Turning funding into more exit relays

"a) network load would just grow to fill whatever new capacity we have, especially if we don't deal with the tiny fraction of users who do bulk downloads, and b) reducing diversity of relay operator control can harm anonymity."

This is exactly right. You can stop the discussion there.

But lets go on. Tor user for 10 years or so. I remember when the network was very slow indeed. It has sped up. Great. Now that it is usable, the primary requirement of anonymity and privacy needs to continue to be focused on.

My basic point is the torproject should focus on 1) improving the code versus the numerous published attacks. 2) Improving the code relative to application level anonymity. 3) running the dir servers in a way that is transparent and clear that it is not some spy net.

I don't agree with the torproject getting involved in running relays. It needs to be continued to be setup in a way that we don't really need to trust the torproject, beyond the tor code, which we can inspect.

Running relays does not seem relevent to improving the code against the numerous attacks and ease of use for primary use cases.

It is clear that the idea here is tor is for people in iran and china. That is ridiculous. It is for people in the US. It is clear funding coming from us democratic and partisan sources is influencing development. If you ask voa to fund 150 nodes, I would like to see Putin put up 150 nodes. Which is the way it may work in the end? Does the military really use this? Or do they rely on encrypted direct satalite communications?

It seems to me the main issues really affecting your privacy (at this point in tor's development), are most habit related. Posting personal information, etc. What is happening is the adversaries are just getting physical with it when they can't censor via the isp's. Tor is an important part of the the personal freedom equation.

The censorship is a big reason to use tor. I heard about someone who was connecting to some server, and the local government (or someone) started dropping their packets. So they used tor. Then the government would watch the connection, and shut off the power to the neighborhood periodically. Or all the nearby wifi points would mysteriously stop working. First they steal your laptop battery...and there is only one store in Nirobi to buy another laptop...

Other jurisdictions planting drugs in activists houses.

It is absolutely mind-boggling the extent to which (most) people will listen to whatever someone in a uniform says...the holocaust being a prime example...but the US has its share of examples. Including screwing with your internet connection.

If they aren't able to really track the traffic (as global passive adversary) they switch to psychological manipuation, and continue to censor you out of fear.

They enter your house when you are not there, and leave something out of place near your computer...stuff like that. So you spend the next 3 days reinstalling your OS and NOT posting about the corruption or what you were trying to do.

You end up spending all this time and resources on increasing your computer security measures, installing firewalls, installing video camera surveillance systems, (if they haven't drained your bank account by this point) when you could be out there talking to people about what is going on. That you STILL have effectively been censored.

This is common for journalists, whistle-blowers, and civil rights activists.

And I am talking about the US too. They feel it is OK to do whatever is necessary to get your information. Guantanamo Bay being a prime example. They just don't give a fuck.

My concern is also with the quality of the exit (and entrance) relays. It takes one government hacker x amount of time to write some script that can compromise k misconfigured or outdated relays. Where it takes k individuals n amount of time (plus k*n dollars) to add k more (probably misconfigured) relays. The hacker wins.

Based on the PUBLISHED assesment of adding compromised relays to the network, it is feasible that an agency could just add another compromized node whenever an un-compromized node is added. This means that if you are using tor, under the current routing algorithms, it is possibly MORE likely for a high level adversary to determine where you are then if you are not using tor. Or am I missing something?

You may say that the hacker needs a million dollar super computer to analyze the data, but realistically, if he controls an entrance node and your isp, and is attacking a particular target, connecting to a particular server, the domain is much smaller. This sounds like a fringe case, but a particular target connection to a particular server is exactly what most activists and whistleblowers are trying to do. And all most adversaries are trying to do is see if you made that ONE post or ONE email.

In order to balance the equation, you need a standard relay os image, (such as tor running in an open bsd chroot (or whatever experts say would be the most secure configuration) that can be just pluged in and deployed, and has a standard hash so the relay operator can be certain that it has not been modified. Relays are potential hack targets to intelligence agencies, which probably have more resources and technical know-how available then the average relay operator. The vidalia exit relay bundles are not useful for high band width servers which often don't have a graphical interface. OR the package maintainers need to consider installing the package by default in a chroot, and sysadmins that have extra bandwidth might consider running a relay. Is there research into self-verifying systems?

My opinion of what the tor project should focus on:

1. Code improvements, and anonymity over performance. Is there a way to add an optional mix or packet spoofing?
2. Application level enforcement. Tor browser is in this direction (more so then torbutton) but is really a one-off from the more complicated https "sanitizer" model which in the long run is bigger and uglier, but more maintainable, and reusable. i.e. privoxy model https/socks intercept with adaptors for each application. Is it possible to register a CA with a browser to allow an intermidiary to validate SSL certs? Keeping all components modular. I am sure this situation has been studied in depth by torproject, but my feeling is that you are giving people half ass solutions and hiding behind the "we told you it was experimental software" line.
3. Standard relay bundels for security. If I am running a server that has extra bandwidth, I might consider running a relay if I knew it was secure (i.e. default chroot scripts for relay packages, or hardening). The idea I mentioned of a Tor OS that can some how compute a hash of itself (np complete problem?) IE rather than more relays, relay verification algorithms.
4. Fine-tuning routing algorithms--we know there are problems here with the statistics you are mentioning.
5. Post an expert assessment on the use case scenarios and how and whether tor should be used. For instance, if people are hunting you down and they are at the ISP too and you are in a rual region without may tor users, and they detect your using tor, they can actually follow you around EASIER. In some countries all the traffic leaves through one gate way...it is not so hard to watch for tor connections and determine the origionating ip--yet much harder then a vpn. And I realize the bridges are useful for this.

For example, have a site that says

• If you are running an ongoing criminal enterprise, should you be using tor?.
• If you are worried about censorship, then this is how you should use tor.
• If you are a fugative and people are after you, do this.
• If a government with large techno capability is after you, etc.
• If you are a russian spy in iran, should you be using tor or gmail?
• If you are worried about corporate ad tracking, etc.
• Which use cases is it better to run tor through a VPN?
• I don't want them to know where I am versus I don't want them to know what I am doing. Different use cases, and different ways to use (or not use) tor.

There was the recent hacker that got busted by chatting online over tor with an fbi informant. They watched his connection at his house and would verify the connection would go on and off when we went downtown.

You need to analyze what are the different use cases. TAILS only covers one use case.

People are AFRAID of liberty. If they weren't afraid, windows would come with a tor like thing built in, and all laptops would ship will full disk encryption and have a smart card attached. Governments define criminals based on the interests of the government. Democracies run by corporate interests define criminals based on what affects corporate profits. Hence, 90% of "criminals" are really political targets, targets of the church, or the result of a system that needs scapegoats. I.E., "The government agent told me to use tor."

I am beginning to think for the average person who thinks they need tor, it may actually be worse for anonymity because its use can be quickly followed by physical surveillance and manipuation, and the added techical know-how and learning curve detracts from other possible free-speech activities.

Simply saying "tor is experimental software, don't rely on it for strong anonymity" isn't enough, because people ARE relying on it for strong anonymity. Simply having a page that has 100 list items of dos and don'ts is too much, because not all those dos and don'ts apply to every use case, and it is too much to handle. If the activist/dissident has to become a PhD in CS, its over.

You are right to focus on diversity. This VOA move is clearly partisan. There is absolutely no reason they cannot deploy their own nodes. In fact, if they did, then can could even leave out the"family" tag from the torrc... If we want to talk about wasted bandwidth, it is that you are on this forum.