Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor Browser 11.0

blog.torproject.org

Post reply on HN
Print view View original

81–90 of 100 posts

Re: Tor Browser 11.0

#81

Post by bawolff »

bouncycastle wrote: post #56
cosentiyes wrote: post #51

Earlier quoted context omitted.

TOR bridges aren't publicly listed and support various obfuscation methods: https://tb-manual.torproject.org/bridges/

Look at the language of that page. All the statements are without certainty, eg it's not "an adversary cannot identify them" but "an adversary cannot identify them easily."

If you ever see security software that promises absolutes, you should view it like an investment opportunity that allegedly only goes up and can't possibly go down (i.e. you're about to lose all your money)

Re: Tor Browser 11.0

#82

Post by johnisgood »

alexeiz wrote: post #74
0xdeadb00f wrote: post #69

> Known Issues Some of these issues seem like pretty big issues: > Bug 40671: Fonts don't render > Bug 40695: JS enabled on Safest in Windows (new)

I've updated, and now the font rendering in the Tor's interface is FU'ed. Good thing I don't rely on the Tor browser. Otherwise I'd be so pissed.

Precisely this. Tor browser after this update looks pretty FU'ed. I hope they are going to fix this one ASAP.

This update is actually so messed up, that I had to delete my whole profile and start from scratch, because everything was missing, including icons and text. It starts and is usable with the fresh profile, but this should seriously be fixed.

Re: Tor Browser 11.0

#83

Post by bawolff »

laverya wrote: post #39
brokenmachine wrote: post #35

Earlier quoted context omitted.

> v2 addresses consist of the first 80 bits of the SHA-1 hash of the hidden services 1024 bit public RSA key. What is the danger of exposing the hash of the services public key? Public keys are public anyway.

It's not the fact that the hash of the public key is exposed, it's the fact that 1. so little of the hash is exposed (only 80 bits of 160 for sha1), making it easier to find a collision 2. the hash is so weak (sha1 is widely considered broken), making it easier to find a collision 3. the underlying public key is so small, making it easier to derive the private key from the public key IIRC if you find a collision you…

For 2) my understanding is that the security issues in sha1 are not relavent to finding preimages, which if im not mistaken is what you would need to take over an onion address. But maybe im mistaken.

Re: Tor Browser 11.0

#84

Post by dotancohen »

Gigachad wrote: post #61
marshray wrote: post #57

Earlier quoted context omitted.

> which looks no different to any other HTTPS traffic Last I heard Tor split all data up into 512 byte chunks. So the statistical distribution of packet sizes could still give you away. In general, Tor does not hide the fact that you are using Tor.

I think the end solution is not to have TOR replicate normal randomish usage, but to have normal usage from everything go through a tor like process so that everyone looks the same.

That would require active participation of major entities who distribute HTTP clients, such as Mozilla, Apple, or the Chromium team. I cannot imagine them participating.

Re: Tor Browser 11.0

#85

Post by heavyset_go »

walrus01 wrote: post #78
wolverine876 wrote: post #42

Earlier quoted context omitted.

I don't know the parent or their situation, but if you need similar security I would be very cautious about taking the parent literally. Sorry if I sound like a jerk; it sounds like the parent has taken great risks for the public good, but I don't want people to be hurt: I'm almost certain that Tor use is easily detected; that is what I've always (100%) read from security experts and it makes sense to me: Traffic pat…

The parent poster who thinks they're saved from Saudi arabian domestic intelligence agencies by using tor is probably overly confident about how much tor is doing for them. The saudis absolutely have lots of money to pay for good quality DPI boxes from China. Using tor by itself stands out. Since it doesn't look like saudi arabia is blocking traffic to/from major cloud hosting providers (obviously, they'd break most…

> If the saudis are breaking TLS1.3 in an up to date browser in a client workstation that doesn't have some kind of APT/rootkit on it (also a high risk), we have other problems.

They wouldn't need to break TLS 1.3 if they have access to root certificates, they could use them to perform MitM attacks.

Re: Tor Browser 11.0

#86

Post by herbst »

wolverine876 wrote: post #42
giga_chad wrote: post #32

TOR has been an invaluable tool for me for its ability to circumvent state censorship in an undetectable way. At some point in my career I was involved in some journalistic reporting in Saudi Arabia; had I used a regular VPN, it could have been easily detected, and in best case defeated, worst case put me in serious legal trouble, which in Saudi Arabia can easily end in corporal punishment and/or death. TOR allowed m…

I don't know the parent or their situation, but if you need similar security I would be very cautious about taking the parent literally. Sorry if I sound like a jerk; it sounds like the parent has taken great risks for the public good, but I don't want people to be hurt: I'm almost certain that Tor use is easily detected; that is what I've always (100%) read from security experts and it makes sense to me: Traffic pat…

FYI in ops security model they likely used bridges, which are not on a public list as the other nodes.

That said, I am no specialist however, I am pretty sure pattern matching does not really work reliably.

The most common attack to de-anonymize tor users in the recent years is getting control of their server and than match incoming traffic with outgoing traffic from their country and basically catch them logged in. However as you can tell this needs international cooperation and a bit of work.

Re: Tor Browser 11.0

#87

Post by walrus01 »

heavyset_go wrote: post #85
walrus01 wrote: post #78

Earlier quoted context omitted.

The parent poster who thinks they're saved from Saudi arabian domestic intelligence agencies by using tor is probably overly confident about how much tor is doing for them. The saudis absolutely have lots of money to pay for good quality DPI boxes from China. Using tor by itself stands out. Since it doesn't look like saudi arabia is blocking traffic to/from major cloud hosting providers (obviously, they'd break most…

> If the saudis are breaking TLS1.3 in an up to date browser in a client workstation that doesn't have some kind of APT/rootkit on it (also a high risk), we have other problems. They wouldn't need to break TLS 1.3 if they have access to root certificates, they could use them to perform MitM attacks.

For a while Uzbekistan was trying to get retail computer stores to install a root CA on all computers sold, for convenient mitm purposes.

Re: Tor Browser 11.0

#88

Post by throwaway243 »

walrus01 wrote: post #78
wolverine876 wrote: post #42

Earlier quoted context omitted.

I don't know the parent or their situation, but if you need similar security I would be very cautious about taking the parent literally. Sorry if I sound like a jerk; it sounds like the parent has taken great risks for the public good, but I don't want people to be hurt: I'm almost certain that Tor use is easily detected; that is what I've always (100%) read from security experts and it makes sense to me: Traffic pat…

The parent poster who thinks they're saved from Saudi arabian domestic intelligence agencies by using tor is probably overly confident about how much tor is doing for them. The saudis absolutely have lots of money to pay for good quality DPI boxes from China. Using tor by itself stands out. Since it doesn't look like saudi arabia is blocking traffic to/from major cloud hosting providers (obviously, they'd break most…

Aren't obfs4 Tor bridges undetectable as of now?

Re: Tor Browser 11.0

#89

Post by Ginden »

heavyset_go wrote: post #85
walrus01 wrote: post #78

Earlier quoted context omitted.

The parent poster who thinks they're saved from Saudi arabian domestic intelligence agencies by using tor is probably overly confident about how much tor is doing for them. The saudis absolutely have lots of money to pay for good quality DPI boxes from China. Using tor by itself stands out. Since it doesn't look like saudi arabia is blocking traffic to/from major cloud hosting providers (obviously, they'd break most…

> If the saudis are breaking TLS1.3 in an up to date browser in a client workstation that doesn't have some kind of APT/rootkit on it (also a high risk), we have other problems. They wouldn't need to break TLS 1.3 if they have access to root certificates, they could use them to perform MitM attacks.

> They wouldn't need to break TLS 1.3 if they have access to root certificates, they could use them to perform MitM attacks.

It's trivially easy and almost undetectable for any nation-state to perform targeted MitM against HTTPS. It wouldn't be legally possible in most of jurisdictions, but Saudi Arabia isn't exactly "rule of law" country.

Uzbekistan tried, because they wanted zero-risk mass surveillance.

Re: Tor Browser 11.0

#90

Post by southerntofu »

0xdeadb00f wrote: post #67
edgyquant wrote: post #63

Earlier quoted context omitted.

What advantages would that bring?

Security. I'm a die hard Firefox user. But chromium has insanely good site isolation and some other great security features. It was built with privilege separation in mind almost since day one, something Firefox does not do. My source here is OpenBSD devs, who said that Chromium was easy to sandbox with pledge+unveil, because for the most part the code was already written in such a way (to separate privileges). Firef…

> Firefox is only now catching up in regard to site isolation.

Yes, but firefox has other benefits. if only that, a cooperative team that's happy to take patches as part of the "tor uplift" project, whereas Chrome wants to fingerprint every single user and makes projects like TBB harder to implement.

Also, i personally think it's a good thing that TBB is a noscript-first browser. Everything involving JS, even with a 10 feet pole, is a glaring security issue. So yes you can enable JS and the site isolation isn't the best, but truth is just use "Safest" mode and you'll be fine.

Post reply on HN