Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor Browser 9.5

blog.torproject.org

Post reply on HN
Print view View original

81–90 of 106 posts

Re: Tor Browser 9.5

#81

Post by DanBC »

staycoolboy wrote: post #56
rakoo wrote: post #54

Earlier quoted context omitted.

No, it's the IP of the first relay. Tor works pretty much like this: You -> Relay 1 -> Relay 2 -> Relay 3 -> The website Each arrow is an encrypted connection. The content of the exchange on a single arrow is the address of the next hop and the query of the next hop. Thanks to this: - Relay 1 only knows you're going through Relay 2 - Relay 2 doesn't know who's asking (you) but knows it passed through Relay 1 and is g…

Do you know if GDPR prevents EU countries from obtaining IP logs for Amazon zones located there? I was hoping I could spin up an EC2 VPN in Europe and feel more secure that my IP logs can't be obtained by the US gov't. I use RunBox for email in Norway, which has the strictest privacy laws, but there is no AWS zone there. Any thoughts? Thanks.

> Do you know if GDPR prevents EU countries from obtaining IP logs for Amazon zones located there?

GDPR has specific exemptions for law enforcement and national security. Governments are allowed to get the data by claiming it's for national security. Some EU countries may have better protections than others.

To give better advice I guess people would want to know what your risk model is. Who do you think is after your data? What do you want to protect?

Re: Tor Browser 9.5

#82

Post by staycoolboy »

DanBC wrote: post #81
staycoolboy wrote: post #56

Earlier quoted context omitted.

Do you know if GDPR prevents EU countries from obtaining IP logs for Amazon zones located there? I was hoping I could spin up an EC2 VPN in Europe and feel more secure that my IP logs can't be obtained by the US gov't. I use RunBox for email in Norway, which has the strictest privacy laws, but there is no AWS zone there. Any thoughts? Thanks.

> Do you know if GDPR prevents EU countries from obtaining IP logs for Amazon zones located there? GDPR has specific exemptions for law enforcement and national security. Governments are allowed to get the data by claiming it's for national security. Some EU countries may have better protections than others. To give better advice I guess people would want to know what your risk model is. Who do you think is after you…

> risk model is

Mostly curiosity: what is the highest degree I can obscure my web use and meta data with off-the-shelf technologies?

Re: Tor Browser 9.5

#83

Post by jerheinze »

pachico wrote: post #51

Why should I use this rather than Brave with Tor option enabled? I'm not being rhetorical.

Tor Browser tries to make your browser fingerprint look the same as all other Tor Browser users, while Brave does have some patches to try to handle that it's still very far from what Tor Browser offers.

Re: Tor Browser 9.5

#84

Post by jerheinze »

VMisTheWay wrote: post #19

I understand the concept of Tor but since the government is actively watching, it doesn't really fit the usecase if I understand correctly. From a privacy point of view, couldn't you use multiple VPNs?

> I understand the concept of Tor but since the government is actively watching, it doesn't really fit the usecase if I understand correctly.

You can hide the fact that you're using Tor by using bridges with or without pluggable transports.

> From a privacy point of view, couldn't you use multiple VPNs?

No amount of chained VPNs will offer you browser fingerprinting resistance or privacy by design.

Re: Tor Browser 9.5

#85

Post by firethief »

Ajedi32 wrote: post #72
SparkyMcUnicorn wrote: post #7

"Onion Location" and "Onion Names" are very welcomed improvements. Not having memorable names makes it tough for people that use a non-persistent OS for Tor. I'm all for creating more accessible URLs.

On the topic of using Tor with a non-persistent OS, what I'd really like to see on that front is a federated encrypted bookmarking sync service integrated into the browser. Would be really neat if you could "sign-in" to the browser using a human-memorizable identifier to restore bookmarks and other settings. Obviously that opens up additional attack surface for de-anonymization attacks, but I think it could be done r…

Firefox Sync meets all the criteria you've described, except I don't think it has automatic Tor integration.

Re: Tor Browser 9.5

#86

Post by techntoke »

Has anyone had any luck or done any experiments using OnionCat with Multicast? I've heard people can get 200MB/s+ doing this but potentially sacrificing some anonymity.

Re: Tor Browser 9.5

#87

Post by _8j50 »

elliekelly wrote: post #9

I downloaded the Tor Browser a decade ago, maybe even longer, in an effort to be privacy conscious. I used it here and there but I never made the switch to using Tor by default. Some time later I remember reading the US government was tracking people, or had a list of everyone, who had simply downloaded Tor. I also vaguely remember reading about how using Tor could potentially expose you to legal risks because of the…

It's true. Same applies with Tails. If your employer is one of the few with intelligence community shadow relationships,they will likely be alerted as well.

You will also be targeted for browser exploitation without a warrant. Tails in an isolated environment is probably the best way of using Tor.

Re: Tor Browser 9.5

#88

Post by kristianp »

elliekelly wrote: post #9

I downloaded the Tor Browser a decade ago, maybe even longer, in an effort to be privacy conscious. I used it here and there but I never made the switch to using Tor by default. Some time later I remember reading the US government was tracking people, or had a list of everyone, who had simply downloaded Tor. I also vaguely remember reading about how using Tor could potentially expose you to legal risks because of the…

You could use Brave browser, it includes a Tor client which is accessed through the "new private window with Tor" menu item. I assume downloads of Brave might not be tracked by the US government, but then again, everything is tracked, it's just a matter of what behavior is likely to be flagged by an agency's algorithms.

Re: Tor Browser 9.5

#89

Post by kanox »

VMisTheWay wrote: post #73
kanox wrote: post #31

Earlier quoted context omitted.

> From a privacy point of view, couldn't you use multiple VPNs? I don't see what could be gained from nesting VPNs because you're identifying yourself to the innermost VPN. Tor is designed so that exit nodes don't know who you are.

Say you did 5 vpns, you'd need all 5 companies to respond correct? I imagine you could pick a few Anti US government VPNs and at least 1 wouldn't cooperate.

No, just the last one (the one which outputs your traffic).

Assuming it's a commercial VPN it has your billing data and doesn't matter that you connected to it via another VPN.

Re: Tor Browser 9.5

#90

Post by mindfulhack »

At a certain philosophical / high level, I don't like the idea of the 'human-memorable names' .onion feature.

It's politicising software. Open-source software should never have an official, hard-coded opinion about any of the content findable through it.

I've seen the Firefox org increasing do similar things when reading their email newsletter. It even stopped me donating to Firefox.

A core idea of Tor is to not censor. When you give special access to some sites, it feels like the opposite of net neutrality. That is on the censorship spectrum.

I guess it's not too bad if they never block any content at the protocol or software level, but at some point, giving certain content privileged features at the software/protocol level is a two-edged sword. It means you're forced to deny supporting other content.

Indeed, once Tor starts having an official opinion about online content at the browser level, who's to stop people starting to pressure Tor to block certain content, since they're basically starting to be in that realm now? It can be a slippery slope.

I'd prefer at the very least it be toned down to a third party add-on. It's great to make onion sites easier to access, of course. But it should be in a way that doesn't involve political or legal barriers for content creators.

---

BTW, I highly encourage anyone with a linux box at home just sitting there 24/7 to start an obfs4 bridge relay. It's not that hard, and low on resources. #tor-relays IRC extremely helpful in getting you set up.

I've been running one for about a year and it's provided tens/hundreds of GBs of Tor Internet to people hopefully in Asia, South America, and the Middle East - protesters who really, really need some help in anonymization or gaining access to blocked content.

Post reply on HN