Tor Used To Collect Embassy Email Passwords

Several readers wrote in to inform us that Swedish security researcher Dan Egerstad has revealed how he collected 100 passwords from embassies and governments worldwide, without hacking into anything: he sniffed Tor exit routers. Both Ars and heise have writeups on Egerstad's blog post, but neither adds much to the original. It's not news that unencrypted traffic exits the Tor network unencrypted, but Egerstad correctly perceived, and called attention to, the lack of appreciation for this fact in organizations worldwide.

Heh

[dada21]

Of course something originally designed by the US Naval Research Laboratory and then spun off to an "independent pro-privacy group" such as the EFF would have loopholes, insecurities, and unwieldly aspects of it.

One thing that doesn't make sense to me: why does Tor operate MOSTLY over primary networks with non-tor functions? Doesn't it make sense that people who rely on Tor-offered anonymity would only operate the network bound to a specific NIC, a specific router and a specific network connection, separate from their main non-anonymous one? If anonymity is that important, why even bother trying to maintain an anonymous network connection concurrent with your non-anonymous one, with both utilizing the same single-point of exit/entry?

Doesn't make sense.

Unencrypted traffic is always unencrypted

[eknagy]

Well, the embassies should have used this new technology called "encryption". I heard that in the future, even browsers will support it...

eknagy

apples and onions

[Anonymous Coward]

I'd hate to be around when you bake a pie.

Re:Encryption is difficult for laypersons.

[Ford Prefect]

Unfortunately, it's possible to tell it's still an onion by the time it reaches your house. And that's what this article is referring to. If you wrapped an apple in an onion (used secure public key encryption) then you have an additional layer of security.

You know, not everybody likes onions. Cake! Everybody loves cakes! Cakes have layers!

...

You know what else everybody likes? Parfaits. Have you ever met a person, you say, "Let's get some parfait," they say, "Hell no, I don't like no parfait"? Parfaits are delicious.

Re:This reminds me...

[betterunixthanunix]

I used the same trick in high school to get around a really annoying filter. This filter would sometimes block slashdot because there were too many curses, "sexual references," or just because the random block feature was active. A quick SSH to a box outside of the school, run w3m (our connection was pretty bad, so I needed to save some bandwidth), and I have the unfiltered web.

Re:This reminds me...

[pclminion]

Heh. When I was in school, people would come to me if they'd forgotten their email password, because they knew I had all of them :-)

Re:Raising the question...

[Anonymous Coward]

No, I'm sure nobody would have any reason for hiding their true identity on the internet if they weren't doing something nefarious, mister ... InvisiblePinkUnicorn.