TOR and Anarchy

Recently I've seen a bit of talk about TOR and so i wanted to open this up for discussion. What do you think anarchists using TOR would look like?

What kind of services would you like to see relevant to anarchists within the TOR network? anarchist based mail or image boards? news-wires or IRC servers?

Why should or shouldn't anarchists move away from the clearweb and into the dark?

Would you, personaly be interested in participating in .onion websites, services or IRC networks?

With tor, it's wise to assume someone is looking at your traffic.

I'll make it way tougher for you now...

Substantiate your claim.

The exit nodes. One can easily set up a malicious exit node and monitor and manipulate everything a person is sending through it. You can get thousands upon thousand of traffic and gain access to other networks. Anyone can do it and they do. Tor isn't that secure and if you're concerned with prvacy and security, you should probably look elsewhere

See my comment below (16:04), exit relays can do strictly less than your ISP without Tor. The fact they're volunteer run means https is more important, but you should be using it anyway, and it ships with HTTPS Everywhere. Tor also tests exit relays and checks for active manipulation of traffic and removes relays found to be doing that (plus traffic manipulation obviously doesn't work for https sites). Oh, and exit relays aren't even a thing for onion service connections.

@21:37

I guess you've never heard of SSL? unless you're still using telnet or wtf but that's 100% on you and not the tor project.

Seriously though, your comment is way off. try to do what you claim, creating a posion tor exit node and see how well that works. And besides that most of the time it doesn't even matter if someone could see parts of your trafic as there is no way of knowing where that trafic is originating from..

Can be excluded or prioritized, either by country or directy by address. These days Tor Project are recommending to use bridges no matter the situation, as they indeed are mmore efficient at bocking those redundant, nasty exit nodes. Your comment was one more instance of net security fatalism... whereas only one potential flaw leads instantly to everyone being compromised, and Tor being snitches etc.

Flaws have been discovered in Tor and that was usually by the developpers themselves. If you think this is some grand scheme by the NSA to snitch everyone for their black markets and questionable porn downloads, and that we should just stop looking for online privacy and sell off to Facebook, well okaaayyy, have fun with Zuckerberg, bro.

This shit is irrelivent when we are talking about projects within the darkweb. 'EXIT nodes' clue is in the name... as i said below, didn't your mother ever teach you that it's better to say nothing if you have nothing worth saying?

It's far more difficult to do that then to check a log and get an IP. Setting up an exit node (or hijacking one or several) is still more difficult and while they can see the traffic they still can't get the IP (not without some serious packet analysis on at least 2 points of the connection.)

There may be other exploits for Tor but it's still not as bad as using your real IP.

I agree, only if you are not stupid you leave lots of false trails such as visiting puppy sites etc...
NOTHING is secure using microsoft/google
I prefer Linux and Tor

and/or storing your info (which no longer is your info) once you press any key, make a sound. Staggers me that there are people who believe that internet privacy or anonymity still exists. Maybe you can be methodical in how you communicate but human error will catch up with you, plus, it means being anal about the latest tech news which is akin to slavery.

I agree, but using Tor instead of your real IP being exposed is still harder for law enforcement to track.

They have to use difficult, expensive (and probably prone to false positives) methods such as browser fingerprinting (also remember Tor Browser is just a browser, you can torify other kinds of traffic.)

Tor, VPN's and what-not cannot guarantee anonymity but even if you believe (and I don't) that it doesn't give you anonymity the tech used to de-anonymise is expensive and costs the enemy money. With shrinking police budgets their big brother tech may not be as ubiquitous as some people believe.

No it doesn't. The enemy passes on the cost to the tax payer.

There have been threads on this subject before, I won't bother linking to them because they're generally shit. Tor is a highly useful tool (I use it at all times when browsing anarchist websites, e.g. now), but please don't try to force it as a cultural phenomenon or panacea. Same goes for any technology or lifestyle. If your project involves saving the masses by "educating" them about anything, it's not going to work. People will learn the things they want to as part of engaging in their daily lives, expecting them to shift their habits around out of some constructed social obligation is just silly.

Some points about Tor specifically:

1) It's Tor, not TOR.

2) Yes, all traffic created over Tor can be "looked at" by "someone". This is a meaningless statement without going into details though. Strap on your "technical crap booties" because here we go:
- Encryption works, if done correctly. Tor does encryption correctly. So unless you need the things you're doing to stay secret for more than, say, 20 years, we can treat encryption as a black box that Just Works (tm).
- Tor works using layered encryption across 3 hops (onion routing). Simply put, this means as long as you assume your adversary isn't tapping the internet connections of you and either the last hop (called the "exit relay" in technical jargon) or the website itself, at the same time, it will prevent that adversary from knowing both who you are and what website you're connecting to. They can know one or the other, but not both. If you assume your adversary *is* tapping both ends (e.g., you're under active surveillance at home, and the FBI is waiting for you to log into an IRC server they're monitoring, as was the case with Jeremy Hammond), then Tor won't help solve this particular problem.
- Tor does encrypt the end connection to .onion Services (a.k.a. Hidden Services, or "Dark Web" sites, or "Deep Web" sites, which are wrong but still used sometimes). So if you go to the New York Times onion site ( https://www.nytimes3xbfgragh.onion ), then Tor itself is encrypting the connection to that website, and it is extra bonus secure woohoo.
- Tor does NOT encrypt the end connection to normal websites. So my connection to anarchistnews.org is not encrypted by Tor between the exit relay and the website itself. If there's no https, this means the person running the exit relay can see everything I'm doing, everything I'm posting, everything I'm reading, etc., just like your internet provider could if you weren't using Tor.
- The browser DOES encrypt the end connection to normal websites if https is enabled (you should see a little green lock, next to the URL https://anarchistnews.org (note the 's' in 'https')). This means if you're using Tor, the exit relay can't see what you're doing any more, only that you're connected to anarchistnews.org (but it and anarchistnews.org don't know who "you" are, because Tor). It can still "see" the traffic of course, but it's all encrypted, so it can't learn anything about the content, aside from a bit of metadata about size, time, etc. (so with some effort, they might be able to tell when you started and stopped streaming a video on youtube, because there's obviously a big difference between "downloading a video" and "not downloading a video" in bandwidth, but not what video you were watching).

3) Tor Browser is, unfortunately, the browser that is most likely to be successfully attacked, if you visit a malicious website. This is because it's the browser that everyone (read: governments and blackmailers) tries attacking. Unless you're looking at child porn this probably isn't a huge problem, but regardless, you have to be really diligent about keeping it up to date, to get the security patches as soon as they're released.

4) Outside of the security problem and the usability problems (Tor is slow as fuck and a bunch of websites *cough* anews *cough* will randomly block it), Tor is a better browser to use for generally browsing the web. It isolates websites from each other and uses anti-fingerprinting so google or facebook can't track you, it masks your IP so nazi script kiddies can't grab your info from IRC, it comes with the HTTPS Everywhere addon, it prevents your internet provider from spying on you or injecting ads, the list goes on and on.

So again, I'd recommend it, especially for anarchist things, and especially for medical things. But I wouldn't say everyone "should" use it, any more than I think everyone "should" be vegan or whatever.

PS: I'd like to apologize for how complicated this post is; this stuff has an unfortunate amount of nuance. If anyone has questions you can ask them here and I'll try my best to help.

I found this post informative so thanks for sharing this info and don't be discouraged by the assholes!

Bravo, you explained Tor in a very easy to understand manner, I even learned something which you expressed clearly.
I struggle a lot with Tor and the deep web and have been for the last 5 years I've used Tor.
Thanks Anon and any other tips in using Tor would be most welcome.

This post is not related to OP and just rambling about Tor. Please keep to the topic, thanks.

The post is a direct response to OP's question of "Why should or shouldn't anarchists move away from the clearweb and into the dark?" and the other posts claiming Tor isn't secure because "someone is listening" and "exit relays can watch your traffic". I don't know how you want it to be more on topic.

THe topic is about what kind of projects people would like to see or participate in within the darknet. again, this isn't hard...

Didn't your mother ever teach you that if you have nothing worth saying then you shouldn't say anything?

Did your mother never teach you how to read? I directly quoted the question OP asked, which is, yet again:

"Why should or shouldn't anarchists move away from the clearweb and into the dark?"

I directly answered to that question, saying things like "Tor is a highly useful tool ... but please don't try to force it as a cultural phenomenon or panacea" and "I wouldn't say everyone 'should' use it, any more than I think everyone 'should' be vegan or whatever," then backed these claims up with evidence. If you don't know how to have an intelligent discussion if it isn't dickwaving about projects (except afaict you can't even do that, since ironically enough, all *you've* done is complain), then maybe you should just stop posting.

If you want to wax about tor then go ahead and do that somewhere else, what i was attempting with this thread was to initiate projects that unitilise TOR but allas i was mistaken, all you lot have the capacity to do is winge about stuff.:(

I think people should use Tor for everything, not just stuff you don't want authorities to see. More users are better, easier to get lost in the crowd with other connections on the exit relay.

THEY KNOW EVERYTHING ! ! To be paranoid is to be un-anarchistic ! Living transparently is proof of successful praxis,.,

so getting caught is... good praxis?

Depends on how you define "getting caught". That's a very loaded term, getting caught tasting mom's cookies before they cool down may save one from burning ones mouth in the future. Its calling heeding the nature of an environments' moral and ethical standards and living by the spontaneous self-preservation instinct. Nature including humanity can be a ruthless and cruel master best avoided, if one is apolitical and amoral. As an existentialist words like impotent and coward are meaningless, the journey of life carries enough burdens and challenges without worrying about binary self-righteous crusades and the colonilisation of other folks belief structures. That's their own problem only they can deal with themselves if they are to escape the cycle of reconstruction and misery.,.

Okay, then why are you posting this on a Tor thread? Tor provides a very specific kind of privacy. It allows me to do shit like say "This one time, after I kicked in a bank window, ..." without having to worry (as much) about that shit coming back on me. If you don't see the value in that, why are you posting anonymously?

Its because I'm an edgelord with a reputation to uphold, and Stirner and stuff.

"Introducing the brand new Troll with Pompuous 19th Century Rhetoric, a new marvel of neckbeard word salads to sweeten your ears. Imagine his raucous, raspy, rapey voice crawling into your mind at these words..."

I'm not sure exactly how this is hard for you lot to wrap your head around but this thread is about projects you would like to see or participate in that utilises the darknet (specifically Tor but could also include I2P.) No offence but if what you have to say is not on topic please make the assumption that people already understand Tor, are able to make there own judgements on if they're secure or not, baring that please just don't bother.

by that logic your post here is also off topic and shouldn't have been posted

Is i2p still alive!?

Yep! I personally prefer it to tor and personally would rather do projects there, i just realize that the majority of people are more comfortable with tor. :)

possible on Tor? Is a low level of tor security not anonymous, does it always have to be set to high? I get a message saying downloading may compromise my anonymity! I don't want my isp or snoopers knowing my business like I don't want them reading my snail mail.

The downloading itself is anonymous, the warning you're seeing is referring to the thing you're downloading. For example, if you download a pdf file, it's as anonymous as anything else on Tor, until you actually open that pdf file in adobe or whatever, because pdf files can actually make internet connections, or even install viruses. So at that point it depends on how much you trust the source. For example, if you downloaded the pdf from https://theanarchistlibrary.org, it's probably safe to open, while if you downloaded it from 4chan.org, lol good luck.

Some general guidelines are:
- media like pictures (jpg, png), audio (mp3, ogg), or movies (mp4, webm) are pretty much always safe if you're using up to date software
- unless it's one of the above (and really even then you should try), only download over https, else the Tor exit relay can switch the file you're actually downloading
- documents like pdfs and Microsoft Word files are scary, be careful (same thing goes for new software, of course)
- if you're not nervous about a virus but are nervous about it revealing your IP, just disconnect your internet before you open it

Can I allow this extraction to happen in tor so i can watch (eg youtube) and or download as it says extracting may enable my pc to be identified?

I don't think Youtube requires canvas extraction, just javascript. The canvas extraction warning I pretty much always select "never for this site"; the only places I've seen legitimate need for it are certain web games, and it would be pretty easy for Google or Facebook to link Tor browser and your non-Tor browser as being on the same computer (fully automatically, as part of their ad tracking -- they openly admit they do this in their privacy policies).

If you meant javascript (typically changed on the security slider), that one's a tougher call. Tor Browser does its best to protect you, but browsers are just so huge these days it's hard to cover everything. If you load a page with javascript enabled, the website owner probably could track you with enough effort. In fact, that's how the FBI broke that child porn ring: they got control of the website they were using, then added some javascript that exploited out of date Tor browsers to reveal their real IP, which the highest level on the security slider would have stopped (though to be fair, so would have updating Tor browser). That said, I usually leave javascript enabled, because so much of the web is just broken without it (including youtube), and javascript over Tor+https is still better than javascript over a normal browser. It's a personal choice though.

documents like pdfs and Microsoft Word files are scary, be careful (same thing goes for new software, of course)

How so? they fall into the first catagory as your appsare kept updated. and if you're worried about 0day then you're fucked regardless. general rule of thumb is that whilst you're maybe okay, then always assume that you're owned and act accordingly, i.e. don't do things that are secret on your machine you connect to the internet with.:)

It has little to do with keeping apps updated in the case of these types of files. I'll assume the "new software" category is obvious, since they can do literally anything, so I won't bother convincing you of that.

What is less obvious is that PDF files and Word documents are not static documents, but actually full programs (if you have some Computer Science background, they're Turing Complete). Part of the PDF standard is full javascript support, along with a smattering of other executable extensions. That means your PDF viewer has to have a full javascript interpreter in it, one of the most commonly exploited things in a web browser, without being one of the pieces of software that gets full security audits the way web browsers do. But even if we ignore the security aspects of it, the PDF standard supports arbitrary web requests, which entirely breaks the privacy of Tor. For example, try opening this PDF from a Canadian immigration form in Firefox or Tor Browser:
https://www.canada.ca/content/dam/ircc/migration/ircc/english/pdf/kits/f...
Firefox doesn't support the cryptographic operations used in this particular PDF, so the downloaded content never replaces the underlying template, and you can see that the actual PDF content you're trying to get is downloaded over the internet by the PDF itself. Try doing that with a jpg.

Similarly, Word documents support macros, typically written in visual basic. They can access arbitrary files, make web requests, etc., which is why one of the most common things you'll see in phishing emails is "open up this Word document!" One of the biggest subjects in corporate security is "how do we get people to stop opening Word documents they get in emails" and related subjects, because actually securing a full office suite is nigh impossible. Which makes sense -- what if the document needs a template from somewhere else on the computer to render? what if there's a picture stored on some webserver? what if it needs to run some complicated calculations on some numbers? Rather than trying to address each of these issues separately and securely, the solution was to toss in a full program interpreter and call it a day.

tl;dr: PDFs and Word documents can do almost anything a program can do

Okay, so this really isn't that hard.. What potential anarchist projects within the darknet would you people use?

"The darknet" is itself a bullshit concept.
Anarchist projects can't exist entirely "within" a digital space.
There are no websites, anarchist or not, that wouldn't be better suited as onion services.
Nothing is done without a bunch of social context.

So if you want to solicit some actual discussion, how about you go first with an example of what you're actually asking for, instead of complaining about how everyone else isn't doing what you want.

A one person project that nobody will use is largely irrelivent, no? and i think you're missunderstanding what frustrates me here, it's the fact that all anybody on @news would rather critisize and whine constantly, when someone comes along and says 'hey, what services do you want to see on TOR, let's do it.' they're more interested in finding every little flaw and using them as excuses to not participate. these are generally the same people who arn't or are only minimally involved in physical anarchist projects for various reasons.

What i want is to aid in creating some digital anarchist infrastructure away from the clear. the roadblocks that people will throw infront of anything to justify there inertia is perplexing, a little sad and overwhelmingly perplexing to me.

theres a thread on the news section about creating an IRC server and it's full of people complaining that IRC isn't secure enough for them (nbody can seem to explain how this is the case though.). this threads shows that tor is apparently to complicate and insecure for people too, i mean if you're going to be that defeatist - doubling down on their inertia- then why even bother to comment at all?

You are literally the only one who "would rather critisize and whine constantly". People are helping each other ITT, people are legitimately excited about the IRC or whatever project, and coming up with solutions in the TOTW. Meanwhile, you just keep coming in OVER AND OVER shitting all over everything while contributing fuck all. Seriously, how many times do I have to ask you "give an example of what you want to talk about" before you stop talking about not talking about anything? I'm tired of it, and this is the last time I'm responding -- I have better shit to do than spoon-feed someone how to read and comprehend a forum in meta-discussions about nothing.

>A one person project that nobody will use is largely irrelivent, no?
Yes, that's exactly my point.

very informative. Thanks to all making their contributions. For people who are not tech savvy but trying to understand how best to use technology, this thread is very helpful.

has been seized by the german state trying to crack down the activist network around KTS Freiburg. Since then the site is offline without an equivalent replacement. Why did noone set up an .onion mirror of the former page yet?
https://media.ccc.de/v/34c3-8955-all_computers_are_beschlagnahmt

Mirroring content without consent is generally frowned upon, unless you make it abundantly clear that it's for archival purposes -- in which case something like archive.org's Wayback Machine would work just as well (in this case it appears to be removed or never archived, but there are snapshots at this alternative archive site: https://archive.fo/https://linksunten.indymedia.org/ ). If the mirroring is official, and actually serves the content of the live site, then a hidden service only helps if the blocking is done via the network (DNS, IP, etc.). If the authorities actually went in and physically took control of the servers, it doesn't give you much more than the regular web address.

I'd like to see an anarchist .onion site. Particularly for sensitive stuff like distributing communiques and discussing resistance tactics. I'm already behind several layers of encryption but I'm worried to post stuff even places like @news.

I'd suggest that @Tor have a news/communique section, a forum, a downloads library, an IRC, and a chan-style imageboard. The last of these would need some kind of automated measure to keep child porn off, because hidden-service imageboards tend to get inundated with child porn. Possibly there should also be sections specifically for anarchists and other sections aimed at a wider userbase.

The groups which use Tor for this kind of thing, generally have clearweb "propaganda" or safe-for-work versions and channel people into the Tor groups later.

inb4 paranoia about Tor use. Tor is not a panacea, it's occasionally been compromised and there's a lot of ways to fuck-up opsec. But the stats say it all, there's hundreds of thousands of users of dark web drug marketplaces and only a few dozen arrests (mostly from package interception, fake sellers, or compromised marketplaces). One time the feds took over a pedo site, ran it for a year and planted malware and fake files which phoned home - and even then they caught fewer than half the people. And we also know that the security services use Tor for their own secret communications - as well as the "Tor Sucks" presentation Snowden leaked. In other words, Tor mostly works.

It's just Tor. Not TOR.

Quick question to pros: are Word and PDF documents (when there's no name on the license of the software, of course!) traceable to a specific machine? is there any bit of information that could ID a specific computer from which it was created (similar to Canvas fingerprinting on browsers and the likes)??

Thanks.

Depending on what you're using this for, yes, I would be extremely careful with it. There are a bunch of ways to trace the specifics of the software configuration of the machine it was created on. For example, even if you don't have a name on the software itself (e.g. MS Word), it will sometimes take whatever username was configured with the OS when you installed that. Some other things that tend to leak are time zone, time of creation, languages installed, and version of the software installed. Unlike canvas fingerprinting, details about the hardware usually don't leak. My recommendation though is always to use a live linux distribution when releasing a document you don't want tied back to you, preferably one like TAILS which is designed for being used anonymously.

https://tails.boum.org/

I haven't heard of that type of tracing. I know it's possible to trace a printed paper document to a specific printer through an ID code hidden in the toner dots.

Add new comment

Filtered HTML

  • Web page addresses and e-mail addresses turn into links automatically.
  • Allowed HTML tags: <a> <em> <strong> <cite> <blockquote> <code> <ul> <ol> <li> <dl> <dt> <dd>
  • Lines and paragraphs break automatically.

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
CAPTCHA
Human?
5
e
r
w
b
d
V
Enter the code without spaces.