Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor Browser 8.5

blog.torproject.org

Post reply on HN
Print view View original

21–30 of 99 posts

Re: Tor Browser 8.5

#21

Post by sjustinas »

trpc wrote: post #13
joshuakelly wrote: post #10

Earlier quoted context omitted.

This is amusingly uninformed. Saying nothing about the ad-ware comment, since that seems designed to deliberately obfuscate/obscure reality, you probably weren't aware of: https://brave.com/tor-tabs-beta To OP - check out the issues, there's a reason it's still in beta: https://github.com/search?utf8=&q=is%3Aopen+is%3Aissue+org%3...

This is amusingly uninformed. Describing Brave as adware is generous to say the least, Brave is more of a scam than a business. The kind of scams you would find in tech bubbles like what happened in late 1990s.

Could you elaborate? As far as I know, Brave promises to give you a browser and it gives you a browser. Does not sound like something I would call a "scam".

Re: Tor Browser 8.5

#22

Post by mikorym »

HNLurker2 wrote: post #2

I wish people used the deep web for something besides illegal buying and child pornography

If using the definition for the dark/deep web that I think, then it includes traffic to and from any networked entity that does not have a URL (or otherwise public frontend).

This could then include stored data, VPNs or other company/govt/organisational data that is not accessible via normal web traffic.

Re: Tor Browser 8.5

#23

Post by mikorym »

edoo wrote: post #12
Nursie wrote: post #5

Earlier quoted context omitted.

I've used it to maintain normal(ish) internet service for myself when visiting places like China.

When I went to China I expected problems so I setup my laptop with an SSL tunnel on port 443 to a virtual server and then routed openvpn over that. It worked like a charm. My favorite feature of openvpn is it can maintain state, so even if the tunnel resets and openvpn has to reconnect all the tcp connections just pick up where they left off.

What is the difference between this and just having a normal SSH tunnel; for example, how does this differ from using sshuttle?

Re: Tor Browser 8.5

#24

Post by nextlevelwizard »

Tinfoilhat666 wrote: post #7

How is this better than Brave browser?

Just from considering that Brave is a complete meme, like c'mon switching ads to other ads is one of the stupidest ideas I've ever heard. You are not improving anything except padding pockets of Brave developers. To make matters worse it is just Chromium with new shit on top.

Literally anything is better than Brave, well, maybe not IE.

Re: Tor Browser 8.5

#25

Post by bepvte »

mikorym wrote: post #22
HNLurker2 wrote: post #2

I wish people used the deep web for something besides illegal buying and child pornography

If using the definition for the dark/deep web that I think, then it includes traffic to and from any networked entity that does not have a URL (or otherwise public frontend). This could then include stored data, VPNs or other company/govt/organisational data that is not accessible via normal web traffic.

I believe thats just the definition for deep web.

Re: Tor Browser 8.5

#26

Post by friendly_chap »

edoo wrote: post #16
friendly_chap wrote: post #4

Earlier quoted context omitted.

I do and a lot of people I know also do. Just for added privacy, or anything sensitive but legal. Tor became such a pleasant (and fast, unlike it used to be) experience that it can be used for general anon surfing.

You have to be a little weary using tor. Anyone can run an exit node and it is trivial to rewrite and inject onto web pages. You can also on the fly intercept SSL requests and generate your own self signed certificate that fails proper verification but looks real enough if inspected that will always trick a percentage of users. If you've used tor with any frequency you've probably hit weird SSL cert errors that go aw…

To be fair I mostly use it for not overly sensitive stuff. Let me give you an idea: I prefer to not have my ISP log my requests to reddit.com/r/LSD.

Not because I do anything illegal (I don't even take acid), but in this dystopian world where every action on the internet is recorded, the last thing I want is to end up on lists purely because of my curiosity.

If I would do anything I could get into trouble for (which I won't), I would definitely research more about how to use Tor safely.

Re: Tor Browser 8.5

#27

Post by bepvte »

mikorym wrote: post #23
edoo wrote: post #12

Earlier quoted context omitted.

When I went to China I expected problems so I setup my laptop with an SSL tunnel on port 443 to a virtual server and then routed openvpn over that. It worked like a charm. My favorite feature of openvpn is it can maintain state, so even if the tunnel resets and openvpn has to reconnect all the tcp connections just pick up where they left off.

What is the difference between this and just having a normal SSH tunnel; for example, how does this differ from using sshuttle?

For one, openvpn can use udp unlike ssh, which means the annoying overhead of double tcp is gone

Re: Tor Browser 8.5

#28

Post by ikornaselur »

friendly_chap wrote: post #26
edoo wrote: post #16

Earlier quoted context omitted.

You have to be a little weary using tor. Anyone can run an exit node and it is trivial to rewrite and inject onto web pages. You can also on the fly intercept SSL requests and generate your own self signed certificate that fails proper verification but looks real enough if inspected that will always trick a percentage of users. If you've used tor with any frequency you've probably hit weird SSL cert errors that go aw…

To be fair I mostly use it for not overly sensitive stuff. Let me give you an idea: I prefer to not have my ISP log my requests to reddit.com/r/LSD. Not because I do anything illegal (I don't even take acid), but in this dystopian world where every action on the internet is recorded, the last thing I want is to end up on lists purely because of my curiosity. If I would do anything I could get into trouble for (which…

Please correct me if I'm wrong, but can't your ISP only see that you're requesting reddit.com, as long as you're using https? Now sure, if you go to lsd.reddit.com, it can be logged as a subdomain, but anything beyond reddit.com shouldn't be viewable by your ISP.

I'm not saying that you shouldn't use tor, just that as far as I understand, the whole request, including path and method, is encrypted over tls/ssl after your browser establishes a tcp connection to the server.

Re: Tor Browser 8.5

#29

Post by chii »

Izmaki wrote: post #18

Allow me to send a big shoutout and my deepest thanks to the maintainers and volunteers of both the Tor Browser and the Tor Project in general. You make the world a better place, even if the majority of the population don't realise they should pay more attention to your work. You're the real MVPs!

more people ought to use TOR so that the users who _need_ tor gets the protection of anonymity in a crowd.

If nobody uses TOR, then TOR users immediately becomes suspicious and nothing prevents the real world investigation from uncovering them.

Re: Tor Browser 8.5

#30

Post by throwaway66hack »

cyphar wrote: post #20
edoo wrote: post #16

Earlier quoted context omitted.

You have to be a little weary using tor. Anyone can run an exit node and it is trivial to rewrite and inject onto web pages. You can also on the fly intercept SSL requests and generate your own self signed certificate that fails proper verification but looks real enough if inspected that will always trick a percentage of users. If you've used tor with any frequency you've probably hit weird SSL cert errors that go aw…

It is fair to say that using unauthenticated protocols like HTTP over Tor is a pretty bad idea (and there really should be more warning bells about this in the Tor Browser). However on the TLS comment -- almost all modern websites use HSTS, so sslstrip doesn't really work any more.

How about sslstrip2 ([1], check demo)? A weakness of HSTS is that is stored per domain and the exit node can also control your DNS traffic. I wonder how hard it is to pull this off as a Tor exit node, for local networks there are tools like bettercap [2].

[1] https://github.com/byt3bl33d3r/sslstrip2

[2] https://www.bettercap.org/legacy/

Post reply on HN