Tor 0day: Stopping Tor Connections • Hacker News Board

Re: Tor 0day: Stopping Tor Connections

#81

Post by yjftsjthsd-h » Thu, Jul 23, 2020, 9:54 PM UTC

core_dumped wrote: post #53

ragnese wrote: post #19

Earlier quoted context omitted.

Java is not the same thing as JavaScript

People always say I'm being pedantic when I point that out, but I think it's a really important distinction to make to someone who's not aware, especially in the context of their security.

There's a line about pedantic meaning "you're right but I don't like it", but Java vs JS isn't even close! They're both OO programming languages in the C-like family with garbage collection, but they have completely different execution models, runtimes, usecases, and implementations; their close naming is a bug.

Re: Tor 0day: Stopping Tor Connections

#82

Post by staticassertion » Thu, Jul 23, 2020, 10:09 PM UTC

phenomax wrote: post #61

flotzam wrote: post #33

Both of these vulnerabilities are bogus. 1. "using JavaScript, you can identify the scrollbar width [...] so an attacker can identify the underlying operating system" Using JavaScript, you can simply ask Tor Browser what platform it's on using navigator.userAgent, and it will tell you the truth because lying breaks e.g. websites' custom key combinations. Tor Browser will however attempt to anonymize the platform in p…

I'd definetely consider Tor Node Fingerprinting (2nd issue) to be an important issue. Nonetheless, both issues have been _accepted_ as those by Tor Maintainers, yet they failed to act appropriately.

> I'd definetely consider Tor Node Fingerprinting (2nd issue) to be an important issue.

Why? If someone knows I'm running TOR, I guess that's not great, but I don't really see the issue.

Re: Tor 0day: Stopping Tor Connections

#83

Post by sloshnmosh » Thu, Jul 23, 2020, 10:13 PM UTC

I don’t know why the Tor browser allows JavaScript to be enabled by default to begin with.

I don’t allow JavaScript to run on my mobile browser because of the disturbing crash logs in WebKit in the few times I have enabled JS.

Re: Tor 0day: Stopping Tor Connections

#84

Post by bowmessage » Thu, Jul 23, 2020, 11:56 PM UTC

Scoundreller wrote: post #80

Forbo wrote: post #78

Earlier quoted context omitted.

It's called "letterboxing", and rounds the window size to the nearest 200x100 px when maximized, I think. So while it does make you slightly less unique than just maximizing normally would, that anonymity set is still potentially smaller than the set that can fit everyone, namely the 1000x1000 default. There are methods of detecting screen resolution using CSS that don't require JavaScript, so blocking JavaScript doe…

Fascinating to realize that CSS can do that. I guess it does it by “calling” x.png 1024 times and y.png 768 times? Or running some loop to call 1024x.png and 768y.png...

No loop necessary, maybe just a set of @media rules with e.g. custom .png resources: https://developer.mozilla.org/en-US/docs/Web/CSS/@media

Re: Tor 0day: Stopping Tor Connections

#85

Post by phyzome » Fri, Jul 24, 2020, 12:09 AM UTC

Sorry, this seems bogus. There are a lot of ways to block Tor connections, and Tor doesn't try to make it particularly hard to identify ordinary entry nodes. That's what bridge nodes are for, if you need it.

Re: Tor 0day: Stopping Tor Connections

#86

Post by tonyarkles » Fri, Jul 24, 2020, 12:15 AM UTC

jandrese wrote: post #74

wolco wrote: post #48

Earlier quoted context omitted.

Wait.. you are logging into facebook and using your real name? Step 1: Log into tor. Step 2: Create facebook account using a fake name Step 3: Don't add anyone you know in real life as a friend. Best not to search for friends. Facebook will not connect you now.

What is the point of using Facebook then?

One example would be to join groups that you don't want associated with your IRL identity. Another would be as part of a phish test while doing a pentest against an organization you're working for.

Or... a bazillion other illegitimate reasons ;).

Re: Tor 0day: Stopping Tor Connections

#87

Post by countbackula » Fri, Jul 24, 2020, 12:25 AM UTC

Bugs and 0days aside, is not the writer's main issue here a communication problem with the Tor project?

Re: Tor 0day: Stopping Tor Connections

#88

Post by cortesoft » Fri, Jul 24, 2020, 1:06 AM UTC

flotzam wrote: post #49

cortesoft wrote: post #41

Earlier quoted context omitted.

Sure, but the comment mentions that you would use the 'set of websites that are whitelisted' as an identifier... your method can only check the site you are currently on, it doesn't give you information on if other websites have been whitelisted or not.

AFAIK NoScript whitelists don't respect first-party isolation (so a JS-enabled website can be included in a JS-disabled website), which makes it a relatively simple coordination problem between website A and B (possibly automated by a third-party tracker included in both A and B). In any case, first-party isolation can be subverted: https://news.ycombinator.com/item?id=17947605

Yes, with coordination it is possible. I was thinking of the non-coordination issue.

Re: Tor 0day: Stopping Tor Connections

#89

Post by mr_spothawk » Fri, Jul 24, 2020, 2:53 AM UTC

staticassertion wrote: post #82

phenomax wrote: post #61

Earlier quoted context omitted.

I'd definetely consider Tor Node Fingerprinting (2nd issue) to be an important issue. Nonetheless, both issues have been _accepted_ as those by Tor Maintainers, yet they failed to act appropriately.

> I'd definetely consider Tor Node Fingerprinting (2nd issue) to be an important issue. Why? If someone knows I'm running TOR, I guess that's not great, but I don't really see the issue.

Is it going to get you in trouble if anybody finds out?

Re: Tor 0day: Stopping Tor Connections

#90

Post by [deleted] » Fri, Jul 24, 2020, 10:25 AM UTC

ColanR wrote: post #17

sanqui wrote: post #7

As a person who has, over the years, been recommending Tor and defending it against people claiming it's backdoored and useless, I'm disappointed. Can anybody here on HN give information on how some Tor alternatives and projects with similar goals are holding up?

I'm not sure there is a good alternative. Most of the alternatives are built with Java, which (considering tor isn't considered safe with Java enabled) doesn't seem like an improvement. Is there an alternative that's performant and built with a decent language? Or do the good ones just get snuffed out?

[deleted]