Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

If the NSA has pinpointed certain people using TOR, is there a way to encrypt unencrypted web traffic? I suppose this is kind of a dumb question that answers itself, as once it leaves the exit node, it's all in the clear.

Does ipv6 support ssl, tls or some kind of vpn encryption for all connections? For example, an implementation could maybe be such: you have a unencrypted connection to some service, you could merely click "Secure this connection" and voila! Secured!

I seem remember this feature was mentioned in some of the early articles about ipv6 (but could have just been some random slashdotter).

share|improve this question

closed as unclear what you're asking by MariusMatutiae, Nifle, Tog, Ƭᴇcʜιᴇ007, Kevin Panko Jan 6 '14 at 3:44

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
It's hard to understand your question because it's not clear what it is you are trying to do. What are you expecting the encryption to accomplish exactly? Are you assuming the cooperation of the end node? If so, why would the traffic be unencrypted in the first place? –  David Schwartz Jan 5 '14 at 7:56
    
@Spiff Sorry about the IPsec thing, I have been reading a book that was published earlier this year that mentioned it. –  ekaj Jan 5 '14 at 9:44
    
@ekaj No worries. –  Spiff Jan 5 '14 at 10:46
    
Who says the NSA can identify people who use TOR the few cases where that was done there was other factors involved. The most recent cases involved as colleges network where the student was either of a few who used TOR or the sole user. Other cases involved similar situations –  Ramhound Jan 5 '14 at 15:08
    
@Ramhound see schneier.com/blog/archives/2013/10/how_the_nsa_att.html –  ekaj Jan 7 '14 at 4:59

1 Answer 1

Nope, you can't secure your web traffic unless you can authenticate the web server you're connecting to, because otherwise you could be talking to an NSA "Man in the Middle" (MitM) attack box (think of a web proxy that intercepts and snoops on, but still forwards, all your communication with that web server). If you didn't authenticate the other endpoint of your encrypted session, your encryption partner might be the NSA's MitM and not the actual website.

Unfortunately, there's no reliable or widely-deployed way to authenticate web servers that the NSA can't get around.

You mentioned IPv6, but that's no real solution. At one time, a somewhat obscure IPv6-related spec document said that IPv6-capable hosts "MUST" support IPsec, but that was downgraded in 2011 to a "SHOULD". And even if it hadn't been, it's not like there were "IPv6 police" out there to revoke your "IPv6 license" if you didn't put IPsec support into your IPv6 stack. And even if you could count on every IPv6-capable host having IPsec support, that doesn't mean it's enabled and properly configured such that you could take advantage of it. And even if you could take advantage of it, the typical host authentication methods use X.509 certificates just like SSL/TLS, which as I just mentioned, the NSA has been known to break. And then there's John Gilmore's assertion that NSA employees inserted bad requirements into the IPsec standard, and overcomplicated it to the point that crypto researchers don't even try to analyze it for security.

So maybe you figure, "Hey, those MitM attacks seem pretty targeted and expensive, maybe I won't get targeted, so maybe I only care about making sure my data doesn't get caught up in the mass dragnet programs", which I'd counter with, "yeah, but the Tor user unmasking attacks are targeted and expensive too, but you still thought yourself likely enough to be targeted that you were looking for something better than Tor". And then I'd follow up by noting that the NSA considers encrypted data suspicious and claims the right to keep it until they can decrypt it.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.