191–200 of 230 posts
So I guess Mozilla isn't working on unforking tor browser?
It's pretty much already happened. Tor Browser is little more than stock Firefox with some of the settings changed.
Earlier quoted context omitted.
That’s probably one of the reasons that TLS over Tor has remained such a tough nut, with people who otherwise seem to have tinfoil hats claiming that it’s not needed because Tor provides enough protection. My opinion is that you want that end to end protection for the same reason you want it on the clearnet - to make so nobody along the way is sniffing your traffic. (that includes both exit nodes and any middle nodes…
> people who otherwise seem to have tinfoil hats claiming that it’s not needed because Tor provides enough protection I've been on the side of advocating for it, but the other side isn't making an obviously ridiculous argument. The onion protocol itself negotiates an end-to-end cryptographic session, authenticated by the onion site's public key, between the onion site and the end user. There's not cleartext traffic s…
How much do you believe what this book (by Yasha Levine, writer for Wired, New York Observer, etc) states — that Tor is funded by the CIA and has backdoors? https://www.amazon.com/Surveillance-Valley-Military-History-...
Some more Yasha stuff: https://micahflee.com/2014/12/fact-checking-pandos-smears-ag...
Earlier quoted context omitted.
Tor can be made substantially less obvious if you make sure the bitrate and packet timings over each 'hop' of users connections are fixed. Eg. each client sends out 1000 1 kbyte packets per second to each peer, once per millisecond. Inside each packet, they send the onion encrypted user data. The rest of the packet is filled with rand(). Without that protection, any network attacker can do packet size and timing anal…
Is that individually tunable, or are you suggesting something that the project would have to change in their code?
If just a single client used this option, their traffic path, all the way to the exit node, would stand out to any network attacker.
All comments here focus on extreme cases: The police viewing you as a possible suspect, FBI becoming interested in you etc. Here is a much more mundane problem: Using Tor (even a VPN) while logging in to most big Silicon Valley firma that make money with your data (LinkedIn, Facebook, Tinder etc.) will result in your profile being suspended REAL FAST with the only way out to upload your gov't ID, i.e. complete deanon…
Earlier quoted context omitted.
Tor can be made substantially less obvious if you make sure the bitrate and packet timings over each 'hop' of users connections are fixed. Eg. each client sends out 1000 1 kbyte packets per second to each peer, once per millisecond. Inside each packet, they send the onion encrypted user data. The rest of the packet is filled with rand(). Without that protection, any network attacker can do packet size and timing anal…
I'm not sure if only the client does the padding, or if the padding also occurs at intermediate hops, but Tor does randomly pad traffic by default (from manpage of torrc): CircuitPadding 0|1 If set to 0, Tor will not pad client circuits with additional cover traffic. Only clients may set this option. This option should be offered via the UI to mobile users for use where bandwidth may be expensive. If set to 1, paddin…
Basically - this option doesn't serve it's intended purpose.
I once spoke with someone who knew someone who ran an exit node in Europe. He told crazy stories with police knocking every once in a while. Also the legal structure to do that was tricky, because you want to avoid the police searching your house; you'd also like tl spread responsability on multiple shoulders. So you have to create a kind of non-profit organization and run the exit node through that. It's very hard w…
Earlier quoted context omitted.
the scenario I'm describing is "You -> VPN/SSH -> Tor" and your link says it's a fine idea.
Just keep in mind that your VPN/SSH provider now has the same visibility your ISP did.
now, a foreign VPN isn't going to be connected to the xkeyscore dragnet like Comcast would be. I'm sure the NSA's pwned dozens of VPN providers, but beam-splitting all VPN traffic into a colo'd supercomputer isn't going to be stealthy. the best the NSA could do is watch for outbound connections from the VPN to Tor, then match the connection to your ingress using their access inside the VPN's infra. they can't do that in bulk without the VPN company catching on. that's a capability they'll save for going after individuals. just the fact you connected to Tor isn't suspicious enough to be worth risking burning their backdoor, for them.
the point is that connecting to Tor via a VPN keeps you out of the dragnets. and all the VPN provider learns is that you're using them as a gateway into Tor.
Earlier quoted context omitted.
Afaik, it does not use Tor from within the browser, but uses a proxy server into Tor. That could have changed though.
It runs a TOR client locally and proxies all connections through that. It does not implement the privacy protections of the TOR browser tho. Basically, using the TOR network as a VPN.
The TOR browser and Brave do the exact same thing, it's just that the TOR browser is configured to not store anything and to make sure it's fingerprint to other sites is as generic as possible (this is also why TOR warns you about changing window size, it un-generalizes that fingerprint). Both ultimately are conveniences because messing with SOCKS proxy settings is rather unfriendly for most users.
If you use a Linux distro, I'd recommend checking out torsocks[1], it's a shared library + a shell script that lets you "onion-ify" any application pretty easily.
[0]: This also means you can connect basically every mainstream browser to TOR if you know the port the SOCKS proxy is running on.