Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor 0day: Stopping Tor Connections

hackerfactor.com

Post reply on HN
Print view View original

61–70 of 92 posts

Re: Tor 0day: Stopping Tor Connections

#61

Post by phenomax »

flotzam wrote: post #33

Both of these vulnerabilities are bogus. 1. "using JavaScript, you can identify the scrollbar width [...] so an attacker can identify the underlying operating system" Using JavaScript, you can simply ask Tor Browser what platform it's on using navigator.userAgent, and it will tell you the truth because lying breaks e.g. websites' custom key combinations. Tor Browser will however attempt to anonymize the platform in p…

I'd definetely consider Tor Node Fingerprinting (2nd issue) to be an important issue. Nonetheless, both issues have been _accepted_ as those by Tor Maintainers, yet they failed to act appropriately.

Re: Tor 0day: Stopping Tor Connections

#62

Post by gruez »

syrrim wrote: post #39
staticassertion wrote: post #18

> (Many users think that Tor makes them anonymous. But Tor users can be tracked online; they are not anonymous.) Being tracked and anonymous feel like two distinct issues. If you were to only see a hash of my username, you could track me, but you couldn't identify me with it. Definitely something you'd want TOR to stop, but I think that's pretty important. The other vulnerability is that websites can identify that a…

Suppose you visit facebook via tor and log in. If you can be traced across the web, then your real name can now be attached to all your activity.

>If you can be traced across the web, then your real name can now be attached to all your activity.

But that's not how tor works. It's not like a VPN where all your traffic comes out of one node. So if even if you logged into facebook using tor browser, it won't be able to correlate your other tor browsing activities. Even third party cookies won't work because tor browser has third party isolation enabled.

Re: Tor 0day: Stopping Tor Connections

#63

Post by EE84M3i »

gpm wrote: post #47
EE84M3i wrote: post #26

Earlier quoted context omitted.

If you feel it necessary to block Tor nodes in some way, I think it's better to only block non-safe methods. Personally, I don't do it, but I understand why it's appealing. I see it as a personal decision (its your website after all) and not morally wrong as some see it. I once talked to someone working security for a Canadian government agency. They considered it against their charter and/or illegal to block tor nod…

I think there are also some Canadian court cases protecting the right to speak anonymously over the internet. It's an area where I think our government is going a pretty decent job (as governments interacting with new fangled technologies go)

Yeah, I don't remember the exact reason they didn't consider it a possibility, but I seem to remember the guy saying it would save him a headache but it wasn't in the cards and that they had to explicitly configure some solution they were using (perhaps cloudflare?) to not DoS the traffic.

Re: Tor 0day: Stopping Tor Connections

#64

Post by ddalex »

gruez wrote: post #58

>Checking every network connection against every possible Tor node takes time. This is fine if you have a slow network or low traffic volume, but it doesn't scale well for high-volume networks What? I can't tell if this is sarcastic or not. There's only around 3000 tor entry nodes[1]. This is orders of magnitude smaller than the number of entries in the internet routing table, which is around 800k. This means at the…

It's like people haven't invented a Bloom filter yet so you can add it in front of a hash table....

Re: Tor 0day: Stopping Tor Connections

#65

Post by staticassertion »

syrrim wrote: post #39
staticassertion wrote: post #18

> (Many users think that Tor makes them anonymous. But Tor users can be tracked online; they are not anonymous.) Being tracked and anonymous feel like two distinct issues. If you were to only see a hash of my username, you could track me, but you couldn't identify me with it. Definitely something you'd want TOR to stop, but I think that's pretty important. The other vulnerability is that websites can identify that a…

Suppose you visit facebook via tor and log in. If you can be traced across the web, then your real name can now be attached to all your activity.

Yes, totally. As I said, it's a very significant issue, but it requires a separate ability to tie the tor identity to the user's real identity.

Re: Tor 0day: Stopping Tor Connections

#66

Post by staticassertion »

strbean wrote: post #34
staticassertion wrote: post #27

Earlier quoted context omitted.

Yeah, that's my point. Anonymity to me implies that you can not determine my true identity. That property still holds here. What doesn't hold is that you can not determine that I am the same person in multiple locations - a very significant issue, but a much less serious one.

One feeds into the other strongly, though. The odds of an adversary de-anonymizing you go up the more activity the adversary can see. Also, we should look at your anonymity on a per-site/session basis, and if de-anonymization on one site breaks your anonymity on other sites, that is bad.

I fully agree that it is bad and a legitimate issue. As I said, "a very significant issue".

Re: Tor 0day: Stopping Tor Connections

#67

Post by Ajedi32 »

Moru wrote: post #35
sanqui wrote: post #7

As a person who has, over the years, been recommending Tor and defending it against people claiming it's backdoored and useless, I'm disappointed. Can anybody here on HN give information on how some Tor alternatives and projects with similar goals are holding up?

I'm not realy using it much but i2p[0] has been around for a while. It's Java though as all other projects like this in case you have anything against it. [0] https://geti2p.net/en/

IIRC the main issue with I2P is that it doesn't natively offer access to traditional websites the way Tor does. You can configure your browser to connect to a remote HTTP proxy over I2P and access the web that way, but that requires you to find such a proxy first (preferably several such proxies, each with multiple users, so that your traffic across multiple sessions can't be correlated by using the outproxy IP), and setting it up is a lot more complicated than Tor's method of "download Tor browser, click run".

Re: Tor 0day: Stopping Tor Connections

#69

Post by giomasce »

eat_veggies wrote: post #6
leksak wrote: post #4

Could someone in the know inform me as to whether or not my knee jerk reaction of "couldn't this individual possibly contribute to the Tor project instead?" is warranted?

They are contributing to the Tor project by sending detailed vulnerability reports. As for demanding that they fix/upstream changes themselves, then yes, that's likely too big of an ask, as even these reports are a gift. Tor has paid employees. "PRs welcome, wontfix" is not acceptable for security vulnerabilities in a security product.

If someone gives you a gift, you are not forced to accept it. Tor paid employees probably have something else to work onto, given that they are paid my Tor's money, not by the bug reporter's money. Frankly, the issue about blocking connections is pretty useless: the author themselves admit that the underlying issue cannot be fixed, since the list of relays is public. And it's not a security issue anyway: of course your traffic carrier will always be able to drop your packets, but nobody consider this a security issue for any other application.

So they are basically reporting trivial issues (this is trivial, at least, I cannot judge for the others they say they have) and pretending that people paid by someone else now care just about that. Doesn't look like very smart.

Re: Tor 0day: Stopping Tor Connections

#70

Post by kodablah »

flotzam wrote: post #33

Both of these vulnerabilities are bogus. 1. "using JavaScript, you can identify the scrollbar width [...] so an attacker can identify the underlying operating system" Using JavaScript, you can simply ask Tor Browser what platform it's on using navigator.userAgent, and it will tell you the truth because lying breaks e.g. websites' custom key combinations. Tor Browser will however attempt to anonymize the platform in p…

Wrt #1, I think the issue is that scrollbar size makes it easier to tell one Tor user apart from another in the Tor browser, not that you can determine they are running in the Tor browser (or even know their platform from a common fixed set). For most users of Tor and the Tor browser, simply checking that they are coming from a publicly known list of exit node IPs is enough (or if they are already hitting an onion service, then it's obvious).
Post reply on HN