed anywhere/in your control. When you really say Tor should be removed, I'm not sure if you've given up on this project or not. Unlike a VPN, Tor Browser attempts to solve that problem that VPNS have -> the identity behind whose using it, well unless you use it incorrectly. Anyways, no more ranting, if you plan on making it a security project as well, I better see written up guides on how to harden a system because I sure as hell know that downloading some software doesn't make you anymore secure ..

Well the problem is much tougher than you make it out to be and I guarantee the website as of right now can't handle that information. Right now, the website just has a bunch of links to possible software you can download. Just like preserving your privacy, security is a process. Tor Browser is as secure as the person using it so I'm not sure how Google Chrome + VPN is anymore secure and private for a person. Yes, Google Chrome is secure but it's just not private; that's the whole reason why we tell people not to use Facebook and Google yes? Like come on man, you're not even trying anymore. If the whole project is security, I'd trust my life with Google & Facebook yes? I can trust Google will make an effort to write secure software because they are the biggest targets to the world. But this is also a privacy project, which funny enough, they don't provide. I can be on board with Algo because it's neutral - it's open source software and can be deployed anywhere/in your control. When you really say Tor should be removed, I'm not sure if you've given up on this project or not. Unlike a VPN, Tor Browser attempts to solve that problem that VPNS have -> the identity behind whose using it, well unless you use it incorrectly. Anyways, no more ranting, if you plan on making it a security project as well, I better see written up guides on how to harden a system because I sure as hell know that downloading some software doesn't make you anymore secure ..

ghost commented 2017-07-22 21:12:23 +00:00 (Migrated from github.com)

Copy Link

Using your own VPN has very few privacy advantages compared to a commercial VPN.

Using your own VPN has very few privacy advantages compared to a commercial VPN.

dnguyen01 commented 2017-07-22 21:32:15 +00:00 (Migrated from github.com)

Copy Link

Well, I'm not sure we're even talking about the same thing anymore. You here talking about setting up own VPNs when we were just talking about removing Tor Browser. Anyways, that's why it's called a privacy spectrum. For those who want true privacy (aka have their information & identity selectively revealed), they will go for setting up a personal VPN. By doing this, they know what goes into the setup and what they are running. It may use their ISP BUT the ISP and anyone looking only know where they have been but not what they are doing or information that is passed. So textbook definition of privacy basically.

When you choose a commercial VPN, your trading in this ISP knowing where you went for another entity knowing where you have been. You also trade the ability to know for a pure fact that what you are doing will not be used against you in the future, whether it is secure, whether it is what they claim to be. You are also trading in money for them to "promise" that they do this; which I will link to later but a Redditor exposed ExpressVPN for being in 100+ countries when really they just ran AWS or cloud setups.

So when you say "Using your own VPN has very few privacy advantages compared to a commercial VPN.", I'm actually really confused and very doubtful to take your advice. I realize that you have a certain setup and defending against certain targets but when you say a commercial VPN has more advantages, I'm not sure if you are actually looking out for people who want pure control of their privacy. If you are willing to trade some privacy for a certain target to not know what you are doing, fine. But don't go saying, there are few privacy advantages, when literally the definition of privacy is (https://en.wikipedia.org/wiki/Privacy) "ability of an individual or group to seclude themselves, or information about themselves, and thereby express themselves selectively. "

Well, I'm not sure we're even talking about the same thing anymore. You here talking about setting up own VPNs when we were just talking about removing Tor Browser. Anyways, that's why it's called a privacy spectrum. For those who want true privacy (aka have their information & identity selectively revealed), they will go for setting up a personal VPN. By doing this, they know what goes into the setup and what they are running. It may use their ISP BUT the ISP and anyone looking only know where they have been but not what they are doing or information that is passed. So textbook definition of privacy basically. When you choose a commercial VPN, your trading in this ISP knowing where you went for another entity knowing where you have been. You also trade the ability to know for a pure fact that what you are doing will not be used against you in the future, whether it is secure, whether it is what they claim to be. You are also trading in money for them to "promise" that they do this; which I will link to later but a Redditor exposed ExpressVPN for being in 100+ countries when really they just ran AWS or cloud setups. So when you say "Using your own VPN has very few privacy advantages compared to a commercial VPN.", I'm actually really confused and very doubtful to take your advice. I realize that you have a certain setup and defending against certain targets but when you say a commercial VPN has more advantages, I'm not sure if you are actually looking out for people who want pure control of their privacy. If you are willing to trade some privacy for a certain target to not know what you are doing, fine. But don't go saying, there are few privacy advantages, when literally the definition of privacy is (https://en.wikipedia.org/wiki/Privacy) "ability of an individual or group to seclude themselves, or information about themselves, and thereby express themselves selectively. "

👍 2

aediot commented 2017-07-22 21:41:26 +00:00 (Migrated from github.com)

Copy Link

It's almost like certain people in this thread don't realize that everyone's tradecraft is different and different people need different tools for different things.

Crazy.

It's almost like certain people in this thread don't realize that everyone's tradecraft is different and different people need different tools for different things. Crazy.

C-O-M-P-A-R-T-M-E-N-T-A-L-I-Z-A-T-I-O-N commented 2017-07-22 22:35:18 +00:00 (Migrated from github.com)

Copy Link

@Shifterovich
Thanks for clarifying. However note that controlling 50% of nodes doesn't mean that a random user will have a 50% chance of happening on one of your nodes, Tor picks nodes based on their consensus, which depends on its calculated bandwidth and other factors. For more accurate figures you may find this blog post informative, https://blog.torproject.org/blog/improving-tors-anonymity-changing-guard-parameters

@Shifterovich Thanks for clarifying. However note that controlling 50% of nodes doesn't mean that a random user will have a 50% chance of happening on one of your nodes, Tor picks nodes based on their consensus, which depends on its calculated bandwidth and other factors. For more accurate figures you may find this blog post informative, https://blog.torproject.org/blog/improving-tors-anonymity-changing-guard-parameters

ghost commented 2017-07-23 08:34:03 +00:00 (Migrated from github.com)

Copy Link

@C-O-M-P-A-R-T-M-E-N-T-A-L-I-Z-A-T-I-O-N Indeed, there are other factors, but still 3 nodes is bad.

I can be on board with Algo because it's neutral

Well, I'm not sure we're even talking about the same thing anymore.

Isn't Algo a self-hosted VPN? When a hundred people connect to one server, and a hundred connections are coming from the server, there is some privacy compared to you connecting to a middleman that only you use. Evades ISP monitoring, but if your threat model includes the government, it's useless.

@C-O-M-P-A-R-T-M-E-N-T-A-L-I-Z-A-T-I-O-N Indeed, there are other factors, but still 3 nodes is bad. > I can be on board with Algo because it's neutral > Well, I'm not sure we're even talking about the same thing anymore. Isn't Algo a self-hosted VPN? When a hundred people connect to one server, and a hundred connections are coming from the server, there is some privacy compared to you connecting to a middleman that only you use. Evades ISP monitoring, but if your threat model includes the government, it's useless.

aediot commented 2017-07-23 08:49:14 +00:00 (Migrated from github.com)

Copy Link

You're thinking anonymity. Not privacy.

Big difference.

You're thinking anonymity. Not privacy. Big difference.

ghost commented 2017-07-23 08:59:14 +00:00 (Migrated from github.com)

Copy Link

Am I? If the government can see your traffic, how's that private? Not to mention that VPS providers generally focus much less on privacy than VPN providers. I can imagine a self-hosted VPN being secure, but definitely not private. A self-hosted VPN can be as bad as a logging commercial VPN.

Am I? If the government can see your traffic, how's that private? Not to mention that VPS providers generally focus much less on privacy than VPN providers. I can imagine a self-hosted VPN being *secure*, but definitely not *private*. A self-hosted VPN can be as bad as a logging commercial VPN.

aediot commented 2017-07-23 09:08:43 +00:00 (Migrated from github.com)

Copy Link

So if I live in Turkey but have my VPN endpoint in Austria or Germany how exactly is the Turkish government going to passively monitor my traffic.

Even if I had it in Sweden my point remains the same.

Also the problem with a VPN service as an anonymity tool is that it's a trust based service.

You're trusting that these services are not hacked and/or logging.

VPNs weren't designed with anonymity in mind, we turned that into a service later down the road.

So if I live in Turkey but have my VPN endpoint in Austria or Germany how exactly is the Turkish government going to passively monitor my traffic. Even if I had it in Sweden my point remains the same. Also the problem with a VPN service as an anonymity tool is that it's a trust based service. You're trusting that these services are not hacked and/or logging. VPNs weren't designed with anonymity in mind, we turned that into a service later down the road.

aediot commented 2017-07-23 09:14:24 +00:00 (Migrated from github.com)

Copy Link

As far as the "Tor is broken" comments go, unless a user connects to all three nodes they can't decrypt the traffic.

And while that has happened in the past, the fact that a Gov or any other entity can't actively select and then deanonymize any user they want means that it works.

As to quote per the NSA slide documents Snowden leaked: "We can deanonymize some of the users some of the time, but never all of the users all of the time. And we can't pick and choose who we deanonymize."

That's not even bringing in the point of owning your own private obfuscated Tor bridge.

Or the fact that even if they do decrypt your traffic it'll only last for 10 minutes before you're on a new circuit route.

So basically if you're going to scream Tor / TBB is broken you're going to need to actually provide a source on how it is instead of quoting other "security experts" who also quote no other sources aside from "haha google it".

As far as the "Tor is broken" comments go, unless a user connects to all three nodes they can't decrypt the traffic. And while that has happened in the past, the fact that a Gov or any other entity can't actively select and then deanonymize any user they want means that it works. As to quote per the NSA slide documents Snowden leaked: "We can deanonymize some of the users some of the time, but never all of the users all of the time. And we can't pick and choose who we deanonymize." That's not even bringing in the point of owning your own private obfuscated Tor bridge. Or the fact that even if they do decrypt your traffic it'll only last for 10 minutes before you're on a new circuit route. So basically if you're going to scream Tor / TBB is broken you're going to need to actually provide a source on how it is instead of quoting other "security experts" who also quote no other sources aside from "haha google it".

ghost commented 2017-07-23 09:17:51 +00:00 (Migrated from github.com)

Copy Link

The fact that political relationships make paperwork hard between some countries doesn't mean it's secure. The fact that your government can't monitor your activities doesn't mean it's private.

You're trusting that these services are not hacked and/or logging.

Compared to a VPS provider that may log all traffic.

The fact that political relationships make paperwork hard between some countries doesn't mean it's secure. The fact that *your* government can't monitor your activities doesn't mean it's private. > You're trusting that these services are not hacked and/or logging. Compared to a VPS provider that may log all traffic.

aediot commented 2017-07-23 09:27:40 +00:00 (Migrated from github.com)

Copy Link

Typically when people talk about privacy they're talking about from their own Government and/or from companies like Google or whatnot.

Also VPS providers do typically log traffic.

However the difference between a logging VPS provider and a logging VPN provider is that your VPN provider if actually moled or hacked has a better chance of actively colluding with Government than some random VPS provider does.

I don't think the Turkish Gov is going to walk up to every VPS service hosted offshore and say "hey we want to spy on such and such user because reasons give us their traffic logs" because they'd likely be turned down.

If I was doing illegal things that would be an entirely different story.

But were on privacytools dot io talking about everyday privacy from things like your own ISP.

At the end of the day it really just depends on what you need for your personal setup. But you can't actively say {insert thing here} no good and to only use {insert thing here} because your trash might be my treasure and my threat model is not the same as yours.

Typically when people talk about privacy they're talking about from their own Government and/or from companies like Google or whatnot. Also VPS providers do typically log traffic. However the difference between a logging VPS provider and a logging VPN provider is that your VPN provider if actually moled or hacked has a better chance of actively colluding with Government than some random VPS provider does. I don't think the Turkish Gov is going to walk up to every VPS service hosted offshore and say "hey we want to spy on such and such user because reasons give us their traffic logs" because they'd likely be turned down. If I was doing illegal things that would be an entirely different story. But were on privacytools dot io talking about everyday privacy from things like your own ISP. At the end of the day it really just depends on what you need for your personal setup. But you can't actively say {insert thing here} no good and to only use {insert thing here} because your trash might be my treasure and my threat model is not the same as yours.

C-O-M-P-A-R-T-M-E-N-T-A-L-I-Z-A-T-I-O-N commented 2017-07-23 10:25:28 +00:00 (Migrated from github.com)

Copy Link

@aediot

That's not even bringing in the point of owning your own private obfuscated Tor bridge.

Depends on the threat model, but in some cases that may be bad. As Roger mentions in the blog post on Tor's anonymity and guard selection parameters,

But there's a second benefit as well: right now your choice of guards acts as a kind of fingerprint for you, since very few other users will have picked the same three guards you did. (This fingerprint is only usable by an attacker who can discover your guard list, but in some scenarios that's a realistic attack.) To be more concrete: if the adversary learns that you have a particular three guards, and later sees an anonymous user with exactly the same guards, how likely is it to be you? Moving to two guards helps the math a lot here, since you'll overlap with many more users when everybody is only picking two.

I can imagine that running your own private bridge will make you even more fingerprintable in some of these attacks.

Or the fact that even if they do decrypt your traffic it'll only last for 10 minutes before you're on a new circuit route.

Or the fact that in the Tor Browser you get a unique circuit for each first party domain, makes correlation attacks less dramatic ;)

So basically if you're going to scream Tor / TBB is broken you're going to need to actually provide a source on how it is instead of quoting other "security experts" who also quote no other sources aside from "haha google it".

Also be sure to quote security experts who know that Firefox' ESR receives security updates, and that Firefox (will (depending on the platform)) implements sandboxing (Firefox 52 and upward uses Chromium's sandboxing code for Windows, for Linux content sandboxing landed only until Firefox 54, but TB developers are looking for backporting that code to Firefox 52).

@aediot > That's not even bringing in the point of owning your own private obfuscated Tor bridge. Depends on the threat model, but in some cases that may be bad. As Roger mentions in the blog post on Tor's anonymity and guard selection parameters, > But there's a second benefit as well: right now your choice of guards acts as a kind of fingerprint for you, since very few other users will have picked the same three guards you did. (This fingerprint is only usable by an attacker who can discover your guard list, but in some scenarios that's a realistic attack.) To be more concrete: if the adversary learns that you have a particular three guards, and later sees an anonymous user with exactly the same guards, how likely is it to be you? Moving to two guards helps the math a lot here, since you'll overlap with many more users when everybody is only picking two. I can imagine that running your own private bridge will make you even more fingerprintable in some of these attacks. > Or the fact that even if they do decrypt your traffic it'll only last for 10 minutes before you're on a new circuit route. Or the fact that in the Tor Browser you get a unique circuit for each first party domain, makes correlation attacks less dramatic ;) > So basically if you're going to scream Tor / TBB is broken you're going to need to actually provide a source on how it is instead of quoting other "security experts" who also quote no other sources aside from "haha google it". Also be sure to quote security experts who know that Firefox' ESR receives security updates, and that Firefox (will (depending on the platform)) implements sandboxing (Firefox 52 and upward uses Chromium's sandboxing code for Windows, for Linux content sandboxing landed only until Firefox 54, but TB developers are looking for backporting that code to Firefox 52).

aediot commented 2017-07-23 10:31:41 +00:00 (Migrated from github.com)

Copy Link

I agree. Depends on your threat model.

But on the alms of privacy and even anonymity someone "knowing you're the same user" isn't as bad as "know who you are" in most use cases.

On top of which I was speaking about having one bridge {that you own} instead of three provided by the Tor project.

And if you land on two nodes owned by the same person your traffic won't be completely decrypted because of your owned bridge.

My point was just to say there's a lot you can do to avoid being deanonymized as opposed to saying "Tor is broken because {insert gov here} might own a lot of nodes".

I agree. Depends on your threat model. But on the alms of privacy and even anonymity someone "knowing you're the same user" isn't as bad as "know who you are" in most use cases. On top of which I was speaking about having one bridge {that you own} instead of three provided by the Tor project. And if you land on two nodes owned by the same person your traffic won't be completely decrypted because of your owned bridge. My point was just to say there's a lot you can do to avoid being deanonymized as opposed to saying "Tor is broken because {insert gov here} might own a lot of nodes".

alugarius commented 2017-08-03 02:33:37 +00:00 (Migrated from github.com)

Copy Link

I2P is better...

Even if I don't like java

I2P is better... Even if I don't like java

ghost commented 2017-08-03 15:59:33 +00:00 (Migrated from github.com)

Copy Link

I2P is the network, not the Java client. There are many implementations, such as i2pd.

I2P is the network, not the Java client. There are many implementations, such as [i2pd](https://github.com/PurpleI2P/i2pd).

C-O-M-P-A-R-T-M-E-N-T-A-L-I-Z-A-T-I-O-N commented 2017-08-04 21:22:12 +00:00 (Migrated from github.com)

Copy Link

@alugarius
I2P is a self-contained network, it's not meant for clearnet browsing, see an interview by I2P's current lead dev zzz here.

@alugarius I2P is a self-contained network, it's not meant for clearnet browsing, see an interview by I2P's current lead dev zzz [here](https://www.gulli.com/news/2913-i2p-an-anonymous-network-interrogated-2009-03-09).

C-O-M-P-A-R-T-M-E-N-T-A-L-I-Z-A-T-I-O-N commented 2017-08-17 11:21:02 +00:00 (Migrated from github.com)

Copy Link

@privacytoolsIO @Shifterovich @bakku @kewde

What else is there to add here? Also take a look at the related for more info if needed: https://github.com/nylira/prism-break/issues/1760

@privacytoolsIO @Shifterovich @bakku @kewde What else is there to add here? Also take a look at the related for more info if needed: https://github.com/nylira/prism-break/issues/1760

ghost commented 2017-08-17 11:49:56 +00:00 (Migrated from github.com)

Copy Link

Like I said, Tor is perfect for some, awful for others. We recommend tools for different threat models and it's up to the user to decide.

We're not gonna remove Tor, so I'm closing the issue.

Like I said, Tor is perfect for some, awful for others. We recommend tools for different threat models and it's up to the user to decide. We're not gonna remove Tor, so I'm closing the issue.

ghost commented 2017-08-17 21:18:01 +00:00 (Migrated from github.com)

Copy Link

Not an issue with Tor itself, but https://twitter.com/torproject/status/898256109789687808

Not an issue with Tor itself, but https://twitter.com/torproject/status/898256109789687808

C-O-M-P-A-R-T-M-E-N-T-A-L-I-Z-A-T-I-O-N commented 2017-08-18 18:16:25 +00:00 (Migrated from github.com)

Copy Link

Not an issue with Tor itself, but https://twitter.com/torproject/status/898256109789687808

Where's the issue in that?

> Not an issue with Tor itself, but https://twitter.com/torproject/status/898256109789687808 Where's the issue in that?

aediot commented 2017-08-18 18:18:35 +00:00 (Migrated from github.com)

Copy Link

How dare they think that racists are bad people.

How dare they think that racists are bad people.

Atavic commented 2017-08-18 18:27:39 +00:00 (Migrated from github.com)

Copy Link

That's outside the field of Tor Project IMHO

If some bad people is using Tor, it's the law that should look at them, not the Tor Project.

That's outside the field of Tor Project IMHO If some bad people is using Tor, it's the law that should look at them, not the Tor Project.

ghost commented 2017-08-18 19:26:51 +00:00 (Migrated from github.com)

Copy Link

Where's the issue in that?

They present Tor as a tool to evade censorship, yet they support censoring speech they don't like. They feel using Tor as a platform for free speech is using it for vile purposes.

@aediot Well they're fine with all the other crime, yet freedom of speech is an issue?

@Atavic Except there's no crime here, but they're fine with real crime.

> Where's the issue in that? They present Tor as a tool to evade censorship, yet they support censoring speech they don't like. They feel using Tor as a platform for free speech is using it for vile purposes. @aediot Well they're fine with all the other crime, yet freedom of speech is an issue? @Atavic Except there's no crime here, but they're fine with real crime.

aediot commented 2017-08-18 19:29:00 +00:00 (Migrated from github.com)

Copy Link

They strictly say that they're not censoring them in the article and that they're going to defend their rights / can't do anything about it. They were just grandstanding that they hate them.

However I will give you that point of them not calling out other crime.

Whoever put out that blog post needs to be fired because of that point alone.

They strictly say that they're not censoring them in the article and that they're going to defend their rights / can't do anything about it. They were just grandstanding that they hate them. However I will give you that point of them not calling out other crime. Whoever put out that blog post needs to be fired because of that point alone.

ghost commented 2017-08-18 19:47:26 +00:00 (Migrated from github.com)

Copy Link

I was referring to the other tweets, not the article itself.

They strictly say that they're not censoring them

They can't, but saying that freedom of speech disgusts and angers them and that censorship evasion when they don't like it is a vile use is not a good thing for an anti-censorship project.

I was referring to the other tweets, not the article itself. > They strictly say that they're not censoring them They can't, but saying that freedom of speech disgusts and angers them and that censorship evasion when they don't like it is a vile use is not a good thing for an anti-censorship project.

aediot commented 2017-08-18 19:54:32 +00:00 (Migrated from github.com)

Copy Link

So if I like freedom of speech I can't say any ideas are horrible and vile? What?

Isn't that like.

The whole point.

Or something?

So if I like freedom of speech I can't say any ideas are horrible and vile? What? Isn't that like. The whole point. Or something?

aediot commented 2017-08-18 19:54:58 +00:00 (Migrated from github.com)

Copy Link

If anything the fact that they disagree with them and don't do everything in their power to shut them down is arguably even a better look for them.

If anything the fact that they disagree with them and don't do everything in their power to shut them down is arguably even a better look for them.

ghost commented 2017-08-18 19:57:29 +00:00 (Migrated from github.com)

Copy Link

any ideas are horrible and vile

They said the use of Tor is vile here.

don't do everything in their power to shut them down

Except they can't (can to some extent, but it won't last). And it's a suicide.

> any ideas are horrible and vile They said the use of Tor is vile here. > don't do everything in their power to shut them down Except they can't (can to some extent, but it won't last). And it's a suicide.

aediot commented 2017-08-18 19:59:19 +00:00 (Migrated from github.com)

Copy Link

Uh....?

Uh....? 

ghost commented 2017-08-18 20:00:07 +00:00 (Migrated from github.com)

Copy Link

We feel this way any time Tor is used for vile purposes.

> We feel this way any time Tor is used for vile purposes.

aediot commented 2017-08-18 20:01:27 +00:00 (Migrated from github.com)

Copy Link

Right......So how is this damning in any way? Protectors of free speech aren't allowed to disagree with ideas and find others horrible even if they defend their right to say it? 🤔

Right......So how is this damning in any way? Protectors of free speech aren't allowed to disagree with ideas and find others horrible even if they defend their right to say it? 🤔

ghost commented 2017-08-18 20:02:57 +00:00 (Migrated from github.com)

Copy Link

There are some vile purposes for sure. But I didn't know free speech is a vile purpose. Not a good way to feel for an anti-censorship project team.

There are some vile purposes for sure. But I didn't know free speech is a vile purpose. Not a good way to feel for an anti-censorship project team.

aediot commented 2017-08-18 20:05:04 +00:00 (Migrated from github.com)

Copy Link

Do you support free speech? y/n

Do you support free speech? y/n

ghost commented 2017-08-18 20:06:04 +00:00 (Migrated from github.com)

Copy Link

Yes, for everyone. Even for Tor Project. And for myself to point out Tor Project's hypocrisy.

Yes, for everyone. Even for Tor Project. And for myself to point out Tor Project's hypocrisy.

aediot commented 2017-08-18 20:07:02 +00:00 (Migrated from github.com)

Copy Link

Do you think racism is a vile thing? y/n

Do you think racism is a vile thing? y/n

Atavic commented 2017-08-18 20:08:07 +00:00 (Migrated from github.com)

Copy Link

Yes, for everyone (even Palestinians).

Yes, for everyone (even Palestinians).

ghost commented 2017-08-18 20:08:38 +00:00 (Migrated from github.com)

Copy Link

Yes. Do I think using Tor Project to evade censorship of racist journalism is vile? Not at all.

Yes. Do I think using Tor Project to evade censorship of racist journalism is vile? Not at all.

ghost commented 2017-08-18 20:09:12 +00:00 (Migrated from github.com)

Copy Link

The content of the speech is irrelevant to its freedom.

The content of the speech is irrelevant to its freedom.

aediot commented 2017-08-18 20:10:39 +00:00 (Migrated from github.com)

Copy Link

So if you run a Tor node and someone uses your Tor node to actually say that someone is inferior to them because of their genes are you really going to tell me that you're not going to wish that they didn't think that way on your network?

So if you run a Tor node and someone uses your Tor node to actually say that someone is inferior to them because of their genes are you really going to tell me that you're not going to wish that they didn't think that way on your network?

aediot commented 2017-08-18 20:11:29 +00:00 (Migrated from github.com)

Copy Link

At the end of the day the Tor project is allowed to think whatever the actual hell they want. They could think the sky is purple for all I care. They're not enforcing action against dailystormer. Which means they defend free speech even though they hate racists.

So what was your point in all this again?

At the end of the day the Tor project is allowed to think whatever the actual hell they want. They could think the sky is purple for all I care. They're not enforcing action against dailystormer. Which means they defend free speech even though they hate racists. So what was your point in all this again?

ghost commented 2017-08-18 20:12:21 +00:00 (Migrated from github.com)

Copy Link

They don't hate racists, they hate when racists evade censorship which is hypocritical for an anti-censorship project.

They don't hate racists, they hate when racists evade censorship which is hypocritical for an anti-censorship project.

aediot commented 2017-08-18 20:13:06 +00:00 (Migrated from github.com)

Copy Link

So? Who cares so long as they're not enforcing their own beliefs on others?

So? Who cares so long as they're not enforcing their own beliefs on others?

ghost commented 2017-08-18 20:15:46 +00:00 (Migrated from github.com)

Copy Link

So if you run a Tor node and someone uses your Tor node to actually say that someone is inferior to them because of their genes are you really going to tell me that you're not going to wish that they didn't think that way on your network?

If you're volunteering to help protect freedom of speech, yet don't realize you might not like some, then you haven't thought it through.

So? Who cares so long as they're not enforcing their own beliefs on others?

What's wrong with the content on The Daily Stormer? I mean, as long as they're not enforcing their own beliefs on others, who cares?

> So if you run a Tor node and someone uses your Tor node to actually say that someone is inferior to them because of their genes are you really going to tell me that you're not going to wish that they didn't think that way on your network? If you're volunteering to help protect freedom of speech, yet don't realize you might not like some, then you haven't thought it through. > So? Who cares so long as they're not enforcing their own beliefs on others? What's wrong with the content on The Daily Stormer? I mean, as long as they're not enforcing their own beliefs on others, who cares?

aediot commented 2017-08-18 20:17:00 +00:00 (Migrated from github.com)

Copy Link

But I do realize that I might not like some.

And I run one anyway.

I'm allowed to hate them so long as I defend their right to speak.

But I do realize that I might not like some. And I run one anyway. I'm allowed to hate them so long as I defend their right to speak.

ghost commented 2017-08-18 20:18:50 +00:00 (Migrated from github.com)

Copy Link

are you really going to tell me that you're not going to wish that they didn't think that way on your network

Not going to wish that at all. Again, the content of the speech is irrelevant to its freedom.

> are you really going to tell me that you're not going to wish that they didn't think that way on your network Not going to wish that at all. Again, **the content of the speech is irrelevant to its freedom.**

aediot commented 2017-08-18 20:20:18 +00:00 (Migrated from github.com)

Copy Link

I mean you're free to not think pedophiles using the Tor network is vile. That's your prerogative.

I still run a Tor node anyway knowing that people who actually need it for good reasons will use it.

I mean you're free to not think pedophiles using the Tor network is vile. That's your prerogative. I still run a Tor node anyway knowing that people who actually need it for good reasons will use it.

C-O-M-P-A-R-T-M-E-N-T-A-L-I-Z-A-T-I-O-N commented 2017-08-19 11:59:12 +00:00 (Migrated from github.com)

Copy Link

Again lots of nonsense here,

@Shifterovich

They present Tor as a tool to evade censorship, yet they support censoring speech they don't like.

They literally said in the blog post, "Tor is designed to defend human rights and privacy by preventing anyone from censoring things, even us."

They feel using Tor as a platform for free speech is using it for vile purposes.

Dailystormer isn't a platform for free speech, it's a neo-Nazi racist white-supremacist site.

Well they're fine with all the other crime, yet freedom of speech is an issue?

Where did they say that they were fine with other crimes?

Except there's no crime here, but they're fine with real crime.

Where did they say that Dailystormer was engaging in criminal activity?

---

@aediot

However I will give you that point of them not calling out other crime.

"We feel this way any time the Tor network and software are used for vile purposes."

Again lots of nonsense here, @Shifterovich > They present Tor as a tool to evade censorship, yet they support censoring speech they don't like. They literally said in the blog post, "Tor is designed to defend human rights and privacy by preventing anyone from censoring things, even us." > They feel using Tor as a platform for free speech is using it for vile purposes. Dailystormer isn't a platform for free speech, it's a neo-Nazi racist white-supremacist site. > Well they're fine with all the other crime, yet freedom of speech is an issue? Where did they say that they were fine with other crimes? > Except there's no crime here, but they're fine with real crime. Where did they say that Dailystormer was engaging in criminal activity? ------------- @aediot > However I will give you that point of them not calling out other crime. "We feel this way any time the Tor network and software are used for vile purposes."

aediot commented 2017-08-19 14:00:57 +00:00 (Migrated from github.com)

Copy Link

I think the argument was that they've not put out any blog posts calling out crimes but they put out a blog about white supremacy.

I think the argument was that they've not put out any blog posts calling out crimes but they put out a blog about white supremacy.

Atavic commented 2017-08-19 14:29:01 +00:00 (Migrated from github.com)

Copy Link

@C-O-M-P-A-R-T-M-E-N-T-A-L-I-Z-A-T-I-O-N Politically leaning about Freedom of Speech?
Most of the questions in this issue are purely rhetorical.

@C-O-M-P-A-R-T-M-E-N-T-A-L-I-Z-A-T-I-O-N Politically leaning about Freedom of Speech? Most of the questions in this issue are purely rhetorical.

ghost commented 2017-08-19 15:21:35 +00:00 (Migrated from github.com)

Copy Link

@C-O-M-P-A-R-T-M-E-N-T-A-L-I-Z-A-T-I-O-N

"We feel this way any time the Tor network and software are used for vile purposes."

feeling != calling out

Where did they say that Dailystormer was engaging in criminal activity?

@Atavic: "If some bad people is using Tor, it's the law that should look at them, not the Tor Project."

Where did they say that they were fine with other crimes?

Crimes, not other crimes. Saying racist stuff isn't a crime. They didn't, but they always replied with "technology can be used for bad things as well", yet free speech is an issue?

Dailystormer isn't a platform for free speech, it's a neo-Nazi racist white-supremacist site.

What's the difference?

They literally said in the blog post, "Tor is designed to defend human rights and privacy by preventing anyone from censoring things, even us."

So what? Literally saying that using Tor to evade censorship is a vile purpose is contradictory to that.

@C-O-M-P-A-R-T-M-E-N-T-A-L-I-Z-A-T-I-O-N > "We feel this way any time the Tor network and software are used for vile purposes." feeling != calling out > Where did they say that Dailystormer was engaging in criminal activity? @Atavic: "If some bad people is using Tor, it's the **law** that should look at them, not the Tor Project." > Where did they say that they were fine with other crimes? Crimes, not other crimes. Saying racist stuff isn't a crime. They didn't, but they always replied with "technology can be used for bad things as well", yet free speech is an issue? > Dailystormer isn't a platform for free speech, it's a neo-Nazi racist white-supremacist site. What's the difference? > They literally said in the blog post, "Tor is designed to defend human rights and privacy by preventing anyone from censoring things, even us." So what? Literally saying that using Tor to evade censorship is a vile purpose is contradictory to that.

This repo is archived. You cannot comment on issues.

No Branch/Tag Specified

Branches Tags

master

dependabot/bundler/nokogiri-1.13.6

dependabot/bundler/addressable-2.8.0

freddy-m-patch-3

pr-add_RemoveMyPhone_sponsor

pr-browser_cleanup_1257_1328_1430

freddy-m-patch-2

freddy-m-patch-1

pr-vpn_hated_one_video

cdn

update-nitrohorse-image

promote-metager-to-card

hardware

pr-add_azirevpn

pr-add_mailfence

shop

1673

pr/1658

i18n-simple

sponsorship-edits-nov2019

i18n

ipfs

blacklight447-ptio-patch-3

blog

remove-windows-icons

pr/1147

i18n-testing

add-beautify

Labels

Clear labels   

🔍🤖 Search Engines

  

approved

approved, waiting for a PR

  

dependencies

Pull requests that update a dependency file

  

duplicate

  

feedback wanted

  

high priority

  

I2P

The Invisible Internet Project (I2P)

  

iOS

  

low priority

  

OS

Operating Systems

  

Self-contained networks

  

Social media

  

stale

A label for stalebot if it gets added

  

streaming

Anything related to media streaming.

  

todo

  

Tor

Anything covering the Tor network

  

WIP

active work in progress, do not merge or PR (yet)!

  

wontfix

Issues or bugs that will not be fixed and/or do not have significant impact on the project.

  

XMPP

Extensible Messaging and Presence Protocol

  

[m]

Matrix protocol

  

₿ cryptocurrency

  

ℹ️ help wanted

  

↔️ file sharing

  

⚙️ web extensions

Browser Extension related issues

  

✨ enhancement

  

❌ software removal

  

💬 discussion

  

🤖 Android

  

🐛 bug

  

💢 conflicting

  

📝 correction

Correction of content on the website

  

🆘 critical

  

📧 email

  

🔒 file encryption

  

📁 file storage

  

🦊 Firefox

Firefox & forks, about:config etc.

  

💻 hardware

  

🌐 hosting

  

🏠 housekeeping

Anything primarily related to site cleanup.

  

🔐 password managers

  

🧰 productivity tools

  

🔎 research required

  

🌐 Social News Aggregators

  

🆕 software suggestion

  

👥 team chat

  

🔒 VPN

Virtual Private Network

  

🌐 website issue

*Technical* issues with the website.

  

🚫 Windows

  

👁️ browsers

  

🖊️ digital notebooks

  

🗄️ DNS

Domain Name System

  

🗨️ instant messaging (im)

  

🇦🇶 translations

Anything covering a translated version of the site

No Label

🔍🤖 Search Engines

approved

dependencies

duplicate

feedback wanted

high priority

I2P

iOS

low priority

OS

Self-contained networks

Social media

stale

streaming

todo

Tor

WIP

wontfix

XMPP

[m]

₿ cryptocurrency

ℹ️ help wanted

↔️ file sharing

⚙️ web extensions

✨ enhancement

❌ software removal

💬 discussion

🤖 Android

🐛 bug

💢 conflicting

📝 correction

🆘 critical

📧 email

🔒 file encryption

📁 file storage

🦊 Firefox

💻 hardware

🌐 hosting

🏠 housekeeping

🔐 password managers

🧰 productivity tools

🔎 research required

🌐 Social News Aggregators

🆕 software suggestion

👥 team chat

🔒 VPN

🌐 website issue

🚫 Windows

👁️ browsers

🖊️ digital notebooks

🗄️ DNS

🗨️ instant messaging (im)

🇦🇶 translations

Milestone

Clear milestone

No items

No Milestone

Assignees

Clear assignees

No Assignees

1 Participants

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: privacyguides/privacytools.io#296

No description provided.