Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor 0day: Stopping Tor Connections

hackerfactor.com

Post reply on HN
Print view View original

71–80 of 92 posts

Re: Tor 0day: Stopping Tor Connections

#71

Post by joosters »

flotzam wrote: post #33

Both of these vulnerabilities are bogus. 1. "using JavaScript, you can identify the scrollbar width [...] so an attacker can identify the underlying operating system" Using JavaScript, you can simply ask Tor Browser what platform it's on using navigator.userAgent, and it will tell you the truth because lying breaks e.g. websites' custom key combinations. Tor Browser will however attempt to anonymize the platform in p…

Also, it seems to me that whatever they do to make the TLS handshake and certificate look more like a typical web server, they would never be able to make it exactly match. Tor connections could still be identified by simple things like the self-signed certificate, the random hostname, the hostnameIP mismatch, and so on.

Trying to fix this would be a never-ending losing battle, I can understand why the Tor project aren't that interested in changing things.

Re: Tor 0day: Stopping Tor Connections

#72

Post by webmaven »

gruez wrote: post #62
syrrim wrote: post #39

Earlier quoted context omitted.

Suppose you visit facebook via tor and log in. If you can be traced across the web, then your real name can now be attached to all your activity.

>If you can be traced across the web, then your real name can now be attached to all your activity. But that's not how tor works. It's not like a VPN where all your traffic comes out of one node. So if even if you logged into facebook using tor browser, it won't be able to correlate your other tor browsing activities. Even third party cookies won't work because tor browser has third party isolation enabled.

> >If you can be traced across the web, then your real name can now be attached to all your activity.

> But that's not how tor works. It's not like a VPN where all your traffic comes out of one node. So if even if you logged into facebook using tor browser, it won't be able to correlate your other tor browsing activities. Even third party cookies won't work because tor browser has third party isolation enabled.

Except that the OP discussed a technique that exposed an attribute of the user's setup that (when combined with other such techniques) allows unique (albeit pseudonymous) identification of the user across requests and sessions (this is called fingerprinting). Add in correlation of the pseud identifier with a real-world identity via use of FB, and the user would be totally hosed.

Re: Tor 0day: Stopping Tor Connections

#73

Post by jandrese »

gruez wrote: post #58

>Checking every network connection against every possible Tor node takes time. This is fine if you have a slow network or low traffic volume, but it doesn't scale well for high-volume networks What? I can't tell if this is sarcastic or not. There's only around 3000 tor entry nodes[1]. This is orders of magnitude smaller than the number of entries in the internet routing table, which is around 800k. This means at the…

It’s no problem, he has some regexs you can put in your DPI system to catch the connections instead. Regex is cheap right? Especially when it is long and complex.

Re: Tor 0day: Stopping Tor Connections

#74

Post by jandrese »

wolco wrote: post #48
syrrim wrote: post #39

Earlier quoted context omitted.

Suppose you visit facebook via tor and log in. If you can be traced across the web, then your real name can now be attached to all your activity.

Wait.. you are logging into facebook and using your real name? Step 1: Log into tor. Step 2: Create facebook account using a fake name Step 3: Don't add anyone you know in real life as a friend. Best not to search for friends. Facebook will not connect you now.

What is the point of using Facebook then?

Re: Tor 0day: Stopping Tor Connections

#75

Post by thaumaturgy »

EE84M3i wrote: post #59
thaumaturgy wrote: post #45

Earlier quoted context omitted.

Yeah. I'm sympathetic towards the Tor project in general, but it's also a huge source of nuisances and almost 0% legitimate traffic (in my case). As a beleaguered one-man sysadmin who also wears a full-time dev hat, I just don't have the resources available to build out a more clever rule-based filter for Tor traffic. This approach took me all of about 10 minutes to figure out and deploy across my little network of s…

I was thinking that Apache / Nginx blocking based on IP match and HTTP method is likely approximately equivalent complexity. Also CDNs generally offer this if you use one.

Not quite, unfortunately. Apache's not all that nimble; setting up rewrites for a handful of ips-and-methods is pretty easy, but it doesn't have a built-in way to use an external list of ips (that I'm aware of). I just checked, there are over 1300 tor ips in the result set currently.

I could write a conf.d file to be included in each vhost, and write a script to generate a large rewrite file nightly and "apachectl graceful" it afterward, and that would probably work... but I expect that will have a measurable impact on response times and, again, I'm not hosting governmental sites or anything that could reasonably be considered vital to the health and well-being of innocent tor users.

Re: Tor 0day: Stopping Tor Connections

#76

Post by zelly »

ColanR wrote: post #17
sanqui wrote: post #7

As a person who has, over the years, been recommending Tor and defending it against people claiming it's backdoored and useless, I'm disappointed. Can anybody here on HN give information on how some Tor alternatives and projects with similar goals are holding up?

I'm not sure there is a good alternative. Most of the alternatives are built with Java, which (considering tor isn't considered safe with Java enabled) doesn't seem like an improvement. Is there an alternative that's performant and built with a decent language? Or do the good ones just get snuffed out?

Java is significantly safer than C which Tor is written in.

Re: Tor 0day: Stopping Tor Connections

#77

Post by AaronFriel »

smooth_remmy wrote: post #28

I have gotten the impression over the last few years that the Tor Project has embraced social justice and diversity to the detriment of their software.

I find that when I come across comments or jokes that might expose biases, rather than interrogate the person you can expose those by just asking the simplest questions, the ones that seem too obvious to ask. When someone says a joke that might be described as biased, usually using a more particular word, just ask them to explain the joke. That usually is more revealing than calling its speaker a name.

So, I don't want to infer your opinions, but I want to ask: what about social justice and diversity is to the detriment of their software?

Re: Tor 0day: Stopping Tor Connections

#78

Post by Forbo »

JohnTHaller wrote: post #54
Scoundreller wrote: post #51

Earlier quoted context omitted.

> and until recently, the Tor browser also just leaked your window size via Javascript. Though this was why Tor would always open in the same window size. But ya, that all fell apart if you maximized. When did they fix “the leak” itself? Wouldn’t that require intercepting the JavaScript call in the same way that the scroll bar size issue could be fixed?

I believe they implemented panels inside the browser window that force the window size to be different reported values.

It's called "letterboxing", and rounds the window size to the nearest 200x100 px when maximized, I think. So while it does make you slightly less unique than just maximizing normally would, that anonymity set is still potentially smaller than the set that can fit everyone, namely the 1000x1000 default. There are methods of detecting screen resolution using CSS that don't require JavaScript, so blocking JavaScript doesn't necessarily protect you from this fingerprinting method.

Re: Tor 0day: Stopping Tor Connections

#79

Post by wcerfgba »

throwaway89201 wrote: post #43

The author of this blog strongly comes across as a person who understands a good deal about finding vulnerabilities, but doesn't really understand the tradeoffs being made in maintaining usable anonymity software such as the Tor browser. The reported scroll bar width vulnerability is his strongest case. He rightly got a bounty for it. But it's relatively hard to fix, and until recently, the Tor browser also just leak…

Could you expand on "his proposed solution in trying to impersonate traditional PKI simply won't work against even mediocre attackers" ? How would you defeat his proposed solution?

Re: Tor 0day: Stopping Tor Connections

#80

Post by Scoundreller »

Forbo wrote: post #78
JohnTHaller wrote: post #54

Earlier quoted context omitted.

I believe they implemented panels inside the browser window that force the window size to be different reported values.

It's called "letterboxing", and rounds the window size to the nearest 200x100 px when maximized, I think. So while it does make you slightly less unique than just maximizing normally would, that anonymity set is still potentially smaller than the set that can fit everyone, namely the 1000x1000 default. There are methods of detecting screen resolution using CSS that don't require JavaScript, so blocking JavaScript doe…

Fascinating to realize that CSS can do that. I guess it does it by “calling” x.png 1024 times and y.png 768 times? Or running some loop to call 1024x.png and 768y.png...
Post reply on HN