tor-webwml.git

@@ -47,16 +48,17 @@

 <h3>Doesn't Tor enable criminals to do bad things?</h3>

-<p>Criminals can already do bad things. Since they're willing to break laws, they already have lots of options available that provide _better_ privacy than Tor provides. They can steal cell phones, use them, and throw them in a ditch; they can crack into computers in Korea or Brazil and use them to launch abusive activities; they can spread viruses that take control of literally millions of Windows machines around the world. </p>

+<p>Criminals can already do bad things. Since they're willing to break

+laws, they already have lots of options available that provide <em>better</em> privacy than Tor provides. They can steal cell phones, use them, and throw them in a ditch; they can crack into computers in Korea or Brazil and use them to launch abusive activities; they can spread viruses that take control of literally millions of Windows machines around the world. </p>

 <p>Tor aims to provide protection for ordinary people who want to follow the law. Only criminals have privacy right now; we need to fix that. </p>

 <p> </p>

 <h3>Isn't it just a tradeoff: accepting the bad uses for the good ones?</h3>

 <p>No, we don't think that's how it works in the case of Tor. </p>

-<p>There are lots of ways to get anonymity on the net, some legal and some illegal. As we explained <a href="#WhatAboutCriminals">above</a>, many of the illegal approaches can provide stronger anonymity than Tor can provide, because they can control literally millions of computers via spyware, viruses, and other techniques. </p>

+<p>There are lots of ways to get anonymity on the net, some legal and some illegal. As we explained above, many of the illegal approaches can provide stronger anonymity than Tor can provide, because they can control literally millions of computers via spyware, viruses, and other techniques. </p>

 <p>Criminals and other bad people have the motivation to learn how to get good anonymity, and many have the motivation to pay well to achieve it. Being able to steal and reuse the identities of innocent victims (identify theft) makes it even easier. Normal people, on the other hand, don't typically have the time or money to spend figuring out how to get privacy online. This is the worst of all possible worlds. </p>

-<p>So yes, criminals could in theory use Tor, but they already have better options, and it seems unlikely that taking Tor away from the world will stop them from doing their bad things. At the same time, Tor and other privacy measures can *fight* identity theft, physical crimes like stalking, and so on. </p>

+<p>So yes, criminals could in theory use Tor, but they already have better options, and it seems unlikely that taking Tor away from the world will stop them from doing their bad things. At the same time, Tor and other privacy measures can <em>fight</em> identity theft, physical crimes like stalking, and so on. </p>

 <p> </p>

 <h3>What about distributed denial of service attacks?</h3>

@@ -91,18 +93,18 @@

 <ul>

 <li><p> Somebody connects to hotmail, and sends a criminal mail somewhere. The FBI sends you a polite email, you explain that you run a Tor server, and they say 'oh well' and leave you alone. [Port 80] </p>

 </li>

-<li class="gap"><p> Somebody tries to get you shut down by using Tor to connect to google groups and posting spam to usenet, and then sending an angry mail to your ISP about how you're destroying the world. [Port 80] </p>

+<li><p> Somebody tries to get you shut down by using Tor to connect to google groups and posting spam to usenet, and then sending an angry mail to your ISP about how you're destroying the world. [Port 80] </p>

 </li>

-<li class="gap"><p> Somebody connects to an irc network and makes a nuisance of himself. Your ISP gets polite mail about how your computer has been compromised; and/or your computer gets ddosed. [Port 6667] </p>

+<li><p> Somebody connects to an irc network and makes a nuisance of himself. Your ISP gets polite mail about how your computer has been compromised; and/or your computer gets ddosed. [Port 6667] </p>

 </li>

-<li class="gap"><p> Somebody uses Tor to download a Vin Diesel movie, and your ISP gets a DMCA takedown notice. According to our lawyers (and this convinced the Harvard general counsel), your ISP can totally ignore this notice with no liability problems. See <a class="external" href="http://tor.eff.org/eff/tor-dmca-response.html">http://tor.eff.org/eff/tor-dmca-response.html</a>. [Arbitrary ports] </p>

+<li><p> Somebody uses Tor to download a Vin Diesel movie, and your ISP gets a DMCA takedown notice. According to our lawyers (and this convinced the Harvard general counsel), your ISP can totally ignore this notice with no liability problems. See <a href="http://tor.eff.org/eff/tor-dmca-response.html">Tor DMCA Response</a>. [Arbitrary ports] </p>

 </li>

 </ul>

 <p>You might also find that your Tor server's IP is blocked from accessing some Internet sites/services. This might happen regardless of your exit policy, because some groups don't seem to know or care that Tor has exit policies. (If you have a spare IP not used for other activities, you might consider running your Tor server on it.) For example, </p>

 <ul>

 <li><p> Wikipedia is currently blocking many Tor server IPs from writing (reading still works), because they haven't figured out internally how to deal with the fact that they want to provide open access but they also have no ways to control abuse to their website. We're working with them to resolve this. </p>

 </li>

-<li class="gap"><p> It seems that SORBS is putting some Tor server IPs on their email blacklist as well. They do this because they passively detect whether your server connects to certain IRC networks, and they conclude from this that your server is capable of spamming. We're working with them to teach them that not all software works this way. Until then, we recommend you avoid them, and teach your friends (if they use them) to avoid them too. </p>

+<li><p> It seems that SORBS is putting some Tor server IPs on their email blacklist as well. They do this because they passively detect whether your server connects to certain IRC networks, and they conclude from this that your server is capable of spamming. We're working with them to teach them that not all software works this way. Until then, we recommend you avoid them, and teach your friends (if they use them) to avoid them too. </p>

 </li>

 </ul>

 <p> </p>

@@ -122,7 +124,7 @@ blocking Tor, or a single Tor exit node, please put that information on

 <h3>Your nodes are banned from the mail server I want to use.</h3>

-<p>Even though <a class="external" href="http://wiki.noreply.org/wiki/TheOnionRouter/TorFAQ#WhatAboutSpammers">Tor isn't useful for spamming</a>, some over-zealous blacklisters seem to think that all open networks like Tor should be boycotted. They don't understand how Tor works (e.g. that it has exit policies), and don't seem to care to understand it. If your server administrators decide to make use of these blacklists to refuse incoming mail, you should have a conversation with them and explain how Tor works. </p>

+<p>Even though <a href="http://wiki.noreply.org/wiki/TheOnionRouter/TorFAQ#WhatAboutSpammers">Tor isn't useful for spamming</a>, some over-zealous blacklisters seem to think that all open networks like Tor should be boycotted. They don't understand how Tor works (e.g. that it has exit policies), and don't seem to care to understand it. If your server administrators decide to make use of these blacklists to refuse incoming mail, you should have a conversation with them and explain how Tor works. </p>

 <p> </p>

 <h3>I want to ban the Tor network from my service.</h3>

@@ -130,13 +132,13 @@ blocking Tor, or a single Tor exit node, please put that information on

 <p>First, ask yourself if there's a way to do application-level decisions to separate the legitimate users from the jerks. For example, you might have certain areas of the site, or certain privileges like posting, available only to people who are registered. You could set up this distinction only for certain IP addresses such as Tor exit nodes. This way you can have multi-tiered access and not have to ban everything. </p>

 <p>Second, consider that thousands of people use Tor every day to protect against data-gathering corporations like Doubleclick while going about their normal  activities. Some Tor users may be legitimately connecting to your service right now to carry on normal activities. You need to decide whether banning the Tor network is worth losing the contributions of these users, as well as potential future such users. </p>

 <p>Lastly, please remember that Tor servers have individual exit policies. Many Tor servers do not allow exiting connections at all. Many of those that do, probably already disallow connections to your service. When you go about banning nodes, you should parse the exit policies and only block the ones that allow these connections; and you should keep in mind that exit policies can change (as well as the overall list of nodes in the network). </p>

-<p>If you really want to do this, there is a python script to parse the Tor directory <a class="external" href="http://tor.eff.org/cvs/tor/contrib/exitlist">here</a>. </p>

+<p>If you really want to do this, there is a python script to parse the Tor directory <a href="http://tor.eff.org/cvs/tor/contrib/exitlist">here</a>. </p>

 <p> </p>

 <h3>I have legal questions about Tor abuse.</h3>

 <p>We're only the developers. We can answer technical questions, but we're not the ones to talk to about legal questions or concerns. </p>

-<p>Please take a look at the <a class="external" href="http://tor.eff.org//eff/tor-legal-faq.html">Tor Legal FAQ</a>, and contact EFF directly if you have any further questions. </p>

+<p>Please take a look at the <a href="http://tor.eff.org//eff/tor-legal-faq.html">Tor Legal FAQ</a>, and contact EFF directly if you have any further questions. </p>

 <p> </p>

   </div><!-- #main -->