Tim_ said:The Inside Story of Tor, the Best Internet Anonymity Tool the Government Ever Built
"That’s ironic, because Tor started as a project of the U.S. government. More than half of the Tor Project’s revenue in 2012, or $1.24 million, came from government grants, including an $876,099 award from the Department of Defense, according to financial statements available on the project’s website."
"Paul Syverson at the U.S. Naval Research Laboratory in Washington is one of the world’s foremost researchers on encrypting and routing data and one of Tor’s creators."
"For the onion router to work properly, the Navy needed to step back from running it. A cloaking system is not useful if all the cloaks say 'Navy' on them."
"Syverson and other researchers have written voluminously about Tor’s weaknesses. The network operates within the wider Web, and the way users behave and configure their computers outside Tor is one of the biggest sources of insecurity."
"One way the NSA found to get around Tor’s software and spy on users was an attack called 'EgotisticalGiraffe,' exploiting a vulnerability in the Firefox browser. Another approach was to try to reconstruct the encrypted path to find the identity of a Tor user by monitoring relays, according to the 'Tor Stinks' presentation."
"Tor exerts little control over who volunteers to host traffic, and researchers have found evidence of abuse, such as cases where an operator is snooping on traffic."
"In September a security researcher, Robert Graham of Errata Security, analyzed almost 23,000 connections to a relay he’d set up, and concluded that the majority were vulnerable to NSA decryption. Three-quarters of the traffic he monitored used an older version of Tor based on encryption keys that 'everyone seems to agree' the NSA can break, he wrote."
"Yet because of Snowden, we now know that the NSA has been working to unpeel the protective layers built by the Tor system."
"'With manual analysis we can de-anonymize a very small fraction of Tor users,' one slide reads."
"Tapping the line before it enters the Tor network can reveal the origin of the traffic"
"Tapping the line after it emerges from the Tor network can reveal the destination and the content"