[lady_godiva]

Hello guys,

first of all i must apologise for my long period of inactivity.

Let's come to the post:

Few weeks ago i had the occasion to speak with some of the highest skilled IT security professionals and pentesters and here's what came out:

• Tor (the onion router) is no more secure. Looks like NSA has placed a really high number of routers all over the network and when the 3 hop connectionis estabilished it's most likely there will be at least one NSA router in the circuit. For those who have been using Tor for quite long, everyone will surely have noticed that Tor speed highly increased. This is due to the fact that NSA routers are high bandwidth router.
  
• Tails OS - This Operative system was designed to provide anonymity. Not so true or at least might not be. More people in the IT field are starting to think that it was the NSA who developed it and all the articles about it might be false (there's no definitive proof however). By the way, wether true or not, Tails relies heavily on Tor...
  
• Cryptography - Due to a low enforcement, everyone who develops a cryptography algorithm within the US boundaries, must provide a backdoor for the NSA. Rumors says that NSA got a backdoor in RSA too.
  

Reasons for all this is that NSA is trying to identify all the users that seek anonimity in the internet.

Tor, Tails and normal cryptography can still be used for the purpose they are meant to be (eg. not to be traced by others, website etc.)

Right now, the best anonimity solutions seem to be:

• PGP - if PROPERLY configured, it's not possible to bruteforce it (even NSA might have a really hard time).
  
• Proxychains - it works by setting a chain of proxies. The main drawback is that you are relying on proxies but if properly configured (eg. you use chinese or russian proxies, or whatever depending on the purpose and who you do not want to be traced by) it can keep good anon.
  
• Tor - it's not a contradiction, i know i just said that it is secure no more but there is a way to configure it properly. Tor is based on onion routing, which means that a circuit is made. This circuit is tipically made up of 3 hosts. It can actually be configured to have 3 <= hop <= 8. Configuring a 8 hop circuit requires some skills in configuring tor, but if someone knows reliable routers, he can manually set the circuit so that those trusted routers are used.
  

Privacy has always been important for me, because i strongly believe that no one should read personal information and data, so any contribution to this post, critics etc are and will always be well accepted.

[Ex094]

Well written post, I too think that Tor is insecure due to recent NSA attempts to track anonymous users while about Tails that's also true it relies on Tor..

About the cryptology thing inside USA, Why bother posting your own made encryption online? Use it yourself and stay secure, find out a safe way of prompting it's use under the radar.

[lady_godiva]

About the cryptology thing inside USA, Why bother posting your own made encryption online? Use it yourself and stay secure, find out a safe way of prompting it's use under the radar.

I totally agree with you, it's enough to develop or at least release it outside US boundaries. That consideration was to underline (ok, i didn't make myself so clear on that one) that the law is retroactive.

[Templar.Clown]

There has to be some way of being completely anonymous to agencies like nsa... I guess it's just about time to do everything through a very secure vpn/vps... Personally I find it a bit irritating that we need to go to these lengths to secure our privacy from our own government. Nice post btw.

[lady_godiva]

I thought it was important to share this as in my opinion Tor tends to be too much overrated. A true way of being anonymous would be great, but it's really hard to say wether there is one, mostly because you don't know what agencies like NSA are capable of, but with supercomputers (talking about hunderds of petaflop) it's not hard to believe that they can do almost anything they want.

[Ex094]

I thought it was important to share this as in my opinion Tor tends to be too much overrated. A true way of being anonymous would be great, but it's really hard to say wether there is one, mostly because you don't know what agencies like NSA are capable of, but with supercomputers (talking about hunderds of petaflop) it's not hard to believe that they can do almost anything they want.

Creating a custom encryption to encrypt the data packets between the server and the host but that'll be nearly pain staking

[lady_godiva]

Ye of course that would work but you have to keep in mind that designing any sort of encryption algorithm is really hard and NSA got the best cryptoanalysts out there. The main concern is the time requested to design and implement such algorithm vs the time that it can be used (not cracked). The time spent to design it is high, the time to crack it might be very low.

It's a really challenging task but that's surely the correctly way.

[Templar.Clown]

I wonder how the nsa would do against a algorithm they have never seen before.... I mean like one that is created by a user with the intent to disrupt there snooping.

[Ex094]

I wonder how the nsa would do against a algorithm they have never seen before.... I mean like one that is created by a user with the intent to disrupt there snooping.

Best Cryptographer means these guys know hell lots of stuff and it's not just 1 person it's a whole team.

[Templar.Clown]

I wonder how the nsa would do against a algorithm they have never seen before.... I mean like one that is created by a user with the intent to disrupt there snooping.

Best Cryptographer means these guys know hell lots of stuff and it's not just 1 person it's a whole team.

I still think if someone created something unlike the other encryption that is out there I don't think they could crack it so easy. Even as a team.