The rumors of our demise
The security community lives on papers that analyze attacks on security tools. Although these are called “attack papers” they are usually done by people who are trying to help and refine the object of the research.
When an attack paper is published, documenting an attack on the Tor network, it’s often with our knowledge. The authors consult with us for inside info. But invariably, someone on slashdot or other blogs will skim the paper and say “OMG, Tor is broken!”
Using Tor is relatively safe. If there were a published way to attack the network that we thought made it less safe to use Tor, we’d tell you first — since, so far, the authors of every genuinely new vulnerability have told us before their work hit the web. We announce security patches and other issues on or-announce@freehaven.net.
The UColorado/Boulder technical paper is an example of the evolving research in anonymity. Refining well-known attacks from several years ago, the researchers better documented what an attack on the network might look and behave like. They combined a bandwidth overstatement attack with a correlation attack.
They consulted with us on the project. We are aware of these kinds of potential attacks — but such a bandwidth overstatement attack, to be successful, would leave fingerprints all over the Tor directories. We have never seen such an attack “in the wild,” and we think it no more likely that this paper would make such an attack easier or more likely than it was a few years ago when another version of it was documented.
The authors of the new paper have published a FAQ addressing how users should think about their research — they expressed their surprise and regrets at the uproar.
It says in part:
Q0. Most importantly, should we stop using Tor?
A0. ABSOLUTELY NOT! Despite our findings, Tor is the most secure and usable privacy enhancing system available. We believe that the system is safe for end-users, however, the system is experimental and the developers make no guarantees about the degree of privacy that it can provide. Let use re-iterate: Concerned users should NOT stop using Tor.
No internet security is 100%. Tor is not perfect — we’re constantly refining it, in a context of a hugely supportive community of researchers. But we believe we are still the best low-latency (i.e. allowing web surfing, not just transferring a file every few hours) anonymity/privacy one can have online without crossing a line of civility. Your only better option is to buy into a botnet, steal an identity, or participate in some other crime with a victim.
We are currently seeking funding that should help us close these vulnerabilities in Tor (and if you would like to donate or fund Tor development, please contact me!). We have plans to close the bandwidth overstatement vulnerability in the coming months. In the meantime, we watch for attacks on the network, and work to be transparent in our operations.
We appreciate that people care about Tor. If in the future you are worried about some issue in Tor, please feel free to contact us directly. If you read speculation about Tor, please encourage the bloggers to check with us — we’re very blogger friendly, and part of our purpose is to protect bloggers where blogging isn’t safe.
Imagine this scenario — a very small risk documented in a technical paper gets sensationalized in the blogosphere. Some number of dissidents and bloggers in places such as China abandon Tor. As a result, they might be arrested, jailed, or disappeared.
Blogstorms can have real world consequences. Please ponder before you write, critically examine what you read, and ask us for updates.
topsportsup
January 8, 2013 @ 3:33 pm
I really enjoyed reading your blog! I found it not only informational but nice to read as well! I am primarily involed with topsportsup but I really picked up a lot from this. Keep up the good work!
Perth Spray Tan
January 15, 2013 @ 10:38 am
Super share it is actually. We have been searching for this information.
security doors
January 22, 2013 @ 11:25 pm
I didnt realize they published papers that analyze attacks on security tools and call them “attack papers“. This is a real eye opener.
Thanks
Bucky Mccarron
January 31, 2013 @ 3:19 pm
Hello there! This post couldn’t be written any better! Looking through this article reminds me of my previous roommate! He continually kept preaching about this. I’ll send this information to him.
Pretty sure he will have a great read. Many thanks for sharing!
קורס בניית ציפורניים
February 3, 2013 @ 4:41 am
Well said, I will never stop using TOR.
Sofia
February 4, 2013 @ 3:47 am
I think that not everyone will agree on this.
cigarette machine top
February 8, 2013 @ 3:47 pm
Keep up the superb work , I read few posts on this website and I conceive that your website is really interesting and holds bands of great info .
Hautelook Discount Code
February 10, 2013 @ 8:31 pm
Having read this I believed it was really enlightening.
I appreciate you spending some time and energy to put
this informative article together. I once again find myself
personally spending way too much time both reading and commenting.
But so what, it was still worthwhile!
lights
February 16, 2013 @ 9:19 am
That was a really good post. You made some really good points and I appreciate for your insight! Take care!
Mervin Pulley
February 18, 2013 @ 9:04 pm
Wonderful post! We will be linking to this great post on our website. Keep up the great writing.
home remedies for yeast infection
February 20, 2013 @ 9:45 am
I thoroughly enjoyed reading your post! I found it not only informative but entertaining also! I am primarily involed with home remedies for yeast infection but I really got a lot from this. Keep up the good work!
Search Engine Optimisation
February 21, 2013 @ 8:55 am
Great news indeed. I’ve been waiting for this update.
Sydney window tinting
February 24, 2013 @ 6:51 pm
That was an excellent article. You made some exceptional points and I am thankful for your insight! Take care!
kocaali
February 27, 2013 @ 10:12 am
That was an informative article. You made some exceptional points and I am thankful for your information! Keep it up!
my blog
March 2, 2013 @ 9:58 am
If you are going for most excellent contents like I do, simply
visit this site all the time because it presents quality
contents, thanks
Aluminium Shutters Brisbane
March 21, 2013 @ 9:31 pm
I really enjoyed reading your post! I found it not only informational but entertaining as well! I am mainly involed with Aluminium Shutters Brisbane but I really got a lot from this. Keep it up!
schoene wohnideen
March 22, 2013 @ 3:41 pm
Great post it is really.
hypnotherapy in london
March 28, 2013 @ 9:39 pm
I really enjoyed reading your post! I found it not only informational but entertaining as well! I am primarily involed with hypnotherapy in london but I really got a lot from this. Keep up the good work!
Five Star Hotels In Kuwait
April 5, 2013 @ 9:14 am
Good job again! Thank you!
Charlotte Amalie
April 9, 2013 @ 11:33 pm
I enjoyed visiting your website. I plan to visit again keep up the good work.
ehr reviews
April 16, 2013 @ 5:13 pm
I really enjoyed reading your blog! It was not only informative but entertaining as well! I am mainly involed with ehr reviews but I really picked up a lot from this. Take care!
lyoness scam
April 17, 2013 @ 5:04 pm
Great information it is surely. Friend on mine has been seeking for this content.
Kadın sitesi
April 25, 2013 @ 6:07 pm
Kadın sitesi ve dukan diyeti demek. I plan to visit again keep up the good work.
игровые автоматы играть бесплатно
April 29, 2013 @ 12:25 pm
What’s Going down i am new to this, I stumbled upon this I have found It positively helpful and it has aided me out loads. I’m hoping to contribute & help other customers like its aided me. Good job.
Product Reviews
April 29, 2013 @ 6:32 pm
That was a really good post. You made some exceptional points and I am thankful for your information! Keep it up!
clash of clans hack 2013 no survey
May 5, 2013 @ 8:11 am
Good day very cool web site!! Guy .. Beautiful .. Amazing .. I’ll bookmark your web site and take the feeds also?I’m happy to search out a lot of useful information here in the post, we’d like work out extra techniques on this regard, thanks for sharing. . . . . .
Ken Shipman
May 6, 2013 @ 11:54 am
Amazing how timely this is still, looking forward to contributing some more in the future. Thanks for keeping the discussion going!
Частное, гражданское, промышленное, строительство, спортивные сооружения, транспортные терминалы, системы линейного водоотвода, системы т
May 6, 2013 @ 12:55 pm
Гидро-маркет
What is SAP
May 9, 2013 @ 8:53 pm
Cool story indeed. My teacher has been awaiting for this information.
Üroloji
May 14, 2013 @ 1:29 pm
Normally I don’t read article on blogs, however I would like to say that this write-up very pressured me to check out and do it! Your writing style has been surprised me. Thanks, very nice post.
HealthCareLawNet.Com
May 21, 2013 @ 10:46 am
Good job once again! Thanks;)
Austin Divorce Lawyer
May 21, 2013 @ 11:06 am
Tor is not secure and this is not really news anymore. No internet security precaution is 100% secure. Obvious statements of course.