Schneier on Security

Pat Cahalan • December 13, 2007 6:54 PM

I would finally ask why, if providing a service and listening on it, and then
publishing otherwise private data is acceptable, there is the uproar there
is over secret rooms at phone companies.

I’m not exactly sure that what Dan Egerstad did was entirely kosher (it’s certainly slated a little towards the sensational), but there are several differences between what he did and secret rooms at phone companies.

First is the level of service provided. The Tor project itself documents what service the Tor network is providing, and gives a very well written account of what services the Tor network are not providing (see http://www.torproject.org/, specifically http://www.torproject.org/download.html.en#Warning)

More pointedly, they specifically mention exit node eavesdropping, and make it pretty clear that users should regard this as a potential security threat. (https://wiki.torproject.org/noreply/TheOnionRouter/TorFAQ#ExitEavesdroppers)

Second, Egerstad did not publish all usernames and passwords that came through his exit nodes, he posted “inter-governmental, NGO and high-value corporate email” credentials. Certainly all of these are large public entities that ought to have better security practices, particularly as they have a public duty. Publishing them is certainly embarrassing, but an effective way to publicize the problem.

Finally, neither the Tor network nor the telecommunications companies have a public responsibility to protect data outside their network. Egerstad was monitoring an exit node, not traffic inside the network itself. The secret room (allegedly) was monitoring traffic inside the network, which the telecommunications companies have an acknowledged and legally encoded public duty to protect from government wiretapping without warrant.

Pat Cahalan • December 16, 2007 2:11 AM

@ Leen

Our discussion is a little muddled here as we’re discussing simultaneously legal and ethical implications.

Legally, I have no idea if what Egerstad did was wrong. I’m unfamiliar with Swedish telecommunications law.

Ethically, I have reservations about what Egerstad did. If he took steps to ensure that he informed those people whose credentials he’d sniffed that he was going to publish those credentials, then the value of publishing them (for the sake of publicizing the problem) vastly outweighs the harm (basically, just embarrassing people who ought to know better).

Shouldn’t the law be the most protective when there isn’t a
technological protection available?

There’s a couple of different ways to look at that question. Either way, though, the law is supposed to exist to protect you from harm, no? It’s very easy in this particular case to argue that Egerstad is attempting to protect people from harm. He’s not using the account credentials himself for nefarious ends (presumably). He’s publishing the credentials (supposedly) to raise awareness that people are using the Tor network without understanding what it is they’re getting. There is a sensationalism aspect to it, sure, and you can argue that he did what he did to get himself in the press – this is the sort of thing that Marcus Ranum would probably sneer at. But it’s certainly the case that the more sensational the story, the more coverage it gets, and the more likely it is that people who may be misunderstanding how secure Tor makes them might learn about it. Taking into account the fact that publishing this sort of thing is very, very likely to get you in hot water (as shown here), and that Egerstad is clearly not an idiot and knew this ahead of time, it’s reasonable to assume an altruistic motivation here.

The second point makes the argument that because these passwords
were particularly important, that is more justification to expose them.

That’s actually not what I was trying to say. What I’m trying to say is that exposing that set of credentials more thoroughly illustrated the extent of the problem, but publishing a bunch of “everyday Joe” credentials doesn’t add much.

I would have more sympathy for the underlying argument …if running
tcpdump on an exit node was a novel, or previously undiscovered
‘attack.’ That’s far from the case.

This belies a security researcher bias. Clearly a large percentage of people who use Tor are unaware of the implications of what they’re doing. To these people, this is an undiscovered attack. Publishing it in a way that gets it out of security researcher publications and into the mainstream media raises awareness.

Now he’s no different than someone sitting outside the network listening
in on the conversation? How is that better?

How is that relevant? If the network engineer that provided the bandwidth to the Tor nodes (which they certainly could do, being able to monitor the interface) had published these same results, the action would be essentially equivalent, and we’d be discussing it essentially on the same grounds.

I’m unfamiliar with what law creates the duty that forces the
telecommunications companies to protect their communications
from government wiretapping without a warrant.

Case law, Katz v United States, Supreme Court decision 1967.