Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor Browser 8.5

blog.torproject.org

Post reply on HN
Print view View original

41–50 of 99 posts

Re: Tor Browser 8.5

#41

Post by friendly_chap »

Grangar wrote: post #32
friendly_chap wrote: post #26

Earlier quoted context omitted.

To be fair I mostly use it for not overly sensitive stuff. Let me give you an idea: I prefer to not have my ISP log my requests to reddit.com/r/LSD. Not because I do anything illegal (I don't even take acid), but in this dystopian world where every action on the internet is recorded, the last thing I want is to end up on lists purely because of my curiosity. If I would do anything I could get into trouble for (which…

Your ISP won't log the request going to /r/LSD. It's over SSL, so the only thing your ISP sees is a request to reddit.com.

You are correct. Domains can be still sensitive though.

Re: Tor Browser 8.5

#42

Post by edoo »

cyphar wrote: post #20
edoo wrote: post #16

Earlier quoted context omitted.

You have to be a little weary using tor. Anyone can run an exit node and it is trivial to rewrite and inject onto web pages. You can also on the fly intercept SSL requests and generate your own self signed certificate that fails proper verification but looks real enough if inspected that will always trick a percentage of users. If you've used tor with any frequency you've probably hit weird SSL cert errors that go aw…

It is fair to say that using unauthenticated protocols like HTTP over Tor is a pretty bad idea (and there really should be more warning bells about this in the Tor Browser). However on the TLS comment -- almost all modern websites use HSTS, so sslstrip doesn't really work any more.

I mean you can intercept the request, retrieve the real cert, generate a self signed cert with the exact same details, then submit that to the user and be man in the middle. Of course the user gets the blank SSL cert error page on the browser, but a percentage of those users will override and continue. Copying the cert details increases that percentage as some will actually look at the invalid cert. It is quite blatant but it is just a numbers game at that point. If you ever hit an SSL cert error with TOR you should force a new onion path.

Re: Tor Browser 8.5

#43

Post by pawal »

dmos62 wrote: post #36

Are there any casual users of Tor around? Someone who does it not for the sake of safety, but just privacy? I'd happily use Tor, but the last time I used it (which was ~5 years ago), it was terribly slow for regular browsing (not streaming, or anything considered bandwidth heavy).

Yes, I use it often. My Debian installations use Tor for installing updates. Just as an example.

Re: Tor Browser 8.5

#44

Post by throwaway66hack »

cyphar wrote: post #39
throwaway66hack wrote: post #30

Earlier quoted context omitted.

How about sslstrip2 ([1], check demo)? A weakness of HSTS is that is stored per domain and the exit node can also control your DNS traffic. I wonder how hard it is to pull this off as a Tor exit node, for local networks there are tools like bettercap [2]. [1] https://github.com/byt3bl33d3r/sslstrip2 [2] https://www.bettercap.org/legacy/

That is a pretty neat attack, but I disagree it would be useful against Tor. DNS traffic is funneled through a different Tor circuit than the web traffic. You'd need to apply the bad DNS to all users, which would almost certainly in your exit node being dropped from the network. I'm also not sure how this would be handled with HSTS preload lists -- HSTS preload applies to all subdomains so you'd need to come up with…

You are right. With different Tor circuits, the attacker needs to control a lot of exit nodes to correlate the initial HTTP request to ssl-stripped page and the DNS query (to be a global adversary).

Re: Tor Browser 8.5

#45

Post by dmos62 »

neiman wrote: post #40
dmos62 wrote: post #36

Are there any casual users of Tor around? Someone who does it not for the sake of safety, but just privacy? I'd happily use Tor, but the last time I used it (which was ~5 years ago), it was terribly slow for regular browsing (not streaming, or anything considered bandwidth heavy).

What do you mean by casual? I use it relatively often, when I want to access a website privately (I don't trust any VPN service that much). I'm pretty sure I'm not the only person doing that. But maybe you mean if someone using it as the main browsing tool for privacy reasons? This I doubt, since it's indeed slow. I also don't think that Tor is meant to be used as your main browser really.

That's pretty much what I meant my casual -- Tor as main browsing tool.

Re: Tor Browser 8.5

#46

Post by maeln »

dmos62 wrote: post #36

Are there any casual users of Tor around? Someone who does it not for the sake of safety, but just privacy? I'd happily use Tor, but the last time I used it (which was ~5 years ago), it was terribly slow for regular browsing (not streaming, or anything considered bandwidth heavy).

I use Tor/Tor Browser quite often. I use it mostly for privacy, but also to test a few thing like price of plane tickets and such.

The speed is much better nowadays. Unless your unlucky and you circuit has a slow node in it (which the protocol try to avoid if i remember correctly), you should have a decent web browsing experience. Sure, it will be slower than your "normal" connection, but usually not by that much.

Although, if you plan on downloading large files via Tor, you will hit a bandwidth cap fairly quickly. You can look in detail here: https://metrics.torproject.org/torperf.html

Available bandwidth quadruple since 2014: https://metrics.torproject.org/bandwidth-flags.html?start=20...

Re: Tor Browser 8.5

#47

Post by DougHaber »

Tinfoilhat666 wrote: post #7

How is this better than Brave browser?

Sadly, most of the replies you've gotten are terribly biased or uniformed. It is a good question. I'm not connected to any of this, so this answer is solely from my own understanding.

For those that don't know, the Brave browser has Tor tabs, which route through Tor. It also has the standard private tabs. Tor support currently exists only on the desktop Brave browser.

Here is the announcement: https://brave.com/tor-tabs-beta

Brave has been supporting Tor, and running Tor relays to improve the network.

Brave is newer at the game. They have had Tor tabs less than a year. They can do fingerprinting protection and no-script, but it's still a full featured web browser, with a lot of risks. The fingerprinting protection isn't as good as the Tor Browser, and unless they changed something, Javascript wasn't disabled by default in Tor tabs.

The Tor Browser has been around for a while and is meant to be a secure web browser from top to bottom. It has had a lot of development looking to find and fix possible leaks and to ensure security. That is its primary focus, and it is pretty good at it.

If you want to use Tor casually, maybe access an onion site, or just get a big boost in your level of privacy, the Tor tabs in Brave are a nice option. They are really easy to use and give great privacy. It is good for casual Tor use.

If you want (or need) serious privacy, the Tor Browser is a better choice. That is its purpose. It is developed to be hardened for protecting the user and it will provide better protection.

Re: Tor Browser 8.5

#48

Post by cyphar »

edoo wrote: post #42
cyphar wrote: post #20

Earlier quoted context omitted.

It is fair to say that using unauthenticated protocols like HTTP over Tor is a pretty bad idea (and there really should be more warning bells about this in the Tor Browser). However on the TLS comment -- almost all modern websites use HSTS, so sslstrip doesn't really work any more.

I mean you can intercept the request, retrieve the real cert, generate a self signed cert with the exact same details, then submit that to the user and be man in the middle. Of course the user gets the blank SSL cert error page on the browser, but a percentage of those users will override and continue. Copying the cert details increases that percentage as some will actually look at the invalid cert. It is quite blata…

Yes, you could do that but then your node would be kicked off the Tor network (because you'd need to do it indiscriminately since you don't know who the user is you're trying to target). In addition, relays are load-balanced based on trustworthiness and bandwidth so in order to attack a significant portion of users you'd need to be running a large and trusted node (which would be hard to do if you're just doing this to attack people).

Re: Tor Browser 8.5

#49

Post by cyphar »

dmos62 wrote: post #36

Are there any casual users of Tor around? Someone who does it not for the sake of safety, but just privacy? I'd happily use Tor, but the last time I used it (which was ~5 years ago), it was terribly slow for regular browsing (not streaming, or anything considered bandwidth heavy).

I use Tor fairly regularly, though I am a bit annoyed that the default add-ons on the Tor Browser are so outdated (no uBlock Origin and questionably-set-up NoScript). And if you want to remain anonymous it'd be a bad idea to add new extensions since that changes your fingerprint. The main annoyance is not the bandwidth (it's okay for most things, videos can be a bit painful) but the CAPTCHA you have to keep completing. If I have to see one more photo of traffic lights where the boxes don't line up with the poles I'm going to scream.

Re: Tor Browser 8.5

#50

Post by octosphere »

dmos62 wrote: post #36

Are there any casual users of Tor around? Someone who does it not for the sake of safety, but just privacy? I'd happily use Tor, but the last time I used it (which was ~5 years ago), it was terribly slow for regular browsing (not streaming, or anything considered bandwidth heavy).

I use Tor for about 30% of my browsing. Tor is handy if you are doing research on a topic and you don't want to leave too much of a 'data exhaust' or otherwise alert people to the fact that you are interested in certain topics.

I typically stay away from Tor when it comes to online banking or finance in general (logging into Amazon with Tor can raise some red flags for example).

In terms of speed, I have noticed personally that Tor has gotten a lot faster. Sometimes you get a slow circuit and have to spawn a new identity / rebuild a new circuit to get a faster one, sort of like 'circuit roulette'.

The rest of my surfing is for fairly innocuous subject matter and using Tor for it would be overkill. Again, Tor would be handy for privately researching general health issues, sexual health issues, mental health issues, etc

Tor is also handy for recon[0] in general too. For me privacy is how you present yourself to the world, and doing recon[0] in a certain community, or (anonymously) 'lurking' in a community is useful before you re-register an account and start posting as the 'real you'.

[0] https://en.wiktionary.org/wiki/reconnaissance

Post reply on HN