Dark web doesn't exist, says Tor's Dingledine. And folks use network for privacy, not crime

Cofounder brings us up to date on network status

DEF CON A Tor Project grandee sought to correct some misconceptions about the anonymizing network during a presentation at the DEF CON hacking convention in Las Vegas on Friday.

Roger Dingledine, one of the three founders of the Tor Project, castigated journos for mischaracterizing the pro-privacy system as a bolthole exclusively used by drug dealers and pedophiles to hide from the authorities.

In fact, he said, only three per cent of Tor users connect to hidden services, suggesting the vast majority of folks on the network are using it to anonymously browse public websites for completely legit purposes. In other words, netizens – from journalists to activists to normal peeps – use Tor to mask their identities from website owners, and it's not just underworld villains.

Dingledine even went as far as saying the dark web – a landscape of websites concealed within networks like Tor – is so insignificant, it can be discounted.

“There is basically no dark web. It doesn’t exist,” he told his DEF CON audience. “It’s only a very few webpages.”

The most popular website visited by Tor users was Facebook, Dingledine said. In 2014 the ad giant embraced Tor, setting up a hidden service as a portal to its social network. Now over a million people log into Mark Zuckerberg's empire using the anonymizing network. It’s a tiny percentage of Facebook’s billion-plus user base, but very significant for a project like Tor, Dingledine said.

He also sought to calm those who fear that the world’s intelligence agencies have infiltrated the network by running large numbers of relay nodes in order to unmask Tor users. Leaks from the whistleblower Edward Snowden showed that yes, a number of nodes had been run by government snoops, Dingledine said, but not very many – not enough to compromise the integrity of the mesh.

Dingledine said that he knew about two thirds of the people running Tor relays and could vouch for them. Intelligence agencies didn’t need to set up their own stepping-stone nodes he said, since they could – if they wanted to – just monitor those who did run them.

Meanwhile, the Tor Project this week pushed out a security fix following an interesting discovery reported via its new bug bounty program. A chap called Julian Jackson found that it was possible, on some Linux systems, for a malicious URL to make Firefox bypass the Tor network and reveal the user's public IP address. If you're using Linux and Tor, check for a security update.

Firefox is still the preferred browser for Tor, Dingledine said, and Chrome is still causing concern due to its proxy bypasses. The project's software is also being updated to allow for simpler and more secure hosting of sites.

The biggest need is Windows developers, we were told. Most Tor staff are Linux users, but the project is used by heaps of folks on Windows. As a result the project needs coders conversant in Microsoft's operating system.

A benefit of the Snowden leaks is that Tor is seen as the best option for anonymous web use. Dingledine quoted top-secret Five Eyes documents that were backhandedly complimentary about the service. Tor was “the king of high security low latency internet anonymity,” GCHQ said. “There are no other contenders for the throne.” ®