[tor-talk] BlackHat2014: Deanonymize Tor for $3000

[C B]

It also has to be a hollow claim. To actually "deanonymize" someone would mean making a list of every website that was visited by that client. Not just identify one client that visited one website. And how many clients were you planning on doing that with? It would take an NSA size budget not a $3000 budget to try to do that for everyone. And the NSA apparently can not do it for everyone.

about:tor starts out by saying "Tor is NOT all you need to browse anonymously! You may need to change some of your browsing habits to ensure your identity stays safe" and has some tips at https://www.torproject.org/download/download.html.en#warning which says at the bottom "This list of pitfalls isn't complete, and we need your
help identifying and documenting
all the issues" with a link to https://www.torproject.org/getinvolved/volunteer.html.en#Documentation
 
Basically we know that Tor is pretty robust, and yes it is being improved. I certainly benefit from using it every day. And all I really care about is no one making a list of my searches and sending me targeted advertising, which is very offensive. But others have much more serious reasons for using Tor.

--
Christopher Booth


________________________________
 From: Yuri <yuri at rawbw.com>
To: tor-talk at lists.torproject.org 
Sent: Thursday, July 3, 2014 10:01 PM
Subject: Re: [tor-talk] BlackHat2014: Deanonymize Tor for $3000
 

On 07/03/2014 16:17, Adrian Crenshaw wrote:
> Best guess, many client side and web app attacks Tor can't do much about.
> (My talk at Defcon will cover a bunch of folks that got Deanonymized, but
> in every case it was not Tor that was really broke)

This actually depends on what to mean by "Tor". If just the network 
level part, then yes. But tor project also provides and promotes TBB, 
which attempts to prevent various client side exploits and web app 
attacks, but apparently can't prevent all of them. If tor project went 
one step further, and developed security-by-isolation approach (using 
virtual machines, like Whonix does), this could prevent practically all 
client side exploits. And pretty much the only way user could be 
deanoned is if he himself typed in his personal information, or logged 
into some service shared with other identities.

Yuri


-- 
tor-talk mailing list - tor-talk at lists.torproject.org
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk