Tor really sucks for sending abusive traffic, it's slow and blacklisted by everyone (IME mostly due to problematic users, rather than "hacking" and such).
Luminati for example offers a much better service, as do the hundreds of thousands of routers offering unauthenticated SSH tunneling around the world. Way better speeds, and no blacklists.
> Tor's anonymity is analogous to Twitter's free speech, but in both cases, abuse of those freedoms defines the need for some practical protections in order to maintain them.
This sounds worryingly like a call to weaken Tor, I really hope it's not.
It's not in any way a call to weaken Tor, but I think that response is indicative of an ideological viewpoint that will achieve the same result.
A perfectly secure, perfectly anonymous network that no network-neutral party will service because of the levels of abuse which come from it is no stronger a solution than an insecure, de-anonymized solution. The parent blog post implicitly acknowledges this -- the poster disables exit handling for SMTP and BGP traffic because of that traffic's likelihood for abuse and the resulting effect on the exit node, even though such traffic might have legitimate uses. Practical requirements of node functionality trump ideology, in the case of SMTP and BGP traffic at least.
While Tor operators may accept abusive traffic as a result of their greater goal, the upstream providers of their nodes may not. The ability to reliably deliver traffic for all customers, Tor and non-Tor is key to their business. If that ability becomes compromised, they take action to preserve their business.
Wow Luminati is expensive but sounds like a very premium platform for on-demand proxies. Are they running this in a shady manner where a P2P application is also serving as a web proxy for Luminati?
I never really tracked down what exactly causes the vulnerability, but it's a rather common bug in various SSH implementations (millions of affected devices). Dropbear is the most commonly affected.
I guess easiest way to demonstrate it is like this:
debug1: Next authentication method: password
root@117.243.179.217's password:
debug1: Authentication succeeded (password).
Authenticated to 117.243.179.217 ([117.243.179.217]:22).
debug1: channel 0: new [client-session]
debug1: Entering interactive session.
debug1: Sending environment.
debug1: Sending env LANG = en_US.UTF-8
debug1: Sending env LC_CTYPE = en_US.UTF-8
login failed: please enter correct username and password
Login:
Notice how for the initial login attempt the SSH server itself will accept any password, but subsequently the login is handled by the binary set as the login shell? After the initial "failed" login attempt you can freely open as many SSH tunnels as you please. You can most likely get RCE from here
Luminati for example offers a much better service, as do the hundreds of thousands of routers offering unauthenticated SSH tunneling around the world. Way better speeds, and no blacklists.
> Tor's anonymity is analogous to Twitter's free speech, but in both cases, abuse of those freedoms defines the need for some practical protections in order to maintain them.
This sounds worryingly like a call to weaken Tor, I really hope it's not.