Top all-time · #5576
Stories by nusenu on Medium
Personal blog · nusenu.medium.comsecurity
Stories by nusenu on Medium is a personal blog at nusenu.medium.com about security. Since 2021, 14 different Hacker News readers have linked it 15 times, most often “Tracking One Year of Malicious Tor Exit Relay Activities (Part II)”. The last post was in 2021, but the archive is still widely read.
Too few sampled comments (10) to say how often HN recommends it.?
Why HN links it
HN readers link this Medium blog's posts on malicious Tor relays and exit nodes, citing them as evidence in discussions of Tor de-anonymization and attacks on the network.
Summarised by Claude from a sample of 10 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Tracking One Year of Malicious Tor Exit Relay Activities (Part II)6 people · 6 mentions · first linked 2021-05-09
- Is “KAX17” performing de-anonymization Attacks against Tor Users?5 people · 5 mentions · first linked 2021-12-02
- The Growing Problem of Malicious Relays on the Tor Network (2019)3 people · 3 mentions · first linked 2021-12-06
What Hacker News says?
https://nusenu.medium.com/tracking-one-year-of-malicious-tor...
Comment linking /tracking-one-year-of-malicious-tor-exit-relay-activities-part-ii-85c80875c5df
on “Climate activist arrested after ProtonMail provided his IP address”Submitted Is “KAX17” performing de-anonymization Attacks against Tor Users? as a story · 306 points
HN discussion> increased churn in tor relay nodes There actually was something kinda close to that recently: https://nusenu.medium.com/tracking-one-year-of-malicious-tor... But that's an increase in known-malicious relays and exits and doesn't speak to churn in existing, non-malicious nodes. The attribution efforts made in that article also suggest a different motive, though if I was a three-letterer attacking Tor I'd probably a…
Comment linking /tracking-one-year-of-malicious-tor-exit-relay-activities-part-ii-85c80875c5df
on “PayPal shuts down long-time Tor supporter”Submitted Tracking One Year of Malicious Tor Exit Relay Activities (Part II) as a story · 270 points
HN discussionIf I am online, I assume some entity somewhere can maliciously access what I am doing. My goal is to secure it enough so that entity has to be a state actor. Tor is not a silver bullet, even if used properly, because anyone (including state actors) can stand up a Tor node: https://nusenu.medium.com/tracking-one-year-of-malicious-tor...
Comment linking /tracking-one-year-of-malicious-tor-exit-relay-activities-part-ii-85c80875c5df
on “L0phtCrack Is Now Open Source”Submitted Is “KAX17” performing de-anonymization Attacks against Tor Users? as a story · 5 points
HN discussionIt's not specified, but related to the software they are running: "In autumn 2019 I stumbled on something odd: Tor relays doing something that the official tor software is unable to do." [1] [1] https://nusenu.medium.com/the-growing-problem-of-malicious-r...
Comment linking /the-growing-problem-of-malicious-relays-on-the-tor-network-2f14198af548
on “Is “KAX17” performing de-anonymization Attacks against Tor Users?”Submitted Tracking One Year of Malicious Tor Exit Relay Activities (Part II) as a story · 5 points
HN discussionTraffic correlation attacks are very difficult to mitigate. Even Tor is not immune to this (see research such as [1], and the Tor project's own statements that the design is not resistant to analysis by a global network observer). Also Briar may be unsuitable for some use cases where you want to remain anonymous to people you communicate with[2]. Some research has been done into communication networks that are resis…
Comment linking /the-growing-problem-of-malicious-relays-on-the-tor-network-2f14198af548
on “XMPP: The secure communication protocol that respects privacy”Submitted The Growing Problem of Malicious Relays on the Tor Network (2019) as a story · 1 points
HN discussionPart 1 says that they use SSL-stripping attacks to replace cryptocurrency addresses with their own address, allowing them to capture e.g. transfers to a crypto mixer. https://nusenu.medium.com/how-malicious-tor-relays-are-explo...
Comment linking /how-malicious-tor-relays-are-exploiting-users-in-2020-part-i-1097575c0cac
on “Tracking One Year of Malicious Tor Exit Relay Activities (Part II)”It’s not related to that particular article, but you might find this interesting, they write about a lot of similar research: https://nusenu.medium.com/tracking-one-year-of-malicious-tor...
Comment linking /tracking-one-year-of-malicious-tor-exit-relay-activities-part-ii-85c80875c5df
on “Why offer an Onion Address rather than just encourage browsing-over-Tor?”Just a reminder if you're being censored in any serious way then don't use TOR, as the network is largely controlled by a few actors and the devs don't seem to care / or don't have the proper resources to deal with it. https://nusenu.medium.com/is-kax17-performing-de-anonymizati...
Comment linking /is-kax17-performing-de-anonymization-attacks-against-tor-users-42e566defce8
on “Tor Snowflake Proxy”If the Obscura network started getting DDoSed, I'm sure Obscura would also become quite slow. The infosec hobbyist in me believes the many-months-long massive DDoS attack against tor infrastructure was exploiting a vulnerability in tor to perform (timing attacks, or related traffic correlation attacks) against and unmask hidden services or hidden service users, or maybe even exit node users. How realistic is this to…
Comment linking /is-kax17-performing-de-anonymization-attacks-against-tor-users-42e566defce8
on “Obscura: The VPN that can't track your activity”I run one of the bigger Tor relay families [0] with around 3.5% of the exit bandwidth [1]. Hosting high bw stuff is actually pretty cheap if you stay away from the cloud. I don't pay five figures per month for all these relays it's less than 1k$. For the actual question there was a big attacker uncovered in 2021 [2] and removed from the network. I'm pretty sure there are still malicious relays on the network the har…
Comment linking /is-kax17-performing-de-anonymization-attacks-against-tor-users-42e566defce8
on “Tor Browser Security Audit”
