Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In light of recent events, I've been learning more about Tor, and I have a lot of questions. Here's one.

Wikipedia's article states;

As of 2012, 80% of the Tor Project's $2M annual budget comes from the United States government, with the Swedish government and other organizations providing the rest, including NGOs and thousands of individual sponsors.

I realize that Tor software is open source, so surely if there were some obvious issues with it, we'd know about them already. Still, I can't help but wonder if, by using it, I'm simply bringing myself into a henhouse of the foxes' own making, or at the very least inviting more scrutiny. Is my paranoia justified?

share|improve this question
7  
The Internet itself (originally ARPAnet) was all government funded. Should we stop using it too? –  AbsoluteƵERØ Jun 13 '13 at 16:01
add comment

2 Answers

up vote 5 down vote accepted

Since the source code is open, it can be vetted. The bigger problem is that a large number of compromised nodes makes it easier to try to track, but this has nothing directly to do with the development itself. As for why the government would fund something like this. While it does make it easier for bad people to do bad things, it also makes it easier for good people to do good things in bad countries and that's still something the US government generally likes to see happen. The technology enables a much higher level of freedom in countries that otherwise would restrict freedom. While it can make it harder to stop bad people, it still has enough benefit for good that it is worth the risk of bad people abusing it.

That all said, can we be sure that they don't have some way to get around it. No, but based on the amount of research the government has been known to do on how to try to break TOR, it does seem unlikely they have some magic switch.

share|improve this answer
    
There have been some discussions about ways to make TOR traffic analysis more difficult even if an attacker runs a number of exit nodes, such as padding requests, mixing dummy requests with real requests, and randomly delaying responses within the TOR network to make it harder to identify which response belongs to a particular request. –  Johnny Jun 13 '13 at 21:00
    
So the government does research on how to build Tor, and then the government does research on how to break Tor? Well, I guess if there's one thing the government is good at, it's finding work for itself. –  Garrett Albright Jun 16 '13 at 1:19
    
@GarrettAlbright - yeah, well, in fairness, both serve useful purposes. You want to be able to protect innocent people from bad people but you don't want bad people to be able to abuse it. The two goals are in conflict but both are valuable in and of themselves. –  AJ Henderson Jun 16 '13 at 18:58
add comment

Well, it's open source, and the network is open too. Of course, some of the volunteer nodes could be under government control, especially the big nodes. I doubt that there's anything malicious in the source code. There are many with the same level of cautiousness; so I'm pretty sure that the source code has been well vetted.

So the only issue is dishonest/government nodes. In such a case, you could make your own private network of Tor by forking it, making small tweaks, and distributing it in trusted circles. Note that it becomes more trackable if less people are using it.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.