Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor Browser 11.0

blog.torproject.org

Post reply on HN
Print view View original

31–40 of 100 posts

Re: Tor Browser 11.0

#31

Post by yjftsjthsd-h »

spurgu wrote: post #27
triter wrote: post #3

Great to see the project still going strong, we need this type of tools more than ever.

Same. The world would feel quite dystopian without Tor, Signal and other similar software aiming to preserve your privacy. I rarely use Tor but I'm soooo happy it exists. Just started wondering: If Tor disappeared off the face of the earth right now, what would be the replacement? 1. Would it be an existing alternative that would become dominant in the space? 2. Would an identical software/network be built? 3. Would…

If TOR went away tomorrow, I assume i2p would pick up the slack; it's already there and AFAIK a good alternative, just with a smaller network and less emphasis on exit nodes.

Re: Tor Browser 11.0

#32

Post by giga_chad »

TOR has been an invaluable tool for me for its ability to circumvent state censorship in an undetectable way.

At some point in my career I was involved in some journalistic reporting in Saudi Arabia; had I used a regular VPN, it could have been easily detected, and in best case defeated, worst case put me in serious legal trouble, which in Saudi Arabia can easily end in corporal punishment and/or death. TOR allowed me to circumvent all that and keep reporting on government official and police force corruption in a safe way, in a country that frankly could use a lot more of this type of journalism.

Thank you, TOR project!

Re: Tor Browser 11.0

#33

Post by brokenmachine »

superkuh wrote: post #2

The first major release that lacks all support for most tor onion service domains. Tor v2 code was removed for security reasons. But the community still mostly uses v2. Follow along with the death of most tor onion services in the plots at: https://www.encryptionin.space/tracking-hsdirs-and-the-versi... (here's a snapshot mirror if the site is slow under load, https://i.ibb.co/9NzVcsz/plot.png )

What's a HSDir?

Re: Tor Browser 11.0

#35

Post by brokenmachine »

I_Byte wrote: post #13
superkuh wrote: post #7

Earlier quoted context omitted.

Yes, it probably is. Most people use tor because they just want a pseudoanonymous proxy to the clear web. For them the switch to v3 internally is important and probably required. For users of the .onion and onion services in general it's more split but I think most would say v2 going away is good. Soon it will be possible to spoof v2 domain prefixes at a feasible cost. I personally don't like that v2 is being shut of…

The depreciation of v2 addresses is the best course of action in this case. v2 addresses consist of the first 80 bits of the SHA-1 hash of the hidden services 1024 bit public RSA key. This sentence alone is enough to make any cryptographer cringe, it is really bad ! (SHA-1 has been shown to be broken and it is suspected that 1024 bit RSA can be cracked by any determined well funded state actor) Also, Tor Project has…

> v2 addresses consist of the first 80 bits of the SHA-1 hash of the hidden services 1024 bit public RSA key.

What is the danger of exposing the hash of the services public key? Public keys are public anyway.

Re: Tor Browser 11.0

#36

Post by Aachen »

saurik wrote: post #24
Aachen wrote: post #22

Earlier quoted context omitted.

So it would be best if those services simply advertise their new address on the v2 domain right? Rather than sit still and lose their traffic when everyone's forced to, or when attacks really become feasible. It's not even a hard upgrade, afaik it's literally just a change of what address users have to copy/bookmark and nothing else. I just don't get what the reason to not upgrade is.

> afaik it's literally just a change of what address users have to copy/bookmark and nothing else ...and all of the links that everyone has embedded in content all over the ecosystem.

Sure, but that's not effort on the site's behalf so they can switch over and make the V2 show the redirect notice. If IPv6 would have been this simple, just show a redirect, we'd have upgraded long ago...

Re: Tor Browser 11.0

#37

Post by pfundstein »

giga_chad wrote: post #32

TOR has been an invaluable tool for me for its ability to circumvent state censorship in an undetectable way. At some point in my career I was involved in some journalistic reporting in Saudi Arabia; had I used a regular VPN, it could have been easily detected, and in best case defeated, worst case put me in serious legal trouble, which in Saudi Arabia can easily end in corporal punishment and/or death. TOR allowed m…

Tor has long been billed as a tool for journalists to fly under the radar and avoid persecution, but it's great to hear these case studies from the horse's mouth. Thanks to you and other journalists who risk life and limb to report on and within these abusive regimes.

Re: Tor Browser 11.0

#38

Post by pfundstein »

Shadonototra wrote: post #26

Tor lost all credibility for sticking to firefox, not to mention all the other security issues discovered over the past few years

If you actually looked at the numbers you'd see FF has had fewer security issues than any other major browsers.

Also Torbrowser uses a security-hardened version of FF LTS, so it's pretty useless to assume FF vulnerabilities all apply to Torbrowser.

Re: Tor Browser 11.0

#39

Post by laverya »

brokenmachine wrote: post #35
I_Byte wrote: post #13

Earlier quoted context omitted.

The depreciation of v2 addresses is the best course of action in this case. v2 addresses consist of the first 80 bits of the SHA-1 hash of the hidden services 1024 bit public RSA key. This sentence alone is enough to make any cryptographer cringe, it is really bad ! (SHA-1 has been shown to be broken and it is suspected that 1024 bit RSA can be cracked by any determined well funded state actor) Also, Tor Project has…

> v2 addresses consist of the first 80 bits of the SHA-1 hash of the hidden services 1024 bit public RSA key. What is the danger of exposing the hash of the services public key? Public keys are public anyway.

It's not the fact that the hash of the public key is exposed, it's the fact that

1. so little of the hash is exposed (only 80 bits of 160 for sha1), making it easier to find a collision

2. the hash is so weak (sha1 is widely considered broken), making it easier to find a collision

3. the underlying public key is so small, making it easier to derive the private key from the public key

IIRC if you find a collision you can use that to take over / contest an onion address, and obviously reversing the public key into a private key gives you as much control over an onion address as the original creator.

Re: Tor Browser 11.0

#40

Post by Koshkin »

brokenmachine wrote: post #33
superkuh wrote: post #2

The first major release that lacks all support for most tor onion service domains. Tor v2 code was removed for security reasons. But the community still mostly uses v2. Follow along with the death of most tor onion services in the plots at: https://www.encryptionin.space/tracking-hsdirs-and-the-versi... (here's a snapshot mirror if the site is slow under load, https://i.ibb.co/9NzVcsz/plot.png )

What's a HSDir?

According to Google, it's either a high school directory or a hidden service directory.
Post reply on HN