{"id":203558,"date":"2017-03-21T08:00:58","date_gmt":"2017-03-21T06:00:58","guid":{"rendered":"http:\/\/mybroadband.co.za\/news\/?p=203558"},"modified":"2017-03-21T07:45:18","modified_gmt":"2017-03-21T05:45:18","slug":"tor-upgrades-to-protect-user-privacy-and-security","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/203558-tor-upgrades-to-protect-user-privacy-and-security.html","title":{"rendered":"Tor upgrades to protect user privacy and security"},"content":{"rendered":"

In the coming months, the Seattle-based nonprofit The Tor Project<\/a> will be making some changes to improve how the Tor network protects users\u2019 privacy and security.<\/p>\n

The free network lets users browse the internet anonymously.<\/p>\n

For example, using Tor can reduce the risk of being identified when dissidents speak out against their governments, whistleblowers communicate with journalists and victims of domestic abuse seek help. \"The<\/p>\n

In its most common, and best-known, function, a person using the free Tor Browser<\/a> \u2013 essentially a privacy-enhanced version of Firefox \u2013 uses the internet mostly normally.<\/p>\n

Behind the scenes, the browser and the network handle the web traffic by bouncing the communications through a chain of three randomly chosen computers from all over the world, called \u201crelays.\u201d As of March 2017, the Tor network counts almost 7,000 of these relays<\/a>. The goal of leveraging these relays is to decouple a user\u2019s identity from her activity.<\/p>\n

\"Tor\"<\/a><\/p>\n

But those users are still, generally speaking, using others\u2019 websites, which can be shut down<\/a> or pressured into censoring online activity<\/a>.<\/p>\n

My own work as a scholar and volunteer member of The Tor Project also looks at the network\u2019s way of allowing people to host websites privately and anonymously, which is where most of the upgrades to the system will come.<\/p>\n

Called \u201conion services,\u201d this element of the Tor network makes it possible for a person to run a website (or filesharing site, or chat service or even video calling system) from a dedicated server or even her own computer without exposing where in the world it is.<\/p>\n

That makes it much harder for authorities or opponents to take down. The upcoming changes<\/a> will fix flaws in the system\u2019s original design, and employ modern-day cryptography to make the system future-proof.<\/p>\n

They will improve security and anonymity for existing Tor users and perhaps draw additional users who were concerned the prior protections were not enough when communicating and expressing themselves online.<\/p>\n

Understanding onion services<\/h3>\n

As of March 2017, an estimated 50,000 onion services<\/a> are operating on the Tor network. Onion services continuously come online and offline, though, so it is difficult to obtain exact numbers.<\/p>\n

Their name comes from the fact that, like Tor users, their identities and activities are protected by multiple layers of encryption, like those of an onion.<\/p>\n

While criminals are frequently early adopters<\/a> of anonymity technology, as more people use the system, legal and ethical uses become far more common than illegal ones. Many onion services host websites, chat sites and video calling services.<\/p>\n

We don\u2019t know all of what they\u2019re doing because The Tor Project designs privacy into its technology<\/a>, so it does not and cannot keep track. In addition, when new onion services are set up, their very existence is private by default; an operator must choose to broadcast a service\u2019s existence publicly.<\/p>\n

Many owners do announce their sites\u2019 existence, however, and the Ahmia search engine<\/a> provides a convenient way to find all publicly known onion services.<\/p>\n

They are as diverse as the internet itself, including a search engine<\/a>, a literary journal<\/a> and an archive of Marxist and related writing<\/a>. Facebook<\/a> even has a way for Tor users to connect directly to its social media service<\/a>.<\/p>\n

\"Facebook\"<\/a><\/p>\n

Creating an onion site<\/h3>\n

When a privacy-conscious user sets up an onion service (either manually<\/a> or with a third-party tool such as onionshare<\/a>), people who want to connect to it must use the Tor Browser or other Tor-enabled software; normal browsers such as Chrome and Firefox cannot connect to domains whose names end in \u201c.onion.\u201d<\/p>\n

(People who want to peek at onion sites without all of the network\u2019s anonymity protections can visit Tor2web<\/a>, which acts as a bridge between the open web and the Tor network.)<\/p>\n

Originally, a new onion service was supposed to be known only to its creator, who could choose whether and how to tell others of its existence.<\/p>\n

Of course, some, like Facebook, want to spread the word as widely as possible. But not everyone wants to open their Tor site or service to the public, the way search and social media sites do.<\/p>\n

However, a design flaw made it possible for an adversary to learn about the creation of a new onion service. This happened because each day, onion services announce their existence to several Tor relays.<\/p>\n

As happened in 2014, an attacker could potentially control enough relays<\/a> to keep track of new service registrations and slowly build up a list of onion sites \u2013 both secret and public \u2013 over time.<\/p>\n

The same design flaw also made it possible for an attacker to predict what relays a particular service would contact the following day, allowing the adversary to become these very relays, and render the onion service unreachable.<\/p>\n

Not only could someone wanting to operate a private, secret onion service be unmasked under certain circumstances, but their site could effectively be taken offline.<\/p>\n

The updates to the system fix both of these problems<\/a>. First, the relays each service contacts for its daily check-in will be randomly assigned. And second, the check-in message itself will be encrypted, so a relay can follow its instructions, but the human operator won\u2019t be able to read it.<\/p>\n

Naming domains more securely<\/h3>\n

Another form of security causes the names of onion services to be harder to remember. Onion domains are not named like regular websites are: facebook.com<\/a>, theconversation.com<\/a> and so on.<\/p>\n

Instead, their names are derived from randomly generated cryptographic data, and often appear like expyuzz4wqqyqhjn.onion<\/a>, which is the website of The Tor Project. (It is possible to repeatedly generate onion domains until a user arrives at one that\u2019s a bit easier to recognize. Facebook did that and \u2013 with a combination of luck and raw computational power \u2013 managed to create facebookcorewwwi.onion<\/a>.)<\/p>\n

Older onion services had names made up of 16 random characters. The new ones will use 56 characters, making their domain names look like this: l5satjgud6gucryazcyvyvhuxhr74u6ygigiuyixe3a6ysis67ororad.onion.<\/p>\n

While the exact effects on users\u2019 ability to enter onion services\u2019 addresses haven\u2019t been studied, lengthening their names shouldn\u2019t affect things much. Because onion domain names have always been hard to remember, most users take advantage of the Tor Browser\u2019s bookmarks, or copy and paste domain names into address fields.<\/p>\n

Protecting onion sites<\/h3>\n

All this new design makes it significantly harder to discover an onion service whose operator wants it to remain hidden. But what if an adversary still manages to find out about it? The Tor Project has solved that problem by allowing onion services to challenge would-be users to enter a password before using it.<\/p>\n

In addition, The Tor Project is updating the cryptography that onion services employ. Older versions of Tor used a cryptosystem called RSA<\/a>, which could be broken by calculating the two prime factors of very large numbers.<\/p>\n

While RSA is not considered insecure yet, researchers have devised several attacks<\/a>, so The Tor Project is replacing it with what is called elliptic-curve cryptography<\/a>, which uses keys that are shorter, more efficient and understood to be at least as secure.<\/p>\n

The developers are also updating other basic elements of the encryption standards used in Tor. The hash function, which Tor uses to derive short and constant-length text strings from arbitrarily long data, will change from the troubled \u2013 and partially broken<\/a> \u2013 SHA-1 to the modern SHA-3<\/a>.<\/p>\n

In addition, secret keys for the Advanced Encryption Standard<\/a> cryptosystem will be twice as long as before \u2013 and therefore significantly harder to break. These don\u2019t address specific immediate threats, but protect against future improvements in attacking encryption.<\/p>\n

With these improvements to the software that runs Tor, we\u2019re expecting to be able to prevent future attacks and protect Tor users around the world.<\/p>\n

However, better anonymity is only one aspect in the bigger picture. More experimentation and research are necessary to make onion services easier to use.<\/p>\n

Philipp Winter<\/a>, Postdoctoral Research Associate in Computer Science, Princeton University<\/a><\/em><\/p>\n

This article was originally published on The Conversation<\/a>. Read the original article<\/a>.<\/p>\n

Now read:\u00a0Former IT admin \u201cused backdoors\u201d to help new employer<\/a><\/h3>\n","protected":false},"excerpt":{"rendered":"

In the coming months, the Seattle-based nonprofit The Tor Project will be making changes to improve privacy and security. <\/p>\n","protected":false},"author":340972,"featured_media":161684,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_facebook_post_id":"","_sma_instagram_post_id":"","_sma_threads_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[27],"tags":[35,2818],"class_list":["post-203558","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-headline","tag-tor"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/203558"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/340972"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=203558"}],"version-history":[{"count":1,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/203558\/revisions"}],"predecessor-version":[{"id":203562,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/203558\/revisions\/203562"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/161684"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=203558"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=203558"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=203558"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}