faq-abuse.html (0bb2f5c5d) - tor-webwml.git

faq-abuse.html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
 <title>Abuse FAQ for Tor Server Operators</title>
 <meta name="Author" content="Roger Dingledine" />
 <meta http-equiv="content-type" content="text/html; charset=ISO-8859-1" />
 <link rel="stylesheet" type="text/css" href="stylesheet.css" />
 <link rel="shortcut icon" type="image/x-icon" href="/favicon.ico" />
</head>
<body>

<table class="banner" border="0" cellpadding="0" cellspacing="0">
    <tr>
        <td class="banner-left"></td>
        <td class="banner-middle">
            <a href="index.html">Home</a>
          | <a href="howitworks.html">How It Works</a>
          | <a href="download.html">Download</a>
          | <a href="documentation.html">Docs</a>
          | <a href="users.html">Users</a>
          | <a href="faq.html">FAQs</a>
          | <a href="contribute.html">Contribute</a>
          | <a href="developers.html">Developers</a>
          | <a href="research.html">Research</a>
          | <a href="people.html">People</a>
        </td>
        <td class="banner-right"></td>
    </tr>
</table>

<h2>Abuse FAQ for Tor Server Operators</h2>
<hr />

<a id="WhatAboutCriminals"></a>
<h3><a class="anchor" href="#WhatAboutCriminals">Doesn't Tor enable criminals to do bad things?</a></h3>

<p>Criminals can already do bad things. Since they're willing to
break laws, they already have lots of options available that provide
<em>better</em> privacy than Tor provides. They can steal cell phones,
use them, and throw them in a ditch; they can crack into computers
in Korea or Brazil and use them to launch abusive activities; they
can spread viruses that take control of literally millions of Windows
machines around the world. </p>

<p>Tor aims to provide protection for ordinary people who want to follow
the law. Only criminals have privacy right now; we need to fix that. </p>

<a id="Tradeoff"></a>
<h3><a class="anchor" href="#Tradeoff">Isn't it just a tradeoff: accepting the bad uses for the good ones?</a></h3>

<p>No, we don't think that's how it works in the case of Tor. </p>

<p>There are lots of ways to get anonymity on the net, some legal and
some illegal. As we explained above, many of the illegal approaches
can provide stronger anonymity than Tor can provide, because they can
control literally millions of computers via spyware, viruses, and other
techniques. </p>

<p>Criminals and other bad people have the motivation to learn how to
get good anonymity, and many have the motivation to pay well to achieve
it. Being able to steal and reuse the identities of innocent victims
(identify theft) makes it even easier. Normal people, on the other hand,
don't typically have the time or money to spend figuring out how to get
privacy online. This is the worst of all possible worlds. </p>

<p>So yes, criminals could in theory use Tor, but they already have
better options, and it seems unlikely that taking Tor away from the
world will stop them from doing their bad things. At the same time, Tor
and other privacy measures can <em>fight</em> identity theft, physical
crimes like stalking, and so on. </p>

<a id="DDoS"></a>
<h3><a class="anchor" href="#DDoS">What about distributed denial of service attacks?</a></h3>

<p>Distributed denial of service attacks typically rely on having a group
of thousands of computers all sending floods of traffic to a victim. Since
the goal is to overpower the bandwidth of the victim, they typically send
UDP packets since those don't require handshakes or coordination. </p>

<p>But because Tor only transports correctly-formed TCP streams, not
all IP packets, you cannot send UDP packets over Tor. (You can't do
specialized forms of this attack like SYN flooding either.) So ordinary
DDoS attacks are not possible over Tor. Tor also doesn't allow bandwidth
amplification attacks against external sites: you need to send in a byte
for every byte that the Tor network will send to your destination. So
in general, attackers who control enough bandwidth to launch an effective
DDoS attack can do it just fine without Tor. </p>

<p>And if this argument doesn't convince you, go try Tor and see how
much aggregate throughput you can eke out of it, then come back to us
if you're still worried. </p>

<a id="WhatAboutSpammers"></a>
<h3><a class="anchor" href="#WhatAboutSpammers">What about spammers?</a></h3>

<p>The simple answer: The default Tor exit policy rejects all outgoing
port 25 (SMTP) traffic. So sending spam mail through Tor isn't going to
work by default. It's possible that some server operators will enable
port 25 on their particular exit node, in which case that computer will
allow outgoing mails; but that individual could just set up an open mail
relay too, independent of Tor. In short, Tor isn't useful for spammers,
because nearly all Tor servers refuse to deliver their mail. </p>

<p>The complex answer: Even if the above were not true, spammers are
already doing great without Tor. They
have armies of compromised computers that do their spamming. The added
complexity of getting new software installed and configured, and doing
Tor's public key operations, etc, makes it not economically worthwhile
for them to use Tor. </p>

<a id="ExitPolicies"></a>
<h3><a class="anchor" href="#ExitPolicies">How do Tor exit policies work?</a></h3>

<p>Each Tor server has an exit policy that specifies what sort of
outbound connections are allowed or refused from that server. The exit
policies are propagated to the client via the directory, so clients
will automatically avoid picking exit nodes that would refuse to exit
to their intended destination. </p>

<p>This way each server can decide the services he wants to allow
connections to, based on abuse potential and his own situation. </p>

<a id="HowMuchAbuse"></a>
<h3><a class="anchor" href="#HowMuchAbuse">Does Tor get much abuse?</a></h3>

<p>Not much, in the grand scheme of things. We've been running the network
since October 2003, and it's only generated a handful of complaints. Of
course, like all privacy-oriented networks on the net, we attract our
share of jerks. Tor's exit policies help separate the role of "willing
to donate resources to the network" from the role of "willing to deal
with exit abuse complaints", so we hope our network is more sustainable
than past attempts at anonymity networks. </p>

<p>Since Tor has <a
href="http://tor.eff.org/cvs/tor/doc/tor-doc.html">many good uses as
well</a>, we feel that we're doing pretty well at striking a balance
currently. </p>

<a id="TypicalAbuses"></a>
<h3><a class="anchor" href="#TypicalAbuses">So what should I expect if I run a server?</a></h3>

<p>If you run a Tor server that allows exit connections (such as the
default exit policy), it's probably safe to say that you will eventually
hear from somebody. Abuse complaints can come in a variety of forms. The
main ones so far have taken the following form: </p>
<ul>
<li>Somebody connects to hotmail, and sends a criminal mail somewhere. The
FBI sends you a polite email, you explain that you run a Tor server,
and they say 'oh well' and leave you alone. [Port 80]</li>
<li>Somebody tries to get you shut down by using Tor to connect to google
groups and post spam to usenet, and then sending an angry mail to
your ISP about how you're destroying the world. [Port 80]</li>
<li>Somebody connects to an irc network and makes a nuisance of
himself. Your ISP gets polite mail about how your computer has been
compromised; and/or your computer gets ddosed. [Port 6667]</li>
<li>Somebody uses Tor to download a Vin Diesel movie, and
your ISP gets a DMCA takedown notice. According to our lawyers
(and this convinced the Harvard general counsel), your ISP can
totally ignore this notice with no liability problems. See EFF's <a
href="http://tor.eff.org/eff/tor-dmca-response.html">Tor DMCA
Response Template</a>. [Arbitrary ports]</li>
</ul>

<p>You might also find that your Tor server's IP is blocked from accessing
some Internet sites/services. This might happen regardless of your exit
policy, because some groups don't seem to know or care that Tor has
exit policies. (If you have a spare IP not used for other activities,
you might consider running your Tor server on it.) For example, </p>

<ul>
<li>Wikipedia is currently blocking many Tor server IPs from writing
(reading still works), because they haven't figured out internally how
to deal with the fact that they want to provide open access but they
also have no ways to control abuse to their website. We're working with
them to resolve this.</li>
<li>It seems that SORBS is putting some Tor server IPs on their email
blacklist as well. They do this because they passively detect whether your
server connects to certain IRC networks, and they conclude from this that
your server is capable of spamming. We're working with them to teach them
that not all software works this way. Until then, we recommend you avoid
them, and teach your friends (if they use them) to avoid them too.</li>
</ul>

<a id="IrcBans"></a>
<h3><a class="anchor" href="#IrcBans">Tor is banned from the IRC network I want to use.</a></h3>

<p>Sometimes jerks make use of Tor to troll IRC channels. This abuse
results in IP-specific temporary bans ("klines" in IRC lingo), as the
network operators try to keep the troll off of their network. </p>

<p>This response underscores a fundamental flaw in IRC's security model:
they assume that IP addresses equate to humans, and by banning the
IP address they can ban the human. In reality this is not the case --
many such trolls routinely make use of the literally millions of open
proxies and compromised computers around the Internet. The IRC networks
are fighting a losing battle of trying to block all these nodes,
and an entire cottage industry of blacklists and counter-trolls has
sprung up based on this flawed security model (not unlike the antivirus
industry). The Tor network is just a drop in the bucket here. </p>

<p>On the other hand, from the viewpoint of IRC server operators, security
is not an all-or-nothing thing.  By responding quickly to trolls or
any other social attack, it may be possible to make the attack scenario
less attractive to the attacker.  And most individual IP addresses do
equate to individual humans, on any given IRC network at any given time.
The exceptions include NAT gateways which may be allocated access as
special cases. While it's a losing battle to try to stop the use of open
proxies, it's not generally a losing battle to keep klining a single
ill-behaved IRC user until that user gets bored and goes away. </p>

<p>But the real answer is to implement application-level auth systems,
to let in well-behaving users and keep out badly-behaving users. This
needs to be based on some property of the human (such as a password he
knows), not some property of the way his packets are transported. </p>

<p>Of course, not all IRC networks are trying to ban Tor nodes. After
all, quite a few people use Tor to IRC in privacy in order to carry
on legitimate communications without tying them to their real-world
identity. Each IRC network needs to decide for itself if blocking a few
more of the millions of IPs that bad people can use is worth losing the
contributions from the well-behaved Tor users. </p>

<p>If you're being blocked, have a discussion with the network operators
and explain the issues to them. They may not be aware of the existence of
Tor at all, or they may not be aware that the hostnames they're klining
are Tor exit nodes.  If you explain the problem, and they conclude that
Tor ought to be blocked, you may want to consider moving to a network that
is more open to free speech.  Maybe inviting them to #tor on irc.oftc.net
will help show them that we are not all evil people. </p>

<p>Finally, if you become aware of an IRC network that seems to be
blocking Tor, or a single Tor exit node, please put that information on <a
href="http://wiki.noreply.org/wiki/TheOnionRouter/BlockingIrc">The Tor
IRC block tracker</a>
so that others can share.  At least one IRC network consults that page
to unblock exit nodes that have been blocked inadvertently. </p>

<a id="SMTPBans"></a>
<h3><a class="anchor" href="#SMTPBans">Your nodes are banned from the mail server I want to use.</a></h3>

<p>Even though <a href="#WhatAboutSpammers">Tor isn't useful for
spamming</a>, some over-zealous blacklisters seem to think that all
open networks like Tor should be boycotted. They don't understand how
Tor works (e.g. that it has exit policies), and don't seem to care to
understand it. If your server administrators decide to make use of these
blacklists to refuse incoming mail, you should have a conversation with
them and explain how Tor works. </p>

<a id="Bans"></a>
<h3><a class="anchor" href="#Bans">I want to ban the Tor network from my service.</a></h3>

<p>First, ask yourself if there's a way to do application-level decisions
to separate the legitimate users from the jerks. For example, you might
have certain areas of the site, or certain privileges like posting,
available only to people who are registered. You could set up this
distinction only for certain IP addresses such as Tor exit nodes. This
way you can have multi-tiered access and not have to ban everything. </p>

<p>Second, consider that thousands of people use Tor every day to protect
against data-gathering corporations like Doubleclick while going about
their normal  activities. Some Tor users may be legitimately connecting
to your service right now to carry on normal activities. You need to
decide whether banning the Tor network is worth losing the contributions
of these users, as well as potential future such users. </p>

<p>At this point, you should also ask yourself what you do about other
services that aggregate many users behind a few IP addresses. Tor is
not so different from AOL in this respect.</p>

<p>Lastly, please remember that Tor servers have individual exit
policies. Many Tor servers do not allow exiting connections at
all. Many of those that do allow some exit connections probably already
disallow connections to
your service. When you go about banning nodes, you should parse the
exit policies and only block the ones that allow these connections;
and you should keep in mind that exit policies can change (as well as
the overall list of nodes in the network). </p>

<p>If you really want to do this, there is a
python script to parse the Tor directory <a
href="http://tor.eff.org/cvs/tor/contrib/exitlist">here</a>. </p>

<a id="LegalQuestions"></a>
<h3><a class="anchor" href="#LegalQuestions">I have legal questions about Tor abuse.</a></h3>

<p>We're only the developers. We can answer technical questions, but
we're not the ones to talk to about legal questions or concerns. </p>

<p>Please take a look at the <a
href="http://tor.eff.org//eff/tor-legal-faq.html">Tor Legal FAQ</a>,
and contact EFF directly if you have any further legal questions. </p>

</div>
  </div>
    <div class="bottom" id="bottom">
      <i><a href="mailto:tor-webmaster@freehaven.net" class="smalllink">Webmaster</a></i> - $Id$
    </div>
</body>
</html>

tor-webwml.git

added the rest of the anchors to faq-abuse.html