Hacker News Reader

> The blog post makes casual reference to the "enormous social value" of hidden services and claim they're worried about "secret police repressing dissidents", but doesn't cite any actual examples.

I'll give you one:

Russia currently has laws that, among other things, require the author of a blog to register personal information with the government if the blog has more than 3,000 daily readers[1]. The law is specifically intended to prevent anonymity.

When working as intended, hidden services enable those blog authors to protect their identity and ensure the government doesn't harass, arrest or kill them.

[1] http://www.bbc.com/news/technology-28583669

It's much, much easier for them to just write a Wordpress or Blogger blog, hosted in the USA where Russia can't get access to the logs. Or in any other jurisdiction that won't respond to Russian requests for their data.

The big advantage is - anyone can read your blog. Not just people who are willing to download and use the Tor browser.

Most famous cases of dissent in recent times have preferred to play jurisdictional arbitrage rather than use Tor. Snowden is being kept safe by Russia, his information was published by a British newspaper that then shifted reporting to New York to avoid the UK government goons. Apparently for now that's good enough.

This is why I talked about specific examples of hidden services being used in this way and actually getting real traction - I can't think of any.

I see your point about hidden services severely limiting the practical accessibility of the content. But isn't it a good idea to use Tor rather than HTTP(S) to compose that blog in such situation?

In theory yes, in practice most people I know in places with strict firewalls use commercial VPNs rather than Tor (faster, easier).

Also if you're hosting on a site like Wordpress or Blogger all the government sees is an SSL connection to wordpress.com or google.com. They don't get to see if you're reading or composing. So in practice it's probably good enough.

> "Actually I've never heard of a hidden service that has enormous social value"

You make it sound like you've actually looked. Perhaps you've spoken to some Ukrainians, or protesters in Turkey or Honk Kong, and they've assured you they have little use for "hidden services"?

I have looked (or at least paid close attention) and I am unaware of anyone in Ukraine, Turkey or Hong Kong using hidden services for political reasons.

Additionally, Tor gets way less traffic from people trying to evade national firewalls than VPN services do. They aren't the big fish in that space at all.

You heard it here first folks. Mike_hearn has scoured the earth and cannot find one person using hidden services for non-criminal purposes.

Can you?

Besides, I'm not sure what your point is. Societies don't tend to judge a thing by whether there's a single good use, somewhere. They weigh things up.

Hidden services can be enumerated, so it's not impossible to find one if there's some awesome hidden service somewhere. But such a site would get a lot of attention very quickly. It wouldn't be secret very long.

Hopefully this whole story will amount to nothing. It'd be very sad if Tor disappeared. But let's face it - when you have the Prime Minister of a technically advanced western country tasking one of the worlds most advanced intelligence agencies with "break the dark web" they were going to hit serious problems sooner or later anyway. And mostly that's because of hidden services. It'd be a crying shame if this one feature with hardly any legitimate usage caused the entire project to tank.

> Societies ... They weigh things up.

Societies don't 'weigh' anything up. Governments with idealogical leanings make decisions regardless of evidence. You only have to look at the 'war on drugs' to see how, regardless of the evidence put before them, politicians will blindly follow their ideologies. 'Weighing up' implies a reasoned judgement, based on the arguments for and against and based on the available evidence. To think that the UK or US (or any other) government works that way is naive.

I agree that they are vastly inflating the utility of Tor for people in repressive regimes given how easy it is to block Tor at an ISP level (e.g. Tor is completely blocked in China).

there are ~1200 directly connecting users [0] and ~200 bridge users [1] who might dispute the assertion that 'Tor is completely blocked in China'.

instead of casting aspersions on a free software project, i would encourage you to please help make tor more useful for these users, or to build your own alternative.

[0] https://metrics.torproject.org/userstats-relay-country.html?...

[1] https://metrics.torproject.org/userstats-bridge-country.html...

There is a small subset of IPs in the Shanghai Free-trade Zone which are not subject to the same Internet restrictions as the rest of China. This along with government IPs and inaccurate IP-to-country mappings could account for those stats. For comparison, there are more than 300000 users in the US for a country that is considerably smaller in terms of population.

For what it's worth, I have unsuccessfully tried using Tor (and Tor bridges) a few times in Shenzhen and I'm a lot more tech savvy than your average political dissident. Tor's blog even has a post about how it is being blocked in China if you don't believe me: https://blog.torproject.org/blog/closer-look-great-firewall-...

> instead of casting aspersions on a free software project, i would encourage you to please help make tor more useful for these users, or to build your own alternative

I doubt I could build a better alternative and I was not criticising the Tor project as a whole.

Try using obfuscated bridges [1] next time you're in China.

[1] - https://bridges.torproject.org/options

If you, like me, didn't know how Tor is being blocked in China: https://www.usenix.org/sites/default/files/conference/protec...

Interestingly it's partially the same issue - the directory servers have static IP's. ISP's are simply blocking traffic to these directory server IPs. Without access to the directory servers, can you still use Tor?

Also see above article for thoughts on how to circumvent this mode of censorship.

Tor has a network of unpublished bridges it provides via offline methods in high risk countries. You can also request unpublished bridges via email [1]. Pluggable transports [2] allow your tor traffic to look like Skype or SSL. These tools combined allow most of the "noble use cases" of tor to operate without being hunted down.

1. https://www.torproject.org/docs/bridges.html.en

2. https://www.torproject.org/docs/bridges.html.en#PluggableTra...

The last update I heard is that the GFW does active probing to detect Tor bridges and relays. That is, there are computers inside China that are triggered by something, which then actually speak the Tor protocol to an IP to check if it's capable of subverting the firewall. If so, it gets blocked.

There isn't really any way around that which scales, which is why Tor is basically a non-entity in China right now. Everyone I know from the west who spends time in China just uses commercial VPN services, not Tor.

They pointedly didn't mention China in their list of repressive regimes: "Iran, Syria, and Russia".

I think for most people, China is the first country that comes to mind when you think about internet censorship. But my experience is that it is impossible to connect to Tor there. Maybe they are acknowledging that tacitly.

Or maybe they were trying to make the blog post more palatable to US government readers, since Iran, Syria, and Russia are currently bad guys, while things with China are supposed to be fine.

As 'blunder has mentioned elsewhere, you should use pluggable transports (try obfs3, scramblesuit, fte in https://bridges.torproject.org/options) when in mainland China. Don't use vanilla Tor bridges or vanilla Tor there.

Here is one example, journalists.