81–90 of 122 posts
Earlier quoted context omitted.
That situation becomes quite relevant when debating "VPN then Tor" or "Tor then VPN," which I've seen people come down on both ways. Ultimately it depends on who the threat is. Example: https://thetinhat.com/tutorials/darknets/tor-vpn-using-both....
What about VPN -> Tor -> VPN?
Earlier quoted context omitted.
> It does obscure the size Encryption does not inherently obscure the size of plaintext. Protocols may choose to pad plaintext for various reasons, and both Tor (since Tor always sends fixed-width cells) and TLS (when it uses a block cipher mode) do so. However, the amount of padding is typically small and can hardly be said to "obscure" the size of a request - it is not a defense against traffic analysis.
> since Tor always sends fixed-width cells you send 1px of data or 500px tor always send fixed width cells. There is no question of padding here.
Earlier quoted context omitted.
Yeah, because 5,000ms latency is fun.
Tor is already slow - people use it because they want security. The addition of another VPN increases security greatly and only adds a minimal amount of more latency.
Relatively, sure. But I've found it very usable in recent times actually. Used it almost full-time (besides a normal Firefox instance for the company's intranet) to get around some silly firewall that wouldn't let me download "hack tools" (I was an intern in the cyber security department, security tools were part of my job). There were times where I didn't notice at all that I was using Tor, and most of the time it was comparable to mediocre wifi.
Earlier quoted context omitted.
Yeah, because 5,000ms latency is fun.
For a bomb threat? Or more benignly, uploading a few documents to a whiteblowers platform (some news organizations have one)? No problem I'd say.
I see your point, don't worry, it would just be a lot more rough than you're implying, particularly to upload many heavy PDFs. (I kind of want to lab it now that we've discussed it.)
Earlier quoted context omitted.
But it's a Google-served reCAPTCHA so there's nothing to measure on CloudFlare. So I disagree that there's detail here. Need real technical detail to be able to take action. If this were a paper or PoC then would be different. If there's a way to do that then please report it to us.
You're right of course wrt to Google serving reCAPTCHA, in this case you'd just be providing plausible deniability if Google and Mallory-ISP were to collude to exploit this. Tor users on google fiber take note.
This is why I got quite scared when I first heard of Google Fiber.
It's in Google's interest to provide good, fast and cheap service: they will gain more customers and more people will be able to use more Internet services (many of which are from Google or use Google -- adwords, analytics, etc.). Thus they provide speeds for prices that are very hard to compete with for normal ISPs, since normal ISPs don't have the luxury of being the world's most popular, well, so many things (search engine, mapping service, email service, ad service, etc.).
If one company knows everything about you and controls a big enough stake in your life, that sounds very scary to me. Not because Google is bad, but because it's one company able to control many basic services.
One way around this is to disable javascript for ReCAPTCHA, the service provides you with a rather primitive HTML form with checkboxes over the images, generating only one request on submit.
Yeah, this again. You can't secure your system, if you are running your adversary's code. Tor is upfront about this, this is why Javascript is disabled by default, and why there is a warning if you enable it globally. I suppose this does make for decent clickbait headlines though.
Earlier quoted context omitted.
> since Tor always sends fixed-width cells you send 1px of data or 500px tor always send fixed width cells. There is no question of padding here.
I believe what he's saying is that it'll pad to fit those cells. If you're sending 500b of data in 16b chunks, you'll need some padding (12b) in there to fit into 32x16 = 512b.
I didn't realize just how fragile TOR is. . . While I understand that remaining anonymous requires adjusting your browser habits somewhat extensively, the fact that a ReCAPTCHA is enough to (theoretically) de-anonymize a user seems to me that it's not able to anonymize at all when browsing. While TOR may be useful for evading firewalls, my general perception of the project has changed from general anonymity tool to a…
> I didn't realize just how fragile TOR is. . . It's JavaScript that causes it (you could choose to disable it [0]). The FAQ [1] warns of it: But there's a third issue: websites can easily determine whether you have allowed JavaScript for them, and if you disable JavaScript by default but then allow a few websites to run scripts (the way most people use NoScript), then your choice of whitelisted websites acts as a so…