Live data from Hacker News

Oniux: Kernel-level Tor isolation for any Linux app

blog.torproject.org

21–30 of 54 posts

Re: Oniux: Kernel-level Tor isolation for any Linux app

#21
Oniux seems like an "officially" supported tool similar to orjail (which hasn't received a commit in four years, but still works great as a shell script with iptables/iproute tools [1]). Orjail has also an option to run with firejail for further isolation, which seems to be still a feature that Oniux doesn't have.

[1] https://github.com/orjail/orjail/blob/master/usr/sbin/orjail

Re: Oniux: Kernel-level Tor isolation for any Linux app

#22
post #19

Earlier quoted context omitted.

You can, but please don’t do this, you’ll stick out even more! Tor browser has a series of anti fingerprinting strategies that chrome doesn’t

Does Brave attempt to mimic any of these anti fingerprinting strategies? Asking because it has a "Private tab with Tor" feature

No. First of all, just check for `navigator.brave`. If it exists, it's Brave. When I ran a .onion site I added a JavaScript check and if navigator.brave was present, it redirected users to a specific page saying:

> Hey, there's something funny about your Tor Browser. When browsing Tor hidden services (.onion), you should be using Tor Browser. Are you using an outdated version, or perhaps something else entirely?

Brave is chrome. Tor browser is firefox, has a bunch of tweaks, different default settings, and a different fingerprint. Also when browsing on Tor, you should disable JavaScript as it's a source of many vulnerabilities.

Re: Oniux: Kernel-level Tor isolation for any Linux app

#24
post #19

Earlier quoted context omitted.

You can, but please don’t do this, you’ll stick out even more! Tor browser has a series of anti fingerprinting strategies that chrome doesn’t

Does Brave attempt to mimic any of these anti fingerprinting strategies? Asking because it has a "Private tab with Tor" feature

The main strategy is that most people on Tor are using Tor Browser. This creates a cluster big enough to blend in. If you're using anything else, you're sticking out.

Re: Oniux: Kernel-level Tor isolation for any Linux app

#26

Oniux seems like an "officially" supported tool similar to orjail (which hasn't received a commit in four years, but still works great as a shell script with iptables/iproute tools [1]). Orjail has also an option to run with firejail for further isolation, which seems to be still a feature that Oniux doesn't have. [1] https://github.com/orjail/orjail/blob/master/usr/sbin/orjail

No Javascript URL:

https://raw.githubusercontent.com/orjail/orjail/master/usr/s...

Re: Oniux: Kernel-level Tor isolation for any Linux app

#27
post #12

Huh. I had a conversation with a Tor developer on this topic about a decade ago, when network namespaces were still kind of a new hotness - the feedback I got was that it would be an easy way for people to think they were being secure while still leaking a bunch of identifiable information, so I didn't push that any further.

Strange, because torsock and torify do the same thing, but less robustly.

Re: Oniux: Kernel-level Tor isolation for any Linux app

#29
post #23

Earlier quoted context omitted.

Non-TCP activity wouldn't route and will fail to send.

UDP wouldn't route?..

The TOR protocol does not natively support UDP, though there are workarounds[0]

[0]: https://www.whonix.org/wiki/Tunnel_UDP_over_Tor

Re: Oniux: Kernel-level Tor isolation for any Linux app

#30

Earlier quoted context omitted.

Irssi iirc used to default your username to your system username, so noobs would leak their given name by accident. After seeing that I changed my username in Linux to always be the most common username

What is the most common Linux username though? Obviously you don’t want to do your regular work as root. And guest has its own issues. Is there a “common name”?

Robert'); DROP TABLE Students;-- Roberts
Post reply on HN