"Lessons Learned from Tor" by Roger Dingledine // ECC#2 - Buenos Aires 2025

Hi everybody. I'm Roger from tour and I'm going to see if the the clicker even works. Perfect. So I'm going to try to smash together two talks today. The first one is a uh crash course intro to tour and the second one is thinking about tour and uh could we add tokens to it?

How do you do incentive structures? that sort of thing. So, how many people here use tour? Know how tour works? How many people here run tour relays?

A couple of hands, but not as many. So, we should talk afterwards and see if we can improve the community participation. Okay. So, tour is a lot of different things. It's a nonprofit organization.

It's an ecosystem of free software, open- source software. It's a community of volunteers around the world who are helping to make tour uh stronger and safer and teach people about it. But the the main topic here is creepy NSA guy from some from 15 years ago now was saying we kill people based on metadata. And that's he wasn't bragging, he wasn't threatening, he's just saying look this is how NSA and governments work. we collect all the communications metadata and figure out who's talking to who and then drop the bomb in the right place.

And that's just that's just how the how the world works these days. So from my perspective, I'm trying to think through how can I protect against people learning your communications metadata. And there are a couple of other context things going on at the same time. One of the big ones is the whole endtoend encryption debate whether WhatsApp and Signal and so on should be allowed to actually protect their users. And every year there's another government coming in and saying let's let's try to prevent end to end encryption.

Let's try to get rid of safety for users. And then there's a more interesting for this audience motivation. I found this news article a couple of years ago. Apparently, there was some guy on the internet that the FBI was trying to bust and they didn't know how to find him. So, they sent him a YouTube link and then they went to YouTube and said, "Tell us every person who's ever watched that video."

And I don't know whether Google answered them or not, but apparently the the reason they were trying to find him was moneyaundering. He was he had some Bitcoin and he wanted to sell them for cash, not going through the the expected channels. And that was enough to have them just scoop up all the data they could from Google in order to uh to do a side channel around whatever this guy's privacy properties were. So that's that's one of the one of the topics where communications metadata can matter a lot. Okay.

So I actually only use the word anonymity when I'm talking to other researchers. When I'm talking to my parents, I work on privacy systems because anonymity is kind of socially weird. I'm not sure we should have it. But privacy, as we learned from the previous talks here, is an important uh value that everybody should have. When I talk to companies, I work on communication security because privacy is dead.

Anonymity is weird. But of course, I need to protect my communications metadata when I'm uh investigating other companies, thinking about buying things. thinking about patenting things. And when I talk to governments, I work on traffic analysis resistant communication networks. So again, it's the same system.

It's privacy. It's anonymity. It's security. But you go to a government and say, "I've got a security tool." They're like, "Oh, I have I have plenty of those."

But if you explain, I have a way for you to send your diplomat to Israel and have somebody watching the hotel network in Israel not learn that it's your diplomat. Well, wait a minute. Yes, we do need that sort of thing. And then there's the the the last category, which are the marginalized people, the the people censored, the people who can't reach BBC. And all part of the goal of tour is to get all these different people into the same network so that they can blend together because without you can't just have the cancer survivors in the network or everybody would know why they are using tour.

Okay. So how do you build one of these? The easy answer is you all know VPNs these days they they spend a lot of energy hyping themselves on YouTube. But the challenge with the the centralized VPN world is first of all, what happens if that central VPN ends up not providing the security they they promise? And it always starts off with we promise we're never going to look at your traffic.

Okay. Actually, we do look at your traffic, but we promise we won't write anything down. Okay. Okay. We we do log everything, but we promise we won't tell anybody.

Well, of course we answer when governments ask us. What did you expect? And and of course, we sold the company and all of the data went with it. So, I mean, we're a company. What did you expect?

So, part of the challenge there is it's privacy by trust, privacy by promise. We have the data. We promise not to screw you. And that is not that's not that's not the world I want to live in. And it's worse than that because even if somehow that VPN provider is they're magically in Switzerland and Switzerland makes them perfect so they're they'll never give out any data, it's still one wire going into their computer and the same wire coming out.

And if Deutsch Telecom gets to spy on that wire, they can do traffic and volume attacks to figure out which user is going to which destination. So even if the centralized service is completely honest and completely safe and really does follow through with everything, the centralization of where they are on the internet is itself a problem. Okay, so the the answer we've been hearing today is decentralization. The part of the way the tour network works, we have 9,000 relays all around the world and your tour browser builds a path through three of these relays so that no single point gets to learn uh both who you are and what you're doing on the internet. And we've been growing as a network.

There are a lot of different uh discussions we can have about performance versus centralization versus uh diversity versus privacy. In terms of how do we measure these things, there are two two sort of uh utility functions uh that we can think about. The first one is where are the relays in the world compared to where the attackers can be. So if you're worried about French intelligence, for example, maybe they get to see some parts of France, maybe they have a deal with Germany, so they share data with Germany. How much of the internet do they get to see compared to where the tour network is and where the tour traffic is?

That's the first uh way to think about it. And then the second way to think about it is what kinds of uses do people have? This goes back to the cute cat theory that we heard about this morning. The more ordinary people there are using tour, the safer it is in that situation. So counterintuitively, we have a lot of users in Iran, not because they're all political dissident, but because Iran blocked Facebook.

So if you want to get to your pictures of kittens, you need something like tour in order to get around the blocking. And that makes the use of tour much more ordinary. It means that that most people are doing it not because they want to tear down their government, but because that's what the internet should be. And that ordinariness is a security property. It's why it is safe for the people who really do need it to also be able to use it.

Okay. And transparency is important. Yes, it's free software. Yes, it's open source. Yes, we give you design documents.

Yes, we give you the specifications. And yes, we say, "Hi, I'm Roger. I wrote Torum." We are publicly identifying ourselves. And every time I I say that to a privacy audience, they're like, "That's weird.

The privacy person is talking about transparency." And it's not a contradiction because privacy is about choice. I choose to be public. I choose to be transparent in order to build a stronger community. in order for people to to be able to decide whether they should trust me.

So that community building and that transparency is part of why tour is so strong around the world because so many people have met so many tour people. Okay, so that was the first half of the talk. The second half is uh what are some lessons that we have learned in the tour world that hopefully can apply to your organization whether it's a tiny wallet or uh you're in samurai wallet land or tornado cash land or your Ethereum itself. What are things that we've discovered over the past 20 years of working on tour that might be helpful? The first one is uh have positive uses and publicize them.

So basically build allies even build allies among the people you think are your your enemies or your adversaries or the people who are scared of you. So some piece of that is don't be tornado cash but it's more than just that. Let me put on a social scientist hat for a little while. We went and interviewed many tour users and asked them for their stories about why they care about tour. So the first story I have here is uh is the one that you're all thinking of already.

um I'm a political activist and people are watching what I'm doing and when I say things on the internet that the government doesn't appreciate then I'm at risk. So that's the story we all uh think about when we think about privacy. But let me give you a different story. I'm a doctor in a very political town. Think Washington DC or Brussels.

I have patients who work on legislation that can mean billions of dollars. So when the congressman comes in and has cancer or some embarrassing medical situation, who want who in the defense industry wants to learn about that? And if it's worth a billion dollar airplane, of course they're going to be surveilling what doctors this guy goes to. If he goes to a cancer doctor, then um then maybe we can use that to blackmail him or something. And so that the doctor example is one I I gave this example to an audience a while ago and a lawyer came up to me afterwards and said I take the same approach for my uh clients because of course when somebody comes to me with a legal situation and then I go Google on the internet all about it right afterwards of course somebody is going to be able to to put that together and figure out what the legal case is and discover what our plans are and so on.

So as a doctor, it's your responsibility to keep your patients safe for all definitions of safe. And similarly, as a lawyer, it's your responsibility to keep your clients safe for all definitions of safe. So these are some examples of why tools like tour are an important building block. It's not tour by itself won't be enough, but you need it at the network layer. And we have some fun uh high-profile users over the years.

I'm low on time, so I'm not going to talk too much about the Ed uh example. But the key thing to think about here is Ed got to choose when he went public. He used Tor to talk to the journalists. And when he decided it was the right time to stand up and say that was me, he was able to do that when he chose to. And that's a that's an example of a privacy tool succeeding at its part of the job.

And I guess the the bigger picture thing to think about here when you think about dual use technologies, you start off saying, well, there are good uses and there are bad uses and you have to accept both of them. But the reality, so uh from Eva's talk this morning, she was talking about designing for marginalized societies, thinking through who you are benefiting with your tool. The people who are like the Russian mafia with the police, they're doing fine. and they don't need tour. But the individual blogger in Egypt who's blogging about LGBTQ things in Egypt, they really need something like tour.

So the folks who already have power don't benefit as much from tour as the people who are in very very vulnerable situations in their world. So I guess the the other way of saying that is technology is not neutral. technology is political and you should think through the architecture of the system that you're building and are you concentrating power? Are you building a Google Docs where all the power goes to some huge corporation or are you distributing power? Are you putting power on the users on the edges?

Are you empowering individuals to decide for themselves what their privacy should be? Who gets to learn things about them? So those are uh those are the principles that I think about when I'm deciding whether something is going in the right direction or the wrong example. Uh so I mentioned allies even allies among people that that maybe aren't part of you. I have a friend who went to join the FBI and he understood tour.

He's a big tour fan and he was in the FBI and he was telling me a story of being in a room where the Department of Justice people were meeting and they said, "You know what we should do today? we should make a law outlawing tour. And he as an FBI person got to stand up and say, I use tour. I need tour. Are you trying to make my job harder?

Why would you outlaw tour? And because he was in the room in that room that day, they didn't pass that law that day. So, we need allies in the right places in all these different organizations that you might start off thinking are are uh anti- privacy, but actually they're just made of human beings also. Okay, so another topic, how do you actually build a community, a network in terms and have it be sustainable and scalable and so on. So one of the topics that we think a lot about is how do we maintain the torque the like the 9,000 relay operators around the world.

They're all doing it for a lot of different reasons, but do you build your network based on the altruism building block or based on the capitalism building block? In our case for tour, we've chosen the altruism side where a lot of people have basically free bandwidth. They some of them work at universities or companies and you just plug in another computer. Some of them are the cisadmins at uh some of these organizations and they've got extra bandwidth. Bandwidth is mostly free if you know the right people, if you are the right places.

So, it's about building a community of people who have these spare resources and want to contribute back to the world and helping them understand the stories about people in Egypt and Iran and Russia and so on help them decide that they're doing the right thing. But it's really about the altruism, the I have this, of course, I will provide it. And an alternative world would be the capitalism world where you're you're trying to incentivize people. you're trying to basically let them maximize their profit from participating. And these aren't just two different ways to get to the same destination.

They result in a different type of community. The organic growth maybe doesn't scale as well, but it might be more resilient and it might be more uh more secure against certain attacks. And I want to be careful here not to uh just show up and be like, yo, the problem is capitalism, though in a lot of ways it is. think through like so imagine a tour world where we where people run relays in order to make money. So the first thing you should do is you should put all of your relays at Hner in Germany because that's the cheapest uh hosting provider and now the whole tour network centralizes and concentrates in one place.

And then the second thing you should do, if I'm here to maximize money, why not sell the data on the side? Like if I'm here to to to to profit rather than to keep users safe, then I will I'll take any opportunity I can to maximize my revenue, minimize my costs. So that these result in different um different resulting networks. So there are some ways that that I've been thinking about that that don't seem like they would destroy the community. uh certainly the gamification leaderboards uh Reddit style badges and so on and community buildings actually having meetups of relay operators and users and advocates and giving them attention from developers and there are a bunch of people around the world who are making nonprofits where they run the relays as a nonprofit and that allows them to scale better and have more legal protections and so on.

So I guess the other piece of this is when you're doing what I would call mechanism design and what you would call smart contracts, think through what your ground truth is. What can you actually verify when you're trying to to incentivize people to do something? So for example, let's say we want to uh incentivize different locations for relays. You say, "I'll pay you more if your relay is in an unusual location." and that's cool, but uh it turns out that the goip side of things isn't maybe as robust as you want it to be.

Um, another one would be knowing how much bandwidth the relay is providing. So, as as the goip example, uh, this was a a a relay that was running about a year ago. I think the relay is in Sweden, but this guy hacked his GIP hacked our GOIP database so that we list him as being in Antarctica. and he did it because it was funny, not because it was going to make him an extra 10x revenue. It's just fun to be able to say that I'm in Antarctica.

So, in terms of ground truth, there are no actually robust databases of what country an IP address is in, what as an IP address is in, and so on. So, uh if we were to build an incentive structure, then people would hack the heck out of it. So, think through your ground truth. The next lesson, be critical infrastructure. Brave bundles tour.

There a bunch of other tools we've been hearing about. Uh a bunch of major companies have Onion services as part of what they provide to the world. We've got a bunch of anti-censorship tools that uh that are modular and pluggable so other groups can and do use them. Another fun example, this is actually how I started getting into the the the the cryptocurrency space. This is a graph of the nodes in the Bitcoin network and which addresses they're reachable by.

So the the black on the top is IPv4 reachable Bitcoin nodes and the purple on the bottom is Bitcoin nodes reachable only as their onion address. So the majority of the Bitcoin network is reachable only through tour. That is an example of critical infrastructure where they rely on us for their continued sustainability, scalability and so on. And it's not just the Bitcoin world, the Ethereum world. Funding the Commons has a conference on Wednesday.

You should all come. Vitalic mentioned the HTTPS example, which I think is a great one. We should look at the past and figure out cases where we in the crypto wars did succeed. Now it's you wouldn't imagine going to a website without having the little lock in your browser. So somehow we've we've made real progress on some of these things.

I think the next phase is the endto-end encryption fight where still we have governments in North America and Europe and elsewhere saying what we need to do for safety for everybody is to make everybody unsafe and somehow there that those logs keep coming up and it's tied into the foreign policy side. Uh it's not just China and Russia that are being authoritarian on the internet. It's actually my country and your country and so many more. Okay. Um, as a last note, EFF has been running a campaign to get more tour tour relays running at universities.

So, if you are connected to a university, I would love to chat with you about getting a relay going. We started with about eight universities and now we're up to 42. We have a bunch of big names, MIT and Stanford and CMU and Michigan and we have a bunch of smaller names and we'd love to have you as part of that. So yes, things to think about and I' I'd be happy to chat with you after the 20 minutes are over. Think about what sort of incentives will lead to the sort of network that you want, will lead to the sort of community that you want because it's not just I'm going to uh uh create a coin and everybody will want my coin and then it'll be great and I'll have a community.

There's more to it than that. and figure out who you need as allies who are going to come after you or fear you or try to regulate you and teach them about your project and what your good use cases are. And yes, we're a nonprofit. So, if you're uh hanging on to a big wallet and your cryptocurrency has gone up a lot lately, then uh we'd love to chat with you. And also in terms of funding the commons, we'll talk more on Wednesday about uh about how to structure things to make the world a better place.

And with that, I'm going to let the next speaker go. Thank you.