Tor provides good security but is not perfect, particularly against the NSA

Sep 6, 2013 14:54 GMT  ·  By

Tor is one of the few things available that actually manage to protect a user's privacy and anonymity. The "dark web" network makes it possible to hide your tracks and your location on the Internet, by using a distributed VPN network.

Any data sent through the network is heavily encrypted, so the theory is that it's impossible to tell where one communication stream originates from or ends at.

In fact, using TOR is one of the things that may prevent the NSA from snooping on your communications, or at least make it harder for the spies.

Or maybe it won't, as a new academic paper proves that an organization with the necessary resources may be able to determine the original location of a Tor user, given enough time.

This "adversary" would have to have access to a large portion of the Internet, i.e. a major ISP or an Internet Exchange Point.

A government which strictly controls Internet usage would have this capability, as well as a government technically advanced to infiltrate or cooperate with commercial operators. That obviously includes the NSA, which is known to be able to tap into major Internet nodes in the US and elsewhere.

The researchers explain that discovering the location of any Tor user is a matter of time. For example, an adversary in control of a regular Tor node can hope to discover the location of a particular user with a 50 percent probability within three months and 80 percent probability within six months.

Someone in control of a large Internet node will be able to discover the location of a user with a 95 percent probability within three months. The more nodes it can control, the faster the detection.

The NSA, for example, has access to all the major US nodes, which are responsible for a significant percentage of world traffic, and several other international nodes.

With cooperation from large ISPs and Internet cable operators, it can be expected that the NSA has direct access to the majority of Internet traffic.

That said, like with its efforts to break encrypted communications, discovering the location of a single user takes some effort even for the NSA so, unless you have reason to believe that the agency is after you, perhaps if you're a journalist working with leaked files, Tor should be as safe as ever.

In fact, the Tor Project is well aware that someone with enough resources could defeat the system, given enough time.