Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor Browser 8.5

blog.torproject.org

Post reply on HN
Print view View original

51–60 of 99 posts

Re: Tor Browser 8.5

#51

Post by edoo »

cyphar wrote: post #48
edoo wrote: post #42

Earlier quoted context omitted.

I mean you can intercept the request, retrieve the real cert, generate a self signed cert with the exact same details, then submit that to the user and be man in the middle. Of course the user gets the blank SSL cert error page on the browser, but a percentage of those users will override and continue. Copying the cert details increases that percentage as some will actually look at the invalid cert. It is quite blata…

Yes, you could do that but then your node would be kicked off the Tor network (because you'd need to do it indiscriminately since you don't know who the user is you're trying to target). In addition, relays are load-balanced based on trustworthiness and bandwidth so in order to attack a significant portion of users you'd need to be running a large and trusted node (which would be hard to do if you're just doing this…

I wasn't aware that Tor tested services and had a trustworthiness score but an attack like that could still be quite useful for certain purposes and possibly stay well hidden. If you set something up that only did it for Google IP blocks for example it might go undetected. If you actually got shut down you could refine it by only targeting a small percentage of those users. There would be some rate of account collection, however small.

Re: Tor Browser 8.5

#52

Post by dooglius »

cyphar wrote: post #14
HNLurker2 wrote: post #2

I wish people used the deep web for something besides illegal buying and child pornography

Less than 3% of Tor traffic is to onion services of any kind (which means 97% is to websites already accessible on the public internet), and the most popular onion service on the internet by a large margin is Facebook's (facebookcorewwwi.onion). More than 2 million people use Tor every day -- are they all bad people? Heck, government agents use Tor when traveling abroad. Do bad people do bad things using Tor? Yes. Do…

> the most popular onion service on the internet by a large margin is Facebook's

How do you know? It shouldn't be possible to collect this sort of data.

Re: Tor Browser 8.5

#53

Post by walrus01 »

edoo wrote: post #12
Nursie wrote: post #5

Earlier quoted context omitted.

I've used it to maintain normal(ish) internet service for myself when visiting places like China.

When I went to China I expected problems so I setup my laptop with an SSL tunnel on port 443 to a virtual server and then routed openvpn over that. It worked like a charm. My favorite feature of openvpn is it can maintain state, so even if the tunnel resets and openvpn has to reconnect all the tcp connections just pick up where they left off.

This will work for a short while, but consistent long term openvpn-matching packets are now seen the the GFW's automated dpi systems, eventually the IP of your non-china VPN endpoint will get blocked.

Re: Tor Browser 8.5

#54

Post by Vinnl »

DougHaber wrote: post #47
Tinfoilhat666 wrote: post #7

How is this better than Brave browser?

Sadly, most of the replies you've gotten are terribly biased or uniformed. It is a good question. I'm not connected to any of this, so this answer is solely from my own understanding. For those that don't know, the Brave browser has Tor tabs, which route through Tor. It also has the standard private tabs. Tor support currently exists only on the desktop Brave browser. Here is the announcement: https://brave.com/tor-t…

It is also based on Firefox, and when possible improvements it makes to Firefox feed back into regular Firefox, strengthening their position in an ever-less competitive browser market. Not something everyone cares about, but it could be relevant.

Re: Tor Browser 8.5

#55

Post by tgragnato »

dooglius wrote: post #52
cyphar wrote: post #14

Earlier quoted context omitted.

Less than 3% of Tor traffic is to onion services of any kind (which means 97% is to websites already accessible on the public internet), and the most popular onion service on the internet by a large margin is Facebook's (facebookcorewwwi.onion). More than 2 million people use Tor every day -- are they all bad people? Heck, government agents use Tor when traveling abroad. Do bad people do bad things using Tor? Yes. Do…

> the most popular onion service on the internet by a large margin is Facebook's How do you know? It shouldn't be possible to collect this sort of data.

Counting hits on HSDir(s) and extrapolating a statistic. Related: https://trac.torproject.org/projects/tor/ticket/8106

Re: Tor Browser 8.5

#56

Post by Nursie »

edoo wrote: post #12
Nursie wrote: post #5

Earlier quoted context omitted.

I've used it to maintain normal(ish) internet service for myself when visiting places like China.

When I went to China I expected problems so I setup my laptop with an SSL tunnel on port 443 to a virtual server and then routed openvpn over that. It worked like a charm. My favorite feature of openvpn is it can maintain state, so even if the tunnel resets and openvpn has to reconnect all the tcp connections just pick up where they left off.

That sounds much more prepared than I was, I arrived and then wanted a quick solution on the fly, Tor fit the bill nicely.

I would probably use my StrongSwan IPSEC VPN setup to home now that I have one.

Re: Tor Browser 8.5

#57

Post by tialaramex »

friendly_chap wrote: post #31
ikornaselur wrote: post #28

Earlier quoted context omitted.

Please correct me if I'm wrong, but can't your ISP only see that you're requesting reddit.com, as long as you're using https? Now sure, if you go to lsd.reddit.com, it can be logged as a subdomain, but anything beyond reddit.com shouldn't be viewable by your ISP. I'm not saying that you shouldn't use tor, just that as far as I understand, the whole request, including path and method, is encrypted over tls/ssl after y…

I do believe the url path is visible even over HTTPS. Off to do some research on this. Edit: apparently the url is not visible, but the domain (more like IP, which can be easily resolved to domain). Same thing still applies, perhaps not with reddit subreddits, but with specific domains/websites.

With ordinary DNS you are asking in plain text hey, what's the IP address for reddit.com and it does not take a genius to guess that's because you're visiting reddit.com

With HTTPS using TLS 1.2 or earlier the site sends its certificate in plaintext too, so even if you just remember the IP address, it will tell anybody snooping "Hi, this is reddit.com".

In TLS 1.3 the site's certificate is encrypted. However the SNI, which is used to make virtual hosting work, is not encrypted. So your ISP can see where you said you were going, but not whether they proved they were the real deal.

DPRIVE such as DNS over HTTPS cures the first thing, you use an encrypted transport to do DNS queries against somebody trustworthy who won't rat you out.

eSNI (encrypted SNI) is intended to one day cure the other problem.

Even with both these, seeing that you visited a very popular system like Facebook or Reddit is always going to be easy. So Tor remains important.

Re: Tor Browser 8.5

#58

Post by belorn »

dmos62 wrote: post #36

Are there any casual users of Tor around? Someone who does it not for the sake of safety, but just privacy? I'd happily use Tor, but the last time I used it (which was ~5 years ago), it was terribly slow for regular browsing (not streaming, or anything considered bandwidth heavy).

As a sysadmin I use tor regularly as a easy and free third-party perspective. If there is a problem but it works when I test it, I then go and test in tor in order to eliminate any potential effect in my local network.

Tor is also ipv4 so it is a convenient way to get a ipv4 web view inside a ipv6 enabled network, without having to deal with browser plugins or adjust the interface on the machine.

Re: Tor Browser 8.5

#59

Post by kodablah »

dmos62 wrote: post #36

Are there any casual users of Tor around? Someone who does it not for the sake of safety, but just privacy? I'd happily use Tor, but the last time I used it (which was ~5 years ago), it was terribly slow for regular browsing (not streaming, or anything considered bandwidth heavy).

I use it (Tor, not the browser as much) just to bust NAT to my local computer when sharing stuff. It's so easy to create an onion service that links to a local web server.

Re: Tor Browser 8.5

#60

Post by tptacek »

Tor Browser might be the least mainstream safe browser on the Internet:

* It permanently tracks the lagging ESR Firefox.

* It puts its users on Tor, which "anonymizes" them but also flags their traffic as interesting.

* It collapses all those users down to a single set of browser releases, making it cost-effective to target exploits to.

Use Firefox if you really like Firefox, but use the most recent version you can possibly get. Mozilla's is not the best-hardened browser.

Use Tor if you really believe in Tor. But use it explicitly, not as part of a browser bundle. Your choice of browser has a significant impact on your operational security; don't let a bunch of volunteers at Tor make that decision for you.

Post reply on HN