Speaker 1: Get in touch with technology with text stuff from how
Speaker 1: stuff dot com either and welcome to text stuff. I'm
Speaker 1: Jonathan Strickland and I'm Lauren Bock Obama, and I'm in
Speaker 1: the dark. That the dark, the dark dark net, dark
Speaker 1: dark Web. I don't think we're actually in the dark snet. No,
Speaker 1: Actually we're pretty much on the light. But we're gonna
Speaker 1: talk a little bit about the dark net. Really, what
Speaker 1: we're going to talk about is Tour, right, that was
Speaker 1: originally an act from him for the Onion Router. Yeah,
Speaker 1: now it's just Tour. They still have an onion that
Speaker 1: is in their logo. It takes the place of the
Speaker 1: O in Tour t o R. And that's not just
Speaker 1: because they really like onions. There's a reason that we
Speaker 1: will get into. Yeah, but so, but so, what is this?
Speaker 1: So all the Mighty Tour is one of the Avengers.
Speaker 1: He wields the hammer Jolner, and his brother is Loki.
Speaker 1: She's not even rolling her eyes, she's just staring me
Speaker 1: down this time. Okay. So seriously, though, what Tour is
Speaker 1: free software. It's an open network and it helps you
Speaker 1: defend against traffic analysis. In other words, people trying to
Speaker 1: figure out what you are doing and who you're communicating with.
Speaker 1: Traffic analysis is a form of network surveillance that threatens
Speaker 1: personal freedom and privacy. UH, it threatens confidential business activities
Speaker 1: and relationships, and it threatens state security. Therefore, some folks
Speaker 1: got together and said, hey, you know what we should
Speaker 1: do is we should come up with the means to
Speaker 1: allow people to communicate over the Internet, but do so
Speaker 1: in a private, anonymous fashion, so that you can set
Speaker 1: up these anonymous channels. Perhaps the most popular way to
Speaker 1: access this is through a customized built a Firefox called
Speaker 1: the the Tour Browser Bundle. Right, yeah, because just using
Speaker 1: Tour on its own is one thing to do to
Speaker 1: to allow you to have a little more of an
Speaker 1: anonymous presence, But it requires more than that, because if
Speaker 1: you access Tour through some other means, if you don't
Speaker 1: have say Flash disabled in your web browser, then you're
Speaker 1: still kind of broadcasting where you are because Flash often
Speaker 1: involves UH identification information in order for it to work.
Speaker 1: So it is open source, so if you feel like
Speaker 1: getting in there and and doing your own thing, you're
Speaker 1: absolutely able to um and uh and and a lot
Speaker 1: of people do use it in one form or another.
Speaker 1: At its peak in more than half a million people
Speaker 1: were using it every day. Yeah, oddly enough, I think
Speaker 1: as I a call in that year, there was some
Speaker 1: news that broke about government agencies. Yeah, Edward Snowden had
Speaker 1: that leak about the n s A, and suddenly people
Speaker 1: were thinking, you know, I was like it doubled. Yeah. Yeah,
Speaker 1: it was one of those things where people began to
Speaker 1: get very concerned. And it's not necessarily that these people
Speaker 1: are doing anything wrong. In fact, that's not the point
Speaker 1: at all. The point is that they have an expectation
Speaker 1: to privacy and being able to hold this kind of
Speaker 1: anonymous communication with other people. The communication itself isn't necessarily anonymous,
Speaker 1: but the channels are. Uh, you know, that's just that's
Speaker 1: just an expectation we have. It's not that, you know,
Speaker 1: I'm planning something to various, it's just if I want
Speaker 1: to send a message to Lauren and it's just for
Speaker 1: Lauren's eyes, I don't think anyone else has the right
Speaker 1: to look in on that. So yeah, and in normal
Speaker 1: internet traffic, that's absolutely a possibility. Yes. Because we've talked
Speaker 1: a lot about how information travels across the internet, you know,
Speaker 1: it all gets divided up into these little packets. Then
Speaker 1: the packets go across the network and then get put
Speaker 1: together Willy Wonka style on the other side, so that
Speaker 1: you get whatever it is you were trying to send,
Speaker 1: which is unfortunately probably not a delicious chocolate bar no
Speaker 1: or Mike TV either, it's not neither of those things.
Speaker 1: What it might be like if I if I were
Speaker 1: to send that email to Lauren and it's a sizeable email,
Speaker 1: that email gets divided up into numerous packets. The packets
Speaker 1: go across the Internet, not necessarily taking the same path,
Speaker 1: and they eventually reassemble on the other side and Lauren
Speaker 1: can read it. But in order for that to happen,
Speaker 1: these packets have to have little bits of information so
Speaker 1: the routers know where to send the information onto next.
Speaker 1: So it's kind of like an address on a piece
Speaker 1: of mail. So let's say that you've got a snoop
Speaker 1: in your neighborhood and this person is getting into everybody's business.
Speaker 1: And the way this person does it is they look
Speaker 1: at all the mail that's going in and out of
Speaker 1: a person's mailbox, and even if they're not opening that
Speaker 1: mail and and reading all of it, just just the
Speaker 1: fact that you're sending it to particular people at particular
Speaker 1: times can tell that snoop a lot about what's going on. Right,
Speaker 1: So if you're sending out uh, you know, envelopes to
Speaker 1: say a medical facility, that could give a lot of
Speaker 1: information to a snoop if they're seeing that stuff from
Speaker 1: various insurance companies is coming into you, that could you know,
Speaker 1: I'm going with a medical thing here. But really this
Speaker 1: applies to any sort of communication. So so what we're
Speaker 1: saying is that it's not enough for the content of
Speaker 1: what you send over the internet, uh necessarily, I mean
Speaker 1: you are hypothetical, you maybe you're fine. It's not enough
Speaker 1: for you to encrypt the content, but the actual transfer
Speaker 1: of the content in some cases needs to be encrypted exactly.
Speaker 1: And there are a lot of legitimate cases where you
Speaker 1: would want that to happen. I mean, let's talk about
Speaker 1: journalists for example. So you might have a journalist who
Speaker 1: is pursuing some major story, perhaps they're in unfriendly territory
Speaker 1: to do so, and they want to be able to
Speaker 1: contact sources that might be in danger otherwise if there
Speaker 1: if if this communication were publicly known, or really anything
Speaker 1: that could endanger the journalist, a source or the story itself,
Speaker 1: then you would want to have a way of securely
Speaker 1: communicating and making sure that no one's really snooping in
Speaker 1: on you. Well, that's that's a perfectly legitimate source. Their
Speaker 1: governments use this kind of thing in order so that
Speaker 1: they can gather information and disseminate information. Uh, you've got
Speaker 1: companies that use this kind of stuff in order to
Speaker 1: have secure communications about upcoming products or services that are
Speaker 1: not part of the public knowledge and don't need to
Speaker 1: be Oh sure, I mean even if you're just doing
Speaker 1: r and D about something, you know, like like let's
Speaker 1: say that you're the example that you used and in
Speaker 1: our notes here is Apple. Like if here, if you're
Speaker 1: creating a new product and you start researching patents online, um,
Speaker 1: the right person could could find your searches and figure
Speaker 1: out what you were looking for. And that sucks for you. Yeah, yeah,
Speaker 1: if you had the next big idea and you were waiting,
Speaker 1: because you know, like the company of Apple, they get
Speaker 1: a lot of you a boost from folks whenever they
Speaker 1: announced something brand new that surprises everyone, which of course
Speaker 1: is exactly why you have so many news agencies scrutinizing
Speaker 1: everything Apple does in order to try and guess what's
Speaker 1: coming next. So the more you're able to keep that secret,
Speaker 1: the bigger the impact is when you unveil it. Because
Speaker 1: the worst the worst feeling is when you tune into
Speaker 1: an Apple event and it ends up being exactly what
Speaker 1: you expected it was to be. Every everyone still tunes in,
Speaker 1: but then they're like, oh, but that's exactly what they
Speaker 1: were talking about last week. I know, and you read
Speaker 1: what they wrote last week, so stop it me. Sure,
Speaker 1: and and lots of other people who could generally be
Speaker 1: considered to be working for for non nefarious purposes, but
Speaker 1: nonetheless would like a little bit of secrecy, uh, for example,
Speaker 1: activists or whistleblowers um or you know Chinese citizens who
Speaker 1: really just want to use Facebook or read news from
Speaker 1: other countries. Sure, and we've seen plenty of examples also,
Speaker 1: things like the Arabs Spring. You know, places in the
Speaker 1: world where you have people who are trying to enact
Speaker 1: change in a very harsh environment where if their activities
Speaker 1: were picked up on by official sources, government sources, state
Speaker 1: sponsored sources, they could face some serious consequences. And it's
Speaker 1: not necessarily the again, like you said, that they're doing
Speaker 1: anything nefarious it's just they can't do it at all
Speaker 1: without fear of some form of consequence unless that can
Speaker 1: remain secure. So you've got to figure out how do
Speaker 1: we make this secure. Also, we have to figure out
Speaker 1: how do we frame this in such a way where
Speaker 1: we also admit some people do use it for nefarious purposes. Oh, sure,
Speaker 1: of course. I mean there are plenty of people out
Speaker 1: there who are going to use this kind of anonymous
Speaker 1: connection in order to conduct illegal or otherwise illicit activities.
Speaker 1: We've talked about some of them in previous episodes, in fact,
Speaker 1: and we'll mention some more as we go along. So again,
Speaker 1: it's one of those things where you would probably argue
Speaker 1: that it's a relatively small percentage of the population using
Speaker 1: it for these purposes, but they're the ones who get
Speaker 1: the most press, uh, and so therefore or it kind
Speaker 1: of creates this public perception that people who use tour
Speaker 1: are up to something. Also, you know, we mentioned the
Speaker 1: fact that in a normal Internet communication, the you know what,
Speaker 1: what amounts to the uh, the address on the label
Speaker 1: is perfectly visible because it needs to be so that
Speaker 1: it can route across gets to the place it's gone.
Speaker 1: And Tour they had to figure out a way around
Speaker 1: that so that you could have it be obuse skated
Speaker 1: so that if someone were to snoop in on communication,
Speaker 1: they would not be able to determine what the origin
Speaker 1: nor destination were. And that it is pretty amazing stuff
Speaker 1: because you've got you gotta figure out a way of
Speaker 1: implementing that where it can still work, Like how do
Speaker 1: you disguise the address and still hope that it gets
Speaker 1: to where it's going? Because if we did that to
Speaker 1: the to the US Postal Service, our stuff would never
Speaker 1: get anywhere and it wouldn't be their fault either, because
Speaker 1: you just wouldn't be following the rules. Oh sure, yeah,
Speaker 1: I if you don't write your address on something, then
Speaker 1: how does it get to that place? So here's another
Speaker 1: funny thing, Lauren, Um, who was it that came up
Speaker 1: with this whole tour idea? I mean it must have
Speaker 1: been like some like hackers you know at def con
Speaker 1: convention who all got together and said, we don't want
Speaker 1: the government looking in on our stuff, right, you know?
Speaker 1: It was the government? It was it was it was
Speaker 1: the U. S. Naval Research Laboratory UM back in back
Speaker 1: in actually, which makes it extra hilarious that that the
Speaker 1: n s A has kind of been trying to crack
Speaker 1: trying to crack it because you've got a government agency
Speaker 1: doing its best to figure out how to intercept information
Speaker 1: that goes across a tour network, and another government US
Speaker 1: government entity that's responsible in large part for the creation
Speaker 1: for creation and furthermore, other governmental agencies that are responsible
Speaker 1: for funding it. As of twelve, one point two four
Speaker 1: million dollars half of tours revenue UH came from government grants,
Speaker 1: including a large part from the Department of Defense. So
Speaker 1: this is an example of two different parts of the
Speaker 1: United States government working at odds against each other, one
Speaker 1: part saying this is absolutely necessary for us to be
Speaker 1: able to operate in a secure way, and the other
Speaker 1: part saying, we want to be able to see what's
Speaker 1: going on here. So so so yeah. But but but this
Speaker 1: all got its start back with the U. S. Navy
Speaker 1: and UM. It was part of an onion rooting project
Speaker 1: routing project rooting. If you're in England, it's routing. Here
Speaker 1: in the US, it's usually routing either way. Why would
Speaker 1: you even call it an onion It's because it relies
Speaker 1: upon quote a layered object to direct the construction of
Speaker 1: an anonymous, bidirectional, real time virtual circuit between two communicating
Speaker 1: parties and initiator and responder. And that's as clear as day. Yeah,
Speaker 1: we can just end up podcast now. Guys, don't worry.
Speaker 1: We're going to explain the whole layered thing a little
Speaker 1: bit later on. So we will. We will make sure
Speaker 1: that you understand why an onion it's actually a pretty
Speaker 1: clever way to describe what's going on. But the project
Speaker 1: had specific goals to research and develop and build anonymous
Speaker 1: communication systems, to analyze other anonymous communications systems, and to
Speaker 1: create low latency Internet based systems that resisted traffic analysis, eavesdropping,
Speaker 1: and other attacks from outsiders as an Internet routers or
Speaker 1: insiders as an Onion routing servers. So if the best
Speaker 1: uh the ideal was to create some form of distributed
Speaker 1: system where you could have two parties communicating with one
Speaker 1: another and no one would be able to know that
Speaker 1: those two parties were in communication. They would know the
Speaker 1: communication is going on because traffic is moving across the network,
Speaker 1: but because of the network's design, they would have no
Speaker 1: way of knowing what to end parties were actually communicating
Speaker 1: with one another. Because just as we were saying with
Speaker 1: that snoop. Even if you can't see what the information
Speaker 1: itself is, just knowing who is talking to whom gives
Speaker 1: you a lot of info. Right. Because of this, And
Speaker 1: funnily enough, the Navy actually had to step back from
Speaker 1: the project in order to make it actually useful because
Speaker 1: the network needs to be open, right. Um. So, I mean,
Speaker 1: if if you know, if you can see that everything
Speaker 1: is coming through, if on if only the Navy used it,
Speaker 1: then you would know whenever communication was happening that the
Speaker 1: Navy was communicating with people like you would you would
Speaker 1: have limited the number of people that could possibly be
Speaker 1: the ones communicating by making it open and say this
Speaker 1: is a playground where everyone can come in. Suddenly you
Speaker 1: can't tell who's communicating with whom because there's so many's
Speaker 1: too much noise and not in the traffic, right. Um. So,
Speaker 1: the project incorporated as a nonprofit in two thousand six,
Speaker 1: and it currently depends a whole lot on crowdsourcing. Um.
Speaker 1: There are only nine full time to our employees as
Speaker 1: of this podcast, which we are recording on April, by
Speaker 1: the way, um and uh, the rest of the development
Speaker 1: is spread across dozens of part time assistants and hundreds
Speaker 1: of volunteers. The code is open source, which actually makes
Speaker 1: it harder to mess with. Um. You know, like if someone, say,
Speaker 1: say the n s A, tried to create a vulnerability deliberately,
Speaker 1: then anyone could catch it, right. Yeah, it's not like
Speaker 1: it's hidden the way behind closed doors. In that way,
Speaker 1: it gets overlooked and you suddenly have this back door
Speaker 1: entrance into the Tour Network. No, it's it's it's much
Speaker 1: more likely for someone to catch it if lots of
Speaker 1: people are looking. Yeah exactly. Yeah, you've got lots of
Speaker 1: people checking on it all the time. So it's actually
Speaker 1: more secure by being in plain sight in that way.
Speaker 1: So here's how it used to work. Because you know,
Speaker 1: I mentioned that tour was had an onion in the oh,
Speaker 1: but it doesn't really involve onions anymore. And then we've
Speaker 1: mentioned onions. Yeah, so yeah, so we're we're gonna we're
Speaker 1: gonna go back to how it worked originally because the
Speaker 1: way it works now is not that much different, but
Speaker 1: it doesn't involve the onion metaphor anymore. So, first of all,
Speaker 1: to achieve anonymity, the Tour Network uses something called privoxy filters,
Speaker 1: which prevent client information from reaching servers. So this means
Speaker 1: that a client, you know, that's that's your computer when
Speaker 1: you are trying to access anything. Let's say you're using
Speaker 1: your your browser to access your email, because I love
Speaker 1: that example. It's easy one. So your your computer is
Speaker 1: the client. It's sending a request to another computer. It's
Speaker 1: asking for data from this computer that hosts the the
Speaker 1: email service that you use, and that is called the server. Now,
Speaker 1: normally the server receives information that can identify the client,
Speaker 1: so you have some sort of address that identifies this
Speaker 1: is the machine that's asking for that information, So then
Speaker 1: the server knows exactly who it's talking to. Well, privoxy
Speaker 1: filters prevent that from happening, so it's possible for a
Speaker 1: client's identity to remain unknown to the server and also
Speaker 1: to the rest of the network as these requests go
Speaker 1: across the network. Also, one of the other things that
Speaker 1: has and we'll talk more about this in a bit,
Speaker 1: is the ability to create hidden services. But you know,
Speaker 1: I'm not going to spoil that because the discussion we
Speaker 1: have later on will really kind of bring that to
Speaker 1: light and it will make much more sense after we
Speaker 1: talk about exactly how this communication occurs. Yes, so it's
Speaker 1: possible to use onion routing software to send information completely anonymously.
Speaker 1: In other words, you could use it so that you
Speaker 1: could send an anonymous message to someone else. They would
Speaker 1: not know the identity of that person. But that's not
Speaker 1: the purpose of tour. The purpose, like I said before,
Speaker 1: is to allow anonymous channels of communication. So you and
Speaker 1: the person with whom you're communicating know each other's identity,
Speaker 1: but nobody else does, right, So this allows you to
Speaker 1: have that honest, open expression of information without fear of
Speaker 1: someone else snooping in on you or any other consequences
Speaker 1: apart from whatever consequences come from just that communication between
Speaker 1: two parties. If you tell someone that they dressed like
Speaker 1: a slab, there's going to be consequence, is what I'm saying.
Speaker 1: It doesn't have to be someone snooping in on you.
Speaker 1: Good point. I get that a lot. Uh. So it
Speaker 1: uses proxy servers, and a proxy server acts as an
Speaker 1: intermediary between a client and some other server. So you
Speaker 1: can kind of think of it as this is the
Speaker 1: go between. So if I were to send a request
Speaker 1: to get my email, but I wanted to go through
Speaker 1: a proxy server, I would log into the proxy server.
Speaker 1: The proxy server would then send my request onto the
Speaker 1: email server, and from the email servers perspective, it looked
Speaker 1: like the proxy server was the origin of that request.
Speaker 1: It isn't able to see back to exactly there's a
Speaker 1: hop missing there. So that's really important in this. And uh,
Speaker 1: the communication part is the tricky part. Like I said,
Speaker 1: so you've got this information, it's passing between nodes or
Speaker 1: little orders within the tour network. Okay, so think of
Speaker 1: these nodes as rest stops between the client, the sender,
Speaker 1: and the recipient the server. Right, Each node only knows
Speaker 1: the identity of the node before it and the note
Speaker 1: after it, right, So uh, and the note before it
Speaker 1: and after it completely is dependent upon when you're sending
Speaker 1: the message, because you're you're going to create new pathways
Speaker 1: every time you create a connection, so it's not like
Speaker 1: you have a set path each time. It's like the Internet.
Speaker 1: It's very flexible. So when you send a message, and
Speaker 1: let's say it's going through letters A through G, we're
Speaker 1: just designating these nodes as A through G and for
Speaker 1: some reason it's going into a B C, D, E
Speaker 1: F G order. So node D only knows about nodes
Speaker 1: C and E. The information came from C. It knows
Speaker 1: it has to send the information onto E. It has
Speaker 1: no awareness of a B or you know, effor G.
Speaker 1: So that's it. And that means that if you were
Speaker 1: to intercept information passing between two nodes, you would just
Speaker 1: know which note it came from and which node it
Speaker 1: went to. You wouldn't know the actual person who sent it,
Speaker 1: nor would you know the person to whom it went. Ultimately,
Speaker 1: on top of that, the nodes encrypt the communication as
Speaker 1: it's passed along. Yes, and this is where you get
Speaker 1: that layer and layer and layer of encryption. And because
Speaker 1: there's so many layers of encryption, well, what else has
Speaker 1: lots of layers? And Onion I was gonna think of
Speaker 1: Game of Thrones, but yes, Onion is right. Onion is
Speaker 1: exactly the thing that they went with because Game of
Speaker 1: Thrones really wasn't that popular. Also, it's proprietary. I mean,
Speaker 1: you know, yeah, that probably would have George R. Martin
Speaker 1: gotten a little upset about that. But yeah, so so
Speaker 1: Onion is in fact what they went with because there's
Speaker 1: so many different layers of encryption. Now I've I know
Speaker 1: that this discussion we've just had is really dense and
Speaker 1: there's a lot of things about nodes and traffic and
Speaker 1: encryption and layers here. So I created an example to
Speaker 1: kind of illustrate this. And we're going to get to
Speaker 1: that in just a moment, but before we do, let's
Speaker 1: take a quick break to thank our sponsor. Okay, So
Speaker 1: here's my example, and I think it's a doozy of
Speaker 1: an example because it's completely believable. I decided to use
Speaker 1: as an example two of our beloved co workers here
Speaker 1: at how stuff works. Uh, and when you start thinking
Speaker 1: to yourself, who would be so paranoid that they would
Speaker 1: need an incredibly secure communication process? Two names leap to
Speaker 1: mind from the shadows and then back into the shadows,
Speaker 1: because that's where they belong. One of them wearing a
Speaker 1: gremlin mask ye, and maybe a fedora on top of it.
Speaker 1: It's not a fedora, I know, Ben Dora. No, it's
Speaker 1: a trill Bey, I'm going to call it a fedor anyway,
Speaker 1: So Ben Bolan and Matt Frederick so Stuff they don't
Speaker 1: want you to know hosts. Yes, and if you've never
Speaker 1: ever listened to that show, go check it out. Watched show. Yeah,
Speaker 1: that's great. So So let's say that Ben wants to
Speaker 1: contact Matt and he wants the communication to be secure,
Speaker 1: so he sends it across the Tour network using this
Speaker 1: freely available software. He's got the Tour bundle installed, and
Speaker 1: he sends the message along. So here's what happens. Ben
Speaker 1: would contact a proxy server on the Tour network. Now,
Speaker 1: that proxy server would then determine the route of nodes
Speaker 1: or the number of hops that it will take to
Speaker 1: get from the proxy server to Matt's computer. So for
Speaker 1: argument's sake, let's say again that it's just uh five nodes,
Speaker 1: So it's a B, C, D E. Those are the
Speaker 1: Those are the nodes that it's going to go through. Now,
Speaker 1: each hop becomes an encryption layer on this onion, and
Speaker 1: the core of the onion is Ben's original message to Matt,
Speaker 1: so that's the very center. Now Ben's proxy server starts
Speaker 1: to construct layers of encryption based upon the path that
Speaker 1: this onion is going to take journeying from the proxy
Speaker 1: server all the way to Matt's computer, and the intermost
Speaker 1: layer will be the encryption for mats proxy. Yes, so
Speaker 1: the next layer out would be the node just before
Speaker 1: it gets to Matt's proxy. The next layer out would
Speaker 1: be the node before that, and so on and so
Speaker 1: forth until you got to the first node that the
Speaker 1: proxy server sends this onion onto. Now, every time the
Speaker 1: onion travels to a new node, it decrypts that layer,
Speaker 1: the corresponding layer of encryption. Yeah, so that that layer
Speaker 1: of the onion gets pulled away, and that's how the
Speaker 1: node knows where to send it onto next. So proxy
Speaker 1: service sends it on to node A. Note A strips
Speaker 1: away that encryption and sees that needs to send it
Speaker 1: on to node B. Node B gets this onion. Now
Speaker 1: Node B only knows that Node A sent the onion,
Speaker 1: doesn't know where the onion originally came from, and it
Speaker 1: decrypts that next layer, strips it free, uh, finds the
Speaker 1: identification of notes C and send it along. Yep, Node
Speaker 1: C doesn't know about Note A, just Notes knows about
Speaker 1: Node B, So so on and so forth till it
Speaker 1: gets to Matt. By the time it gets to Matt,
Speaker 1: all those layers of encryption have been stripped away and
Speaker 1: that can actually read what the messages. Therefore, anyone who's
Speaker 1: trying to analyze all of this traffic would would just
Speaker 1: see a message passing between two seemingly random routers with
Speaker 1: with no way of knowing either where that information came
Speaker 1: from or what the ultimate destination is. Yep, And because
Speaker 1: you've encrypted it so many times, they probably can't even
Speaker 1: tell what the information. They can't read it, they don't
Speaker 1: know where it's going there in the dark. So to them,
Speaker 1: it's just all they know is that traffic is going
Speaker 1: across this network, but they don't have any way of
Speaker 1: deriving meaning from that. Now, once Matt's proxy receives that onion,
Speaker 1: a virtual circuit forms along the nodes. Think of it
Speaker 1: as like a temporary pathway that solidifies between uh Ben's
Speaker 1: proxy and Matt's final computer, and it allows for encryption
Speaker 1: to pass both ways. So you have two different kinds
Speaker 1: of encryption. You've got one kind whenever Ben sends a
Speaker 1: message to Matt, and essentially you have the inverse of
Speaker 1: that when Matt sends it to Ben. So unless you
Speaker 1: have the key to that in encryption, you can't figure
Speaker 1: out what's going on either. So it's it's pretty secure. Now,
Speaker 1: there are some mainly we're talking about vulnerabilities when you
Speaker 1: send it from your computer to that proxy server and
Speaker 1: when that last proxy sends it to the destination. Because
Speaker 1: this is when you don't have the protection of the
Speaker 1: network itself. It's when it's you can think of it
Speaker 1: as the information is leaving the network to get to
Speaker 1: wherever it's going, or entering the net. Yeah, and again,
Speaker 1: if you're using a browser that still has certain things
Speaker 1: enabled like Flash or Java, then you may end up
Speaker 1: having sending along some information that people could identify you
Speaker 1: on based on that. But within the network itself, it's
Speaker 1: incredibly secure, right And and so this, the circuit that
Speaker 1: that you've created, well will last as long as both
Speaker 1: parties want it to. You can you can send a
Speaker 1: command to collapse it at the end of your session,
Speaker 1: you say destroy, and it collapses. This uh, this virtual circuit.
Speaker 1: And then if you going to create a new one,
Speaker 1: you could and it would be a new virtual circuit,
Speaker 1: probably taking a totally different pathway through the nodes. And
Speaker 1: you know, I made the example of ABC D E
Speaker 1: that kind of stuff, but really, you know, it could
Speaker 1: be any order. You know, it's it's and it will
Speaker 1: be an order. That's all. That's one of the who
Speaker 1: points because if it were the same pathway each time,
Speaker 1: then you would ultimately be able to determine who sent
Speaker 1: it and who it went to. So it has to
Speaker 1: be uh, you know. And of course the more the
Speaker 1: more routers you have available, the more of these relay
Speaker 1: nodes you have, the more secure the communication becomes, so
Speaker 1: that's also really important. Then there's also a concept called
Speaker 1: loose routing, which adds another layer of security on this
Speaker 1: because like I said, you know, you ultimately you have
Speaker 1: these proxies that no way more information than all the
Speaker 1: nodes do. They have to in order to be able
Speaker 1: to make that layer of encryption and have this onion
Speaker 1: pass from one spot to the next. So one thing
Speaker 1: you could do with loose routing is that the proxy
Speaker 1: and up sending the onion on to the first node.
Speaker 1: But that's all the proxy knows about the probably and
Speaker 1: then the first nodes responsibility is to create the rest
Speaker 1: of that pathway. So even that first stop isn't aware
Speaker 1: of where, how, what path it's gonna take to get
Speaker 1: to its destination. It just knows this is the first
Speaker 1: step of that path, but beyond that I don't know,
Speaker 1: So it adds another layer of security to it that way. Now, again,
Speaker 1: if you were able to target that first node, you
Speaker 1: might be able to figure some stuff out, but really
Speaker 1: you just know that it came from a proxy. You
Speaker 1: wouldn't know who sent the information to the proxy in
Speaker 1: the first place. But yeah, so we've got these these
Speaker 1: endpoints that have some vulnerabilities, but other than that, it's
Speaker 1: it's pretty secure. Uh, I've got to We've got a
Speaker 1: great little bit about how secure it is, and a
Speaker 1: little in just a little while. But today nodes or
Speaker 1: relays within the system still don't know the origin or
Speaker 1: ultimate destination of information. And you still create virtual circuits
Speaker 1: between the initiator and the recipient for encrypted anonymous channels.
Speaker 1: But there's no our use of this onion metaphor. I mean,
Speaker 1: it's not it's not the same implementation. You get the
Speaker 1: same result, but it's a different implementation that does it.
Speaker 1: But it's this, you know, it's following a lot of
Speaker 1: the same philosophies. And you've got a tour directory that
Speaker 1: keeps track of all the available nodes that are on
Speaker 1: the system at any given moment. As of January, there
Speaker 1: are about five thousand computers around the world operated by
Speaker 1: those volunteers that I mentioned serving as potential nodes in
Speaker 1: this system. Right, And when you send a message to
Speaker 1: recipient across the Tour network, your Tour browser or whatever
Speaker 1: consults this directory, which then uh gives it a route
Speaker 1: of nodes, and then you can send the encrypted information
Speaker 1: across and each node further encrypts the message again and
Speaker 1: only knows the note immediately before and after, kind of
Speaker 1: like the previous version we just talked about. So it's
Speaker 1: not that different, it's just this whole layer metaphor is
Speaker 1: kind of no longer as accurate. But um, yeah, one
Speaker 1: thing you've got to remember is that because as you've
Speaker 1: got this extra layer of encryption going on, and it's
Speaker 1: purposefully obvious, skating the the origin by hopping around a lot,
Speaker 1: communication is not as quick, right, It's going to take
Speaker 1: a longer necessarily. So if you're using Tour in order
Speaker 1: to send instant messages, your definition of instant maybe a
Speaker 1: little different than what it normally would be. It may
Speaker 1: just be pretty darn quick, but not as instant as
Speaker 1: this other method. Yeah. Um. Furthermore, it is not the
Speaker 1: most secure thing that you can do. No. I actually
Speaker 1: read a great article on the best way of using
Speaker 1: Tour as as part of an approach to securely using
Speaker 1: the Internet and maintaining your anonymity, and I thought about
Speaker 1: including it in this podcast. I really did, Guys. I
Speaker 1: was gonna go all into the tips this guy had,
Speaker 1: and then I realized that it was so in depth
Speaker 1: and there was so much to keep tak into consideration
Speaker 1: that really we could just do a full podcast just
Speaker 1: on that, and perhaps in the future we will. If you,
Speaker 1: guys in particular, want to know so I want to
Speaker 1: be as anonymous and secure as possible, Tell me what
Speaker 1: I need to do, and we'll we'll give you the podcast.
Speaker 1: We should we should do that episode. Um I'll tell
Speaker 1: you right now. It's crazy, but but right because because
Speaker 1: even if you're using the most recent version of tour
Speaker 1: I mean, which, as we have just detailed, is an
Speaker 1: incredibly uh complex and encrypted process, a determined party could
Speaker 1: exploit vulnerabilities and Firefox itself, which which Tour is based in.
Speaker 1: Um it could attempt to set up monitoring nodes in
Speaker 1: the network. UM or it could just methodically work on
Speaker 1: key decryption in order to spy on your activities, so
Speaker 1: uh stuff can still happen. Yeah, we'll think about doing
Speaker 1: a full security episode. I mean, I kind of think
Speaker 1: we'll have to pull Ben in for that one. Oh,
Speaker 1: that would be great. We should totally do more classovers.
Speaker 1: We'll we'll see if we can get Ben to be
Speaker 1: available for an episode where we really talk about and
Speaker 1: you know it's going to sound paranoid and crazy, but
Speaker 1: the thing is technology, in order for it to work,
Speaker 1: UH needs to have certain in nation so it can
Speaker 1: allow you to have this communication. But because it needs
Speaker 1: that certain information, it means that your anonymity is at risk.
Speaker 1: So you've got to do these kind of crazy things. Also,
Speaker 1: they're wacky bugs like heart bleed. Yeah actually, um okay,
Speaker 1: go ahead and mention this so heart bleed. If you
Speaker 1: listen to our previous episode, we talked all about this
Speaker 1: vulnerability that was an open SSL versions one point zero
Speaker 1: point one through one point zero point one F and
Speaker 1: UH and how that ended up meaning that people who
Speaker 1: use the heartbeat method could get access to encryption keys
Speaker 1: and thus see everything that's going across the server. So
Speaker 1: you might wonder does this work on the tour network,
Speaker 1: this crazy relay node network, And the short answer is,
Speaker 1: technically it works, but it doesn't help anybody out because
Speaker 1: even if you were to see the information moving across
Speaker 1: a node, it still has multiple layers of encryption, so
Speaker 1: it's not as vulnerable. Yeah, although I mean toward towards
Speaker 1: being tour did say that, you know, if you if
Speaker 1: you really want to be secure, you might just want
Speaker 1: to stay off the internet for a few days, right,
Speaker 1: And they did say that they had planned on rolling
Speaker 1: out patches of the open SSL uh software because the upgrade,
Speaker 1: the newest patch does patch that vulnerability. So uh, they
Speaker 1: are going to be fixing up those nodes over time anyway.
Speaker 1: In fact, by the time this podcast comes out, most
Speaker 1: of them may already be addressed. But yeah, they said that, Um,
Speaker 1: that worst case scenario, you're probably still pretty okay. You know,
Speaker 1: in the grand scheme of things, that heart bleed story
Speaker 1: was a real eye opener. YEA. Then we have the
Speaker 1: other thing we alluded to earlier, oh right, hidden services,
Speaker 1: and that's where that dark net or deep web kind
Speaker 1: of thing comes in. Um okay. So, so tour also
Speaker 1: provides a way to to offer up access to a
Speaker 1: server or to run an entire service without revealing your
Speaker 1: IP addressed to your users and from behind a firewall. Um.
Speaker 1: Sites and services set up like this are are off
Speaker 1: the beaten Internet path. You can't even find them using
Speaker 1: Google or other web searches. You have to be using
Speaker 1: Tour in order to find them. And um, they're they're
Speaker 1: all using what's called the dot Onion extension because onions. Um. Okay. So,
Speaker 1: so basically how this works. The hidden service has a
Speaker 1: public to tour listing, and so when a client wants
Speaker 1: to access that service, the client sets up a rendezvous
Speaker 1: node and sends along an access request via the usual
Speaker 1: Tour encryption routing process UM through a random introduction node
Speaker 1: that the service has set up UM, and then the
Speaker 1: client and service can contact each other through that rendezvous
Speaker 1: node again using the usual Tour circuits. UM. It's it's
Speaker 1: like the the introduction and the rendezvous nodes are translators, right.
Speaker 1: It protects the service and the client because neither knows
Speaker 1: where the other is. That the translators are the recipients
Speaker 1: for each party's communications. And so this this deep web
Speaker 1: or dark net hosts lots of different stuff, some things
Speaker 1: that are definitely in the nefarious category, like the Silk Road,
Speaker 1: although Silk Road still has some legit. Sure of the
Speaker 1: stuff that was on Silk Road was completely legal, the
Speaker 1: other not so much. Yeah, So Silk Road, of course
Speaker 1: that got shut down, but it existed on tour and
Speaker 1: this kind of hidden web because you know, you wouldn't
Speaker 1: want it to be easily accessible, uh, and then everything
Speaker 1: would come crashing down, you know, ultimately came crashing down anyway,
Speaker 1: but it was hidden better than just sitting there and
Speaker 1: on the web. So yeah, that's that's definitely one of
Speaker 1: the other issues. And again there are other things that
Speaker 1: are on this deep net, this this dark net or
Speaker 1: rather or deep web that again not nefarious at all.
Speaker 1: They have very legitimate purposes for existing. It's completely legal,
Speaker 1: but it's also designed in such a way as to
Speaker 1: protect the identity of the people who need to use
Speaker 1: the services. So again, just because we have some really
Speaker 1: high profile examples of naughtiness doesn't mean that the entire
Speaker 1: network is naughty. Just like there are other services that
Speaker 1: people have used where some people are using it in
Speaker 1: order to get like illegal downloads of whatever content they want,
Speaker 1: but most people aren't. A lot of the focuses on
Speaker 1: the people who are the pirates, and thus the entire
Speaker 1: service gets painted as yeah, yeah, it's I I read
Speaker 1: a really great quote and I don't have it open
Speaker 1: right now, and um. Bloomberg Business Week did a really
Speaker 1: great article in January about about tour in general and
Speaker 1: the kids who are running it and all that kind
Speaker 1: of stuff, and uh, the the example that I think
Speaker 1: they used was that, you know, you don't hear about
Speaker 1: someone who's stalker couldn't find them. You you hear about
Speaker 1: the kid who got drugs or the child porn rang
Speaker 1: or something right, right, So you know there are some
Speaker 1: very very The Navy wouldn't have been interested in making this, uh,
Speaker 1: in order just to have crime happened, because as low
Speaker 1: as your opinion of the Navy, maybe depending on if
Speaker 1: you're a Marine or not, it's it's really not in
Speaker 1: that business. No, but but certainly the fact that this
Speaker 1: kind of illegal activity can go on means that it
Speaker 1: attracts attention from, for example, the n s A. Yes, Uh,
Speaker 1: I love the stories about the n s A and
Speaker 1: tour because they're both infuriating and funny at the same time.
Speaker 1: So infuriating in that, uh, the n s A has attempted.
Speaker 1: We know the n s A has attempted to try
Speaker 1: and crack because some of those slides that have come
Speaker 1: out from Standon's League A specifically mentioned tour yep, and uh,
Speaker 1: one of the documents within the n s A is
Speaker 1: titled Tour Stinks. And the reason they say Tour stinks
Speaker 1: is because it's so gosh darn hard to figure out
Speaker 1: what formation is within the Tour network. Now, they do
Speaker 1: note that if you are able to target those points
Speaker 1: where information is coming into the network are coming out
Speaker 1: of the network, then you are more likely to be
Speaker 1: able to determine what is going on and who is
Speaker 1: talking to whom. But if it's within the network itself,
Speaker 1: there's no report that has leaked so far that has
Speaker 1: indicated the NSA has been able to crack that, which
Speaker 1: has not stopped a whole lot of theorists from saying
Speaker 1: that they have totally cracked it, and that the reports
Speaker 1: saying that they haven't cracked it are just so that
Speaker 1: people feel, yeah, that they people will feel a false
Speaker 1: sense of security using tour. Here's the thing about conspiracy theories,
Speaker 1: and again, I wish we had been on here right now. Uh.
Speaker 1: You know, you can you can have a lack of
Speaker 1: evidence and that becomes evidence, or if you have a
Speaker 1: denial then that becomes hard evidence, you know. So I
Speaker 1: I think, I really do think because I don't think
Speaker 1: the n s A ever intended for all the information
Speaker 1: to leak out based up on I don't know everything
Speaker 1: that's happened since then. Uh So I'm pretty willing to
Speaker 1: believe that they have not yet cracked how to get
Speaker 1: look at information in a meaningful way on the Tour
Speaker 1: network itself. In general, I would say that tours seems
Speaker 1: for many purposes pretty secure. Now, keep in mind, you
Speaker 1: still have to uh practice good internet security on your
Speaker 1: own even if you're using tour. Uh And like I said, well,
Speaker 1: maybe we'll do a full episode on that if you're
Speaker 1: interested in that, let's know, because you know, maybe that
Speaker 1: our listeners are thinking, wow, they did a heart bleed
Speaker 1: episode in a tour episode, go back to talking about
Speaker 1: Nintendo or something that we don't know. We have to
Speaker 1: hear from you in order to know. So if you
Speaker 1: want to know really how to securely navigate the web
Speaker 1: like a superspy, let us know, and we'll give you
Speaker 1: all the inside skinny and uh maybe we'll be able
Speaker 1: to grab Ben on here and have them do his
Speaker 1: creepy voice and be awesome. So I do not want
Speaker 1: an entire episode of Ben's creepy I don't know they
Speaker 1: could do a full episode each. I want at least
Speaker 1: for him to introduce himself trap now. I want to
Speaker 1: see him trying. Yeah, all right, well anyway, let us know.
Speaker 1: You can send us email, all right addresses, text stuff
Speaker 1: discovery dot com, or drop us a line on one
Speaker 1: of the many social networks that we are on in
Speaker 1: full view that includes Facebook, Tumbler, and Twitter. We use
Speaker 1: the handle tech stuff H. S W and Lauren and
Speaker 1: I will talk to you again really soon for more
Speaker 1: on this and thousands of other topics. Staff works dot
Speaker 1: com