Show HN: TorProxy, a kernel module which routes all network traffic through Tor
1–10 of 13 posts
Re: Show HN: TorProxy, a kernel module which routes all network traffic through Tor
#2Is there any particular reason for being IPv4-only?
> /* Drop all ipv6 traffic */
Re: Show HN: TorProxy, a kernel module which routes all network traffic through Tor
#3Is there any particular reason for being IPv4-only? > /* Drop all ipv6 traffic */
Yes.
> The Tor network currently only supports TCP ipv4 traffic
Re: Show HN: TorProxy, a kernel module which routes all network traffic through Tor
#4Is there any particular reason for being IPv4-only? > /* Drop all ipv6 traffic */
Yes. > The Tor network currently only supports TCP ipv4 traffic
TCP IPv6 traffic is supported. [https://trac.torproject.org/projects/tor/ticket/5547]
Only relay to relay traffic is actually IPv4 only. [https://trac.torproject.org/projects/tor/ticket/4565]
Re: Show HN: TorProxy, a kernel module which routes all network traffic through Tor
#5We need to pump this. Anonymity only protects the vulnerable in inverse proportion to it's ubiquity.
Re: Show HN: TorProxy, a kernel module which routes all network traffic through Tor
#6We need to pump this. Anonymity only protects the vulnerable in inverse proportion to it's ubiquity.
I can't even comment here when I use my homemade vpn, hosted digital ocean or linode. And HN is not the only place... I understand spam is a problem, but it feels like a hammer solution.
Re: Show HN: TorProxy, a kernel module which routes all network traffic through Tor
#7Interesting but I doubt whether you really want to route /all/ your network traffic through Tor.
As soon as some packet that reaches the internet (through an exit node) that includes some identity information your Tor connection is no longer private. Routing all your traffic via Tor, increases the chance this will happen.
Also if many people use Tor for all their traffic, this will become a scalability problem for Tor (lack of exit nodes).
Re: Show HN: TorProxy, a kernel module which routes all network traffic through Tor
#8It's a terrible idea to route all your traffic over tor. If you have any expectation of anonymity you'll be disappointed. Since tor does not do any application level filtering, it is easy for exit nodes to track you.
It's a neat idea but has the same problems as network wide tor routers.
Re: Show HN: TorProxy, a kernel module which routes all network traffic through Tor
#9Interesting but I doubt whether you really want to route /all/ your network traffic through Tor. As soon as some packet that reaches the internet (through an exit node) that includes some identity information your Tor connection is no longer private. Routing all your traffic via Tor, increases the chance this will happen. Also if many people use Tor for all their traffic, this will become a scalability problem for To…
I would assume if you're going this far you're likely running this module under a Linux VM so only specifics go through Tor.
Re: Show HN: TorProxy, a kernel module which routes all network traffic through Tor
#10It's a terrible idea to route all your traffic over tor. If you have any expectation of anonymity you'll be disappointed. Since tor does not do any application level filtering, it is easy for exit nodes to track you. It's a neat idea but has the same problems as network wide tor routers.
Exactly. Good implementations like Whonix take steps to isolate your circuits between different applications and profiles[0].
Further in those cases you're isolating your identities with virtual machines by default, which helps enforce good compartmentalization.
Forcing all traffic into one environment and then over a single circuit means everything you ever access is linked together. The other story on the front of HN is the accused stalker who was caught partly for doing exactly this (would access his real Gmail and then "stalker" Gmail over the same connection)
Whonix also provides a model of enforcing Tor by using an isolated proxy - which doesn't require kernel modules and also allows firewall policies
I'd classify this as a naive approach that sounds like a good idea at first inspection - but the Whonix developers have really thought this through and their Wiki[1] is a tremendous resource that explains why they use the model they do.
Qubes OS is another similar approach[2]
[0] https://www.whonix.org/wiki/Stream_Isolation