Great, that's all we need, thousands more people streaming media via Tor, like it's not choked enough already. Wonder if these same people will put back what they got out by setting up a Tor relay when they get home.

DOUBT.

B

do journalists need access to Amnesty International's website to report on the games anyway?

"WAH" WAH" We haven't got unrestricted access to the internet"

Err yeah, that's because you're in China.

@Matthew Ellen

You are confusing data privacy and anonymity.

Anyone using TOR needs to read the instructions. Cleartext data at an exit node was never protected, that is not the point of TOR. TOR was deisgned to allow bloggers living under opressive regimes to post anonymously. Being able to read the post at the exit router is no problem, as the post is going to be public anyway.

TOR has separate entry and exit nodes, so even if you monitor an exit node you don't know the IP address of the user, as this is only known by the entry node.

So yes, you can read the traffic, but unless the traffic identifies the user, e.g. posting name and address in clear, it will be impossible to trace back to the user...

... UNLESS, as in the article you posted, you trick the end user into using a poisoned TOR proxy server on their local machine.

TOR isn't really broken, it's just possible to break it for an individual user if that user does not take steps to protect the proxy they run on their local machine.

no surly not. that's never happened before....

oh wait....

You're confusing anonymity with privacy. TOR is good for anonymity (i can see what you're doing but i can't tell who you are) NOT for privacy. The exit router issue was known about since TOR's inception, it's part of the basic design of the network. Since the exit node decrypts the traffic when it sends it to it's final destination it can see all the traffic unless that traffic is also encrypted. Even if it is, as an exit node you're in a great position for a MITM attack. But the exit node can only see the last node that passed the data to it, it can't tell where the data came from before that and it can't tell where the data originated. It's almost impossible (as in it's impossible, but nothing's *technically* impossible) to back track the data to its source. You'd need to be running a large percentage of the exit routers in use and be able to compare their IO.

So the point is, if you're using the TOR network it's almost impossible to tell who you are or where you are coming from. It's trivial, however, to monitor the contents of your communication. In fact you have to assume that it's happening.

That makes TOR very well suited for dissident communication since they're not trying to hide the contents of their conversations, just WHO they are. That's really all TOR is good for, is staying ANONYMOUS. It also makes TOR very dangerous to transmit any secret or personally identifiable material, since you can assume someone is watching. Doing so may very well break the anonymity if the watcher can figure out from the captured info who you are.

TOR is good for what it's good for, but you have to understand how it works, use it carefully, and not rely on the magic privacy fairies to protect your shit.

The way it's being used in the article is outside TOR's intention, and won't work very well, since the network isn't designd for that kind of traffic. You'd almost be better off finding a land line and using your 56k modem to dial into someplace outside china. It would sort of work, though, if you had no other choice and were disciplined enough to NOT send anything to rat yourself out over it.

Anon, in keeping with the spirit of the article.

Surely better to teach a man to fish than to give fish away.

.. just pop into any large multinational operating in one of the special economic areas in China, we've got nice VPNs back to the motherland. Nice perk for the locals, we get to show them what else you can use Tiananmen square for.

You can buy a dedicated server for about £40pm, with a terrabyte of bandwidth. You still have to trust the hosting company, or you could use your home PC and trust your ISP, with phorm, RIPA etc.

SSH tunnel (using a key setup prior to travelling to avoid MITM) through tor to a proxy running on the server and browse through that, have it store all your music, files, and even act as a remote bittorent client (as it's got more upload bandwidth.). It can also provide email, dns, nntp, ntp services all running inside the shell. Even better the laptop you take can be almost blank, using the remote server as storage or desktop, running locally in a sandbox, throwaway USB, to avoid writing to the hard disk. Meaning Chinese police will not be able to read inane reporting on fog levels.

One part missing from the inital media coverage was that China were not only blocking sites, but monitoring the traffic and logging it, just like the UK and USA do to their citizens. I sounds worse with China in front of it, but we in the UK tap phones, log mobile phone triangulation location, read emails, examine browsing habits, setup surveillance on people failing to keep bins empty.

The Chaos Computer Club package mentioned in the article is a German package, as you might expect. You can easily modify the included Firefox to the language of your choice using about:config, but Vidalia remains in German. That's not so much of a problem as the speed at which the package operates ... it is extreeeeemely slow.

If you're just looking for a Tor/Vidalia USB-installable package, get an original one from Tor directly: http://www.torproject.org/download.html.en You can grab the one with just Firefox or the one with both Firefox and Pidgin (IM client). They're the "Tor Browser Bundles" and they work great!