Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor Browser 12.0

blog.torproject.org

Post reply on HN
Print view View original

81–90 of 230 posts

Re: Tor Browser 12.0

#81

Post by resuresu »

londons_explore wrote: post #56
optimalsolver wrote: post #9

The inescapable fact about Tor is that its traffic patterns make you stand out prominently. Just the fact you’re using it automatically makes you interesting and worthy of a closer look. All well and good if you’re just maintaining a cookie recipe site on the dark web, but it’s rarely ever that, is it?

Tor can be made substantially less obvious if you make sure the bitrate and packet timings over each 'hop' of users connections are fixed. Eg. each client sends out 1000 1 kbyte packets per second to each peer, once per millisecond. Inside each packet, they send the onion encrypted user data. The rest of the packet is filled with rand(). Without that protection, any network attacker can do packet size and timing anal…

Submit a pull request then.

Re: Tor Browser 12.0

#82

Post by bombcar »

sterlind wrote: post #36
godelski wrote: post #35

Earlier quoted context omitted.

Why are exit nodes more legally perilous than non-exit nodes?

they shouldn't be, but there's a practical difference in how often your house gets raided by FBI agents. if a Tor user uses your exit node to email a bomb threat or access child porn, it's your source IP that shows up. the FBI should check your IP against the registry of exit node IPs, but if they don't it's still your door getting kicked in.

Exactly - and I've noticed there aren't very many exit nodes at all, small enough that I can start to recognize them by name.

Re: Tor Browser 12.0

#83

Post by bombcar »

mypastself wrote: post #58
time_to_smile wrote: post #45

Earlier quoted context omitted.

> but it’s rarely ever that, is it? Maybe I'm unique, but my dark net activity is usually pretty tame. The number one reason I use Tor is because browsing onion sites reminds a bit more of how the web used to be in the late 1990s. Lot's of garbage of course, but a lot more serendipitous discovery than the web today. Because of its anonymous nature Onion sites are inherently resistant to being swallowed whole by adver…

If I may ask (provided you’re comfortable with disclosing) what kind of content do you find there that’s genuinely interesting?

A surprising number of "clarinet" (er clearnet spellcheck) sites have onion sites, if you use Brave and TOR it sometimes shows up a little onion in the right telling you there's an onion version available.

Re: Tor Browser 12.0

#84

Post by bombcar »

yucky wrote: post #61
HackerNCoder wrote: post #50

Earlier quoted context omitted.

You don't need (outdated) FOIA documents for that... Go to https://www.torproject.org/about/sponsors/ and you will see that they get money from the US government, if you want to know more about how much, go check the IRS 990 forms [1] or check the blog post that explains the 990, it also gives clear percentages on how much comes from where, [2] [1] https://www.torproject.org/about/reports/ [2] https://blog.torproject…

This part appears to be missing from the Tor website: > 2,500 pages of correspondence — including strategy and contracts and budgets and status updates — between the Tor Project and its main funder, a Central Intelligence Agency spinoff now known as the Broadcasting Board of Governors (BBG). These files show incredible cooperation between Tor and the regime change wing of the US government. So the documents acquired…

It's pretty obvious that TOR is a helpful tool if you're doing spyshit in foreign countries.

Re: Tor Browser 12.0

#85

Post by scrlk »

chefandy wrote: post #62
optimalsolver wrote: post #9

The inescapable fact about Tor is that its traffic patterns make you stand out prominently. Just the fact you’re using it automatically makes you interesting and worthy of a closer look. All well and good if you’re just maintaining a cookie recipe site on the dark web, but it’s rarely ever that, is it?

A colleague at a former academic job was questioned by campus police because he was one of a handful of people on the university network connected to TOR when a bomb threat was submitted (I forget how, though) from an IP address running a TOR exit node. Bomb threats from students were pretty common during exams, so after the cops saw that it was our very privacy conscious dev ops guy they didn't pursue him as a suspe…

Was it this incident?

https://www.theverge.com/2013/12/18/5224130/fbi-agents-track...

Re: Tor Browser 12.0

#86

Post by data_maan »

londons_explore wrote: post #56
optimalsolver wrote: post #9

The inescapable fact about Tor is that its traffic patterns make you stand out prominently. Just the fact you’re using it automatically makes you interesting and worthy of a closer look. All well and good if you’re just maintaining a cookie recipe site on the dark web, but it’s rarely ever that, is it?

Tor can be made substantially less obvious if you make sure the bitrate and packet timings over each 'hop' of users connections are fixed. Eg. each client sends out 1000 1 kbyte packets per second to each peer, once per millisecond. Inside each packet, they send the onion encrypted user data. The rest of the packet is filled with rand(). Without that protection, any network attacker can do packet size and timing anal…

I took class in IT privacy back in the day. Exactly this idea came up. And while it really disables certain kinds of timing based attacks, the problem is it doesn't scale. If everyone did this, it seems the network would be flooded.

Re: Tor Browser 12.0

#87

Post by goombacloud »

It's sad to see that Apple Silicon gets extra treatment and arm64 work suddenly gets done while for Linux it's still amd64-only. With Signal it's the same and they also don't offer arm64 builds.

Nowadays it's very easy to build for arm64 - you either go the way with cross compilation or you go the way with full qemu binary emulation which is as simple as it gets because you would build within an arm64 docker image, e.g., docker.io/arm64v8/alpine or docker.io/arm64v8/ubuntu and qemu-static handles the emulation (it will be slower than cross compilation but as long as speed is acceptable you can go this easy way).

Re: Tor Browser 12.0

#88

Post by data_maan »

All comments here focus on extreme cases: The police viewing you as a possible suspect, FBI becoming interested in you etc.

Here is a much more mundane problem: Using Tor (even a VPN) while logging in to most big Silicon Valley firma that make money with your data (LinkedIn, Facebook, Tinder etc.) will result in your profile being suspended REAL FAST with the only way out to upload your gov't ID, i.e. complete deanonimization (perhaps as a kind of punishment).

Any solutions?

Re: Tor Browser 12.0

#89

Post by data_maan »

I once spoke with someone who knew someone who ran an exit node in Europe. He told crazy stories with police knocking every once in a while.

Also the legal structure to do that was tricky, because you want to avoid the police searching your house; you'd also like tl spread responsability on multiple shoulders. So you have to create a kind of non-profit organization and run the exit node through that.

It's very hard work and we should be thankful for the people who do it.

Does anybody know more about how exit nodes are being run?

Re: Tor Browser 12.0

#90

Post by Gigachad »

thekyle wrote: post #16
pr337h4m wrote: post #14

Earlier quoted context omitted.

The Brave browser has around 60 million MAUs and has Tor bundled with it, so Tor traffic is unlikely to stand out as much as before.

I believe the Tor feature of Brave is an optional setting, so I assume only a small fraction of their MAU use it.

It’s not a setting, it’s like their version of an incognito tab. You can right click a link to “open in tor”
Post reply on HN