tor-webwml.git

1) ## translation metadata

2) # Revision: $Revision$

3) # Translation-Priority: 3-low
4) 
5) #include "head.wmi" TITLE="Tor Project: Abuse FAQ" CHARSET="UTF-8"
6) <div id="content" class="clearfix">
7)   <div id="breadcrumbs">

8)     <a href="<page index>">Home &raquo; </a>

9)     <a href="<page docs/documentation>">Documentation &raquo; </a>
10)     <a href="<page docs/faq-abuse>">Abuse FAQ</a>
11)   </div>

12)   <div id="maincol">

13)     <!-- PUT CONTENT AFTER THIS TAG -->
14)     <h1>Abuse FAQ</h1>

15)     <hr>
16)     <h3>Questions</h3>
17)     <ul>
18)     <li><a href="#WhatAboutCriminals">Doesn't Tor enable criminals to do bad things?</a></li>
19)     <li><a href="#DDoS">What about distributed denial of service attacks?</a></li>
20)     <li><a href="#WhatAboutSpammers">What about spammers?</a></li>
21)     <li><a href="#HowMuchAbuse">Does Tor get much abuse?</a></li>
22)     <li><a href="#TypicalAbuses">So what should I expect if I run an exit relay?</a></li>
23)     <li><a href="#IrcBans">Tor is banned from the IRC network I want to use.</a></li>
24)     <li><a href="#SMTPBans">Your nodes are banned from the mail server I want to use.</a></li>
25)     <li><a href="#Bans">I want to ban the Tor network from my service.</a></li>
26)     <li><a href="#TracingUsers">I have a compelling reason to trace a Tor user. Can you help?</a></li>

27)     <li><a href="#RemoveContent">I want some content removed from a
28) .onion address.</a></li>
29)     <li><a href="#AbuseOpinion">Where does Tor Project stand on abusers
30) using technology?</a></li>

31)     <li><a href="#LegalQuestions">I have legal questions about Tor abuse.</a></li>
32)     </ul>
33)     <hr>

34) 

35)     <a id="WhatAboutCriminals"></a>
36)     <h3><a class="anchor" href="#WhatAboutCriminals">Doesn't Tor enable criminals to do bad things?</a></h3>

37) 

38)     <p>Criminals can already do bad things. Since they're willing to
39)     break laws, they already have lots of options available that provide
40)     <em>better</em> privacy than Tor provides. They can steal cell phones,
41)     use them, and throw them in a ditch; they can crack into computers
42)     in Korea or Brazil and use them to launch abusive activities; they
43)     can use spyware, viruses, and other techniques to take control of
44)     literally millions of Windows machines around the world. </p>

45) 

46)     <p>Tor aims to provide protection for ordinary people who want to follow
47)     the law. Only criminals have privacy right now, and we need to fix that. </p>

48) 

49)     <p>Some advocates of anonymity explain that it's just a tradeoff &mdash;
50)     accepting the bad uses for the good ones &mdash; but there's more to it
51)     than that.
52)     Criminals and other bad people have the motivation to learn how to
53)     get good anonymity, and many have the motivation to pay well to achieve
54)     it. Being able to steal and reuse the identities of innocent victims

55)     (identity theft) makes it even easier. Normal people, on the other hand,

56)     don't have the time or money to spend figuring out how to get
57)     privacy online. This is the worst of all possible worlds. </p>

58) 

59)     <p>So yes, criminals could in theory use Tor, but they already have
60)     better options, and it seems unlikely that taking Tor away from the
61)     world will stop them from doing their bad things. At the same time, Tor
62)     and other privacy measures can <em>fight</em> identity theft, physical
63)     crimes like stalking, and so on. </p>

64) 

65)     #<a id="Pervasive"></a>
66)     #<h3><a class="anchor" href="#Pervasive">If the whole world starts using
67)     #Tor, won't civilization collapse?</a></h3>

68) 

69)     <a id="DDoS"></a>
70)     <h3><a class="anchor" href="#DDoS">What about distributed denial of service attacks?</a></h3>

71) 

72)     <p>Distributed denial of service (DDoS) attacks typically rely on having a group
73)     of thousands of computers all sending floods of traffic to a victim. Since
74)     the goal is to overpower the bandwidth of the victim, they typically send
75)     UDP packets since those don't require handshakes or coordination. </p>

76) 

77)     <p>But because Tor only transports correctly formed TCP streams, not
78)     all IP packets, you cannot send UDP packets over Tor. (You can't do
79)     specialized forms of this attack like SYN flooding either.) So ordinary
80)     DDoS attacks are not possible over Tor. Tor also doesn't allow bandwidth
81)     amplification attacks against external sites: you need to send in a byte
82)     for every byte that the Tor network will send to your destination. So
83)     in general, attackers who control enough bandwidth to launch an effective
84)     DDoS attack can do it just fine without Tor. </p>

85) 

86)     <a id="WhatAboutSpammers"></a>
87)     <h3><a class="anchor" href="#WhatAboutSpammers">What about spammers?</a></h3>

88) 

89)     <p>First of all, the default Tor exit policy rejects all outgoing
90)     port 25 (SMTP) traffic. So sending spam mail through Tor isn't going to
91)     work by default. It's possible that some relay operators will enable
92)     port 25 on their particular exit node, in which case that computer will
93)     allow outgoing mails; but that individual could just set up an open mail
94)     relay too, independent of Tor. In short, Tor isn't useful for spamming,
95)     because nearly all Tor relays refuse to deliver the mail. </p>

96) 

97)     <p>Of course, it's not all about delivering the mail. Spammers can use
98)     Tor to connect to open HTTP proxies (and from there to SMTP servers); to
99)     connect to badly written mail-sending CGI scripts; and to control their
100)     botnets &mdash; that is, to covertly communicate with armies of
101)     compromised computers that deliver the spam.
102)     </p>

103) 

104)     <p>
105)     This is a shame, but notice that spammers are already doing great
106)     without Tor. Also, remember that many of their more subtle communication
107)     mechanisms (like spoofed UDP packets) can't be used over Tor, because
108)     it only transports correctly-formed TCP connections.
109)     </p>

110) 

111)     <a id="ExitPolicies"></a>
112)     <h3><a class="anchor" href="#ExitPolicies">How do Tor exit policies work?</a></h3>

113) 

114)     <p>

115)     <a href="<page docs/faq>#ExitPolicies">See the main FAQ</a>

116)     </p>

117) 

118)     <a id="HowMuchAbuse"></a>
119)     <h3><a class="anchor" href="#HowMuchAbuse">Does Tor get much abuse?</a></h3>

120) 

121)     <p>Not much, in the grand scheme of things. The network has been running

122)     since October 2003, and it's only generated a handful of complaints. Of

123)     course, like all privacy-oriented networks on the net, it attracts its

124)     share of jerks. Tor's exit policies help separate the role of "willing
125)     to donate resources to the network" from the role of "willing to deal
126)     with exit abuse complaints," so we hope our network is more sustainable
127)     than past attempts at anonymity networks. </p>

128) 

129)     <p>Since Tor has

130)     <a href="<page about/torusers>">many good uses as

131)     well</a>, we feel that we're doing pretty well at striking a balance
132)     currently. </p>

133) 

134)     <a id="TypicalAbuses"></a>
135)     <h3><a class="anchor" href="#TypicalAbuses">So what should I expect if I run an exit relay?</a></h3>

136) 

137)     <p>If you run a Tor relay that allows exit connections (such as the
138)     default exit policy), it's probably safe to say that you will eventually
139)     hear from somebody. Abuse
140)     complaints may come in a variety of forms. For example: </p>
141)     <ul>
142)     <li>Somebody connects to Hotmail, and sends a ransom note to a
143)     company. The
144)     FBI sends you a polite email, you explain that you run a Tor relay,
145)     and they say "oh well" and leave you alone. [Port 80]</li>
146)     <li>Somebody tries to get you shut down by using Tor to connect to Google
147)     groups and post spam to Usenet, and then sends an angry mail to
148)     your ISP about how you're destroying the world. [Port 80]</li>
149)     <li>Somebody connects to an IRC network and makes a nuisance of
150)     himself. Your ISP gets polite mail about how your computer has been
151)     compromised; and/or your computer gets DDoSed. [Port 6667]</li>
152)     <li>Somebody uses Tor to download a Vin Diesel movie, and
153)     your ISP gets a DMCA takedown notice. See EFF's
154)     <a href="<page eff/tor-dmca-response>">Tor DMCA Response
155)     Template</a>, which explains why your ISP can probably ignore
156)     the notice without any liability. [Arbitrary ports]</li>
157)     </ul>

158) 

159)     <p>Some hosting providers are friendlier than others when it comes to Tor

160)     exits. For a listing see the <a href="<wiki>doc/GoodBadISPs">good and bad

161)     ISPs wiki</a>.</p>

162) 

163)     <p>For a complete set of template responses to different abuse complaint
164)     types, see <a

165)     href="<wiki>doc/TorAbuseTemplates">the collection of templates

166)     on the Tor wiki</a>. You can also proactively reduce the amount of abuse you
167)     get by following <a href="<blog>tips-running-exit-node-minimal-harassment">these tips

168)     for running an exit node with minimal harassment</a> and <a

169)     href="<wiki>doc/ReducedExitPolicy">running a reduced exit policy</a>.</p>

170) 

171)     <p>You might also find that your Tor relay's IP is blocked from accessing
172)     some Internet sites/services. This might happen regardless of your exit
173)     policy, because some groups don't seem to know or care that Tor has
174)     exit policies. (If you have a spare IP not used for other activities,
175)     you might consider running your Tor relay on it.) For example, </p>

176) 

177)     <ul>
178)     <li>Because of a few cases of anonymous jerks messing with its web
179)     pages, Wikipedia is currently blocking many Tor relay IPs from writing
180)     (reading still works). We're talking to Wikipedia about how they might
181)     control abuse while still providing access to anonymous contributors,
182)     who often have hot news or inside info on a topic but don't want to risk
183)     revealing their identities when publishing it (or don't want to reveal
184)     to local observers that they're accessing Wikipedia). Slashdot is also
185)     in the same boat.</li>

186) 

187)     <li>SORBS is putting some Tor relay IPs on their email
188)     blacklist as well. They do this because they passively detect whether your
189)     relay connects to certain IRC networks, and they conclude from this that
190)     your relay is capable of spamming. We tried to work with
191)     them to teach them that not all software works this way,
192)     but we have given up. We recommend you avoid them, and <a
193)     href="http://paulgraham.com/spamhausblacklist.html">teach your friends
194)     (if they use them) to avoid abusive blacklists too</a>.</li>

195) 

196)     </ul>

197) 

198)     <a id="IrcBans"></a>
199)     <h3><a class="anchor" href="#IrcBans">Tor is banned from the IRC network I want to use.</a></h3>

200) 

201)     <p>Sometimes jerks make use of Tor to troll IRC channels. This abuse
202)     results in IP-specific temporary bans ("klines" in IRC lingo), as the
203)     network operators try to keep the troll off of their network. </p>

204) 

205)     <p>This response underscores a fundamental flaw in IRC's security model:
206)     they assume that IP addresses equate to humans, and by banning the
207)     IP address they can ban the human. In reality this is not the case &mdash;
208)     many such trolls routinely make use of the literally millions of open
209)     proxies and compromised computers around the Internet. The IRC networks
210)     are fighting a losing battle of trying to block all these nodes,
211)     and an entire cottage industry of blacklists and counter-trolls has
212)     sprung up based on this flawed security model (not unlike the antivirus
213)     industry). The Tor network is just a drop in the bucket here. </p>

214) 

215)     <p>On the other hand, from the viewpoint of IRC server operators, security
216)     is not an all-or-nothing thing.  By responding quickly to trolls or
217)     any other social attack, it may be possible to make the attack scenario
218)     less attractive to the attacker.  And most individual IP addresses do
219)     equate to individual humans, on any given IRC network at any given time.
220)     The exceptions include NAT gateways which may be allocated access as
221)     special cases. While it's a losing battle to try to stop the use of open
222)     proxies, it's not generally a losing battle to keep klining a single
223)     ill-behaved IRC user until that user gets bored and goes away. </p>

224) 

225)     <p>But the real answer is to implement application-level auth systems,
226)     to let in well-behaving users and keep out badly-behaving users. This
227)     needs to be based on some property of the human (such as a password he
228)     knows), not some property of the way his packets are transported. </p>

229) 

230)     <p>Of course, not all IRC networks are trying to ban Tor nodes. After
231)     all, quite a few people use Tor to IRC in privacy in order to carry
232)     on legitimate communications without tying them to their real-world
233)     identity. Each IRC network needs to decide for itself if blocking a few
234)     more of the millions of IPs that bad people can use is worth losing the
235)     contributions from the well-behaved Tor users. </p>

236) 

237)     <p>If you're being blocked, have a discussion with the network operators
238)     and explain the issues to them. They may not be aware of the existence of
239)     Tor at all, or they may not be aware that the hostnames they're klining
240)     are Tor exit nodes.  If you explain the problem, and they conclude that
241)     Tor ought to be blocked, you may want to consider moving to a network that
242)     is more open to free speech.  Maybe inviting them to #tor on irc.oftc.net
243)     will help show them that we are not all evil people. </p>

244) 

245)     <p>Finally, if you become aware of an IRC network that seems to be
246)     blocking Tor, or a single Tor exit node, please put that information on <a

247)     href="<wiki>doc/BlockingIrc">The Tor

248)     IRC block tracker</a>
249)     so that others can share.  At least one IRC network consults that page
250)     to unblock exit nodes that have been blocked inadvertently. </p>

251) 

252)     <a id="SMTPBans"></a>
253)     <h3><a class="anchor" href="#SMTPBans">Your nodes are banned from the mail server I want to use.</a></h3>

254) 

255)     <p>Even though <a href="#WhatAboutSpammers">Tor isn't useful for
256)     spamming</a>, some over-zealous blacklisters seem to think that all
257)     open networks like Tor are evil &mdash; they attempt to strong-arm network
258)     administrators on policy, service, and routing issues, and then extract
259)     ransoms from victims. </p>

260) 

261)     <p>If your server administrators decide to make use of these
262)     blacklists to refuse incoming mail, you should have a conversation with
263)     them and explain about Tor and Tor's exit policies. </p>

264) 

265)     <a id="Bans"></a>
266)     <h3><a class="anchor" href="#Bans">I want to ban the Tor network from my service.</a></h3>

267) 

268)     <p>We're sorry to hear that. There are some situations where it makes
269)     sense to block anonymous users for an Internet service. But in many
270)     cases, there are easier solutions that can solve your problem while
271)     still allowing users to access your website securely.</p>

272) 

273)     <p>First, ask yourself if there's a way to do application-level decisions
274)     to separate the legitimate users from the jerks. For example, you might
275)     have certain areas of the site, or certain privileges like posting,
276)     available only to people who are registered. It's easy to build an
277)     up-to-date list of Tor IP addresses that allow connections to your
278)     service, so you could set up this distinction only for Tor users. This
279)     way you can have multi-tiered access and not have to ban every aspect
280)     of your service. </p>

281) 

282)     <p>For example, the <a
283)     href="http://freenode.net/policy.shtml#tor">Freenode IRC network</a>
284)     had a problem with a coordinated group of abusers joining channels and
285)     subtly taking over the conversation; but when they labelled all users
286)     coming from Tor nodes as "anonymous users," removing the ability of the
287)     abusers to blend in, the abusers moved back to using their open proxies
288)     and bot networks. </p>

289) 

290)     <p>Second, consider that hundreds of thousands of
291)     people use Tor every day simply for
292)     good data hygiene &mdash; for example, to protect against data-gathering
293)     advertising companies while going about their normal activities. Others
294)     use Tor because it's their only way to get past restrictive local
295)     firewalls. Some Tor users may be legitimately connecting
296)     to your service right now to carry on normal activities. You need to
297)     decide whether banning the Tor network is worth losing the contributions
298)     of these users, as well as potential future legitimate users. (Often
299)     people don't have a good measure of how many polite Tor users are
300)     connecting to their service &mdash; you never notice them until there's
301)     an impolite one.)</p>

302) 

303)     <p>At this point, you should also ask yourself what you do about other
304)     services that aggregate many users behind a few IP addresses. Tor is
305)     not so different from AOL in this respect.</p>

306) 

307)     <p>Lastly, please remember that Tor relays have <a

308)     href="<page docs/faq>#ExitPolicies">individual exit policies</a>. Many
309)     Tor relays do

310)     not allow exiting connections at all. Many of those that do allow some
311)     exit connections might already disallow connections to
312)     your service. When you go about banning nodes, you should parse the
313)     exit policies and only block the ones that allow these connections;
314)     and you should keep in mind that exit policies can change (as well as
315)     the overall list of nodes in the network).</p>

316) 

317)     <p>If you really want to do this, we provide a
318)     <a href="https://check.torproject.org/cgi-bin/TorBulkExitList.py">Tor
319)     exit relay list</a> or a
320)     <a href="<page projects/tordnsel>">DNS-based list you can query</a>.
321)     </p>

322) 

323)     <p>
324)     (Some system administrators block ranges of IP addresses because of
325)     official policy or some abuse pattern, but some have also asked about
326)     whitelisting Tor exit relays because they want to permit access to their
327)     systems only using Tor. These scripts are usable for whitelisting as well.)
328)     </p>

329) 

330)     <a id="TracingUsers"></a>
331)     <h3><a class="anchor" href="#TracingUsers">I have a compelling reason to trace a Tor user. Can you help?</a></h3>

332) 

333)     <p>
334)     There is nothing the Tor developers can do to trace Tor users. The same
335)     protections that keep bad people from breaking Tor's anonymity also
336)     prevent us from figuring out what's going on.
337)     </p>

338) 

339)     <p>
340)     Some fans have suggested that we redesign Tor to include a <a

341)     href="<page docs/faq>#Backdoor">backdoor</a>.

342)     There are two problems with this idea. First, it technically weakens the
343)     system too far. Having a central way to link users to their activities
344)     is a gaping hole for all sorts of attackers; and the policy mechanisms
345)     needed to ensure correct handling of this responsibility are enormous
346)     and unsolved. Second, the bad people <a href="#WhatAboutCriminals">aren't
347)     going to get caught by this anyway</a>, since they will use other means
348)     to ensure their anonymity (identity theft, compromising computers and
349)     using them as bounce points, etc).
350)     </p>

351) 
352)     <p>
353)     This ultimately means that it is the responsibility of site owners to protect
354)     themselves against compromise and security issues that can come from
355)     anywhere. This is just part of signing up for the benefits of the
356)     Internet. You must be prepared to secure yourself against the bad elements,
357)     wherever they may come from. Tracking and increased surveillance are not
358)     the answer to preventing abuse.
359)     </p>
360) 

361)     <p>
362)     But remember that this doesn't mean that Tor is invulnerable. Traditional
363)     police techniques can still be very effective against Tor, such as

364)     investigating means, motive, and opportunity, interviewing suspects,
365)     writing style analysis, technical analysis of the content itself, sting operations,
366)     keyboard taps, and other physical investigations. The Tor Project is also happy to work with everyone
367)     including law enforcement groups to train them how to use the Tor software to safely conduct
368)     investigations or anonymized activities online.

369)     </p>

370) 
371) 

372)     <a id="RemoveContent"></a>
373)     <h3><a class="anchor" href="#RemoveContent">I want some content removed from a .onion address.</a></h3>
374)     <p>The Tor Project does not host, control, nor have the ability to
375)     discover the owner or location of a .onion address.  The .onion address is
376)     an address from <a href="<page docs/hidden-services>">a hidden
377)     service</a>.  The name you see ending in .onion is a hidden service descriptor.
378)     It's an automatically generated name which can be located on any Tor
379)     relay or client anywhere on the Internet.  Hidden services are designed
380)     to protect both the user and service provider from discovering who they
381)     are and where they are from.  The design of hidden services means the
382)     owner and location of the .onion site is hidden even from us.</p>
383)     <p>But remember that this doesn't mean that hidden services are
384)     invulnerable. Traditional police techniques can still be very effective

385)     against them, such as interviewing suspects, writing style analysis,
386)     technical analysis of the content itself, sting operations, keyboard taps,
387)     and other physical investigations.</p>
388) 

389)     <p>If you have a complaint about child abuse materials, you may wish to report

390)     it to the National Center for Missing and Exploited Children, which serves
391)     as a national coordination point for investigation of child pornography:
392)     <a href="http://www.missingkids.com/">http://www.missingkids.com/</a>.
393)     We do not view links you report.</p>

394) 

395)     <a id="AbuseOpinion"></a>
396)     <h3><a class="anchor" href="#AbuseOpinion">Where does Tor Project

397) stand on abusers using technology?</a></h3>

398) 
399)     <p>We take abuse seriously. Activists and law enforcement
400) use Tor to investigate abuse and help support survivors. We
401) work with them to help them understand how Tor can help their work.
402) In some cases, technological mistakes are being made and we help to
403) correct them. Because some people in survivors' communities embrace
404) stigma instead of compassion, seeking support from fellow victims
405) requires privacy-preserving technology.</p>
406) 
407)     <p>Our refusal to build backdoors and censorship into Tor is not
408)   because of a lack of concern. We refuse to weaken Tor because it
409) would harm efforts to combat child abuse and human trafficking in the
410) physical world, while removing safe spaces for victims online.
411) Meanwhile, criminals would still have access to botnets, stolen
412) phones, hacked hosting accounts, the postal system, couriers, corrupt
413) officials, and whatever technology emerges to trade content. They are

414) early adopters of technology. In the face of this, it is dangerous for

415) policymakers to assume that blocking and filtering is sufficient. We
416) are more interested in helping efforts to halt and prevent child
417) abuse than helping politicians score points with constituents by

418) hiding it. The role of corruption is especially troubling; see this

419) United Nations report on <a
420) href="http://www.unodc.org/documents/human-trafficking/2011/
421) Issue_Paper_-_The_Role_of_Corruption_in_Trafficking_in_Persons.pdf">The
422) Role of Corruption in Trafficking in Persons</a>.</p>
423) 
424)     <p>Finally, it is important to consider the world that children will
425)     encounter as adults when enacting policy in their name. Will they
426)     thank us if they are unable to voice their opinions safely as
427) adults? What if they are trying to expose a failure of the state to
428) protect other children?</p>
429) 

430)     <a id="LegalQuestions"></a>

431)     <h3><a class="anchor" href="#LegalQuestions">I have legal questions
432) about Tor abuse.</a></h3>
433) 

434)     <p>We're only the developers. We can answer technical questions, but
435)     we're not the ones to talk to about legal questions or concerns. </p>

436) 

437)     <p>Please take a look at the
438)     <a href="<page eff/tor-legal-faq>">Tor Legal FAQ</a>,
439)     and contact EFF directly if you have any further legal questions. </p>
440)   </div>
441)   <!-- END MAINCOL -->
442)   <div id = "sidecol">
443) #include "side.wmi"
444) #include "info.wmi"
445)   </div>
446)   <!-- END SIDECOL -->
447) </div>
448) <!-- END CONTENT -->