First screen, captured 5 days ago.

How I got over 300 Tor exit nodes removed

What HN thinks

Ten percent of Tor's exits turned out to be a phishing kit, and the comments still found time to argue about whether Amazon can read your RAM.

Use SSH keys, heed warnings
Key-based or mutual authentication would have defeated this MITM since the key never leaves the client, and users should not click past the host-key-changed warning.
Hosting providers can't be trusted
Commenters debated whether cloud VMs are safe from their hosts, with AWS insiders defending Nitro and memory encryption and skeptics saying physical access always wins.
Running exits is legally risky
Only about 3,000 exits exist because operators face police raids and false accusations, leaving many exits plausibly run by spies or criminals.

Consensus: Most agree password SSH logins over Tor were the weak point and that public-key or hardware-backed authentication blocks this attack.

Recommended in the comments

YubiKey (product): Keeps SSH private keys in hardware so they can't be stolen or phished.
Token2 (product): Named as a reputable FIDO2 key vendor usable with ed25519-sk SSH keys.
Termius (product): Can store SSH keys in the iPhone Secure Enclave with Face ID approval.
exitmap (tool): Used by the author to detect the malicious exits.
Tailscale (service): Suggested as a simpler alternative to Tor onion services for NAT traversal to home machines.

Summarised by Claude from the comment thread 3 days ago.

Points: 346
Comments: 104
Posted: 2026-10-20 by kabakabakaba
Category: Security

tor exit-nodes malicious-relays anonymity-networks privacy

All captures:

Looks similar

Screenshot of brokenco.de: The end of the road for Kafka-delta-ingest

The end of the road for Kafka-delta-ingest (brokenco.de)

12 points by alex_hirner 10 months ago | 4 comments

Screenshot of pwn.watch: What’s getting pwned right now

What’s getting pwned right now (pwn.watch)

353 points by mrkd 4 days ago | 165 comments

pwn.watch is a live feed of ongoing security incidents and CVEs, listing affected software, patch status, fixed versions, and source advisories.

vulnerability-tracker cve security-incidents supply-chain

Screenshot of blog.orhun.dev: Can't trust any VPN these days

Can't trust any VPN these days (blog.orhun.dev)

68 points by orhunp_ 2 years ago | 35 comments

Screenshot of pramatias.github.io: The Great Proxywall 3000

The Great Proxywall 3000 (pramatias.github.io)

5 points by emporas 2 years ago | 0 comments

Screenshot of blog.tymscar.com: Imgur geo-blocked the UK, so I geo-unblocked my network

Imgur geo-blocked the UK, so I geo-unblocked my network (blog.tymscar.com)

471 points by tymscar 11 months ago | 161 comments

A blog post describing how the author set up a network-wide VPN proxy on NixOS and Docker to bypass Imgur's geo-block for UK users across their homelab.

imgur geo-blocking vpn nixos