Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor Browser 11.0

blog.torproject.org

Post reply on HN
Print view View original

91–100 of 100 posts

Re: Tor Browser 11.0

#91

Post by toomanybeersies »

smoldesu wrote: post #55
wolverine876 wrote: post #46

Earlier quoted context omitted.

What mode is that? Also, the traffic still goes to a Tor node. Finally, the Tor Project works very hard, but they are outgunned. Security is significantly a matter of resources. Tor's small team has a hard time competing with well-funded state security actors (who can also buy exploits).

FWIW, Tor is maintained by the US Navy as a means of secure communication. If it's outgunned, it becomes a national security risk.

The US Navy uses SIPRNet [1] for secure communication.

[1] https://en.wikipedia.org/wiki/SIPRNet

Re: Tor Browser 11.0

#92

Post by skissane »

wolverine876 wrote: post #59
skissane wrote: post #48

Earlier quoted context omitted.

> Even FTP has been deprecated Not everywhere. FTP-over-TLS is secure, standardised (RFC4217 as updated by RFC8996), and in some environments is still preferred to SFTP, particularly mainframe and minicomputer environments. FTP, due to its age, has a lot of "legacy" features which mean it can work better with non-POSIX filesystems used on mainframe and minicomputer systems than SFTP can. In principle you could add ex…

Thanks for all the knowledge. What is your interest in these protocols, out of curiosity? Deprecated doesn't mean 'wiped off all computers everywhere'. By that definition, name something that is truly 'deprecated'? An interesting trivia question. I think we have to exclude rare tech like prototypes.

> Thanks for all the knowledge. What is your interest in these protocols, out of curiosity?

Curiosity, yeah, pretty much. One day I decided to read the TELNET and FTP RFCs and became fascinated with all the historical cruft in them. I've also long been enjoyed studying IBM mainframe and midrange systems, they are their own somewhat alien world – most of that study has been limited to reading manuals, although I have mucked around with MVS 3.8J under Hercules (which unfortunately doesn't really have TCP/IP networking, or when it does it is some hacked-on thing with little in common with how TCP/IP actually works on MVS whether today or historically).

> Deprecated doesn't mean 'wiped off all computers everywhere'. By that definition, name something that is truly 'deprecated'? An interesting trivia question. I think we have to exclude rare tech like prototypes.

There are many systems which we know nobody still uses for production use, only for hobbyist / retrocomputing uses. A famous example would be Multics, at its peak it had over 50 production sites, the last production site was shut down in 2000, it took over 10 years between the last production site being shut down and an emulator becoming available so anyone could run it.

By contrast, people still use FTP and TELNET every day in production. Neither is inherently insecure, because both can be used over TLS. The majority of open source FTP/TELNET clients/servers never added TLS support, but commercial/proprietary implementations targeted at IBM mainframe sites do.

Re: Tor Browser 11.0

#93

Post by skissane »

kingcharles wrote: post #52
skissane wrote: post #48

Earlier quoted context omitted.

> Even FTP has been deprecated Not everywhere. FTP-over-TLS is secure, standardised (RFC4217 as updated by RFC8996), and in some environments is still preferred to SFTP, particularly mainframe and minicomputer environments. FTP, due to its age, has a lot of "legacy" features which mean it can work better with non-POSIX filesystems used on mainframe and minicomputer systems than SFTP can. In principle you could add ex…

I think the poster above is referring to the fact that ftp:// is removed as a supported protocol in some web browsers now.

By Chrome and Firefox yes, but curl says they aren't dropping it: https://daniel.haxx.se/blog/2020/04/15/curl-is-not-removing-...

If curl decided to remove it, I would be more worried.

Re: Tor Browser 11.0

#95

Post by heavyset_go »

walrus01 wrote: post #87
heavyset_go wrote: post #85

Earlier quoted context omitted.

> If the saudis are breaking TLS1.3 in an up to date browser in a client workstation that doesn't have some kind of APT/rootkit on it (also a high risk), we have other problems. They wouldn't need to break TLS 1.3 if they have access to root certificates, they could use them to perform MitM attacks.

For a while Uzbekistan was trying to get retail computer stores to install a root CA on all computers sold, for convenient mitm purposes.

I wouldn't be surprised if the Saudis have access to the root signing certificates themselves. They wouldn't have to put new certificates in computers' trust stores, as computers would ship from manufacturers already trusting certificates that were signed with those root signing certificates.

Re: Tor Browser 11.0

#96

Post by schoen »

chii wrote: post #72
schoen wrote: post #65

Earlier quoted context omitted.

As marshray said below, Tor doesn't generally try to hide the fact that you're using Tor, only what you're doing with it. This is complicated by the very active research on obfuscating methods for accessing Tor, but those methods are mostly trying to prevent automated large-scale detection in real time, in order to evade blocking by national firewalls. They aren't necessarily trying to prevent more manual or after-th…

> people do know you are using it, supposing that they don't know for what. And then they can use the rubber hose method to find out. Knowing that you have traffic you want to hide is almost as good as knowing the traffic

That depends hugely on the environment and context. This is clearly true in some settings and clearly untrue in others.

Re: Tor Browser 11.0

#97

Post by saurik »

Aachen wrote: post #36
saurik wrote: post #24

Earlier quoted context omitted.

> afaik it's literally just a change of what address users have to copy/bookmark and nothing else ...and all of the links that everyone has embedded in content all over the ecosystem.

Sure, but that's not effort on the site's behalf so they can switch over and make the V2 show the redirect notice. If IPv6 would have been this simple, just show a redirect, we'd have upgraded long ago...

How is that not the same thing then for your user bookmark case?

Re: Tor Browser 11.0

#98

Post by schoen »

toomanybeersies wrote: post #91
smoldesu wrote: post #55

Earlier quoted context omitted.

FWIW, Tor is maintained by the US Navy as a means of secure communication. If it's outgunned, it becomes a national security risk.

The US Navy uses SIPRNet [1] for secure communication. [1] https://en.wikipedia.org/wiki/SIPRNet

Very different concept from Tor -- this is about passing sensitive information between dedicated government facilities, not about hiding some of the details of your activity on the public Internet.

The argument for Tor's benefit for military personnel (which may or may not have panned out in practice) was all about protecting some of their activity on networks controlled or at least monitored by their adversaries. That's almost the opposite of SIPRNet.

Re: Tor Browser 11.0

#99

Post by Seirdy »

georgyo wrote: post #17
wolverine876 wrote: post #9

I've wondered about the fact that (AFAIK) Tor routes only TCP: 1. Is that (still) correct? 2. Can't web pages include non-TCP traffic, and if so, is it routed via Tor? For example, doesn't some some streaming media use UDP? 3. QUIC doesn't use TCP (deliberately, I think). Won't that affect Tor's long-term viability if everyone eventually moves to QUIC?

QUIC and HTTP3 are great technologies, but they are never likely to become the only protocol a service supports. For one thing, convection to a website via one of those protocols first, and then a header informs the client that it can reconnect via QUIC/HTTP3. IE they have to have a working http 1 or 2 webserver first. UDP is disallowed in many many places, and many ISPs treat UDP as hostile and rate limit it. In the…

> For one thing, convection to a website via one of those protocols first, and then a header informs the client that it can reconnect via QUIC/HTTP3.

Nit: new SVCB DNS records can serve the same purpose as Alt-Svc HTTP headers before the initial request, so the first request to a server is HTTP/3.

But yeah, HTTP/1.1 isn't going away (and shouldn't go away) for many reasons.

Re: Tor Browser 11.0

#100

Post by HackerNCoder »

brokenmachine wrote: post #33
superkuh wrote: post #2

The first major release that lacks all support for most tor onion service domains. Tor v2 code was removed for security reasons. But the community still mostly uses v2. Follow along with the death of most tor onion services in the plots at: https://www.encryptionin.space/tracking-hsdirs-and-the-versi... (here's a snapshot mirror if the site is slow under load, https://i.ibb.co/9NzVcsz/plot.png )

What's a HSDir?

I should probably add something about that to the post.

Sorta like the Tor version of DNS. It's where your Tor goes to get information about an onion, e.g. how to connect to it. Tor versions that don't support v2 will refuse to host this information, and so if all 6 HSDirs of an v2 onion doesn't support it, the onion will be unreachable.

Maybe understanding a bit about how onion services work will help: https://community.torproject.org/onion-services/overview/

Post reply on HN