Computer security lesson: TOR isn’t security
A Swedish computer security researcher has discovered that users of the TOR Internet service (which makes your Internet traffic more or less anonymous) apparently thought it also encrypted their computer traffic and made it secure — which it doesn’t.
Wired News reports:
A little over a week ago, Swedish computer security consultant Dan Egerstad posted the user names and passwords for 100 e-mail accounts used by the victims, but didn’t say how he obtained them. He revealed Friday that he intercepted the information by hosting five Tor exit nodes placed in different locations on the internet as a research project.
Egerstad was able to get email accounts and passwords and read emails sent by the worthies at the Iranian embassy, among other groups. Even though Egerstad is in Sweden and there were no U.S. government agencies whose Internet traffic he intercepted, the Web host that hosts his blog apparently got a take-down notice from some unnamed U.S. law enforcement agency. I wonder if Egerstad has revealed a U.S. intelligence gathering mechanism.
There’s another lesson in this, of course: This computer security stuff shouldn’t be taken lightly, and there’s a big dangerous world out there. Use good passwords. And use ‘https’ when you’re doing anything online that involves passwords or email you want to keep confidential.