Why would I pay at least 450 euro per month for something I have to run myself? I appreciate that support and maintenance costs are certainly something to pay for, but a high monthly charge when I'm taking all the risk, and paying for the hosting immediately turns me off.
Especially considering the 4 hour SLA on phone support for the enterprise version. If the password management system is down, work stops. I'd rather not have to break the glass on the emergency god account at all.
> Why would I pay at least 450 euro per month for something I have to run myself?
Some people/teams/departments are busy with other things, so that amount is worth the cost of outsourcing a service such that the team members can focus on other things.
Also:
* why would anyone run RHEL when they can run CentOS? (The cost of a service being down is more than the support fee.)
* why would I go to a restaurant when I can cook a meal at home for much less?
* why would I pay for a car wash when a garden house and a sponge worth just as well?
Also also, you may want to actually check what the pricing is:
I'm in charge of a security for a reasonable sized company. I generally support the Tor project and the goals of having a surveillance free internet.
However - if an employee would install tor browser or use tor on a company device, or a device attached to the company network, they would be fired immediately. I would then refer them to law enforcement after conducting a forensic audit.
Should you make your site only available via onion routing, or primarily available on onion routing, all workplaces will immediately block access and look at anyone who accesses with great incredulity
I wasn't as active on the Internet during the initial rise of HTTPS, but I wonder how many companies, schools, and public stores threw the exact same fits back then when they realized there might be a world where they could no longer MITM every web request that went across their routers.
I do remember the "kids who use Linux are hackers" arguments from schools; arguments that still occasionally pop up on rare occasions. And even more recently, I see the pushback from administrators and ISPs over encrypted DNS.
My instinct in this situation is that the "only criminals need privacy" argument is probably evergreen, and that Tor probably isn't in a unique position.
Of course, companies can choose what to install on their own devices, and they can choose what software they'll allow to connect to their networks. The Tor project changes nothing about employers' rights to control and monitor the hardware that they issue. It's normal for workplace networks to have more restrictions than ordinary networks.
Nevertheless, if (beyond those policies) your instinct is that anyone you see using Tor is probably a criminal, then I'm not sure you can honestly claim that you "generally support the Tor project and the goals of having a surveillance free internet." A casual observer would be forgiven for thinking that maybe the opposite is true, and you're terrified of a world where the Internet can't be monitored -- particularly the ordinary, everyday Internet as accessed by regular nontechnical people on their regular, everyday smartphones and laptops.
> I wonder how many companies, schools, and public stores threw the exact same fits back then
Plenty did, but they were typically outgunned by the need for ecommerce transactions. Everyone had to order something with a credit card at some point.
TOR needs to find a mainstream killer-application like that, if it is to ever go beyond the current stereotypical demographic (hacktivists and criminals).
> There is no legitimate use for it in this context
There's no legitimate usage for World of Warcraft on a work computer, and I'd happily ban that from work computers. But I also wouldn't hop onto an unrelated article for new players and imply that all of them were criminals. The linked article never mentions work computers, it's talking to website operators.
If your objection here is that you think Tor is inappropriate at this moment in one specific work setting, then fine, but that's not really adding anything to the conversation about whether or not general websites should be made available over Tor. It's just unrelated FUD.
I want to be clear, the goal of Tor proponents is for everyone to be running Tor (or something similar), and for most websites to be available over Tor by default. People should be running Tor on their smartphones, on their home laptops. Tor should be the default way that people share files with each other, and the default way that people set up technical blogs, or even just quick websites that show off pictures of their cat. The vision of the Tor project is a world where Tor is normal and ubiquitous for regular, non-technical people.
So unless your work policy bans all personal devices from your network, creating an expectation that any smartphone that joins and boots up a Tor browser automatically belongs to a criminal is contrary to the goals of the privacy movement. Our goal is that every device and every website should be private by default. Your network should be the exception, and it should only have company-owned devices on it.
And of course it's fine if you disagree with that, you don't have to be a privacy proponent. Lots of smart, reasonable people disagree with us about what the balance is between security and privacy. But demonizing Tor users in ordinary, everyday contexts is anti-Tor.
> or primarily available on onion routing, all workplaces will immediately block access and look at anyone who accesses with great incredulity
To go a step farther and suggest that making a website available over Tor should automatically mean that people who visit it are suspicious -- that is also anti-Tor and (I would argue) anti-privacy in general.
If I went into an interview for any company in any field offhandedly mentioning that I ran a Tor website, and then had to field a bunch of questions about whether or not I was a criminal, that would be a major red flag to me to avoid that company.
I'm adding my thought that hosting a website on Tor primarily, will make it totally unavailable from many workplaces. Currently, Tor is not the place for a site that doesn't _require_ an extremely high level of anonymity of access.
The network policy does ban all personal devices, in order to control what connections originate from inside the network.
To be clear, I'm not demonizing Tor or Tor users. I like what the Tor project wants to do, and I support it, but believing it will be allowed in many corporate settings, in July 2020, is extremely naive. As I already mentioned, there's no legitimate use case to allow this in a corporate setting.
> There is no legitimate use for it in this context
Do concerns about being tracked between websites suddenly disappear at work? Is it no longer legitimate for an employee to log in to a personal account for non-work purposes via the corporate network on (for example) their lunch break? Etc, etc.
Also I'm a bit confused by your stance given the realities of encryption. Does your network strictly block all outbound traffic that it can't actively MITM? If not, a nefarious employee could proxy their criminal (Tor or other) traffic through an external machine that they controlled. In fact this would be the obvious thing to do as visiting an HTTPS (apparently) website on a personal device would seem much less likely to arouse suspicion.
> Also I'm a bit confused by your stance given the realities of encryption. Does your network strictly block all outbound traffic that it can't actively MITM? If not, a nefarious employee could proxy their criminal (Tor or other) traffic through an external machine that they controlled. In fact this would be the obvious thing to do as visiting an HTTPS (apparently) website on a personal device would seem much less likely to arouse suspicion.
Yes - with some exceptions (lunch break facebook/youtube etc)
You're saying that if someone installs TOR, you'd refer them to law enforcement? This is interesting. What do you tell law enforcement? You: "Hey I'd like to report someone a work installed a web browser that I don't like.." LEO: "are you reporting a crime?" You: "No, just that they installed TOR." LEO: "Sounds serious. Did they hack your network?" You: "No, I'm the head of security, I let my users install what they want, except I'm also mad they chose TOR so please come and arrest them."
That seems like a bit of a knee-jerk reaction, you could just ask them not to use Tor on the company network. Some legit browser come bundled with it (Brave).
In some businesses it is important that all employee communications are captured and can be inspected in case there is suspicion of IP or customer data theft.
For example in a hospital, there is no good reason for employee to use Tor on work computer.
>For example in a hospital, there is no good reason for employee to use Tor on work computer.
"I'm a doctor in a very political town. When I have to do research on diseases and treatment or look into aspects of my patients' histories, I am well aware that my search histories might be correlated to patient visits and leak information about their health, families, and personal lives. I use Tor to do much of my research when I think there is a risk of correlating it to patient visits. - Anonymous Tor User"
> in a hospital, there is no good reason for employee to use Tor on work computer.
I would argue that hospitals and other public settings are actually more in need of higher privacy in electronic communications.
Imagine a physician working on, say, Scarlett Johansson's health issues; he periodically sends this data to the specialist that will run some test, and a creepy sysadmin finds out. Should he be able to MITM those comms, and resell the info to newspapers (or worse)...? Nope; the physician should have perfect privacy from network operators.
That's an excellent example but I'd point out that in any such scenario devices ought to be thoroughly locked down and run strictly audited environments. If properly configured you wouldn't be firing an employee for using Tor but instead for maliciously tampering with company hardware.
I've plugged my laptop to my Corp WiFi, Brave browser was running a tor client process, I got approached by Ciso within 3 minutes asking to stop torring or get off the network immediately.
Their unique risk is "our remote access product broke (globally, or widespread) but we can't fix it because we don't have access anymore... because we use it too and it's broken".
You can cut off your own arms pretty easily even if you're not the vendor, but it would look particularly bad for them.
Yeah in theory disciplined updates and testing should resolve the risk, but sensible to have a fallback.
Especially considering the 4 hour SLA on phone support for the enterprise version. If the password management system is down, work stops. I'd rather not have to break the glass on the emergency god account at all.