Hacker News Reader

Comment by class4behavior | Hacker News Reader

>Like, how do I know any of those links aren't the NSA?

Well, I've only linked to communities listed by the Tor Project itself.

Otherwise, the same way you would check whether HN or your local tea store is the NSA. You do your own research, run your own risk analysis, and if you want to stay sane, by default you give people the benefit of the doubt.

Generally, it's best not to run Tor relays from home as services will start to blacklist your IP as a proxy.

If you are going to be an exit node, then you should inform yourself about he legal challenges you might face, since you don't know what people will access with your IP address.

https://blog.torproject.org/tips-running-exit-node

https://www.eff.org/torchallenge/faq.html

Being an entry or middle-level node is less of a problem but some uncertainties remain, so this depends on your local laws.

View on HN

> by default you give people the benefit of the doubt

I actually tend to assume websites like HN are the NSA or at least the NSA have read access to their databases. Maybe it's my tinfoil hat tendencies but instead of giving them the benefit of the doubt I would rather not give them any data I don't mind the NSA having.

Everyone has read access to HN.. there are no private messages that I'm aware of, anyone can search this site using google

HN contains a lot of information that isn't visible on the public web. Ban lists, point counts, user access history, etc.

> Everyone has read access to HN

No, not to their databases as OP is discussing. It would be definitely a crime if any of us had that info as it would imply we broke in and stole it - but OP is suggesting that they assume NSA already has it (a potentially paranoid but also reasonably fair thing to do, IMO).

From a personnel standpoint, isn't Thiel on the board of HN/YC and doesn't Thiel have basically uncountable NSA/CIA/etc connections? I'm not saying Thiel has anything to do with HN's security - but clearly, saying HN's databases might be accessed by someone like CIA (while a board member of YC is active in sales & partnerships to CIA etc) isn't that crazy.

> isn't Thiel on the board of HN/YC

He is not.

I think the HN database is available publicly for download.

It's not.

None of us know how many points your comment has, or if you have an email address on file, or how many times you visited HN today, or what IP you're using, etc. But all of those things are in the HN database(s) I'm sure!

I'm normally the tinfoil-hat guy in any given discussion.

I'll go out on a limb and predict that my HN internet points score is not a signal of interest to NSA selection criteria.

Wait, why not? Knowing who votes for what content, when, and in coordination with whom else seems like it would be extremely useful indeed! Aren't techniques like this already used by FBI etc on Twitter when investigating illegal content and coordination of its' dissemination? Bot networks are taken down on Twitter and other sites all the time using voting data.

Social voting data is a rather sizable and useful dataset for surveillance agencies. HN has a high concentration of current-high-impact and future-high-impact individuals and is therefore a reasonably interesting trove of information.

I realize all this is indeed tinfoil-hat-ish stuff. But I'd be shocked in NSA/CIA/FBI etc was disinterested in online social voting habits of users.

Also, you latched on to a single example I gave. HN may have your email address privately (if you gave it to them) and they also have your IP/access logs. This is all stuff that they save but is not publicly available information.

I'm sure there's more as well. It's not just "internet points" and reducing the discussion down to simply dismissing a single one of my thoughts isn't going to get us anywhere.

GP said "score", so my guess is they weren't even thinking in that direction, just their posts that others voted on.

> just their posts that others voted on

But you can't calculate the 'score' without knowing who those people are, when they voted, and what else they voted on too. The score is a summary generated from lots of information. It's not just some number that carries no value.

> HN may have your email address privately (if you gave it to them) and they also have your IP/access logs. This is all stuff that they save but is not publicly available information.

I'm pretty certain there's nothing the NSA doesn't already have. See the Swowden gifts on MUSCULAR[1] the better-known PRISM[2], and XKEYSCORE[3]. There are other relevant programs, but I don't have my notes on that stuff with me at the moment.

Anyway, I won't argue about how much the NSA values internet scores. Let's just say I can imagine a targeted extortion campaign against a specific individual using such inputs, but I can't see how the Great Hoover would use them as any sort of actionable signal.

[1] http://apps.washingtonpost.com/g/page/world/how-the-nsas-mus...

[2] https://en.wikipedia.org/wiki/PRISM_%28surveillance_program%...

[3] https://en.wikipedia.org/wiki/XKeyscore

A small sampling of as few as 10 Facebook "likes" gives analysts a better picture of you than your friends. As few as 300, a better image than your life partner, should you have one.

(And if you don't, APTs, will assign one to you....)

https://www.wired.com/2015/01/facebook-personality-test/

Err, all the NSA needs to do to get access to our HN posts is scrape the site. National Security Letters are probably more effort to arrange than a copy of BeautifulSoup. I hope ...

Not really, there's a lot of content that isn't public, like upvoted submissions, but can give a lot of information about a person political opinions and interests.

> Like, how do I know any of those links aren't the NSA?

No communication channel can be guaranteed to be 100% secure in the broad sense, i.e. even One-Time Pads can be stolen, recipients of messages can be watched to see what they’re up to, etc.

Users of Tor should assume that the whole channel (not just the Tor part) can be compromised by a willing and capable adversary, and take additional precautions if they feel it’s necessary, e.g. “tradecraft” https://en.m.wikipedia.org/wiki/Tradecraft

> Generally, it's best not to run Tor relays from home as services will start to blacklist your IP as a proxy.

Conversely, if you're engaging in illegal online behavior from your home IP, intermittently running a TOR exit node could be a useful mechanism for creating plausible deniability.

IANAL, and I wouldn't try explaining that to a prosecutor or a federal judge...

what's stopping someone running an exit node through a "no logs" VPN? (serious question)

Nothing.

"TOR was developed by the United States Naval Research Laboratory and funded by DARPA to help U.S. intelligence and foreign freedom fighters communicate under oppressive regimes. I run this exit node to support their patriotic work to protect freedom abroad. I have no control of the traffic that emerges, and I don't collect logs in order to protect covert intelligence operations."

> Generally, it's best not to run Tor relays from home as services will start to blacklist your IP as a proxy.

I think this also specifically refers to exit nodes, no ? Running an intermediate relay should be fine as you'll only be shuffling encrypted tor traffic to other relays.

That should be fine, but seriously check with your ISP first. They tend to not really understand the difference between middle relay and exit node, and in their heads, tor == bad.

Do you confuse relays with exit nodes? Which services block relays?

Exit nodes are relays. Node and relay are synonyms in context of the Tor circuit (guard/bridge - middle - exit). https://miro.medium.com/max/2560/1*j2aTFBQTd9e1PlFDjeKw1g.jp...

Being a Tor relay you participate in a public proxy network, so you automatically run risk that someone will harvest your IP address for whatever reason, e.g., lists for companies trying to prevent browsing via tor, etc.

Reply on news.ycombinator.com