Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor 0day: Stopping Tor Connections

hackerfactor.com

Post reply on HN
Print view View original

51–60 of 92 posts

Re: Tor 0day: Stopping Tor Connections

#51

Post by Scoundreller »

throwaway89201 wrote: post #43

The author of this blog strongly comes across as a person who understands a good deal about finding vulnerabilities, but doesn't really understand the tradeoffs being made in maintaining usable anonymity software such as the Tor browser. The reported scroll bar width vulnerability is his strongest case. He rightly got a bounty for it. But it's relatively hard to fix, and until recently, the Tor browser also just leak…

> and until recently, the Tor browser also just leaked your window size via Javascript.

Though this was why Tor would always open in the same window size. But ya, that all fell apart if you maximized.

When did they fix “the leak” itself? Wouldn’t that require intercepting the JavaScript call in the same way that the scroll bar size issue could be fixed?

Re: Tor 0day: Stopping Tor Connections

#52

Post by MrStonedOne »

rendx wrote: post #42

I can't see how this is a "0day". This post talks about how you can identify a running Tor when you connect to the (operator-assigned, public) relay port. You can only "see" these TLS certificate details when you are connecting to the relay yourself. This means this does not allow network operators to detect traffic going to Tor nodes, or in-between nodes, let alone identify users or deanonymize anyone: To external o…

Security is in the eye of the application. Unauthenticated editing isn't an exploit on Wikipedia but it would be on the CDC's website

In this case the fact that a user is using tor is considered protected information meaning any exposure of that is in fact a info leak vulnerability

Re: Tor 0day: Stopping Tor Connections

#53

Post by core_dumped »

ragnese wrote: post #19
ColanR wrote: post #17

Earlier quoted context omitted.

I'm not sure there is a good alternative. Most of the alternatives are built with Java, which (considering tor isn't considered safe with Java enabled) doesn't seem like an improvement. Is there an alternative that's performant and built with a decent language? Or do the good ones just get snuffed out?

Java is not the same thing as JavaScript

People always say I'm being pedantic when I point that out, but I think it's a really important distinction to make to someone who's not aware, especially in the context of their security.

Re: Tor 0day: Stopping Tor Connections

#54

Post by JohnTHaller »

Scoundreller wrote: post #51
throwaway89201 wrote: post #43

The author of this blog strongly comes across as a person who understands a good deal about finding vulnerabilities, but doesn't really understand the tradeoffs being made in maintaining usable anonymity software such as the Tor browser. The reported scroll bar width vulnerability is his strongest case. He rightly got a bounty for it. But it's relatively hard to fix, and until recently, the Tor browser also just leak…

> and until recently, the Tor browser also just leaked your window size via Javascript. Though this was why Tor would always open in the same window size. But ya, that all fell apart if you maximized. When did they fix “the leak” itself? Wouldn’t that require intercepting the JavaScript call in the same way that the scroll bar size issue could be fixed?

I believe they implemented panels inside the browser window that force the window size to be different reported values.

Re: Tor 0day: Stopping Tor Connections

#56

Post by modzu »

MrStonedOne wrote: post #52
rendx wrote: post #42

I can't see how this is a "0day". This post talks about how you can identify a running Tor when you connect to the (operator-assigned, public) relay port. You can only "see" these TLS certificate details when you are connecting to the relay yourself. This means this does not allow network operators to detect traffic going to Tor nodes, or in-between nodes, let alone identify users or deanonymize anyone: To external o…

Security is in the eye of the application. Unauthenticated editing isn't an exploit on Wikipedia but it would be on the CDC's website In this case the fact that a user is using tor is considered protected information meaning any exposure of that is in fact a info leak vulnerability

tor will never be secure if you're running js enabled. trying to achiveve that is way out of scope of the project:

https://support.torproject.org/tbb/tbb-34/

Re: Tor 0day: Stopping Tor Connections

#57

Post by wolco »

Acrobatic_Road wrote: post #40
smooth_remmy wrote: post #28

I have gotten the impression over the last few years that the Tor Project has embraced social justice and diversity to the detriment of their software.

People said the same about Mozilla, but FF is doing just fine.

It's more important to support FF for a million reasons than not support them because of their internal culture.

Remove those reasons and I would prefer a more open culture and prefer less toxic and would switch browsers to support single thought vs group think.

Re: Tor 0day: Stopping Tor Connections

#58

Post by gruez »

>Checking every network connection against every possible Tor node takes time. This is fine if you have a slow network or low traffic volume, but it doesn't scale well for high-volume networks

What? I can't tell if this is sarcastic or not. There's only around 3000 tor entry nodes[1]. This is orders of magnitude smaller than the number of entries in the internet routing table, which is around 800k. This means at the worst case, if you're an ISP, you can block tor nodes at the router level with virtually zero impact.

[1] https://onionoo.torproject.org/details?search=flag:Guard%20r...

Re: Tor 0day: Stopping Tor Connections

#59

Post by EE84M3i »

thaumaturgy wrote: post #45
EE84M3i wrote: post #26

Earlier quoted context omitted.

If you feel it necessary to block Tor nodes in some way, I think it's better to only block non-safe methods. Personally, I don't do it, but I understand why it's appealing. I see it as a personal decision (its your website after all) and not morally wrong as some see it. I once talked to someone working security for a Canadian government agency. They considered it against their charter and/or illegal to block tor nod…

Yeah. I'm sympathetic towards the Tor project in general, but it's also a huge source of nuisances and almost 0% legitimate traffic (in my case). As a beleaguered one-man sysadmin who also wears a full-time dev hat, I just don't have the resources available to build out a more clever rule-based filter for Tor traffic. This approach took me all of about 10 minutes to figure out and deploy across my little network of s…

I was thinking that Apache / Nginx blocking based on IP match and HTTP method is likely approximately equivalent complexity.

Also CDNs generally offer this if you use one.

Re: Tor 0day: Stopping Tor Connections

#60

Post by rendx »

MrStonedOne wrote: post #52
rendx wrote: post #42

I can't see how this is a "0day". This post talks about how you can identify a running Tor when you connect to the (operator-assigned, public) relay port. You can only "see" these TLS certificate details when you are connecting to the relay yourself. This means this does not allow network operators to detect traffic going to Tor nodes, or in-between nodes, let alone identify users or deanonymize anyone: To external o…

Security is in the eye of the application. Unauthenticated editing isn't an exploit on Wikipedia but it would be on the CDC's website In this case the fact that a user is using tor is considered protected information meaning any exposure of that is in fact a info leak vulnerability

The "fact that a user is using Tor" is not discussed in the post. There is zero connection between how Tor nodes generate their TLS certificates and whether or not you can detect that a user is using Tor. All you can do with this information (which is not a secret but a well-discussed tradeoff with no better option) is to identify Tor relays, which are already public.
Post reply on HN