Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor Browser 11.0

blog.torproject.org

Post reply on HN
Print view View original

61–70 of 100 posts

Re: Tor Browser 11.0

#61

Post by Gigachad »

marshray wrote: post #57
pfundstein wrote: post #45

Earlier quoted context omitted.

I'm not sure if you're aware but Tor has a specific mode for OP's situation, where it disguises traffic by using standard TLS on standard ports which looks no different to any other HTTPS traffic for example, among other things.

> which looks no different to any other HTTPS traffic Last I heard Tor split all data up into 512 byte chunks. So the statistical distribution of packet sizes could still give you away. In general, Tor does not hide the fact that you are using Tor.

I think the end solution is not to have TOR replicate normal randomish usage, but to have normal usage from everything go through a tor like process so that everyone looks the same.

Re: Tor Browser 11.0

#62

Post by chrismorgan »

Pet peeve: the word “deprecate” is misused in this article. (It’s used mostly correctly in the “v2 deprecation timeline” post.)

> Final deprecation of v2 onion services

Final removal, not deprecation.

> v2 onion services would be deprecated in late 2021

No, removed in late 2021, after being deprecated for over a year (from July or September, depending on how you count it).

Re: Tor Browser 11.0

#64

Post by schoen »

smoldesu wrote: post #55
wolverine876 wrote: post #46

Earlier quoted context omitted.

What mode is that? Also, the traffic still goes to a Tor node. Finally, the Tor Project works very hard, but they are outgunned. Security is significantly a matter of resources. Tor's small team has a hard time competing with well-funded state security actors (who can also buy exploits).

FWIW, Tor is maintained by the US Navy as a means of secure communication. If it's outgunned, it becomes a national security risk.

I think this is an exaggeration. The Tor technology was originally invented by researchers with the U.S. Naval Research Laboratory, who suggested that the system might be useful to Navy personnel among others. While Paul Syverson, one of those researchers, has remained involved with Tor since inventing it, no one from the Navy has ever publicly stated how or to what extent Tor is used by the military operationally.

Military researchers invent a lot of cool stuff, much of which theoretically could be useful to the military in some way, but you shouldn't take the military research pedigree as proof that something is necessarily useful for a particular application or threat model today, any more than being invented by people from a famous university means that a technology is good or is the best choice for some application.

A better case for the kind of considerations you mention might be found in infosec guidance that government agencies offer to other government agencies and contractors. For example, NSA has recommended that government agencies use AES to protect sensitive data, which doesn't mean that they think it's perfect (or would necessarily tell us if they knew of problems with it), but presumably puts some kind of cap on how bad it can be. I'm not aware of any government infosec authority that has publicly recommended that people inside the government use Tor.

Re: Tor Browser 11.0

#65

Post by schoen »

wolverine876 wrote: post #42
giga_chad wrote: post #32

TOR has been an invaluable tool for me for its ability to circumvent state censorship in an undetectable way. At some point in my career I was involved in some journalistic reporting in Saudi Arabia; had I used a regular VPN, it could have been easily detected, and in best case defeated, worst case put me in serious legal trouble, which in Saudi Arabia can easily end in corporal punishment and/or death. TOR allowed m…

I don't know the parent or their situation, but if you need similar security I would be very cautious about taking the parent literally. Sorry if I sound like a jerk; it sounds like the parent has taken great risks for the public good, but I don't want people to be hurt: I'm almost certain that Tor use is easily detected; that is what I've always (100%) read from security experts and it makes sense to me: Traffic pat…

As marshray said below, Tor doesn't generally try to hide the fact that you're using Tor, only what you're doing with it. This is complicated by the very active research on obfuscating methods for accessing Tor, but those methods are mostly trying to prevent automated large-scale detection in real time, in order to evade blocking by national firewalls. They aren't necessarily trying to prevent more manual or after-the-fact forensics that might confirm that a particular person was using Tor.

To be clear, the threat models of the obfuscating transports can vary, so what I've described is just a trend in emphasis, not necessarily a suggestion that nobody ever cares about obfuscation-in-retrospect. But the history of that work is around censorship circumvention, which is often a slightly different goal (with slightly different priorities) than confidentiality.

For example, I've heard people who work on obfuscation talk about how it would be good if something required an expensive calculation in order to distinguish from other traffic types. They care about this because a national firewall may not have sufficient capacity to do this in real time.

Depending a lot on your threat model, Tor might still be a benefit even if people do know you are using it, supposing that they don't know for what.

Re: Tor Browser 11.0

#66

Post by cosentiyes »

bouncycastle wrote: post #56
cosentiyes wrote: post #51

Earlier quoted context omitted.

TOR bridges aren't publicly listed and support various obfuscation methods: https://tb-manual.torproject.org/bridges/

Look at the language of that page. All the statements are without certainty, eg it's not "an adversary cannot identify them" but "an adversary cannot identify them easily."

Yes, the tor project is very transparent that anonymity is not guaranteed. Bridges and obfuscation tools are simply one possible answer to the "how is [connecting to tor without ISP detection] possible?" question.

The linked article tries to imply that Ross Ulbricht's arrest was somehow the result of deanonymized tor traffic, but in reality many (most?) large DNM [1,2] and malware/hacking arrests seem to be the result of poor opsec [3].

[1] https://www.ivpn.net/privacy-guides/online-privacy-through-o...

[2] https://en.wikipedia.org/wiki/AlphaBay#Seizure_and_shutdown

[3] https://krebsonsecurity.com/category/breadcrumbs/

Re: Tor Browser 11.0

#67

Post by 0xdeadb00f »

edgyquant wrote: post #63
Shadonototra wrote: post #44

Earlier quoted context omitted.

Chromium

What advantages would that bring?

Security. I'm a die hard Firefox user. But chromium has insanely good site isolation and some other great security features. It was built with privilege separation in mind almost since day one, something Firefox does not do. My source here is OpenBSD devs, who said that Chromium was easy to sandbox with pledge+unveil, because for the most part the code was already written in such a way (to separate privileges). Firefox was a pain to sandbox, because its code is not written in the same way.

Firefox is only now catching up in regard to site isolation.

Re: Tor Browser 11.0

#68

Post by pabs3 »

wolverine876 wrote: post #9

I've wondered about the fact that (AFAIK) Tor routes only TCP: 1. Is that (still) correct? 2. Can't web pages include non-TCP traffic, and if so, is it routed via Tor? For example, doesn't some some streaming media use UDP? 3. QUIC doesn't use TCP (deliberately, I think). Won't that affect Tor's long-term viability if everyone eventually moves to QUIC?

I wonder how many networks allow UDP (and thus QUIC) to pass, seems like there will be lots of places where QUIC can't be used.

Re: Tor Browser 11.0

#70

Post by shp0ngle »

giga_chad wrote: post #32

TOR has been an invaluable tool for me for its ability to circumvent state censorship in an undetectable way. At some point in my career I was involved in some journalistic reporting in Saudi Arabia; had I used a regular VPN, it could have been easily detected, and in best case defeated, worst case put me in serious legal trouble, which in Saudi Arabia can easily end in corporal punishment and/or death. TOR allowed m…

Tor is much more easily detected than VPN.

Or. Well. It is same easily detected, but you can reasonably say you have VPN "just to watch US netflix" or something like that.

You cannot say that about Tor.

Post reply on HN