[Phormic Acid]

Originally Posted by AlexanderHanff

Tor is not the be all and end all of security. There have already been cases in the US and Germany where exit nodes were forced to give up their logs to the authorities.

No, Tor isn’t much to do with security, in the sense that most people think of the security of a network. By default, Tor doesn’t produce any logs that might be useful to the authorities. If forced to produce such logs, those running the node would probably just shut it.

Originally Posted by AlexanderHanff

Tor also causes significant latency on your connection (and I mean significant) so it is not ideal under any circumstances. Furthermore wtf should we have to jump into sneakernets just to ensure our privacy…

I hope you’re not suggesting that Tor is a sneakernet.

Originally Posted by Wild Oscar

I posted about this back on page 408, but it got swallowed up in the 'heat of battle' .. I don't know anybody had a chance to have a look ... it might be useful as an anti-phorm measure!

any thoughts folks?

There’s a thread on BadPhorm called Relakks - A Phorm workaround? Relakks works fine. Note, though, that it’s only PPTP. This is not as secure as L2TP or OpenVPN. L2TP is apparently currently problematic to support. Relakks used to provide L2TP, but gave up on it. OpenVPN is built upon SSL/TLS, which we all know from HTTPS.

There’s an interesting alternative in the form of JonDonym. This was previously called Java Anon Proxy (JAP) and AN.ON. While a VPN may tunnel most things, Tor is more restrictive, being effectively a TCP proxy with further restrictions possible at the exit nodes. JonDonym is even more restrictive, being a HTTP proxy only. However, it tries to combine the best parts of VPNs and networks like Tor. Tor’s weakness is that anyone can set up as one or more nodes. A VPN’s weakness is that all your traffic can easily be monitored from a single point. Your VPN provider may find themselves forced, possibly by court order, to monitor your traffic. All you’ve done is move the ‘Phorm problem’ to a different place. JonDonym’s solution is to have a number of nodes in series, but to allow only identified businesses and institutions to provide those nodes.

As long ago as 2003, the service faced the problem of complying with a court order. There was a press release a little while after – AN.ON still guarantees anonymity. You can read more on the Law enforcement page and there’s a detailed paper entitled Revocable Anonymity that explains the process . The important point is that the German courts have only allowed for the monitoring of specific URLs. General logs that the authorities could trawl through have not been allowed. To make the legal process even harder for those who want to brake the anonymity, you can choose to have your traffic pass through nodes in different countries. Thus, court orders in more than one country would be required.