3

Tor's current CAPTCHA implementation is easily crackable through bots - whether through paid human labour or automatic algorithms with 99.8% accuracy[1]. Although the algorithm by Google is for reCaptcha, the same results could plausibly be applied to Tor's CAPTCHA, which isn't necessarily as secure or hard to read. Can this be done? And surely the NSA and other government agencies have more resources than Google.

So is Tor's Bridge-getting system or are we all being spied on?

  1. Any captcha can be cracked through manual human labour
  2. Government agencies have resources to perform massive amounts of human labour
  3. Therefore any CAPTCHA cannot be used

ispo facto we're all being spied on

And IP-limiting services wouldn't work because you could just use Tor to keep changing your IP. Perhaps we could block Tor end nodes, but there are always private end nodes.

Example CAPTCHA for reference:

enter image description here

noɥʇʎԀʎzɐɹƆ
  • 131
  • 3

2 Answers2

6

Any captcha system can be broken by paying people.

The captcha has been attacked in the past by a nationstate adversary.

The captcha isn't critical to the security of Tor, it does present problems for censorship circumvention.

Breaking it would net you a subset of the bridges on bridgedb, it is partitioned so that a break on any one of the distribution methods will not compromise the entire set of bridges.

There are infact many (and cheaper) ways to discover bridges with less work and effort, see for example this report by arma.

So "ispo (sic) facto we're all being spied on" doesn't hold. The previous "fact" (the captcha is defeatable) does not lead to the conclusion that we're being spied on, merely that powerful adversaries can use a largely redundant method to discover some of the bridgedb bridges.

The captchas purpose is limited, and it's limitations well acknowledged. Worrying about the difficulty of the captcha is bikeshedding, at least against NSA level adversaries.

I'm not even going to waste time trying to deconstruct some of the other faulty logic and assumptions in your question. Even if they were right, the result is mostly irrelevant.

cacahuatl
  • 11,047
  • 2
  • 17
  • 39
0

1.Any captcha can be cracked through manual human labour 2. Government agencies have resources to perform massive amounts of human labour 3. Therefore any CAPTCHA cannot be used

ispo facto we're all being spied on

The point of bridges is to circumvent network blocking of tor. If the operator of the network knows more tor guard nodes, they can make it harder for you to connect to tor.

This doesn't really help them with surveillance. It lets them know that you're using tor, but the network is designed with the assumption that an attacker already knows that.

Xiong Chiamiov
  • 231
  • 1
  • 11