How We Work

Kate, many thanks for your great statement!

But one question: Why this statement right now? Are there any new threats to the Tor Project?

Hi
I am from Iran
Thank you
Grateful

Here is the link to the 31c3 video :
https://media.ccc.de/browse/congress/2014/31c3_-_6251_-_en_-_saal_1_-_2…

1.3 billion people inside the G.F.W. thank you.
防火长城里面的十三亿人民感谢你们。

Maybe I am a little bit naive but you talk about China having issues please let not forget other countries such as :-

- UK
- USA
- (add your own primary concerned countries)

thanks

Thank you to everyone involved with improving Tor!
Re: Funding
Has the possibility to pick one goal on the road map and try to crowd-fund it been considered by Tor developers?

According to Chinese and Russian authorities who have managed to crack some of the encrypted files held by Edward Snowden, Tor contains code that help the NSA and GCHQ track people who write bad things about the United States and its "Five Eyes" allies.

So long as Tor is used by people to feedback about human rights abuses, abuses of freedom of speech and expression in countries other than the U.S. and Western Europe, it is permissible.

But as soon as people use Tor to criticise about human rights abuses in the U.S. and its allies, the NSA and GCHQ will track them. There are cases in which people use Tor to criticise the American government for not indicting racist police officers who targeted and killed African-Americans.

Another example is when people use Tor to criticise the American-led invasion of Libya. These people's online activities have been tracked by the NSA and GCHQ.

A most recent example is one which involves three sisters and their nine children who managed to leave the UK and join Islamic State in Syria this month despite them having been barred from flying in March by British customs. Brits start to criticise the UK government for their lax security and some of them have taken to using Tor to voice their criticisms. Not surprisingly the British domestic intelligence agency manage to track these people's online activities through Tor.

One starts to wonder who among the Tor developers have been bought by the NSA and its allies with huge amounts of money and promises of a life of luxury beyond imagination. If I were a Tor developer or contributor, I would never resist such good offers. Why be hard on oneself when life is short?

A good chunk of the folks outside the GFW thank you as well. Keep up the good work!

"We will accept no back doors to our software, ever. "

This is the most important statement in this post!

Yo, ailanthus! Please advise.

We currently have a crisis with Bashir, the ICC and South African political leadership and, as a consequence of proposed internet censorship by the FPB in that country as well as current reprisals against local activists, I thought I'd get a twitter account via tor.

But twitter require a valid mobile phone number before they'll authorize the registration of any new account - even with TBB.

Or am I doing something wrong?

And please understand that the SA political leadership has, in the past, framed false criminal charges against various ISP and media houses in order to leverage the issuance of subpoenas to ensure co-operation with their security police units. I'm not going back to goal in for any democratic cause. I'm too old.

I'll check back in a few days for your response. TIA

Yo, ailanthus.

Yes, it is I - once more.

Here,

http://www.iol.co.za/news/crime-courts/still-no-answers-on-bashir-s-dep…

you will find material relevant to my previous post.

I must now report that the plaintiff in this instance - Southern Africa Litigation Centre - has ominously had it's website taken off line. Google it and you'll find the url. But, according to Mozilla, it's server is no longer functional. Contact with the community has been banned.

Now go figger!

> According to Chinese and Russian authorities who have managed to crack some of the encrypted files held by Edward Snowden, Tor contains code that help the NSA and GCHQ track people who write bad things about the United States and its "Five Eyes" allies.

I believe you may be thinking of a laughably inaccurate and misleading story which appeared in the Sunday Times earlier this month, which made vaguely similar claims. The best debunking I have seen comes from one of the worlds most respected cryptologists:

https://www.wired.com/2015/06/course-china-russia-snowden-documents/
China and Russia Almost Definitely Have the Snowden Docs
Bruce Schneier
16 Jun 2015

"Last weekend, the Sunday Times published a front-page story (full text here), citing anonymous British sources claiming that both China and Russia have copies of the Snowden documents. It’s a terrible article, filled with factual inaccuracies and unsubstantiated claims about both Snowden’s actions and the damage caused by his disclosure, and others have thoroughly refuted the story. I want to focus on the actual question: Do countries like China and Russia have copies of the Snowden documents?
I believe the answer is certainly yes, but that it’s almost certainly not Snowden’s fault.
But while cryptography is strong, computer security is weak. The vulnerability is not Snowden; it’s everyone who has access to the files.
,,,
I believe that both China and Russia had access to all the files that Snowden took well before Snowden took them because they've penetrated the NSA networks where those files reside."

> So long as Tor is used by people to feedback about human rights abuses, abuses of freedom of speech and expression in countries other than the U.S. and Western Europe, it is permissible. But as soon as people use Tor to criticize about human rights abuses in the U.S. and its allies, the NSA and GCHQ will track them.

First, I strongly agree that it is the duty of every citizen (of every nation) to criticize in the strongest terms such outrageous illegal activities of USIC as extra-judicial political assassination, torture, kidnapping, cyberintrusions into foreign telecom networks and employee health-care systems. Or profiling American children aged 3-7 yo for alleged "future terrorist propensity", i.e. creating a new Jim Crow of state-sponsored discrimination not unlike the institutionalized racism of South Carolina c. 1850.

Some analogies which I am sad to say appear to have considerable validity:

planter class: overseers: slaves
0.1 percent: USIC: 99.9 percent

Second, I agree that the published documents from the Snowden trove clearly show that NSA/GCHQ use their global surveillance apparatus to track down bloggers who express views they dislike.

As the author of one of the documents leaked by Snowden asked rhetorically: "what agency doesn't want to make the world a better place... for itself?" That pretty well captures the cynical amorality of the professional spook. Eliminating dissenting views is just one part of the evil they have wrought.

Third, I agree that thanks to Snowden it is no longer a plausible conjecture that NSA and GCHQ try hard to subvert Tor in order to do harm to Tor users. It is established fact, because these documents contain detailed information on their schemes. However, the documents clearly show that as of mid 2012, NSA and its sidekicks were not trying to directly insert malware into Tor itself, but were following the easier path of attacking components of the browser, experimenting with types of attacks anticipated by the Tor developers (such as Sybil attacks), abusing hard to avoid features of the "ecosystem" such as certain kinds of cookies, and taking advantage of user error.

See https://eff.org/nsa-spying/nsadocs for a compendium; look for the documents discussing attacks on Tor.

> One starts to wonder who among the Tor developers have been bought by the NSA and its allies

It is true that years ago Roger D worked as a summer intern at NSA. And one of the published documents is an NSA memo summarizing an invited talk he gave to his former employers, who apparently learned much less than they had hoped. The Snowden documents are themselves the best proof that Roger at least is not exactly a cats-paw of NSA! That is very good to know, with a good degree of assurance.

It is also true that the original developers of Tor were (and are) career employees at NRL (Naval Research Laboratories, part of the US Navy). In that sense, Tor was born inside the belly of the beast.

But we must all acknowledge that over the decades, the US Surveillance-Military-Industrial Complex has metastasized throughout American society like some deadly stage four cancer. Ties to the USIC are fairly common among US persons with programming skills. NSA is indeed the enemy of every citizen, everywhere in the world, but not everyone with ties to NSA is an enemy.

This said, I share the ongoing concern about the possibility (probability) that NSA will try to "shape" future directions of the Tor Project to suit its evil schemes, and I believe that the Project must accept that many will share it for quite some time to come.

I myself have tried to express concern about current ties of Rachel G, an US academic who does research on evading stylometry deanonymization attacks using stylometry, and who happens to be Roger's wife. She says her motives are pure and I have no reason to doubt that. My concern is that according to a profile of her work which appeared in a US military newspaper, DARPA views her work as supporting their efforts to deanonymize blog posts like this using stylometry. I provided a link and a quote but my post was censored. My point was and is not to criticize RG but to try to explain why IMO she has something to explain: how can she prevent her work from being exploited to harm people like us who need to express views which USIC might dislike?

Along the same lines, I and other users have urged the project to turn away funds from dubious sources such as SRI and DARPA.

> with huge amounts of money and promises of a life of luxury beyond imagination.

In general, they need promise far less than all that to "persuade" people to "assist" them, unfortunately.

> If I were a Tor developer or contributor, I would never resist such good offers. Why be hard on oneself when life is short?

Well, that's you. I feel there is still some reason to hope that Tor people would be far more resistant to threats/enticements from USIC.

I wish every Tor user personally knew some Tor developers. That's not possible, but Kate's suggestion that concerned users seek out videos of talks given by Tor developers is probably the next best thing.

Sorry for the technical question here but my 'Tor circuit for this site' info always has the same location (and correspondent ip) marked as Location 1 (1st position).

Clicking 'New identity' or 'New tor circuit for this site' will do nothing to change it and even restarting the browser does nothing. Is this normal or should I be concerned?

Unless something has changed recently twitter does allow registration by email alone with out a phone and even though it is hard to use with js disabled it is still possible. Although if you take many other precautions tails/wifi etc. even js will not hurt you.

In terms of reporting political matters within a spectrum of either the left or a/a movements a simple blog and/or publication of reports to indymedia servers will encounter enough solidarity republication response that will eventually find its way to social media. So find a way to publish your report according to the norms of the relative political movement. Newcomers and fascists do not fare well unless they get "agency" support.

I don't believe there is a state in this universe that does not use "any" means to defeat any organization of opposition. Which taken back to this talk of China or North Korea, Saudi Arabia, Turkey and other totalitarian regimes the variation to the most liberal European democracy is just that of shades of gray. It is a variation of the matrix programming, pretty on the outside equally ugly on the inside.

Openmailbox.org riseup.net and others provide you with email that you may keep anonymous if you want.

"We believe in the right to privacy for every person on the planet."

"We will accept no back doors to our software, ever."

Thank you for your unambiguous statements regarding these two essential points.

The trouble comes when the Project fails, time and again, to make similarly unambiguous statements regarding two other essential points:

o Does the Project regard censorship, on-line trolling campaigns, illicit cyberintrusions for cyberespionage, "effects operations", cyberwarfare, and domestic population as acceptable [sic] when performed by the current government of the USA and its allies (e.g. JTRIG, a unit of GCHQ which has been profiled in several stories at The Intercept), but not by the current governments of nations such as China, Russia, or Zimbabwe? Or does it oppose these things unambiguously and universally? If your privacy has been invaded, or if your communications have been disrupted, does it really matter whether these crimes were committed at the behest of President Obama or President Putin?

o Much of the Project's funding apparently comes from USIC tied entities such as SRI (Stanford Research Institute). Doesn't this render the Project susceptible to "shaping" by NSA and friends?

You wrote:

"Our community—paid and volunteer—brainstorms projects that embody those ideas, like decentralized hidden messaging systems or ingenious new ways to get uncensored Internet access to people in China."

But what about (for example) Australian censorship?

I draw your attention once again to a key point which has been made by many knowledgeable observers: since 9/11 the FVEY governments appear to be moving closer and closer to the governments of nations like Russia, China, Pakistan, Thailand in controlling what technologies citizens are permitted to use, and how and where, and what and where they are permitted to read and post.

Recently enacted laws in Australia, Spain, and proposed laws in Canada, US, France show this trend very clearly when compared with "presidential decrees" in Russia and Chinese government policies which establish programs for even more intrusive surveillance and control of their own citizens.

Shall wa consider the "no back door, ever" statement
on /this/ page a warrant canari ? Will you remove it (as far as possible) in case something "bad" happens ?

Shoudn't an "official" canari stand on Torpoject's main page,
thoughn clearly designated as such and approved by
Roger - Nick - whoever... ?

Hi.

I really respect Tor project.

I am under serious censorship.

and Tor helped me a lot..

but knowing the device information etc. 'they' seem to hack into the system before I connect to the Tor browser.. probably network itself.

would there be an way to solve this issue?

I am curious if anyone knows of good Linux & BSD Anti-forensics sites & resources?

Anonymity matters. From

http://america.aljazeera.com/opinions/2015/7/social-movements-need-anon…
Social movements need anonymity, but corporations are taking it away
Joshua Kopstein
1 Jul 2015

"It’s not easy to be anonymous on the Internet these days. Some would argue it’s impossible. But in a time of rampant trolling, hacking and corporate and government mass surveillance, the protective cloak of anonymity and online pseudonyms has never been more vital to marginalized groups and social movements around the world."

Referring to a recent SCOTUS decision, Kopstein asks:

"Consider the oppressive technological potential of today’s police and governments and imagine, briefly, how we might have reached last week’s victory if the gay liberation movement had begun today. How many future movements will be silently quashed and brutalized under the boot heel of an inescapable surveillance state?"

What corporations oppose anonymity? The motion picture industry and Facebook are named as two of the chief offenders. Kopstein concludes:

"Today, corporate interests — often more so than governments — are chipping away at any possibility of remaining anonymous on the Internet."

A NATO think tank has just published a fine introduction to Tor, a bit longer (30 pp) than the UK Parliament Technical advisory paper (4 pp) from last year:

Emin Çalışkan, Tomáš Minárik, Anna-Maria Osula
Technical and Legal Overview of the Tor Anonymity Network
NATO Cooperative Cyber Defence Centre of Excellence
Jun 2015
www.ccdcoe.org
(Republished at cryptome.org)

Notable features include:

o discusses human rights applications positively,

o discusses why USG has funded Tor,

o fails to discuss why this might be problematic,

o fails to discuss the contradiction between NRL/DARPA/NID/SRI funding of Tor with calls from some US/EU officials to declare Tor illegal, or to otherwise block users from using it, but doesn't seem well disposed towards such demands,

o cites https://blog.torproject.org/blog several times,

o cites Andrew Lewman's claim that insiders in certain Western agencies sometimes help Tor developers resist some (Chinese? Iranian?) state-sponsored attempts to subvert Tor.

I suggest that Tor Project archive copies of the better overviews of current Tor network in some prominent place, or at least link to them. It would be good to have them handy to quote to politicians at every opportunity, since they all (even the ones from unlikely sources such as NATO think tanks) seem to agree that Tor is an essential component of the technological infrastructure of global society.