6 ms·

Great article. The only real omission I noticed is the lack of mention of advanced browser fingerprinting techniques that can be used against browsers, even if

by apecat 10y ago

Great article. The only real omission I noticed is the lack of mention of advanced browser fingerprinting techniques that can be used against browsers, even if caches are emptied, 'porn modes' activated, VPNs opnened. As demonstrated here by the EFF's Panopticlick initiative. https://panopticlick.eff.org/ https://panopticlick.eff.org/ One of the most important points about the anonymity provied by the Tor project to remember is that the Tor Browser is painstakingly hand crafted to avoid many of these problems. In other discussions about TOR it is worryingly common to see other ways to route browser traffic through TOR, without mentions of the implications. For those interested, here's a recent look into the Tor Browser system by one of the developers. https://www.youtube.com/watch?v=Rq5Qbj2Aouo https://www.youtube.com/watch?v=Rq5Qbj2Aouo

tiatia 10y ago
What do you mean with "VPNs opnened"? The article is wrong about Tor being an alternative option to a VPN. If anonymity is your concern, you should use TOR to connect to a VPN (paid with Bitcoins).
- auganov 10y ago
  With a properly setup TORbrowser it will use a different tor circuit for every host. Using a [single] VPN "centralizes" your exit connections. For HTTPS enabled sites TOR is perhaps a better choice, just have to be careful of sslstrip.
  - tiatia 10y ago
    I even vaguely remember that in one of Snowdens released documents, the NSA wrote in a powerpoint presentation that this setup causes head aches. Will try to find it again.
    - MichaelGG 10y ago
      It's important to note which things are theoretically hard vs lack of tooling. Using a VPN after Tor might defeat a bad exit node sniffing or changing content. But a VPN absolutely hurts anonymity. Plus there's no way to be sure the VPN op isn't keeping logs. If I were at the NSA and concerned about any of this, I'd start a few VPN companies. And run Bitcoin exchangers/vendors.
- apecat 10y ago
  "VPNs opened" was poor wording. Clarifications provided by the guys below seem to match what I remember from listening to talks on Tor by the project's developers. Operational security and Tor is such an interesting and frankly, quite scary subject. I've mainly used and instructed people on Tor for read-only uses of the web. For my own needs, masking the origin of an actively participating persona is out of scope. I generally warn people about doing anything that requires sign-on/nicknames etc without very careful research. I recognize that my lack of a need for serious anonymity for basic political activism etc is a huge privilege. So I try to give back by running a bunch of Tor middle relay myself. For serious anonymity, I'd really be strict about using a forensically clean Tails USB boot environment, on varying public Wi-FI hotspots with a dedicated laptop that never has touched my regular network. The laptop must not ever be powered on near my house. Lots of systems, like Cisco Meraki business Wi-Fi APs take note of all nearby Wi-Fi and Bluetooth devices for 'location analytics'. Javascript and stuff must be disabled of course. Carrying any cell phone, burner or otherwise is out of the question. The reasons are many, but for starters, you don't want to be identifiable as the only person at your location making Tor connections, if you're doing something important. Here are some good points on the subject. https://www.youtube.com/watch?v=eQ2OZKitRwc https://www.youtube.com/watch?v=eQ2OZKitRwc My approach for promoting Tor to regular people around me is through describing it as a way to do random googling on subjects people don't necessarily want linked back to them, through analytics and ad companies. I'm personally pretty convinced that insurance companies around the globe are looking pretty seriously at how far they could push their use of intelligence from data brokers. For purposes like identifying people with potential inherited diseases, recreational drug use habits, mental health problems etc. So, I think Tor is important for all of us.
  - hackney 10y ago
    I love the tor browser, however much of the internet without javascript is not useable, at all. Very unfortunate for a tor fan like myself. To be quite honest, if most people weren't like 'grandma' and actually took more interest in the underpinnings of the computer itself, they would automatically be more self-aware of said security. However, it can be said that our 'security', and most importantly, our identity, has been compromised by the very govts and colluding corporations who regulate the devices with which we network. The "land of the free" is anything, but not that. I can't stress enough that societies need to preach good computing habits with encryption first and foremost. Instead all I ever hear is how wonderful the latest device is because: it's newer, faster, you can piss on it, etc. Where in the hell is the spiel on how secure it is and how wonderfully it encrypts everything? The worst part of it is that most don't take enough interest and the powers that be are similar to snakes in the grass. The balance of anything, even information as well as communication is what we all need to strive for.

by apecat 10y ago

tiatia 10y ago

What do you mean with "VPNs opnened"? The article is wrong about Tor being an alternative option to a VPN. If anonymity is your concern, you should use TOR to connect to a VPN (paid with Bitcoins).

auganov 10y ago
With a properly setup TORbrowser it will use a different tor circuit for every host. Using a [single] VPN "centralizes" your exit connections. For HTTPS enabled sites TOR is perhaps a better choice, just have to be careful of sslstrip.
- tiatia 10y ago
  I even vaguely remember that in one of Snowdens released documents, the NSA wrote in a powerpoint presentation that this setup causes head aches. Will try to find it again.
  - MichaelGG 10y ago
    It's important to note which things are theoretically hard vs lack of tooling. Using a VPN after Tor might defeat a bad exit node sniffing or changing content. But a VPN absolutely hurts anonymity. Plus there's no way to be sure the VPN op isn't keeping logs. If I were at the NSA and concerned about any of this, I'd start a few VPN companies. And run Bitcoin exchangers/vendors.
apecat 10y ago
"VPNs opened" was poor wording. Clarifications provided by the guys below seem to match what I remember from listening to talks on Tor by the project's developers. Operational security and Tor is such an interesting and frankly, quite scary subject. I've mainly used and instructed people on Tor for read-only uses of the web. For my own needs, masking the origin of an actively participating persona is out of scope. I generally warn people about doing anything that requires sign-on/nicknames etc without very careful research. I recognize that my lack of a need for serious anonymity for basic political activism etc is a huge privilege. So I try to give back by running a bunch of Tor middle relay myself. For serious anonymity, I'd really be strict about using a forensically clean Tails USB boot environment, on varying public Wi-FI hotspots with a dedicated laptop that never has touched my regular network. The laptop must not ever be powered on near my house. Lots of systems, like Cisco Meraki business Wi-Fi APs take note of all nearby Wi-Fi and Bluetooth devices for 'location analytics'. Javascript and stuff must be disabled of course. Carrying any cell phone, burner or otherwise is out of the question. The reasons are many, but for starters, you don't want to be identifiable as the only person at your location making Tor connections, if you're doing something important. Here are some good points on the subject. https://www.youtube.com/watch?v=eQ2OZKitRwc https://www.youtube.com/watch?v=eQ2OZKitRwc My approach for promoting Tor to regular people around me is through describing it as a way to do random googling on subjects people don't necessarily want linked back to them, through analytics and ad companies. I'm personally pretty convinced that insurance companies around the globe are looking pretty seriously at how far they could push their use of intelligence from data brokers. For purposes like identifying people with potential inherited diseases, recreational drug use habits, mental health problems etc. So, I think Tor is important for all of us.
- hackney 10y ago
  I love the tor browser, however much of the internet without javascript is not useable, at all. Very unfortunate for a tor fan like myself. To be quite honest, if most people weren't like 'grandma' and actually took more interest in the underpinnings of the computer itself, they would automatically be more self-aware of said security. However, it can be said that our 'security', and most importantly, our identity, has been compromised by the very govts and colluding corporations who regulate the devices with which we network. The "land of the free" is anything, but not that. I can't stress enough that societies need to preach good computing habits with encryption first and foremost. Instead all I ever hear is how wonderful the latest device is because: it's newer, faster, you can piss on it, etc. Where in the hell is the spiel on how secure it is and how wonderfully it encrypts everything? The worst part of it is that most don't take enough interest and the powers that be are similar to snakes in the grass. The balance of anything, even information as well as communication is what we all need to strive for.