Speaker 1: Welcome to Tech Stuff, a production from I Heart Radio.
Speaker 1: Hey there, and welcome to tech Stuff. I'm your host,
Speaker 1: Jonathan Strickland. I'm an executive producer with iHeart Radio and
Speaker 1: I love all things tech and it's time for a
Speaker 1: classic episode. This episode originally published on April six. It
Speaker 1: is titled The Secrets of Tour and the Deep Web.
Speaker 1: I've covered these topics a few times over the years.
Speaker 1: This one was a pretty fun discussion. Hope you enjoy.
Speaker 1: The Mighty Tour is one of the Avengers. He wields
Speaker 1: the hammer Mjolner, and his brother is Loki. She's not
Speaker 1: even growing her eyes, She's just staring me down this time. Okay.
Speaker 1: So seriously, though, what tour is free software. It's an
Speaker 1: open network, and it helps you defend against traffic analysis.
Speaker 1: In other words, people trying to figure out what you
Speaker 1: are doing and who you're commun ninicating with. Traffic analysis
Speaker 1: is a form of network surveillance that threatens personal freedom
Speaker 1: and privacy. Uh, it threatens confidential business activities and relationships,
Speaker 1: and it threatens state security. Therefore, some folks got together
Speaker 1: and said, hey, you know what we should do is
Speaker 1: we should come up with the means to allow people
Speaker 1: to communicate over the Internet, but do so in a private,
Speaker 1: anonymous fashion, so that you can set up these anonymous channels.
Speaker 1: Perhaps the most popular way to access this is through
Speaker 1: a customized build a Firefox called the Tour Browser Bundle. Right, Yeah,
Speaker 1: because just using Tour on its own is one thing
Speaker 1: to do to to allow you to have a little
Speaker 1: more of an anonymous presence, but it requires more than that,
Speaker 1: because if you access Tour through some other means, if
Speaker 1: you don't have say Flash disabled in your web browser,
Speaker 1: then you're still kind of broadcasting where you are because
Speaker 1: Flash often involves uh identification information in order for it
Speaker 1: to work. So it is a and source. So if
Speaker 1: you feel like getting in there and and doing your
Speaker 1: own thing, you're absolutely able to um and uh and
Speaker 1: And a lot of people do use it in one
Speaker 1: form or another. At its peak, in more than half
Speaker 1: a million people were using it every day. Yeah, oddly enough,
Speaker 1: I think as I a call in that year, there
Speaker 1: was some news that broke about government agencies. Yeah, Edward
Speaker 1: Snowden had that leak about the n s A, and
Speaker 1: suddenly people were thinking, you know, I was like it doubled. Yeah, Yeah,
Speaker 1: it was one of those things where people began to
Speaker 1: get very concerned. And it's not necessarily that these people
Speaker 1: are doing anything wrong. In fact, that's not the point
Speaker 1: at all. The point is that they have an expectation
Speaker 1: to privacy and being able to hold this kind of
Speaker 1: anonymous communication with other people. The communication itself isn't necessarily anonymous,
Speaker 1: but the channels are. Uh, you know, that's just that's
Speaker 1: just an expectation we have. It's not that, you know,
Speaker 1: I'm planning something to Ferry. It's just if I want
Speaker 1: to send a message to Lauren, and it's just for
Speaker 1: Lauren's eyes, I don't think anyone else has the right
Speaker 1: to look in on that. So yeah, and in normal
Speaker 1: internet traffic, that's absolutely a possibility. Yes, Because we've talked
Speaker 1: a lot about how information travels across the internet. You know,
Speaker 1: it all gets divided up into these little packets. Then
Speaker 1: the packets go across the network and then get put
Speaker 1: together Willy Wonka style on the other side, so that
Speaker 1: you get whatever it is you were trying to send,
Speaker 1: which is unfortunately probably not a delicious chocolate bar no
Speaker 1: or Mike TV either. It's not neither of those things.
Speaker 1: What it might be like if I, if I were
Speaker 1: to send that email to Lauren, and it's a sizeable email,
Speaker 1: that email gets divided up into numerous packets. The packets
Speaker 1: go across the Internet, not necessarily taking the same path,
Speaker 1: and they eventually reassemble on the other side and then
Speaker 1: Lauren can read it. But in order for that to happen,
Speaker 1: these packets have to have little bits of information so
Speaker 1: the routers know where to send the information onto next.
Speaker 1: So it's kind of like an address on a piece
Speaker 1: of mail. So let's say that you've got a snoop
Speaker 1: in your neighborhood and this person is getting into everybody's business.
Speaker 1: And the way this person does it is they look
Speaker 1: at all the mail that's going in and out of
Speaker 1: a person's mailbox. And even if they're not opening that
Speaker 1: mail and and reading all of it, just just the
Speaker 1: fact that you're sending it to particular people at particular
Speaker 1: times can tell that snoop a lot about what's going on. Right,
Speaker 1: So if you're sending out, uh, you know, envelopes to
Speaker 1: say a medical facility, that could give a lot of
Speaker 1: information to a snoop if they're seeing that stuff from
Speaker 1: various insurance companies is coming into you that could you know,
Speaker 1: I'm going with a medical thing here, but really this
Speaker 1: applies to any sort of communication. So so what we're
Speaker 1: saying is that it's not enough for the content of
Speaker 1: what you send over the internet. Uh necessarily, I mean
Speaker 1: you are hypothetical, you maybe you're fine, it's not enough
Speaker 1: for you to encrypt the content, but the actual transfer
Speaker 1: of the content in some cases needs to be encrypted exactly.
Speaker 1: And there are a lot of legitimate cases where you
Speaker 1: would want that to happen. I mean, let's talk about
Speaker 1: journalists for example. So you might have a journalist who
Speaker 1: is pursuing some major story, perhaps they're in unfriendly territory
Speaker 1: to do so, and they want to be able to
Speaker 1: contact sources that might be in danger otherwise if there
Speaker 1: if if this communication were publicly known or really anything
Speaker 1: that could endanger the journalist, a source, or the story itself,
Speaker 1: then you would want to have a way of securely
Speaker 1: communicating and making sure that no one's really snooping in
Speaker 1: on you. Well, that's that's a perfectly legitimate source. There
Speaker 1: are governments that use this kind of thing in order
Speaker 1: so that they can gather information and disseminate information. Uh,
Speaker 1: you've got companies that use this kind of stuff in
Speaker 1: order to have secure communications about upcoming products or services
Speaker 1: that are not part of the public knowledge and don't
Speaker 1: need to be oh sure, I mean even if you're
Speaker 1: just doing r and D about something you know, like
Speaker 1: like let's say that you're the example that you used
Speaker 1: and in our notes here is Apple. Like if here,
Speaker 1: if you're creating a new product and you start researching
Speaker 1: patents online, um, the right person could could find your
Speaker 1: searches and figure out what you were looking for, and
Speaker 1: that sucks for you. Yeah, yeah, if you had the
Speaker 1: next big idea and you were waiting, because you know,
Speaker 1: like the company of Apple, they get a lot of
Speaker 1: a boost from folks whenever they announced something brand new
Speaker 1: that surprises everyone, which of course is exactly why you
Speaker 1: have so many news agencies scrutinizing everything Apple does in
Speaker 1: order to try and guess what's coming next. So the
Speaker 1: more you're able to keep that secret, the bigger the
Speaker 1: impact is when you unveil it. Because the worst, the
Speaker 1: worst feeling is when you tune into an Apple of
Speaker 1: that and it ends up being exactly what you expected.
Speaker 1: It was. Time to be right. Every everyone still tunes
Speaker 1: in but then they're like, oh, but that's exactly what
Speaker 1: they were talking about last week. I know, and you
Speaker 1: read what they wrote last week, so stop it me. Sure,
Speaker 1: and and lots of other people who could generally be
Speaker 1: considered to be working for for non nefarious purposes, but
Speaker 1: nonetheless would like a little bit of secrecy, uh, for example,
Speaker 1: activists or whistleblowers, um or you know Chinese citizens who
Speaker 1: really just want to use Facebook or read news from
Speaker 1: other countries. Sure, and we've seen plenty of examples also,
Speaker 1: things like the Arabs Spring. You know, places in the
Speaker 1: world where you have people who are trying to enact
Speaker 1: change in a very harsh environment where if their activities
Speaker 1: were picked up on by official sources, government sources, state
Speaker 1: sponsored sources, they could face some serious consequences. And it's
Speaker 1: not necessarily the again, like you said, that they're doing
Speaker 1: anything nefarious, it's just they can't do it at all
Speaker 1: without fear of some form of consequence unless that can
Speaker 1: remain secure. So you've got to figure out how do
Speaker 1: we make this secure. Also, we have to figure out
Speaker 1: how do we frame this in such a way where
Speaker 1: we also admit some people do use it for nefarious purposes. Oh, sure,
Speaker 1: of course. I mean there are plenty of people out
Speaker 1: there who are going to use this kind of anonymous
Speaker 1: connection in order to conduct illegal or otherwise illicit activities.
Speaker 1: We've talked about some of them in previous episodes, in fact,
Speaker 1: and we'll mention some more as we go along. So again,
Speaker 1: it's one of those things where you would probably argue
Speaker 1: that it's a relatively small percentage of the population using
Speaker 1: it for these purposes, but they're the ones who get
Speaker 1: the most press, uh, and so therefore it kind of
Speaker 1: creates this public perception that people who use tour are
Speaker 1: up to something. Also, you know, we mentioned the fact
Speaker 1: that in a normal Internet communication, the you know what,
Speaker 1: what amounts to the the address on the label is
Speaker 1: perfectly visible because it needs to be so that it
Speaker 1: can route across gets to the place it's gone. Yeah,
Speaker 1: and Tour they had to figure out a way around
Speaker 1: that so that you could have it be ob you skated,
Speaker 1: so that if someone were to snoop in on communication,
Speaker 1: they would not be able to determine what the origin
Speaker 1: nor destination were. And that is pretty amazing stuff because
Speaker 1: you gotta you gotta figure out a way of implementing
Speaker 1: that where it can still work, Like, how do you
Speaker 1: disguise the address and still hope that it gets to
Speaker 1: where it's going, Because if we did that to the
Speaker 1: to the US Postal Service, our stuff would never get anywhere.
Speaker 1: And it wouldn't be their fault either, because you just
Speaker 1: wouldn't be following the rules. Oh sure, Yeah, if you
Speaker 1: don't write your address on something, then how does it
Speaker 1: get to that place? So here's another funny thing, Lauren, Um,
Speaker 1: who was it that came up with this whole tour idea?
Speaker 1: I mean it must have been like, um, like hackers,
Speaker 1: you know at def con convention, who all got together
Speaker 1: and so we don't want the government looking in on
Speaker 1: our stuff, right, you know? It was the government. It
Speaker 1: was the it was it was the U. S. Naval
Speaker 1: Research Laboratory UM back in back in actually, which makes
Speaker 1: it extra hilarious that that the n s A has
Speaker 1: kind of been trying to crack trying to crack it
Speaker 1: because you've got a government agency doing its best to
Speaker 1: figure out how to intercept information that goes across a
Speaker 1: tour network, and another government US government entity that's responsible
Speaker 1: in large part for the creation for its creation and furthermore,
Speaker 1: other governmental agencies that are responsible for funding it. As
Speaker 1: of one point two four million dollars, half of tours
Speaker 1: revenue UH came from government grants, including a large part
Speaker 1: from the Department of Defense. So this is an example
Speaker 1: of two different parts of the United States government working
Speaker 1: at odds against each other, one part saying this is
Speaker 1: absolutely necessary for us to be able to operate in
Speaker 1: a secure way, and the other part saying, we want
Speaker 1: to be able to see what's going on here. So
Speaker 1: so so yeah. But but this all got its start
Speaker 1: back with the U. S. Navy and UM. It was
Speaker 1: part of an onion rooting project. Routing project, Yeah, rooting.
Speaker 1: If you're in England, it's routing. Here in the US,
Speaker 1: it's usually routing either way. Why would you even call
Speaker 1: it an onion It's because it relies upon quote a
Speaker 1: layered object to direct the construction of an anonymous, bidirectional
Speaker 1: real time virtual circuit between two communicating parties and initiator
Speaker 1: and responder. And that's as clear as day. Yeah, we
Speaker 1: can just end the podcast now, guys, don't worry. We're
Speaker 1: going to explain the whole layered thing a little bit
Speaker 1: later on. So we will. We will make sure that
Speaker 1: you understand why an onion It's actually a pretty clever
Speaker 1: way to describe what's going on. But the project had
Speaker 1: specific goals to research and develop and build anonymous communication systems,
Speaker 1: to analyze other anonymous communications systems, and to create low
Speaker 1: latency Internet based systems that resisted traffic analysis, eavesdropping, at
Speaker 1: other attacks from outsiders as an Internet routers or insiders
Speaker 1: as an onion routing servers. I have more to say
Speaker 1: about the secrets of tour. The deep Web got a
Speaker 1: lot of layers to peel off that onion. But before
Speaker 1: we get to that, let's take a quick break. So
Speaker 1: the ideal was to create some form of distributed system
Speaker 1: where you could have two parties communicating with one another
Speaker 1: and no one would be able to know that those
Speaker 1: two parties were in communication. They would know the communication
Speaker 1: is going on because traffic is moving across the network,
Speaker 1: but because of the network's design, they would have no
Speaker 1: way of knowing what to end parties were actually communicating
Speaker 1: with one another. Because, just as we were saying with
Speaker 1: that snoop, even if you can't see what the information
Speaker 1: itself is, just knowing who is talking to whom gives
Speaker 1: you a lot of info right because of this, and
Speaker 1: funnily enough, the Navy actually had to step back from
Speaker 1: the project in order to make it actually useful because
Speaker 1: the network needs to be open, right. Um. So, I
Speaker 1: mean if if you know, if you can see that
Speaker 1: everything is coming through, if if only the Navy used it,
Speaker 1: then you would know whenever communication was happening that the
Speaker 1: Navy was communicating with people like you would. You would
Speaker 1: have limited the number of people that could possibly be
Speaker 1: the ones communicating by making it open and say this
Speaker 1: is a playground where everyone can come in. Suddenly you
Speaker 1: can't tell who's communicating with whom because there's so many's
Speaker 1: too much noise and not in the traffic, right. Um. So,
Speaker 1: the project incorporated as a nonprofit in two thousand six,
Speaker 1: and it currently depends a whole lot on crowdsourcing. UM.
Speaker 1: There are only nine full time tour employees as of
Speaker 1: this podcast, which we are recording on April. By the way,
Speaker 1: um and uh, the rest of the development is spread
Speaker 1: across dozens of part time assistants and hundreds of volunteers.
Speaker 1: The code is open source, which actually makes it harder
Speaker 1: to mess with. Um. You know, like if someone say,
Speaker 1: say the n s A tried to create a vulnerability deliberately,
Speaker 1: then anyone could catch it, right, Yeah, it's not like
Speaker 1: it's hidden the way behind closed doors. In that way,
Speaker 1: it gets overlooked and you suddenly have this back door
Speaker 1: entrance into the Tour network. No, it's it's it's much
Speaker 1: more likely for someone to catch it if lots of
Speaker 1: people are looking. Yeah exactly. Yeah, you've got lots of
Speaker 1: people checking on it all the time. So it's actually
Speaker 1: more secure by being in plain sight in that way.
Speaker 1: So here's how it used to work. Because you know,
Speaker 1: I mentioned that tour was had an onion in the oh,
Speaker 1: but it doesn't really involve onions anymore. And then we've
Speaker 1: mentioned onions. Yeah, so yeah, so we're gonna we're gonna
Speaker 1: go back to how it worked originally because the way
Speaker 1: it works now is not that much different, but it
Speaker 1: doesn't involve the onion metaphor anymore. So, first of all,
Speaker 1: to achieve anonymity, the Tour Network uses something called privoxy filters,
Speaker 1: which prevent client information from reaching servers. So this means
Speaker 1: that a client, you know, that's that's your computer. When
Speaker 1: you are trying to access anything, Let's say you're using
Speaker 1: your your browser to access your email, because I love
Speaker 1: that example. It's easy one. So your your computer is
Speaker 1: the client. It's sending a request to another computer. It's
Speaker 1: asking for data from this computer that hosts the the
Speaker 1: email service that you use, and that is called the server. Now,
Speaker 1: normally the server receives information that can identify the client,
Speaker 1: so you have some sort of address that identifies this
Speaker 1: is the machine that's asking for that information. So then
Speaker 1: the server knows exactly who it's talking to. Well, privoxy
Speaker 1: filters prevent that from happening, so it's possible for a
Speaker 1: client's identity to remain unknown to the server and also
Speaker 1: to the rest of the network as these requests go
Speaker 1: across the network. Also, one of the other things that
Speaker 1: has and we'll talk more about this in a bit,
Speaker 1: is the ability to create hidden services. But you know,
Speaker 1: I'm not going to spoil that because the discussion we
Speaker 1: have later on will really kind of bring that to
Speaker 1: light and it will make much more sense after we
Speaker 1: talk about exactly how this communication occurs. Yes, so it's
Speaker 1: possible to use onion routing software to send information completely anonymously.
Speaker 1: In other words, you could use it so that you
Speaker 1: could send an anonymous message to someone else, they would
Speaker 1: not know the identity of that person. But that's not
Speaker 1: the purpose of tour. The purpose, like I said before,
Speaker 1: is to allow anonymous channels of communication. So you and
Speaker 1: the person with whom you're communicating know each other's identity,
Speaker 1: but nobody else does, right, So this allows you to
Speaker 1: have that honest, open expression of information without fear of
Speaker 1: someone else snooping in on you or any other consequences
Speaker 1: apart from whatever consequences come from just that communication between
Speaker 1: two parties. If you tell someone that they dressed like
Speaker 1: a slab, there's going to be consequences. What I'm saying
Speaker 1: doesn't have to be someone snooping in on you. Good point.
Speaker 1: I get that a lot. Uh. So it uses proxy servers,
Speaker 1: and a proxy server acts as an intermediary between a
Speaker 1: client and some other server. So you can kind of
Speaker 1: think of it as this is the go between. So
Speaker 1: if I were to send a request to get my email,
Speaker 1: but I wanted to go through a proxy server, I
Speaker 1: would log into the proxy server. The proxy server would
Speaker 1: then send my request onto the email server, and from
Speaker 1: the email servers perspective, it looked like the proxy server
Speaker 1: was the origin of that request, it isn't able to
Speaker 1: see back to exactly there's a hop missing there. So
Speaker 1: that's really important in this. And uh, the communication part
Speaker 1: is the tricky part. Like I said, So you've got
Speaker 1: this information, it's passing between nodes or little routers within
Speaker 1: the tour network. Okay, so think of these nodes as
Speaker 1: rest stops between the client, the sender, and the recipient
Speaker 1: the server. Right. Each node only knows the identity of
Speaker 1: the node before it and the node after it, right,
Speaker 1: So uh, and the note before it and after it
Speaker 1: completely is dependent upon when you're sending the message, because
Speaker 1: you're you're going to create new pathways every time you
Speaker 1: create a connection, so it's not like you have a
Speaker 1: set path each time. It's like the Internet. It's very flexible.
Speaker 1: So when you send a message, and let's say it's
Speaker 1: going through letters A through G, we're just designating these
Speaker 1: nodes as A through G and for some reason it's
Speaker 1: going into a B, C, D, E F G order.
Speaker 1: So node D only knows about nodes C and E.
Speaker 1: The information came from C. It knows it has to
Speaker 1: send the information onto E. It has no awareness of
Speaker 1: a B or you know, effor G. So that's it.
Speaker 1: And that means that if you were to intercept information
Speaker 1: passing between two nodes, you would just know which note
Speaker 1: it came from and which node it went to. You
Speaker 1: wouldn't know the actual person who sent it, nor would
Speaker 1: you know the person to whom it went. Ultimately, on
Speaker 1: top of that, the nodes encrypt the communication as it's
Speaker 1: passed along. Yes, and this is where you get that
Speaker 1: layer and layer and layer of encryption. And because there's
Speaker 1: so many layers of encryption, well, what else has lots
Speaker 1: of layers? An onion? I was going to think of
Speaker 1: Game of Thrones, but yes, Onion is right. Onion is
Speaker 1: exactly the thing that they went with because Game of
Speaker 1: Thrones really wasn't that popular. Also, it's proprietary. I mean,
Speaker 1: you know, yeah, that probably would have George R. Martin
Speaker 1: gotten a little upset about that. But yeah, so so
Speaker 1: Onion is in fact what they went with because there's
Speaker 1: so many different layers of encryption. Still a little bit
Speaker 1: more to talk about with the secrets of tour in
Speaker 1: the Deep Web, but before we get to that, let's
Speaker 1: take another quick break. Okay, so here's my example, and
Speaker 1: I think it's a doozy of an example. Because it's
Speaker 1: completely believable. I decided to use as an example two
Speaker 1: of our beloved co workers here at how stuff works.
Speaker 1: Uh And when you start thinking to yourself, who would
Speaker 1: be so paranoid that they would need an incredibly secure
Speaker 1: communication process? Two names leap to mind from the shadows
Speaker 1: and then back into the shadows, because that's where they belong.
Speaker 1: One of them wearing a gremlin mask. Yeah, and maybe
Speaker 1: a fedora on top of it. It's not a fedora,
Speaker 1: I know, Ben Dora. No, it's a trill Bey, I'm
Speaker 1: going to call it a fedora anyway. So Ben Bolan
Speaker 1: and Matt Frederick so stuff they don't want you to
Speaker 1: know hosts. Yes, and if you've never ever listened to
Speaker 1: that show, go check it out. Watched the show. Yeah,
Speaker 1: that's great. So so let's say that Ben wants to
Speaker 1: contact Matt and he wants the communication to be secure,
Speaker 1: so he sends it across the Tour network using this
Speaker 1: freely available software. He's got the Tour bundle installed and
Speaker 1: he sends the message along. So here's what happens. Ben
Speaker 1: would contact a proxy server on the TORN network. Now,
Speaker 1: that proxy server would then determine the route of nodes
Speaker 1: or the number of hops that it will take to
Speaker 1: get from the proxy server to Matt's computer. So for
Speaker 1: argument's sake, let's say again that it's just uh five nodes,
Speaker 1: So it's a B, C, D E. Those are the
Speaker 1: Those are the nodes that it's going to go through. Now,
Speaker 1: each hop becomes an encryption layer on this onion, and
Speaker 1: the core of the onion is Ben's original message to Matt,
Speaker 1: So that's the very center. Now Ben's proxy server starts
Speaker 1: to construct layers of encryption based upon the path that
Speaker 1: this onion is going to take journeying from the proxy
Speaker 1: server all the way to Matt's computer, and the innermost
Speaker 1: layer will be the encryption for Matt's proxy. Yes, so
Speaker 1: the next layer out would be the node just before
Speaker 1: it gets to Matt's proxy. The next layer out would
Speaker 1: be the node before that, and so on and so
Speaker 1: forth until you got to the first node that the
Speaker 1: proxy server sends this onion onto. Now, every time the
Speaker 1: onion travels to a new node, it decrypts that layer.
Speaker 1: The corresponding layer strips of encryption. Yeah, so that that
Speaker 1: layer of the onion gets pulled away, and that's how
Speaker 1: the node knows where to send it onto. Next, so
Speaker 1: proxy service sends it on to node A. Note A
Speaker 1: strips away that encryption and sees that needs to send
Speaker 1: it on to Node B. Node B gets this onion.
Speaker 1: Now Node BE only knows that Note A set the onion,
Speaker 1: doesn't know where the onion originally came from, and it
Speaker 1: decrypts that. Next layer strips it free UH, finds the
Speaker 1: identification of Notes C and send it along. Yep. Node
Speaker 1: C doesn't know about Node A, just notes knows about
Speaker 1: Node B, so so on and so forth till it
Speaker 1: gets to Matt. By the time it gets to Matt,
Speaker 1: all those layers of encryption have been stripped away and
Speaker 1: that can actually read what the messages. Therefore, anyone who's
Speaker 1: trying to analyze all of this traffic would would just
Speaker 1: see a message passing between two seemingly random routers with
Speaker 1: with no way of knowing either where that information came
Speaker 1: from or what the ultimate destination is. Yep. And because
Speaker 1: you've encrypted it so many times, they probably can't even
Speaker 1: tell what the information. They can't read it, they don't
Speaker 1: know where it's going. They're in the dark. So to them,
Speaker 1: it's just all they know is that traffic is going
Speaker 1: across this network, but they don't have any way of
Speaker 1: deriving meaning from that. Now, once Matt's proxy receives that onion,
Speaker 1: a virtual circuit forms along the notes. Think of it
Speaker 1: as like a temporary pathway that solidifies between uh Ben's
Speaker 1: proxy and that's final computer, and it allows for encryption
Speaker 1: to pass both ways. So you have two different kinds
Speaker 1: of encryption. You've got one kind whenever Ben sends a
Speaker 1: message to Matt, and essentially you have the inverse of
Speaker 1: that when Matt sends it to Ben. So unless you
Speaker 1: have the key to that encryption, you can't figure out
Speaker 1: what's going on either. So it's it's pretty secure or
Speaker 1: now there are some la Mainly we're talking about vulnerabilities
Speaker 1: when you send it from your computer to that proxy
Speaker 1: server and when that last proxy sends it to the destination,
Speaker 1: because this is when you don't have the protection of
Speaker 1: the network itself. It's when it's you can think of
Speaker 1: it as the information is leaving the network to get
Speaker 1: to wherever it's going or entering. Yeah, and again, if
Speaker 1: you're using a browser that still has certain things enabled
Speaker 1: like Flash or Java, then you may end up having
Speaker 1: sending along some information that people could identify you on
Speaker 1: based on that, but within the network itself, it's incredibly secure,
Speaker 1: right And and so this, this circuit that that you've created,
Speaker 1: well will last as long as both parties want it to.
Speaker 1: You can you can send a command to collapse it
Speaker 1: at the end of your session, you say destroy, and
Speaker 1: it collapses. This uh, this virtual circuit, and then if
Speaker 1: you wanted to create a new one, you could, and
Speaker 1: it would be a new virtual circuit, probably taking a
Speaker 1: totally different hathway through the nodes. And you know, I
Speaker 1: made the example of ABC D E that kind of stuff,
Speaker 1: but really, you know, it could be any order. You know,
Speaker 1: it's it's and it will be any order, right, that's all.
Speaker 1: That's one of the whole points because if it were
Speaker 1: the same pathway each time, then you would ultimately be
Speaker 1: able to determine who sent it and who it went to.
Speaker 1: So it has to be uh, you know. And of course,
Speaker 1: the more the more routers you have available, the more
Speaker 1: of these relay nodes you have, the more secure the
Speaker 1: communication becomes, so that's also really important. Then there's also
Speaker 1: a concept called loose routing, which adds another layer of
Speaker 1: security on this because like I said, you know, you
Speaker 1: ultimately you have these proxies that no way more information
Speaker 1: than all the nodes do. They have to in order
Speaker 1: to be able to make that layer of encryption and
Speaker 1: have this onion pass from one spot to the next.
Speaker 1: So one thing you could do with loose routing is
Speaker 1: that the proxy ends up sending the onion on to
Speaker 1: the first node. But that's all the proxy knows about
Speaker 1: the probably and then the first nodes responsibility is to
Speaker 1: create the rest of that pathway. So even that first
Speaker 1: stop isn't aware of where, how, what path it's gonna
Speaker 1: take to get to its destination. It just knows this
Speaker 1: is the first step of that path, but beyond that,
Speaker 1: I don't know. So it adds another layer of security
Speaker 1: to it that way. Now, again, if you were able
Speaker 1: to target that first node, you might be able to
Speaker 1: figure some stuff out, but really you just know that
Speaker 1: it came from a proxy. You wouldn't know who sent
Speaker 1: the information to the proxy in the first place. But yeah,
Speaker 1: so we've got these these endpoints that have some vulnerabilities,
Speaker 1: but other than that, it's it's pretty secure. Uh, I've
Speaker 1: got to We've got a great little bit about how
Speaker 1: secure it is, and a little in just a little while.
Speaker 1: But today nodes or relays within the system still don't
Speaker 1: know the origin or ultimate destination of information, and you
Speaker 1: still create virtual circuits between the initiator and the recipient
Speaker 1: for encrypted anonymous channels. But there's no more use of
Speaker 1: this onion metaphor. I mean, it's not it's not the
Speaker 1: same implementation. You get the same result, but it's a
Speaker 1: different implementation that does it. But it's this, you know,
Speaker 1: it's following a lot of the same philosophies. And you've
Speaker 1: got a Tour directory that keeps track of all the
Speaker 1: available nodes that are on the system at any given moment.
Speaker 1: As of January, there were about five thousand computers around
Speaker 1: the world operated by those volunteers that I mentioned serving
Speaker 1: as potential nodes in this system. Right, And when you
Speaker 1: send a message to a recipient across the Tour network,
Speaker 1: your tour browser or whatever consults this directory, which then
Speaker 1: gives it a route of nodes, and then you can
Speaker 1: send the encrypted information across and each node further encrypt
Speaker 1: the message again and only knows the note immediately before
Speaker 1: and after, kind of like the previous version we just
Speaker 1: talked about. So it's not that different. It's just this
Speaker 1: whole layer metaphor is kind of no longer as accurate.
Speaker 1: But um, yeah. One thing you've got to remember is
Speaker 1: that because you've got this extra layer of encryption going
Speaker 1: on and it's purposefully obvious, skating the the origin by
Speaker 1: hopping around a lot, communication is not as quick, right.
Speaker 1: It's going to take a longer necessarily, So if you're
Speaker 1: using tour in order to send instant messages, your definition
Speaker 1: of instant maybe a little different than what it normally
Speaker 1: would be. It may just be pretty darn quick, but
Speaker 1: not as instant as this other method. Yeah. Um. Furthermore,
Speaker 1: it is not the most secure thing that you can do. No.
Speaker 1: I actually read a great article on the best way
Speaker 1: of using tour as as part of an approach to
Speaker 1: securely using the Internet and maintaining your anonymity, and I
Speaker 1: thought about including it in this podcast. I really did, guys.
Speaker 1: I was gonna go all into the tips this guy had,
Speaker 1: and then I realized that it was so in depth
Speaker 1: and there was so much to keep tak into consideration
Speaker 1: that really we could just do a full podcast just
Speaker 1: on that, and perhaps in the future we will. If
Speaker 1: you guys in particular, want to know. Seriously, I want
Speaker 1: to be as anonymous and secure as possible. Tell me
Speaker 1: what I need to do. Well, we'll we'll give you podcast.
Speaker 1: We should we should do that episode. UM, I'll tell
Speaker 1: you right now. It's crazy, but but right because because
Speaker 1: even if you're using the most recent version of Tour
Speaker 1: I mean, which, as we have just detailed, is an
Speaker 1: incredibly uh complex and encrypted process, a determined party could
Speaker 1: exploit vulnerabilities and Firefox itself, which which Tour is based in. UM,
Speaker 1: it could attempt to set up monitoring nodes in the network,
Speaker 1: or it could just methodically work on key decryption in
Speaker 1: order to spy on your activities so stuff can still happen. Yeah,
Speaker 1: we'll think about doing a full security episode. I mean,
Speaker 1: I kind of think we'll have to pull Ben in
Speaker 1: for that one. Oh, that would be great. We should
Speaker 1: totally do more classovers. We'll we'll see if we can
Speaker 1: get Ben to be available for an episode where we
Speaker 1: really talk about and you know it's going to sound
Speaker 1: paranoid and crazy, but the thing is technology in order
Speaker 1: for it to work, UH needs to have certain information
Speaker 1: so I can allow you to have this communication. But
Speaker 1: because it needs that certain information. It means at your
Speaker 1: anonymity is at risk, so you've got to do these
Speaker 1: kind of crazy things. Also they're wacky bugs like heartbled
Speaker 1: Yeah actually, um okay, go ahead and mention this so
Speaker 1: heart bleed. If you listen to our previous episode, we
Speaker 1: talked all about this vulnerability that was an open SSL
Speaker 1: versions one point zero point one through one point zero
Speaker 1: point one f and UH and how that ended up
Speaker 1: meaning that people who use the heartbeat method could get
Speaker 1: access to encryption keys and thus see everything that's going
Speaker 1: across the server. So you might wonder does this work
Speaker 1: on the tour network, this crazy relay node network, And
Speaker 1: the short answer is, technically it works, but it doesn't
Speaker 1: help anybody out because even if you were to see
Speaker 1: the information moving across a node, it still has multiple
Speaker 1: layers of encryption, so it's not as vulnerable. Vulnerable, Yeah,
Speaker 1: although I mean toward toward being toward did say that
Speaker 1: you know, if you if you only want to be secure,
Speaker 1: you might just want to stay off the internet for
Speaker 1: a few days, right, And they did say that they
Speaker 1: had planned on rolling out patches of the open ssl
Speaker 1: UH software because the upgrade the newest patch does patch
Speaker 1: that vulnerability. So they are going to be fixing up
Speaker 1: those nodes over time anyway. In fact, by the time
Speaker 1: this podcast comes out, most of them may already be addressed.
Speaker 1: But yeah they said that, Um that worst case scenario,
Speaker 1: you're probably still pretty okay, you know in the grand
Speaker 1: scheme of things. That herd bleed story was a real
Speaker 1: eye opener. Yeah. Then we have the other thing we
Speaker 1: alluded to earlier, oh right, hidden services, and that's where
Speaker 1: that dark net or deep web kind of thing comes in.
Speaker 1: Um okay. So, so tour also provides a way to
Speaker 1: to offer up access to a server or to run
Speaker 1: an entire service without revealing your IP addressed to your
Speaker 1: users and from behind a firewall. Um, sites and services
Speaker 1: set up like this are are off the beaten Internet path.
Speaker 1: You can't even find them using Google or other web searches.
Speaker 1: You have to be using tour in order to find them.
Speaker 1: And um they're they're all using what's called the dot
Speaker 1: Onion extension because onions. Um okay. So, so basically how
Speaker 1: this works. The hidden service has a public to tour listing,
Speaker 1: and so when a client wants to access that service,
Speaker 1: the client sets up a rendezvous node and sends along
Speaker 1: an access request via the usual tour encryption routing process
Speaker 1: UM through a random introduction node that the service has
Speaker 1: set up UM, and then the client and service can
Speaker 1: contact each other through that rendezvous node, again using the
Speaker 1: usual tour circuits UM. It's it's like the introduction and
Speaker 1: the rendezvous nodes are translators, right. It protects the service
Speaker 1: and the client because neither knows where the other is.
Speaker 1: That the translators are the recipients for each party's communications.
Speaker 1: And so this this deep web or darknet hosts law
Speaker 1: of different stuff, some things that are definitely in the
Speaker 1: nefarious category, like the Silk Road, although Silk Road still
Speaker 1: has some legit. Sure of the stuff that was on
Speaker 1: Silk Road was completely legal, the other not so much. Yeah,
Speaker 1: so a silk Road, of course that got shut down,
Speaker 1: but it existed on tour and this kind of hidden
Speaker 1: web because you know, you wouldn't want it to be
Speaker 1: easily accessible, uh, and then everything would come crashing down,
Speaker 1: you know, ultimately came crashing down anyway, but it was
Speaker 1: hidden better than just sitting there and on the web.
Speaker 1: So yeah, that's that's definitely one of the other issues.
Speaker 1: And again there are other things that are on this
Speaker 1: deep net, this this dark net or rather or deep
Speaker 1: web that again not nefarious at all. They have very
Speaker 1: legitimate purposes for existing. It's completely legal, but it's also
Speaker 1: designed in such a way as to protect the identity
Speaker 1: of the people who need to use the services. So
Speaker 1: it again, just because we have some really high profile
Speaker 1: examples of naughtiness doesn't mean that the entire network is naughty,
Speaker 1: just like there are other services that people have used
Speaker 1: where some people are using it in order to get
Speaker 1: like illegal downloads of whatever content they want, but most
Speaker 1: people aren't. A lot of the focuses on the people
Speaker 1: who are the pirates, and thus the entire service gets
Speaker 1: painted as yeah, yeah, it's I I read a really
Speaker 1: great quote and I don't have it open right now,
Speaker 1: and um. Bloomberg business Week did a really great article
Speaker 1: in January about about tour in general and the kids
Speaker 1: who are running it and all that kind of stuff,
Speaker 1: and uh, the the example that I think they used
Speaker 1: was that, you know, you don't hear about someone who's
Speaker 1: stalker couldn't find them. You you hear about the kid
Speaker 1: who got drugs or the child porn rang or something, right, Right,
Speaker 1: So you know, there are some very very the Navy
Speaker 1: wouldn't have been interested in making this uh in order
Speaker 1: just to have crime happened, because as low as your
Speaker 1: opinion of the Davy, maybe depending on if you're a
Speaker 1: Marine or not, it's it's really not in that business. No.
Speaker 1: But but certainly the fact that this kind of illegal
Speaker 1: activity can go on means that it attracts attention from,
Speaker 1: for example, the n s A. Yes, uh, I love
Speaker 1: the stories about the n s A and Tour because
Speaker 1: they're both infuriating and funny at the same time. So
Speaker 1: infuriating in that uh, the n s A has attempted.
Speaker 1: We know the n s A has attempted to try
Speaker 1: and crack because some of those slides that have come
Speaker 1: out from Standon's League as specifically mentioned Tour yep and UH.
Speaker 1: One of the documents within the n s A is
Speaker 1: titled Tour Stinks. And the reason they say Tour stinks
Speaker 1: is because it's so gosh darn't hard to figure out
Speaker 1: what information is within the Tour network. Now, they do
Speaker 1: note that if you are able to target those points
Speaker 1: where information is coming into the network are coming out
Speaker 1: of the network, then you are more likely to be
Speaker 1: able to determine what is going on and who was
Speaker 1: talking to whom. But if it's within the network itself,
Speaker 1: there's no report that has leaked so far that has
Speaker 1: indicated the NSA has been able to crack that, which
Speaker 1: has not stopped a whole lot of theorists from saying
Speaker 1: that they have totally cracked it, and that the reports
Speaker 1: saying that they haven't cracked it are just so that
Speaker 1: people feel, yeah, that they people will feel a false
Speaker 1: sense of security using Tour. Here's the thing about conspiracy theories,
Speaker 1: and again, I wish we had been on here right now.
Speaker 1: Uh you know, you can. You can have a lack
Speaker 1: of evidence and that becomes evidence, or if you have
Speaker 1: a denial, then that becomes hard evidence. You know. So
Speaker 1: I I think, I really do think, because I don't
Speaker 1: think the n s A ever intended for all the
Speaker 1: information to leak out based upon I don't know everything
Speaker 1: that's happened since then. Uh so I'm pretty willing to
Speaker 1: believe that they have not yet cracked how to get
Speaker 1: look at information in a meaningful way on the Tour
Speaker 1: network itself. In general, I would say that Tour seems
Speaker 1: for many purposes pretty secure. Now keep in mind you
Speaker 1: still have to uh practice good internet security on your own,
Speaker 1: even if you're using tour. UH And like I said, well,
Speaker 1: maybe we'll do a full episode on that. If you're
Speaker 1: interested in that, let's no because you know maybe that
Speaker 1: our listeners are thinking, wow, they did a heart bleed
Speaker 1: episode in a tour episode. Go back to talking about
Speaker 1: Nintendo and that wraps up this classic episode from hope
Speaker 1: you enjoyed it. If you have any topics that you
Speaker 1: think I should tackle for future episodes of tech Stuff,
Speaker 1: or maybe there's one that you've listened to and you
Speaker 1: think that really needs an update it's seriously overdue. Let
Speaker 1: me know the best way to do that is over
Speaker 1: on Twitter. The handle I use is tech stuff hs
Speaker 1: W and I'll talk to you again really soon. Tech
Speaker 1: Stuff is an I Heart Radio production. For more podcasts
Speaker 1: from I Heart Radio, visit the i Heart Radio app,
Speaker 1: Apple Podcasts, or wherever you listen to your favorite shows.