Tor, NSA, GCHQ, and QUICK ANT Speculation

Roger raised an important point above concerning the enemy:

The agency can draw upon the technical skills of thousands of full time employees who work inside the agency itself, often as federal employees, but often as contract employees who can provide specific essential skills. These people include black hat hackers who work in the TAO to develop malware for intruding into specific target computers (for example, key switches in the internet backbone which are owned by a provider which resists legal intimidation, journalist laptops).

But the agency also uses a large number of people with full time jobs in academia (math/CS/physics/ENG professors) for irregular contract work (sometimes in a government site, but often from their usual location while also doing their usual job). The enemy long ago learned that many of the best ideas are out in academia, and that they can best keep tabs on what researchers are currently thinking about by coopting the academic community.

Specifically, since so many posters have expressed (not unreasonable) concern about what our enemy knows that we might not about good/bad curves to use with ECC, many academics who work in number theory on topics which underlie ECC in some way have ties with the enemy. In some cases, the enemy even paid for their graduate education.

Universities love federal handouts and persuading faculties to cut their ties to the enemy will be difficult, particularly at a time of rising costs and decreasing ability of students to pay some of their tuition fees. But some academics have stepped forward to urge such measures, because over the next ten years it could considerably downgrade the enemy's R&D viz our own efforts.

I share the concerns of others here about the ties between Tor Project, Tails Project, and the US federal government, but I don't agree with the posters who have concluded that Tor is so "broken" as to be worse than useless. The post-Snowden evidence is still consistent with the conclusion that when used wisely, Tor can still make things difficult for the enemy, possibly even forcing it to engage in risky illegal practices such as attempting to intrude into Tor nodes. I would just point out that the Tor community can fight back by trying hard to capture and reverse engineer any malware used to infect Tor nodes.

Even the knowledge that the Tor community is doing this will provide some deterrence to the enemy's schemes, because the enemy will be reluctant to unleash its most sophisticated tools once it sees that we can detect and counter less sophisticated ones. In other words, I urge the Tor Project to think about countering the TAO as well as improving handshakes, moving towards using strong ECC, etc. (which are clearly also necessary in the current threat environment).

Roger suggested that concerned Tor users study the Tor-related papers at the freedom host archive, but that is hardly practical for most users, who lack the background needed to follow along. I DO have the background and I HAVE read those papers, and I'd like to try to help educate other Tor users about what they suggest about using Tor less unsafely. But currently the only way to do that appears to be to sign onto a mailing list, but many users are quite rightly reluctant to do that (either to ask questions or to offer answers). Indeed, someone at the Tor Project (I can't remember who) even admitted recently that no-one seems to know any currently effective means of using email with anything approaching reasonable anonymity viz our enemy.

So I hope that the Tor Project will work harder to provide a forum allowing anonymous posting via Tor connections, which is far from perfect (some of the reasons why have been mentioned above), but which appears to be less unsafe than alternative methods of two way communication with the user base. I appreciate that project members would rather work on other issues where it is more clear what is needed right away, but I hope they will consider the view that improving communications with the user base now could possibly improve the Project's ability to become aware of and to tackle other issues in the future. (I would remind them that for many years they resisted warnings from the user base, urgent warnings to update their thread model, warnings which have been thoroughly validated by the Snowden disclosures; some of the reasons why are discussed above.)

I have a question about Tor Browser Bundle: some Linux users have pointed out that when they unpack the Linux tarballs, they find Windows style end of line characters in the torrc and other files, suggesting that TBB is developed under Windows. Is that true? Strange if so because someone at Tor Project (right now I forget who) recently warned against using Tor under Windows owing to various intractable problems in obtaining reasonable security while using a proprietary OS developed by a PRISM partner company.