susan_segfault

This is a question I always find really interesting. There are still a lot of alternative systems circulating - often in the mid-latency space - which aim to solve design issues of Tor. Someone releases something intended to be a Tor killer every few years, but they rarely last. Tor still remains the only anonymity solution currently operating at global scale without depositing all your trust in e.g. a VPN provider, partly due to network effects (the installed size of the user base is its own protection, so any competitor system is going to perform worse at the outset regardless), the relative lack of tolerance for anything but the lowest possible latency, highest possible usability system for almost all users, and Tor's lasting success in establishing itself culturally as a global brand that can appeal differently to very different user groups. Tor's devs have also been very good at modularising and standardising the tech so it's been great at getting itself incorporated at the ground level of other technologies - and upcoming changes are only going to make that more the case. I do think that there's a good chance for other systems and models to take off that make different design decisions, but they would have a lot of economic, technical, and cultural barriers to circumvent. Not all of them are to do with the theoretical security of the system - for example, DC-net designs were always traditionally quite vulnerable to Denial of Service attacks via collision, and some of the best attacks against anonymity systems can use 'higher security' properties against them. There's a discussion of some of this in Chapters 4, 5, and 6 of the book if it's of interest - also a huge amount written about this by scholars in PETS, WEIS, and other conferences (and blogs, papers, textbooks etc. in cryptospace).

I would absolutely agree that there's journalists who get significant power and protection from their proximity to major institutions and centres of power. Tor is useful for protecting journalists in situations where they don't have access to that kind of protection. I would agree as you say that's also the case for people that it protects who want to commit really awful forms of harm (who might not have access to this kind of protection). But I'd argue that - in most cases - the majority of really serious and widespread forms of harm are able to exist because of their proximity to different kinds and systems of power. That's not always the case - and these systems of power can compete with one another - but I think it generally holds.

And given that the vast majority of online crime of all kinds isn't anonymous but goes entirely un-enforced against by law enforcement, I would argue that Tor's efforts to distribute power online make relatively little impact on the kinds of crime and harm we see online compared to a lot of other infrastructures built on top of the Internet. I've generally found the more I do this kind of research, the less convinced I am by technical fixes to major social problems - I don't think Tor is a 'fix' to the problem of power, but I think it opens up the battleground a bit for more different (and possibly more hopeful) kinds of future Internet to be built and asserted, that look less like the locked down and centralised versions we're being pitched just now. But I take your points and appreciate you engaging with the arguments in the book.

Actually the relay community is pretty diverse - they have some colourful characters but actually a lot of them are just IT professionals, activists, and people working for libraries or universities. They have come up with some ways (which I talk about in the book) of making them much less likely to get hassle for running an exit - and generally most exit relay operators proceed just fine.

Those are fair points. I would argue that it's not the tech that's weak, but that the protection that powerful people get from institutions, local networks, status in their communities etc. often give them so much access to practical power that they essentially don't need anonymity - because these institutions protect them.

In terms of condemning particular use cases (or deciding not to), I'm more trying to represent a particular argument that some people make about Tor (and lots of other technologies) - i.e. that the tech itself shouldn't carry explicit values/politics, those should all be down to the users. The argument is particularly strongly made by some privacy advocates as they see things like Tor becoming the foundations of a new Internet - and hence needing the broadest possible base of support. There's obviously a lot of good arguments against this philosophy, but I figured I should try to represent the different ways people think about Tor in as good faith as possible.

Obviously sometimes when people argue that they just have an issue with feminist values - sometimes it is definitely disingenuous. But I think there was a wider moment in the Tor community - in which a lot of people were concerned about the transition to a much more professional NGO, more strongly aligned with liberal, 'digital democracy' visions of US geopolitics, and away from a more chaotic and anarchic coalition. While I think there was a clear need for Tor to change and this was as much about its place amid wider changes in the landscape of digital rights, US tech, and hacker politics as anything else, it does give us a way (I think) of understanding the conflicts and choices that might emerge in Tor and other privacy enhancing infrastructures in the future.

There's a lot in the book about this - it depends what you mean. Tor has a lot of social and technical design elements that try as best they can to minimise this risk. It would be pretty hard for intelligence services to compromise the Tor organisation in ways that meant they were deploying malicious code, for example. Plus, the way it's grown over the years has also given them some protections.

In terms of deanonymising people through surveillance (for example, by spying on the whole Internet and tracing you through the Tor network), Tor explicitly doesn't protect you against this. The decision was made early on - they switched all the high-security design elements to 'off' to make the network faster. They calculated that a hyper-secure network that was so slow no-one used it was less secure - i.e. made less privacy exist in the real world - than one that was less secure but used by millions, because that would give you a huge crowd of people to hide in. This gets really complicated - because you also want lots of different kinds of people using the network, so they can't tell if you're a drug dealer, an activist, a spy etc. just because you're using Tor.

Individual bits of major intelligence organisations can probably deanonymise you at some times, and not at others. The real question is if they can do so in a way that's dangerous to you in a sustained way, and if it's actually useful for them to do this. Usually, it's easier to do this through simpler mechanisms (bribing your friends, putting a camera in your bedroom, figuring out who you are etc.) than compromising the Tor network. Some security services absolutely will be researching and developing ways to deanonymise larrge numbers of Tor users at a given time - but in general, the budget for this is going to be quite high on a per-user basis (so you'd have to be a prime target for it to be worth it), and a lot of the complexity of the Internet geography makes this quite hard itself.

Ultimately, for any given high value target, there are usually easier ways to get them than through breaking Tor. In almost every case, a person will make a basic OPSEC error long before mass-scale traffic analysis gets them.

(with the understanding that I'm only speaking for what I found, not for the Tor project or the relay community)

Most of the people I spoke to saw themselves as providing a service - they wanted to help do something to bring a particular kind of future Internet about and found it rewarding to be a part of that. A number of them found the act of running a relay interesting and fun in itself - something they could get better at. Plus, membership of the relay community itself (especially now) is a kind of shared experience of community - and that's attractive to people in itself.

In terms of malicious actors, Tor does a lot to avoid this, from hunting down bad relays actively, monitoring the network as best as it can, continuously developing the algorithms which select routes through the network, and other mechanisms, like forcing relays to operate for a while before they get trusted with a lot of connections.

Cheers for this, I'm the author - AMA! :) A big motivation in writing the book was to feature the voices of the people we often don't hear from in the Tor community (which is why there's a whole chapter on the people who run the relays).