Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla Project Fusion: Tor Integration into Firefox

trac.torproject.org

Post reply on HN
Print view View original

141–150 of 242 posts

Re: Mozilla Project Fusion: Tor Integration into Firefox

#141

Post by mook »

jean- wrote: post #67
sametmax wrote: post #44

Earlier quoted context omitted.

We always could do that with extensions since JS is turing complete and has access to the network. Webtorrent is a thing after all. The issue is not technical. It's just a chicken and egg problem. Most won't use bittorent unless it's stupidely easy to do. Remember that the average user don't know what an URL is and doesn't open new tabs willingly. Since they are the majority, they drive cost and benefits, so we must…

> We always could do that with extensions You couldn't, until Firefox 59. Before that, protocol handlers were not allowed to handle links to Dat/IPFS resources [0]. And while I agree with your comment regarding the chicken and egg problem, there are still some technical issues. As the shadowbanned sibling comment says, extensions don't have access to UDP/TCP sockets, meaning that you will need to run a gateway on you…

> You couldn't, until Firefox 59. Before that, protocol handlers were not allowed to handle links to Dat/IPFS resources [0].

You could, kind of, before Firefox 57 (or at least, at some point). Implementing nsIProtocolHandler/nsIChannel/etc. correctly was difficult (and probably not from JavaScript), and distribution problems meant nobody did it.

Re: Mozilla Project Fusion: Tor Integration into Firefox

#142

Post by jerheinze »

jabn76 wrote: post #139
jerheinze wrote: post #108

Earlier quoted context omitted.

Why take that trouble when they can do it directly using Tor without running any exit at home? Also for instance Bogatov had an alibi when that happened.

Most forums ban all Tor exits.

> Most forums ban all Tor exits.

So running an exit at home to coverup for posting on a forum that bans all Tor exits, that makes no sense.

Re: Mozilla Project Fusion: Tor Integration into Firefox

#143

Post by jerheinze »

adrusi wrote: post #132
jerheinze wrote: post #122

Earlier quoted context omitted.

> You also get encryption while your traffic looks just the same as everybody else’s. You don’t stand out like when you’re using Tor. Detecting WhatsApp usage is trivial. With Tor you can use pluggable transports to obfuscate your traffic.

But everyone and their cousin is a WhatsApp user, so using Whatsapp isn't suspicious.

So the solution is to grow Tor usage, or use bridges with pluggable transports.

Re: Mozilla Project Fusion: Tor Integration into Firefox

#144

Post by dat_boi20 »

tomrittervg wrote: post #137
eganist wrote: post #113

Earlier quoted context omitted.

Thanks for your effort! If I can ask, how much overlap exists between your team and the team overseeing the implementation of security protocols within Firefox e.g. HSTS, CSP, etc.? It'd be neat to see Firefox drive innovation here alongside the effort to weave Tor into the browser; although I wouldn't necessarily treat Tor integration the same as I might the implementation of other security specifications, I can see…

The Fusion project is done by a subset of that team (+me, I happen to sit with Sandboxing due to other responsibilities).

By passing this on to Mozilla and discontinuing Tor Browser, you're going to inherit the innumerable issues in their code base. Wouldn't it be easier to hard-fork and create a simple browser with minimal overhead? It doesn't have to be loaded with features. Just minimalist and private.

Some anti-features that come to my attention off the top of my head:

* Biometric login (as of FF60)

* Dumb PR Stunts like Mr. Robot

* Telemetry

* Balrog (Analytics and browser fingerprinting on AmazonS3)

* Social API

* VR sensors

* DRM

* Google Chrome (large contract Mozilla has with them as they backport this into IPC)

* CloudFlare DNS (Department of Homeland Security partner and Tor arch-enemy)

etc...

Re: Mozilla Project Fusion: Tor Integration into Firefox

#145

Post by xoa »

tomrittervg wrote: post #100

Hi all. I am a Tor Project Developer and work at Mozilla on this project. We appreciate everyone's enthusiasm and feedback. Our ultimate goal is a long way away because of the amount of work to do and the necessity to match the safety of Tor Browser in Firefox when providing a Tor mode. There's no guarantee this will happen, but I hope it will and we will keep working towards it. If anyone is interested in assisting…

>You can also run Tor relays and help us improve the health of the network by working with Tor's new Relay Advocate

Since I've seen this come up before in many previous discussions of Tor I think it's worth emphasizing/clarifying up front: Tor relays are not the same as Tor exit nodes. Relays do not talk to the public internet, they serve only the full encrypted internal Tor virtual network. So they won't ever send out traffic from an IP under your control to some website or general Internet system (and in turn tie that IP in any way to spam/abuse/whatever, at least not for that reason). It's not necessarily hidden that it is acting as a relay, but the relay itself will have no knowledge of the traffic it's carrying.

Plenty of people have reasonable concerns about the risks/inconveniences that might come with acting as an exit node, but on both a legal and practical level there are many more jurisdictions where merely relaying encrypted traffic between other relays isn't a problem. And it's still quite helpful, both for network speed and because purely internal Tor Hidden Services do not need any exit nodes at all.

Re: Mozilla Project Fusion: Tor Integration into Firefox

#146

Post by scrollaway »

sametmax wrote: post #37
kleiba wrote: post #30

Earlier quoted context omitted.

Honest question: is bittorrent even still a thing?

Last month I download 2 linux ISO with it for work. This month all the seasons of the pretender for fun. Facebook used to deploy their code using bittorent. I doubt it has changed. A lot of blizzard video games update using bittorent as well. If you play Starcraft 2, you use bittorent. Streaming services like stremio are basically bittorent. After netflix, it's my main source of video content. If you want to download…

Blizzard games no longer use BitTorrent but a proprietary http-based protocol called ngdp. BitTorrent was causing a lot of issues with firewalls so users were disabling it, so they had added http mirrors to them... And then CDNs became a thing, the rest is history.

I'll be happy to give more details on ngdp if you are curious.

Re: Mozilla Project Fusion: Tor Integration into Firefox

#147

Post by LinuxBender »

jerheinze wrote: post #120
LinuxBender wrote: post #101

Earlier quoted context omitted.

Exactly, they have to pop my machine too. They can't just take control of the traffic in the middle, which absolutely can be done in Tor with enough gov controlled guard nodes, as the arms race of patching has proven. I can set up multiple canaries that they will have to pop and the fingerprint of one of those canaries is going to change or drop off the net.

> They can't just take control of the traffic in the middle, which absolutely can be done in Tor with enough gov controlled guard nodes, as the arms race of patching has proven. I think you're misunderstanding something here, with onion services traffic is e2e encrypted and self-authenticated, as Matt explains: > When you connect to an onion service, how do you know no one is MitM'ing you? Easy. It's impossible. The…

I think where we are having a disconnect is that what Matt posted works when Tor is working as expected. Software has bugs. Tor has not been an exception to this. I watch their change logs for alpha and there are often bugs that affect this overall concept. They are patched quickly, but Tor nodes are not forced to update, nor is there a safe way for them to do so.

My point is that is a single point of success. Any other web service I would cut some slack. In the case of Tor, it is marketed as a means by which dissidents may communicate safely. Putting peoples lives on a single point of success is not appropriate, especially when there are technical means to mitigate the risk.

Re: Mozilla Project Fusion: Tor Integration into Firefox

#148

Post by jean- »

mook wrote: post #141
jean- wrote: post #67

Earlier quoted context omitted.

> We always could do that with extensions You couldn't, until Firefox 59. Before that, protocol handlers were not allowed to handle links to Dat/IPFS resources [0]. And while I agree with your comment regarding the chicken and egg problem, there are still some technical issues. As the shadowbanned sibling comment says, extensions don't have access to UDP/TCP sockets, meaning that you will need to run a gateway on you…

> You couldn't, until Firefox 59. Before that, protocol handlers were not allowed to handle links to Dat/IPFS resources [0]. You could, kind of, before Firefox 57 (or at least, at some point). Implementing nsIProtocolHandler/nsIChannel/etc. correctly was difficult (and probably not from JavaScript), and distribution problems meant nobody did it.

True, I remember looking into that and it was all a bit of a mess.

Re: Mozilla Project Fusion: Tor Integration into Firefox

#149

Post by ChrisSD »

tomrittervg wrote: post #100

Hi all. I am a Tor Project Developer and work at Mozilla on this project. We appreciate everyone's enthusiasm and feedback. Our ultimate goal is a long way away because of the amount of work to do and the necessity to match the safety of Tor Browser in Firefox when providing a Tor mode. There's no guarantee this will happen, but I hope it will and we will keep working towards it. If anyone is interested in assisting…

> first party isolate is generally more stable and usually only has breakage on particular login forms

Are you referring to third-party login services and comment systems (such as disqus and similar)?

Post reply on HN