Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor Browser 11.0

blog.torproject.org

Post reply on HN
Print view View original

71–80 of 100 posts

Re: Tor Browser 11.0

#71

Post by bouncycastle »

cosentiyes wrote: post #66
bouncycastle wrote: post #56

Earlier quoted context omitted.

Look at the language of that page. All the statements are without certainty, eg it's not "an adversary cannot identify them" but "an adversary cannot identify them easily."

Yes, the tor project is very transparent that anonymity is not guaranteed. Bridges and obfuscation tools are simply one possible answer to the "how is [connecting to tor without ISP detection] possible?" question. The linked article tries to imply that Ross Ulbricht's arrest was somehow the result of deanonymized tor traffic, but in reality many (most?) large DNM [1,2] and malware/hacking arrests seem to be the resul…

Obfuscation is a cat-and-mouse game and with enough resources, it's always possible to detect. While Tor is OK for privacy from your ISP or the big-tech firms, certainly not for what the OP described. I think recommending Tor as the definite solution for these types of people is irresponsible.

Re: Tor Browser 11.0

#72

Post by chii »

schoen wrote: post #65
wolverine876 wrote: post #42

Earlier quoted context omitted.

I don't know the parent or their situation, but if you need similar security I would be very cautious about taking the parent literally. Sorry if I sound like a jerk; it sounds like the parent has taken great risks for the public good, but I don't want people to be hurt: I'm almost certain that Tor use is easily detected; that is what I've always (100%) read from security experts and it makes sense to me: Traffic pat…

As marshray said below, Tor doesn't generally try to hide the fact that you're using Tor, only what you're doing with it. This is complicated by the very active research on obfuscating methods for accessing Tor, but those methods are mostly trying to prevent automated large-scale detection in real time, in order to evade blocking by national firewalls. They aren't necessarily trying to prevent more manual or after-th…

> people do know you are using it, supposing that they don't know for what.

And then they can use the rubber hose method to find out. Knowing that you have traffic you want to hide is almost as good as knowing the traffic

Re: Tor Browser 11.0

#73

Post by pphysch »

giga_chad wrote: post #32

TOR has been an invaluable tool for me for its ability to circumvent state censorship in an undetectable way. At some point in my career I was involved in some journalistic reporting in Saudi Arabia; had I used a regular VPN, it could have been easily detected, and in best case defeated, worst case put me in serious legal trouble, which in Saudi Arabia can easily end in corporal punishment and/or death. TOR allowed m…

> At some point in my career I was involved in some journalistic reporting in Saudi Arabia

Was it a career in the IC?

Re: Tor Browser 11.0

#74

Post by alexeiz »

0xdeadb00f wrote: post #69

> Known Issues Some of these issues seem like pretty big issues: > Bug 40671: Fonts don't render > Bug 40695: JS enabled on Safest in Windows (new)

I've updated, and now the font rendering in the Tor's interface is FU'ed. Good thing I don't rely on the Tor browser. Otherwise I'd be so pissed.

Re: Tor Browser 11.0

#75

Post by therein »

yjftsjthsd-h wrote: post #31
spurgu wrote: post #27

Earlier quoted context omitted.

Same. The world would feel quite dystopian without Tor, Signal and other similar software aiming to preserve your privacy. I rarely use Tor but I'm soooo happy it exists. Just started wondering: If Tor disappeared off the face of the earth right now, what would be the replacement? 1. Would it be an existing alternative that would become dominant in the space? 2. Would an identical software/network be built? 3. Would…

If TOR went away tomorrow, I assume i2p would pick up the slack; it's already there and AFAIK a good alternative, just with a smaller network and less emphasis on exit nodes.

Network isn't even necessarily smaller. Since it has a lesser emphasis on exit nodes, each node is a relay and there are more of them than Tor relay nodes.

Re: Tor Browser 11.0

#76

Post by neilv »

My other daily browser is Firefox ESR, so Tor Browser 11 is the first I've seen these strange new tabs.

It's like they kept making the active tab harder to distinguish, until eventually someone had a thought, "the active tab is really hard to distinguish, so let's make this puppy dominate the entire UI".

This is my least-favorite UI change since the intermediate submenu "Close Multiple Tabs" was introduced, to make a somewhat tedious mousing task even more work.

Re: Tor Browser 11.0

#78

Post by walrus01 »

wolverine876 wrote: post #42
giga_chad wrote: post #32

TOR has been an invaluable tool for me for its ability to circumvent state censorship in an undetectable way. At some point in my career I was involved in some journalistic reporting in Saudi Arabia; had I used a regular VPN, it could have been easily detected, and in best case defeated, worst case put me in serious legal trouble, which in Saudi Arabia can easily end in corporal punishment and/or death. TOR allowed m…

I don't know the parent or their situation, but if you need similar security I would be very cautious about taking the parent literally. Sorry if I sound like a jerk; it sounds like the parent has taken great risks for the public good, but I don't want people to be hurt: I'm almost certain that Tor use is easily detected; that is what I've always (100%) read from security experts and it makes sense to me: Traffic pat…

The parent poster who thinks they're saved from Saudi arabian domestic intelligence agencies by using tor is probably overly confident about how much tor is doing for them. The saudis absolutely have lots of money to pay for good quality DPI boxes from China. Using tor by itself stands out.

Since it doesn't look like saudi arabia is blocking traffic to/from major cloud hosting providers (obviously, they'd break most of the internet), this person could simply run a remote desktop session as something like VNC-over-https-by-TLS1.3 (apache guacamole or similar, lots of things).

Or use any of a number of US-based companies that will sell you a cloud-hosted remote desktop system you can use via an HTML5 client inside chrome, firefox, edge or safari, again, over TLS1.3

If the saudis are breaking TLS1.3 in an up to date browser in a client workstation that doesn't have some kind of APT/rootkit on it (also a high risk), we have other problems.

And then keep the saudi workstation as basically a thin client only.

It would look indistinguishable from any ordinary company persistent TLS session used between a workstation PC and some business application hosted in the "cloud".

All of the above doesn't help much if subject to rubber hose cryptanalysis.

Re: Tor Browser 11.0

#79

Post by dillondoyle »

zamadatix wrote: post #58
dillondoyle wrote: post #28

Earlier quoted context omitted.

It's easy to get a webrtc fingerprint just using a public stun server, maybe people smarter can deploy their own. I've used it in our ad tracking js. I'm not sure if Tor Browser turns off by default, searching found this one ticket which suggest that default flag but maybe it's not implemented out of the box. [1] https://privacycheck.sec.lrz.de/active/fp_wrtc/fp_webrtc.htm... [2] https://gitlab.torproject.org/legacy/…

> I'm not sure if Tor Browser turns off by default, searching found this one ticket which suggest that default flag but maybe it's not implemented out of the box. It does and it is removed at compile time since that ticket was closed (i.e. that was a build flag not a runtime flag).

Thanks for explaining!

Re: Tor Browser 11.0

#80

Post by IceWreck »

giga_chad wrote: post #32

TOR has been an invaluable tool for me for its ability to circumvent state censorship in an undetectable way. At some point in my career I was involved in some journalistic reporting in Saudi Arabia; had I used a regular VPN, it could have been easily detected, and in best case defeated, worst case put me in serious legal trouble, which in Saudi Arabia can easily end in corporal punishment and/or death. TOR allowed m…

I think its the opposite. Regular VPN protocols, if obfuscated properly can blend in with https traffic.

Tor is almost always detectable. You can see someone is using Tor, but not what theyre doing with it.

Post reply on HN