Hi, I was looking at TOR's wikipedia entry http://en.wikipedia.org/wiki/Tor_(anonymity_network) "Eavesdropping by exit nodes In September 2007, Dan Egerstad, a Swedish security consultant, revealed that by operating and monitoring Tor exit nodes he had intercepted usernames and passwords for a large number of email accounts.[15] As Tor does not, and by design cannot, encrypt the traffic between an exit node and the target server, any exit node is in a position to capture any traffic passing through it which does not use end-to-end encryption, e.g. SSL. While this does not inherently violate the anonymity of the source, it affords added opportunities for data interception by self-selected third parties, greatly increasing the risk of exposure of sensitive data by users who are careless or who mistake Tor's anonymity for security.[16]" Since a lot of people may be interested in running rouge exit nodes, why not have an optional setup where we can get rid of encrypting the traffic(i mean user data) and provide anonymity alone? It is best to take security out of the hands of the end user but in case the end user knows what he is doing and can run end to end secure services, wouldn't getting rid of this encryption(an optional provision) significantly speed up TOR? Thank you, Sarad.
On Sun, Apr 5, 2009 at 12:43 PM, Sarad AV <jtrjtrjtr2001@yahoo.com> wrote:
... In September 2007, Dan Egerstad ... [was a jerk]..."
Since a lot of people may be interested in running rouge exit nodes, why not have an optional setup where we can get rid of encrypting the traffic(i mean user data) and provide anonymity alone?
not sure what you mean. Tor uses encryption to provide anonymity for TCP streams over a 3+ hop Tor circuit with authentication and privacy between each relay (onion layer). what you do with this TCP stream is your business. if the suggested HTTPS/SSL/TLS over TCP is not available you may be forced to send things in plaintext. if it is in plain text the exit node can tamper with the data, just like someone injecting on a wireless network, and many other situations.
It is best to take security out of the hands of the end user but in case the end user knows what he is doing and can run end to end secure services, wouldn't getting rid of this encryption(an optional provision) significantly speed up TOR?
nope; there's nothing to get rid of. best regards,
participants (2)
-
coderman
-
Sarad AV