tor-webwml.git

en/faq-abuse.wml   1) ## translation metadata

en/faq-abuse.wml   2) # Revision: $Revision$

abuse.html         3) 

en/faq-abuse.wml   4) #include "head.wmi" TITLE="Abuse FAQ for Server Operators"

faq-abuse.html     5) 

abuse.html         6) <div class="main-column">
abuse.html         7) 

faq-abuse.html     8) <!-- PUT CONTENT AFTER THIS TAG -->
faq-abuse.html     9) 
faq-abuse.html    10) <h2>Abuse FAQ for Tor Server Operators</h2>
faq-abuse.html    11) <hr />
faq-abuse.html    12) 

faq-abuse.html    13) <a id="WhatAboutCriminals"></a>
faq-abuse.html    14) <h3><a class="anchor" href="#WhatAboutCriminals">Doesn't Tor enable criminals to do bad things?</a></h3>

abuse.html        15) 

faq-abuse.html    16) <p>Criminals can already do bad things. Since they're willing to
faq-abuse.html    17) break laws, they already have lots of options available that provide
faq-abuse.html    18) <em>better</em> privacy than Tor provides. They can steal cell phones,
faq-abuse.html    19) use them, and throw them in a ditch; they can crack into computers
faq-abuse.html    20) in Korea or Brazil and use them to launch abusive activities; they

faq-abuse.html    21) can use spyware, viruses, and other techniques to take control of
faq-abuse.html    22) literally millions of Windows machines around the world. </p>

abuse.html        23) 

faq-abuse.html    24) <p>Tor aims to provide protection for ordinary people who want to follow
faq-abuse.html    25) the law. Only criminals have privacy right now; we need to fix that. </p>
faq-abuse.html    26) 

faq-abuse.html    27) <p>Some advocates of anonymity explain that it's just a tradeoff &mdash;
faq-abuse.html    28) accepting the bad uses for the good ones &mdash; but we don't think that's

faq-abuse.html    29) how it works in the case of Tor.
faq-abuse.html    30) Criminals and other bad people have the motivation to learn how to

faq-abuse.html    31) get good anonymity, and many have the motivation to pay well to achieve
faq-abuse.html    32) it. Being able to steal and reuse the identities of innocent victims
faq-abuse.html    33) (identify theft) makes it even easier. Normal people, on the other hand,
faq-abuse.html    34) don't typically have the time or money to spend figuring out how to get
faq-abuse.html    35) privacy online. This is the worst of all possible worlds. </p>
faq-abuse.html    36) 
faq-abuse.html    37) <p>So yes, criminals could in theory use Tor, but they already have
faq-abuse.html    38) better options, and it seems unlikely that taking Tor away from the
faq-abuse.html    39) world will stop them from doing their bad things. At the same time, Tor
faq-abuse.html    40) and other privacy measures can <em>fight</em> identity theft, physical
faq-abuse.html    41) crimes like stalking, and so on. </p>
faq-abuse.html    42) 

faq-abuse.html    43) <a id="DDoS"></a>
faq-abuse.html    44) <h3><a class="anchor" href="#DDoS">What about distributed denial of service attacks?</a></h3>

abuse.html        45) 

faq-abuse.html    46) <p>Distributed denial of service (DDoS) attacks typically rely on having a group

faq-abuse.html    47) of thousands of computers all sending floods of traffic to a victim. Since
faq-abuse.html    48) the goal is to overpower the bandwidth of the victim, they typically send
faq-abuse.html    49) UDP packets since those don't require handshakes or coordination. </p>
faq-abuse.html    50) 

faq-abuse.html    51) <p>But because Tor only transports correctly formed TCP streams, not

faq-abuse.html    52) all IP packets, you cannot send UDP packets over Tor. (You can't do
faq-abuse.html    53) specialized forms of this attack like SYN flooding either.) So ordinary
faq-abuse.html    54) DDoS attacks are not possible over Tor. Tor also doesn't allow bandwidth
faq-abuse.html    55) amplification attacks against external sites: you need to send in a byte

faq-abuse.html    56) for every byte that the Tor network will send to your destination. So

faq-abuse.html    57) in general, attackers who control enough bandwidth to launch an effective
faq-abuse.html    58) DDoS attack can do it just fine without Tor. </p>
faq-abuse.html    59) 

faq-abuse.html    60) <a id="WhatAboutSpammers"></a>
faq-abuse.html    61) <h3><a class="anchor" href="#WhatAboutSpammers">What about spammers?</a></h3>

abuse.html        62) 

faq-abuse.html    63) <p>First of all, the default Tor exit policy rejects all outgoing

faq-abuse.html    64) port 25 (SMTP) traffic. So sending spam mail through Tor isn't going to

faq-abuse.html    65) work by default. It's possible that some server operators will enable
faq-abuse.html    66) port 25 on their particular exit node, in which case that computer will
faq-abuse.html    67) allow outgoing mails; but that individual could just set up an open mail

faq-abuse.html    68) relay too, independent of Tor. In short, Tor isn't useful for spamming,
faq-abuse.html    69) because nearly all Tor servers refuse to deliver the mail. </p>

faq-abuse.html    70) 

faq-abuse.html    71) <p>Of course, it's not all about delivering the mail. Spammers can use

faq-abuse.html    72) Tor to connect to open HTTP proxies (and from there to SMTP servers); to
faq-abuse.html    73) connect to badly written mail-sending CGI scripts; and to control their
faq-abuse.html    74) botnets — that is, to covertly communicate with armies of
faq-abuse.html    75) compromised computers that deliver the spam.

faq-abuse.html    76) </p>
faq-abuse.html    77) 

faq-abuse.html    78) <p>
faq-abuse.html    79) This is a shame, but notice that spammers are already doing great
faq-abuse.html    80) without Tor. Also, remember that many of their more subtle communication
faq-abuse.html    81) mechanisms (like spoofed UDP packets) can't be used over Tor, because
faq-abuse.html    82) it only transports correctly-formed TCP connections.
faq-abuse.html    83) </p>

abuse.html        84) 

faq-abuse.html    85) <a id="ExitPolicies"></a>
faq-abuse.html    86) <h3><a class="anchor" href="#ExitPolicies">How do Tor exit policies work?</a></h3>

abuse.html        87) 

faq-abuse.html    88) <p>Each Tor server has an exit policy that specifies what sort of
faq-abuse.html    89) outbound connections are allowed or refused from that server. The exit
faq-abuse.html    90) policies are propagated to the client via the directory, so clients
faq-abuse.html    91) will automatically avoid picking exit nodes that would refuse to exit
faq-abuse.html    92) to their intended destination. </p>
faq-abuse.html    93) 

faq-abuse.html    94) <p>This way each server can decide the services, hosts, and networks
faq-abuse.html    95) he wants to allow connections to, based on abuse potential and his own
faq-abuse.html    96) situation. </p>

abuse.html        97) 

faq-abuse.html    98) <a id="HowMuchAbuse"></a>
faq-abuse.html    99) <h3><a class="anchor" href="#HowMuchAbuse">Does Tor get much abuse?</a></h3>

abuse.html       100) 

faq-abuse.html   101) <p>Not much, in the grand scheme of things. We've been running the network
faq-abuse.html   102) since October 2003, and it's only generated a handful of complaints. Of
faq-abuse.html   103) course, like all privacy-oriented networks on the net, we attract our
faq-abuse.html   104) share of jerks. Tor's exit policies help separate the role of "willing
faq-abuse.html   105) to donate resources to the network" from the role of "willing to deal

faq-abuse.html   106) with exit abuse complaints," so we hope our network is more sustainable

faq-abuse.html   107) than past attempts at anonymity networks. </p>

abuse.html       108) 

en/faq-abuse.wml 109) <p>Since Tor has
en/faq-abuse.wml 110) <a href="<page overview>">many good uses as

faq-abuse.html   111) well</a>, we feel that we're doing pretty well at striking a balance
faq-abuse.html   112) currently. </p>
faq-abuse.html   113) 

faq-abuse.html   114) <a id="TypicalAbuses"></a>
faq-abuse.html   115) <h3><a class="anchor" href="#TypicalAbuses">So what should I expect if I run a server?</a></h3>

abuse.html       116) 

faq-abuse.html   117) <p>If you run a Tor server that allows exit connections (such as the
faq-abuse.html   118) default exit policy), it's probably safe to say that you will eventually

faq-abuse.html   119) hear from somebody. Abuse

faq-abuse.html   120) complaints may come in a variety of forms. For example: </p>

abuse.html       121) <ul>

faq-abuse.html   122) <li>Somebody connects to Hotmail, and sends a ransom note to a

faq-abuse.html   123) company. The

faq-abuse.html   124) FBI sends you a polite email, you explain that you run a Tor server,

faq-abuse.html   125) and they say "oh well" and leave you alone. [Port 80]</li>
faq-abuse.html   126) <li>Somebody tries to get you shut down by using Tor to connect to Google
faq-abuse.html   127) groups and post spam to Usenet, and then sends an angry mail to

faq-abuse.html   128) your ISP about how you're destroying the world. [Port 80]</li>

faq-abuse.html   129) <li>Somebody connects to an IRC network and makes a nuisance of

faq-abuse.html   130) himself. Your ISP gets polite mail about how your computer has been

faq-abuse.html   131) compromised; and/or your computer gets DDoSed. [Port 6667]</li>

faq-abuse.html   132) <li>Somebody uses Tor to download a Vin Diesel movie, and

en/faq-abuse.wml 133) your ISP gets a DMCA takedown notice. See EFF's

en/faq-abuse.wml 134) <a href="<page eff/tor-dmca-response>">Tor DMCA Response

faq-abuse.html   135) Template</a>, which explains to your ISP why it can probably ignore

faq-abuse.html   136) the notice without any liability. [Arbitrary ports]</li>

abuse.html       137) </ul>

faq-abuse.html   138) 
faq-abuse.html   139) <p>You might also find that your Tor server's IP is blocked from accessing
faq-abuse.html   140) some Internet sites/services. This might happen regardless of your exit
faq-abuse.html   141) policy, because some groups don't seem to know or care that Tor has
faq-abuse.html   142) exit policies. (If you have a spare IP not used for other activities,
faq-abuse.html   143) you might consider running your Tor server on it.) For example, </p>
faq-abuse.html   144) 

abuse.html       145) <ul>

faq-abuse.html   146) <li>Because of a few cases of anonymous jerks messing with its web
faq-abuse.html   147) pages, Wikipedia is currently blocking many Tor server IPs from writing
faq-abuse.html   148) (reading still works). We're talking to Wikipedia about how they might
faq-abuse.html   149) control abuse while still providing access to anonymous contributors,
faq-abuse.html   150) who often have hot news or inside info on a topic but don't want to risk
faq-abuse.html   151) revealing their identities when publishing it (or don't want to reveal
faq-abuse.html   152) to local observers that they're accessing Wikipedia). Slashdot is also
faq-abuse.html   153) in the same boat.</li>

en/faq-abuse.wml 154) 

faq-abuse.html   155) <li>SORBS is putting some Tor server IPs on their email

faq-abuse.html   156) blacklist as well. They do this because they passively detect whether your
faq-abuse.html   157) server connects to certain IRC networks, and they conclude from this that

en/faq-abuse.wml 158) your server is capable of spamming. We tried to work with
en/faq-abuse.wml 159) them to teach them that not all software works this way,
en/faq-abuse.wml 160) but we have given up. We recommend you avoid them, and <a
en/faq-abuse.wml 161) href="http://paulgraham.com/spamhausblacklist.html">teach your friends
en/faq-abuse.wml 162) (if they use them) to avoid abusive blacklists too</a>.</li>
en/faq-abuse.wml 163) 

abuse.html       164) </ul>
abuse.html       165) 

faq-abuse.html   166) <a id="IrcBans"></a>
faq-abuse.html   167) <h3><a class="anchor" href="#IrcBans">Tor is banned from the IRC network I want to use.</a></h3>

abuse.html       168) 

faq-abuse.html   169) <p>Sometimes jerks make use of Tor to troll IRC channels. This abuse
faq-abuse.html   170) results in IP-specific temporary bans ("klines" in IRC lingo), as the
faq-abuse.html   171) network operators try to keep the troll off of their network. </p>
faq-abuse.html   172) 
faq-abuse.html   173) <p>This response underscores a fundamental flaw in IRC's security model:
faq-abuse.html   174) they assume that IP addresses equate to humans, and by banning the

faq-abuse.html   175) IP address they can ban the human. In reality this is not the case —

faq-abuse.html   176) many such trolls routinely make use of the literally millions of open
faq-abuse.html   177) proxies and compromised computers around the Internet. The IRC networks
faq-abuse.html   178) are fighting a losing battle of trying to block all these nodes,
faq-abuse.html   179) and an entire cottage industry of blacklists and counter-trolls has
faq-abuse.html   180) sprung up based on this flawed security model (not unlike the antivirus
faq-abuse.html   181) industry). The Tor network is just a drop in the bucket here. </p>
faq-abuse.html   182) 
faq-abuse.html   183) <p>On the other hand, from the viewpoint of IRC server operators, security
faq-abuse.html   184) is not an all-or-nothing thing.  By responding quickly to trolls or
faq-abuse.html   185) any other social attack, it may be possible to make the attack scenario
faq-abuse.html   186) less attractive to the attacker.  And most individual IP addresses do
faq-abuse.html   187) equate to individual humans, on any given IRC network at any given time.
faq-abuse.html   188) The exceptions include NAT gateways which may be allocated access as
faq-abuse.html   189) special cases. While it's a losing battle to try to stop the use of open
faq-abuse.html   190) proxies, it's not generally a losing battle to keep klining a single
faq-abuse.html   191) ill-behaved IRC user until that user gets bored and goes away. </p>
faq-abuse.html   192) 
faq-abuse.html   193) <p>But the real answer is to implement application-level auth systems,
faq-abuse.html   194) to let in well-behaving users and keep out badly-behaving users. This
faq-abuse.html   195) needs to be based on some property of the human (such as a password he
faq-abuse.html   196) knows), not some property of the way his packets are transported. </p>
faq-abuse.html   197) 
faq-abuse.html   198) <p>Of course, not all IRC networks are trying to ban Tor nodes. After
faq-abuse.html   199) all, quite a few people use Tor to IRC in privacy in order to carry
faq-abuse.html   200) on legitimate communications without tying them to their real-world
faq-abuse.html   201) identity. Each IRC network needs to decide for itself if blocking a few
faq-abuse.html   202) more of the millions of IPs that bad people can use is worth losing the
faq-abuse.html   203) contributions from the well-behaved Tor users. </p>
faq-abuse.html   204) 
faq-abuse.html   205) <p>If you're being blocked, have a discussion with the network operators
faq-abuse.html   206) and explain the issues to them. They may not be aware of the existence of
faq-abuse.html   207) Tor at all, or they may not be aware that the hostnames they're klining
faq-abuse.html   208) are Tor exit nodes.  If you explain the problem, and they conclude that
faq-abuse.html   209) Tor ought to be blocked, you may want to consider moving to a network that
faq-abuse.html   210) is more open to free speech.  Maybe inviting them to #tor on irc.oftc.net

faq-abuse.html   211) will help show them that we are not all evil people. </p>

faq-abuse.html   212) 

faq-abuse.html   213) <p>Finally, if you become aware of an IRC network that seems to be

faq-abuse.html   214) blocking Tor, or a single Tor exit node, please put that information on <a

faq-abuse.html   215) href="http://wiki.noreply.org/wiki/TheOnionRouter/BlockingIrc">The Tor
faq-abuse.html   216) IRC block tracker</a>

faq-abuse.html   217) so that others can share.  At least one IRC network consults that page

faq-abuse.html   218) to unblock exit nodes that have been blocked inadvertently. </p>

abuse.html       219) 

faq-abuse.html   220) <a id="SMTPBans"></a>
faq-abuse.html   221) <h3><a class="anchor" href="#SMTPBans">Your nodes are banned from the mail server I want to use.</a></h3>

abuse.html       222) 

faq-abuse.html   223) <p>Even though <a href="#WhatAboutSpammers">Tor isn't useful for
faq-abuse.html   224) spamming</a>, some over-zealous blacklisters seem to think that all

faq-abuse.html   225) open networks like Tor are evil — they attempt to strong-arm network

faq-abuse.html   226) administrators on policy, service, and routing issues, and then extract

faq-abuse.html   227) ransoms from victims. </p>
faq-abuse.html   228) 
faq-abuse.html   229) <p>If your server administrators decide to make use of these

faq-abuse.html   230) blacklists to refuse incoming mail, you should have a conversation with

faq-abuse.html   231) them and explain about Tor and Tor's exit policies. </p>

abuse.html       232) 

faq-abuse.html   233) <a id="Bans"></a>
faq-abuse.html   234) <h3><a class="anchor" href="#Bans">I want to ban the Tor network from my service.</a></h3>

abuse.html       235) 

faq-abuse.html   236) <p>First, ask yourself if there's a way to do application-level decisions
faq-abuse.html   237) to separate the legitimate users from the jerks. For example, you might
faq-abuse.html   238) have certain areas of the site, or certain privileges like posting,
faq-abuse.html   239) available only to people who are registered. You could set up this
faq-abuse.html   240) distinction only for certain IP addresses such as Tor exit nodes. This
faq-abuse.html   241) way you can have multi-tiered access and not have to ban everything. </p>
faq-abuse.html   242) 
faq-abuse.html   243) <p>Second, consider that thousands of people use Tor every day to protect
faq-abuse.html   244) against data-gathering corporations like Doubleclick while going about

faq-abuse.html   245) their normal activities. Others use Tor because it's their only
faq-abuse.html   246) way to get past the restrictive firewalls at their school or other
faq-abuse.html   247) organization. Some Tor users may be legitimately connecting

faq-abuse.html   248) to your service right now to carry on normal activities. You need to
faq-abuse.html   249) decide whether banning the Tor network is worth losing the contributions

faq-abuse.html   250) of these users, as well as potential future legitimate users. </p>

faq-abuse.html   251) 

faq-abuse.html   252) <p>At this point, you should also ask yourself what you do about other
faq-abuse.html   253) services that aggregate many users behind a few IP addresses. Tor is
faq-abuse.html   254) not so different from AOL in this respect.</p>
faq-abuse.html   255) 

faq-abuse.html   256) <p>Lastly, please remember that Tor servers have individual exit
faq-abuse.html   257) policies. Many Tor servers do not allow exiting connections at

faq-abuse.html   258) all. Many of those that do allow some exit connections might already

faq-abuse.html   259) disallow connections to

faq-abuse.html   260) your service. When you go about banning nodes, you should parse the
faq-abuse.html   261) exit policies and only block the ones that allow these connections;
faq-abuse.html   262) and you should keep in mind that exit policies can change (as well as
faq-abuse.html   263) the overall list of nodes in the network). </p>
faq-abuse.html   264) 

faq-abuse.html   265) <p>If you really want to do this, we provide a

en/faq-abuse.wml 266) <a href="<cvssandbox>tor/contrib/exitlist">Python script to parse the Tor

faq-abuse.html   267) directory</a>.
faq-abuse.html   268) </p>

faq-abuse.html   269) 

faq-abuse.html   270) <a id="TracingUsers"></a>
faq-abuse.html   271) <h3><a class="anchor" href="#TracingUsers">I have a compelling reason to trace a Tor user. Can you help?</a></h3>
faq-abuse.html   272) 
faq-abuse.html   273) <p>
faq-abuse.html   274) There is nothing the Tor developers can do to trace Tor users. The same
faq-abuse.html   275) protections that keep bad people from breaking Tor's anonymity also
faq-abuse.html   276) prevent us from figuring out what's going on.
faq-abuse.html   277) </p>
faq-abuse.html   278) 
faq-abuse.html   279) <p>
faq-abuse.html   280) Some fans have suggested that we redesign Tor to include a <a
faq-abuse.html   281) href="http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#Backdoor">backdoor</a>.
faq-abuse.html   282) There are two problems with this idea. First, it technically weakens the
faq-abuse.html   283) system too far. Having a central way to link users to their activities
faq-abuse.html   284) is a gaping hole for all sorts of attackers; and the policy mechanisms
faq-abuse.html   285) needed to ensure correct handling of this responsibility are enormous
faq-abuse.html   286) and unsolved. Second, the bad people <a href="#WhatAboutCriminals">aren't
faq-abuse.html   287) going to get caught by this anyway</a>, since they will use other means
faq-abuse.html   288) to ensure their anonymity (identity theft, compromising computers and
faq-abuse.html   289) using them as bounce points, etc).
faq-abuse.html   290) </p>
faq-abuse.html   291) 
faq-abuse.html   292) <p>
faq-abuse.html   293) But remember that this doesn't mean that Tor is invulnerable. Traditional
faq-abuse.html   294) police techniques can still be very effective against Tor, such as
faq-abuse.html   295) interviewing suspects, surveillance and keyboard taps, writing style
faq-abuse.html   296) analysis, sting operations, and other physical investigations.
faq-abuse.html   297) </p>
faq-abuse.html   298) 

faq-abuse.html   299) <a id="LegalQuestions"></a>
faq-abuse.html   300) <h3><a class="anchor" href="#LegalQuestions">I have legal questions about Tor abuse.</a></h3>

abuse.html       301) 

faq-abuse.html   302) <p>We're only the developers. We can answer technical questions, but
faq-abuse.html   303) we're not the ones to talk to about legal questions or concerns. </p>
faq-abuse.html   304) 

en/faq-abuse.wml 305) <p>Please take a look at the

en/faq-abuse.wml 306) <a href="<page eff/tor-legal-faq>">Tor Legal FAQ</a>,

faq-abuse.html   307) and contact EFF directly if you have any further legal questions. </p>

abuse.html       308) 

faq-abuse.html   309)   </div><!-- #main -->