Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor Browser 11.0

blog.torproject.org

Post reply on HN
Print view View original

51–60 of 100 posts

Re: Tor Browser 11.0

#51

Post by cosentiyes »

bouncycastle wrote: post #49
giga_chad wrote: post #32

TOR has been an invaluable tool for me for its ability to circumvent state censorship in an undetectable way. At some point in my career I was involved in some journalistic reporting in Saudi Arabia; had I used a regular VPN, it could have been easily detected, and in best case defeated, worst case put me in serious legal trouble, which in Saudi Arabia can easily end in corporal punishment and/or death. TOR allowed m…

How is that possible? The fact that you are using Tor is detectable by ISPs just like it is detectable that you are using VPNs. Also, it's sometimes possible to de-anonymize your Tor traffic, and state-level actors would be capable to do so if they wanted. https://www.thesecmaster.com/4-types-of-attacks-on-the-tor-n...

TOR bridges aren't publicly listed and support various obfuscation methods: https://tb-manual.torproject.org/bridges/

Re: Tor Browser 11.0

#52

Post by kingcharles »

skissane wrote: post #48
wolverine876 wrote: post #18

Earlier quoted context omitted.

> we're unlikely to see it [QUIC] take over as the sole protocol any time soon Agreed, but I'm not talking about soon. I mean the long term. Even FTP has been deprecated.

> Even FTP has been deprecated Not everywhere. FTP-over-TLS is secure, standardised (RFC4217 as updated by RFC8996), and in some environments is still preferred to SFTP, particularly mainframe and minicomputer environments. FTP, due to its age, has a lot of "legacy" features which mean it can work better with non-POSIX filesystems used on mainframe and minicomputer systems than SFTP can. In principle you could add ex…

I think the poster above is referring to the fact that ftp:// is removed as a supported protocol in some web browsers now.

Re: Tor Browser 11.0

#53

Post by kingcharles »

wolverine876 wrote: post #18
georgyo wrote: post #17

Earlier quoted context omitted.

QUIC and HTTP3 are great technologies, but they are never likely to become the only protocol a service supports. For one thing, convection to a website via one of those protocols first, and then a header informs the client that it can reconnect via QUIC/HTTP3. IE they have to have a working http 1 or 2 webserver first. UDP is disallowed in many many places, and many ISPs treat UDP as hostile and rate limit it. In the…

> we're unlikely to see it [QUIC] take over as the sole protocol any time soon Agreed, but I'm not talking about soon. I mean the long term. Even FTP has been deprecated.

I gave up on the Internet when my favourite browser stopped supporting gopher://

Re: Tor Browser 11.0

#54

Post by ssalka »

giga_chad wrote: post #32

TOR has been an invaluable tool for me for its ability to circumvent state censorship in an undetectable way. At some point in my career I was involved in some journalistic reporting in Saudi Arabia; had I used a regular VPN, it could have been easily detected, and in best case defeated, worst case put me in serious legal trouble, which in Saudi Arabia can easily end in corporal punishment and/or death. TOR allowed m…

Thank you for your efforts, giga_chad

Re: Tor Browser 11.0

#55

Post by smoldesu »

wolverine876 wrote: post #46
pfundstein wrote: post #45

Earlier quoted context omitted.

I'm not sure if you're aware but Tor has a specific mode for OP's situation, where it disguises traffic by using standard TLS on standard ports which looks no different to any other HTTPS traffic for example, among other things.

What mode is that? Also, the traffic still goes to a Tor node. Finally, the Tor Project works very hard, but they are outgunned. Security is significantly a matter of resources. Tor's small team has a hard time competing with well-funded state security actors (who can also buy exploits).

FWIW, Tor is maintained by the US Navy as a means of secure communication. If it's outgunned, it becomes a national security risk.

Re: Tor Browser 11.0

#56

Post by bouncycastle »

cosentiyes wrote: post #51
bouncycastle wrote: post #49

Earlier quoted context omitted.

How is that possible? The fact that you are using Tor is detectable by ISPs just like it is detectable that you are using VPNs. Also, it's sometimes possible to de-anonymize your Tor traffic, and state-level actors would be capable to do so if they wanted. https://www.thesecmaster.com/4-types-of-attacks-on-the-tor-n...

TOR bridges aren't publicly listed and support various obfuscation methods: https://tb-manual.torproject.org/bridges/

Look at the language of that page. All the statements are without certainty, eg it's not "an adversary cannot identify them" but "an adversary cannot identify them easily."

Re: Tor Browser 11.0

#57

Post by marshray »

pfundstein wrote: post #45
wolverine876 wrote: post #42

Earlier quoted context omitted.

I don't know the parent or their situation, but if you need similar security I would be very cautious about taking the parent literally. Sorry if I sound like a jerk; it sounds like the parent has taken great risks for the public good, but I don't want people to be hurt: I'm almost certain that Tor use is easily detected; that is what I've always (100%) read from security experts and it makes sense to me: Traffic pat…

I'm not sure if you're aware but Tor has a specific mode for OP's situation, where it disguises traffic by using standard TLS on standard ports which looks no different to any other HTTPS traffic for example, among other things.

> which looks no different to any other HTTPS traffic

Last I heard Tor split all data up into 512 byte chunks. So the statistical distribution of packet sizes could still give you away.

In general, Tor does not hide the fact that you are using Tor.

Re: Tor Browser 11.0

#58

Post by zamadatix »

dillondoyle wrote: post #28
zamadatix wrote: post #10

Earlier quoted context omitted.

1. For now 2. That kind of traffic mostly died out with plugins like Flash, streaming media today is usually encapsulated in small frequent chunks over the same https channels as the rest of the page are delivered as that's what's available in JS/native. WebRTC reintroduced some UDP stuff and can be used for streaming but is still mostly used for peer to peer calls. 3. https://gitweb.torproject.org/tor-browser-spec.g…

It's easy to get a webrtc fingerprint just using a public stun server, maybe people smarter can deploy their own. I've used it in our ad tracking js. I'm not sure if Tor Browser turns off by default, searching found this one ticket which suggest that default flag but maybe it's not implemented out of the box. [1] https://privacycheck.sec.lrz.de/active/fp_wrtc/fp_webrtc.htm... [2] https://gitlab.torproject.org/legacy/…

> I'm not sure if Tor Browser turns off by default, searching found this one ticket which suggest that default flag but maybe it's not implemented out of the box.

It does and it is removed at compile time since that ticket was closed (i.e. that was a build flag not a runtime flag).

Re: Tor Browser 11.0

#59

Post by wolverine876 »

skissane wrote: post #48
wolverine876 wrote: post #18

Earlier quoted context omitted.

> we're unlikely to see it [QUIC] take over as the sole protocol any time soon Agreed, but I'm not talking about soon. I mean the long term. Even FTP has been deprecated.

> Even FTP has been deprecated Not everywhere. FTP-over-TLS is secure, standardised (RFC4217 as updated by RFC8996), and in some environments is still preferred to SFTP, particularly mainframe and minicomputer environments. FTP, due to its age, has a lot of "legacy" features which mean it can work better with non-POSIX filesystems used on mainframe and minicomputer systems than SFTP can. In principle you could add ex…

Thanks for all the knowledge. What is your interest in these protocols, out of curiosity?

Deprecated doesn't mean 'wiped off all computers everywhere'. By that definition, name something that is truly 'deprecated'? An interesting trivia question. I think we have to exclude rare tech like prototypes.

Re: Tor Browser 11.0

#60

Post by wolverine876 »

kingcharles wrote: post #53
wolverine876 wrote: post #18

Earlier quoted context omitted.

> we're unlikely to see it [QUIC] take over as the sole protocol any time soon Agreed, but I'm not talking about soon. I mean the long term. Even FTP has been deprecated.

I gave up on the Internet when my favourite browser stopped supporting gopher://

Which browser?
Post reply on HN