On 14 July 2016 at 08:37, Mirimir <miri...@riseup.net> wrote: > On 07/14/2016 12:23 AM, Jon Tullett wrote:
>> Having pwned the server, a malware component is then injected to >> visiting computers. Ie: when the criminal visits the infected >> site, his PC is infected (over that encrypted, secure, etc) >> connection. Now infected, his PC will be under the control of the >> FBI, and the investigation will proceed from there. As soon as it's >> connected to the regular internet, that connection will be traced, >> but that connection is not necessary - data on the PC can be >> exfiltrated by the feds over Tor and used to identify the user. > > Tor Project ought to inform users about this risk, and recommend > countermeasures. It's not like this is new. I see nothing at > <https://www.torproject.org/download/download.html.en#warning>. I agree - a warning of the dangers of visiting infected onion sites could be useful (even though the problem is not specifically a Tor one). There's the risk of feature creep - security is a big space and it isn't really Tor's job to educate people on every risk online. Perhaps a clarification that just as TBB is not all you need to maintain privacy, it's also not all you need to stay secure, with a pointer to some external tips? For onion site operators, there's this: https://www.torproject.org/docs/tor-hidden-service.html.en Which does include this: 'Hidden services operators need to practice proper operational security and system administration to maintain security. For some security suggestions please make sure you read over Riseup's "Tor hidden services best practices" document.' Which in turn links here: https://help.riseup.net/en/security/network-security/tor/onionservices-best-practices That's more specifically about Tor config though - it could usefully include pointers on basic webserver opsec too, though again it may be out of scope to say much more than "bad people may attack your web server, onion or not. Educate yourself on keeping it secure". -J -- tor-talk mailing list - tor-talk@lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
