5 ms·

How Tor Works

171 points by LForLambda 10y ago

joaobatalha 10y ago
Cool blogpost. People that enjoyed this might also like to take a look at "The Architecture of Open Source Applications" http://aosabook.org/en/index.html http://aosabook.org/en/index.html. Also, a few months back I annotated the original Tor whitepaper here http://fermatslibrary.com/s/tor-the-second-generation-onion-router http://fermatslibrary.com/s/tor-the-second-generation-onion-...
- vthallam 10y ago
  The annotations on the paper look informative, thanks for sharing!
deltaprotocol 10y ago
When I see articles about security related topics I immediately expect them to be served over HTTPS and get frustrated when they are not. It makes me think if HN should perhaps make a stand and either display some sort of lock icon next to secure links or make it harder for insecure links to show in the front page. Where is the right place to discuss this?
- deleted 10y ago
  [deleted]
- kbart 10y ago
  Why do you need https for text only page? Sure, somebody could do deep packet inspection, but they would not find anything they couldn't find going to the domain (that won't be hidden by https anyway) directly. EDIT: previously incorrectly stated 'url' instead of 'domain'.
  - niftich 10y ago
    For integrity, ie. tamper-resistance and knowing if MitM tampering was done.
    - justinlardinois 10y ago
      What's the end game for our hypothetical man in the middle? To edit the article to be subtly incorrect, so you'll misunderstand how Tor works?
      - beardog 10y ago
        Redirect to another website, push malware, show shock material, exploit a vulnerability in your browser.
        c3833174 10y ago
        All of those can be performed by an url shortening service or advertising or a compromised website (wordpress comes to mind) or ... etc. /* insert ascii goatse here */
      - x0137294744532 10y ago
        Spy on our country's citizens with deep packet inspection and put anyone on a list that reads anything related to Tor. With HTTPS, the visit of this website would seem 'innocent'.
        throwanem 10y ago
        It's a domain known to host Tor-related content, and HTTPS doesn't hide that you're connecting to it.
        justinlardinois 10y ago
        This. HTTPS hides the details of your requests to sites you visit, but it doesn't hide the actual sites themselves.
  - deltaprotocol 10y ago
    I don't know what is on a page until I visit it, so to make a stand myself in favor of a less insecure internet, I use HTTPS Everywhere in strict mode, which blocks HTTP. I have found that mostly I can live with it, and wish for the community (HN audience is a good part of it) to keep pushing (through a bit of pressure perhaps) towards an HTTPS only internet.
    - beardog 10y ago
      The problem with this is that it makes it very difficult to do network/isp level caching, this is especially problematic in areas where internet connectivity is slow, expensive, and limited.
      - hueving 10y ago
        It would be nice if https had a signature only mode so ISPs could cache but not meddle with the contents.
    - fiatjaf 10y ago
      Buy me certificates and I'll use HTTPS.
      - gldalmaso 10y ago
        https://letsencrypt.org/ https://letsencrypt.org/
  - sasas 10y ago
    Javascript inserted that injects fake flash/ms/java update... fake redirect to a login page to capture credentials... the list goes on.
  - jahnu 10y ago
    But URLs are encrypted as it's the TCP connection that's encrypted, isn't it?!
    - beardog 10y ago
      Yes, snoopers can only see the domain you visit (not the full url). (although they can make good educated guesses based on file sizes)
  - yoo1I 10y ago
    > that won't be hidden by https anyway The only thing that's not hidden are the domain names in the certificate that the server presents. The rest of the URL is encrypted, along with all data and headers.
    - nbraud 10y ago
      Assuming the server uses SNI, the domain name requested by the client is also sent in plaintext. Also, it's exposed anyway in DNS queries.
  - nbraud 10y ago
    There are several reasons you want this, relating to security, privacy and “politics” (in the wider sense). Regarding security, using HTTPS (along with the right measures on externally-hosted content) guarantees (to some extend) that what the users gets is what you meant to publish: an hostile network cannot replace the content with misinformation and cannot inject JS -- to exploit the client or not (as was done with the “Great Cannon” [0] which took down Github). Privacy-wise, a number of countries routinely spy on their communication infrastructure, and revealing “I visited this website” is far more problematic than “I visited this Tor-related post on this website, and left this comment”. The last reason for systematic HTTPS is “political”: if we go towards a situation where HTTPS is systematically employed, HTTP-only website will be subjected to increasing amounts of social pressure as adoption rates grow: deploying HTTPS (and preferably best-practices) on your “text-only” website pushes other websites (that might “need” it more) to deploy it too. [0]: https://citizenlab.org/2015/04/chinas-great-cannon/ https://citizenlab.org/2015/04/chinas-great-cannon/
mirimir 10y ago
It would also be useful to point out limitations and vulnerabilities. Tor browser has no protection against malware that hits the Internet directly, bypassing Tor circuits. But Tor Project does not prominently warn users about that on its website. While Tor Project does acknowledge Tor's vulnerability to global adversaries, there's also no prominent warning about that. If you run Tor in a terminal, you see "This is experimental software. Do not rely on it for strong anonymity." But how many users will ever see that warning?
- beardog 10y ago
  Even worse is that javascript is default enabled, making the security as strong as the Firefox sandbox.
- nbraud 10y ago
  That's FUD and untrue. The first thing you see in Tor Browser is a tab explaining that you got properly connected to Tor, but that Tor in itself is not a complete solution to online privacy and suggests you follow a link to an informative document written by the Tor Project.
0xmohit 10y ago
Another 3 part series: http://jordan-wright.com/blog/2015/02/28/how-tor-works-part-one/ http://jordan-wright.com/blog/2015/02/28/how-tor-works-part-... http://jordan-wright.com/blog/2015/05/09/how-tor-works-part-two-relays-vs-bridges/ http://jordan-wright.com/blog/2015/05/09/how-tor-works-part-... http://jordan-wright.com/blog/2015/05/14/how-tor-works-part-three-the-consensus/ http://jordan-wright.com/blog/2015/05/14/how-tor-works-part-...
- jwcrux 10y ago
  Hey there! I'm the author of this series - happy to answer any questions. Edit: I've also had some posts about Tor that did not fall exactly under this series format but should be helpful: http://jordan-wright.com/blog/tags/tor/ http://jordan-wright.com/blog/tags/tor/
known 10y ago
Remember that Tor anonymizes the origin of your traffic, and it encrypts everything inside the Tor network, but it can't encrypt your traffic between the Tor network and its final destination. If you are communicating sensitive information, you should use as much care as you would on the normal scary Internet — use HTTPS or other end-to-end encryption and authentication. https://www.torproject.org/projects/torbrowser.html.en https://www.torproject.org/projects/torbrowser.html.en
kefka 10y ago
I've also written up a comprehensive IoT infrastructure using Tor, Node-Red, MQTT, and sensor/actuator nodes as you choose. It's all documented here: https://hackaday.io/project/12985-multisite-homeofficehackerspace-automation https://hackaday.io/project/12985-multisite-homeofficehacker...

171 points by LForLambda 10y ago

Cool blogpost. People that enjoyed this might also like to take a look at "The Architecture of Open Source Applications" http://aosabook.org/en/index.html http://aosabook.org/en/index.html. Also, a few months back I annotated the original Tor whitepaper here http://fermatslibrary.com/s/tor-the-second-generation-onion-router http://fermatslibrary.com/s/tor-the-second-generation-onion-...

vthallam 10y ago
The annotations on the paper look informative, thanks for sharing!

deltaprotocol 10y ago

When I see articles about security related topics I immediately expect them to be served over HTTPS and get frustrated when they are not. It makes me think if HN should perhaps make a stand and either display some sort of lock icon next to secure links or make it harder for insecure links to show in the front page. Where is the right place to discuss this?

deleted 10y ago
[deleted]
kbart 10y ago
Why do you need https for text only page? Sure, somebody could do deep packet inspection, but they would not find anything they couldn't find going to the domain (that won't be hidden by https anyway) directly. EDIT: previously incorrectly stated 'url' instead of 'domain'.
- niftich 10y ago
  For integrity, ie. tamper-resistance and knowing if MitM tampering was done.
  - justinlardinois 10y ago
    What's the end game for our hypothetical man in the middle? To edit the article to be subtly incorrect, so you'll misunderstand how Tor works?
    - beardog 10y ago
      Redirect to another website, push malware, show shock material, exploit a vulnerability in your browser.
      - c3833174 10y ago
        All of those can be performed by an url shortening service or advertising or a compromised website (wordpress comes to mind) or ... etc. /* insert ascii goatse here */
    - x0137294744532 10y ago
      Spy on our country's citizens with deep packet inspection and put anyone on a list that reads anything related to Tor. With HTTPS, the visit of this website would seem 'innocent'.
      - throwanem 10y ago
        It's a domain known to host Tor-related content, and HTTPS doesn't hide that you're connecting to it.
        justinlardinois 10y ago
        This. HTTPS hides the details of your requests to sites you visit, but it doesn't hide the actual sites themselves.
- deltaprotocol 10y ago
  I don't know what is on a page until I visit it, so to make a stand myself in favor of a less insecure internet, I use HTTPS Everywhere in strict mode, which blocks HTTP. I have found that mostly I can live with it, and wish for the community (HN audience is a good part of it) to keep pushing (through a bit of pressure perhaps) towards an HTTPS only internet.
  - beardog 10y ago
    The problem with this is that it makes it very difficult to do network/isp level caching, this is especially problematic in areas where internet connectivity is slow, expensive, and limited.
    - hueving 10y ago
      It would be nice if https had a signature only mode so ISPs could cache but not meddle with the contents.
  - fiatjaf 10y ago
    Buy me certificates and I'll use HTTPS.
    - gldalmaso 10y ago
      https://letsencrypt.org/ https://letsencrypt.org/
- sasas 10y ago
  Javascript inserted that injects fake flash/ms/java update... fake redirect to a login page to capture credentials... the list goes on.
- jahnu 10y ago
  But URLs are encrypted as it's the TCP connection that's encrypted, isn't it?!
  - beardog 10y ago
    Yes, snoopers can only see the domain you visit (not the full url). (although they can make good educated guesses based on file sizes)
- yoo1I 10y ago
  > that won't be hidden by https anyway The only thing that's not hidden are the domain names in the certificate that the server presents. The rest of the URL is encrypted, along with all data and headers.
  - nbraud 10y ago
    Assuming the server uses SNI, the domain name requested by the client is also sent in plaintext. Also, it's exposed anyway in DNS queries.
- nbraud 10y ago
  There are several reasons you want this, relating to security, privacy and “politics” (in the wider sense). Regarding security, using HTTPS (along with the right measures on externally-hosted content) guarantees (to some extend) that what the users gets is what you meant to publish: an hostile network cannot replace the content with misinformation and cannot inject JS -- to exploit the client or not (as was done with the “Great Cannon” [0] which took down Github). Privacy-wise, a number of countries routinely spy on their communication infrastructure, and revealing “I visited this website” is far more problematic than “I visited this Tor-related post on this website, and left this comment”. The last reason for systematic HTTPS is “political”: if we go towards a situation where HTTPS is systematically employed, HTTP-only website will be subjected to increasing amounts of social pressure as adoption rates grow: deploying HTTPS (and preferably best-practices) on your “text-only” website pushes other websites (that might “need” it more) to deploy it too. [0]: https://citizenlab.org/2015/04/chinas-great-cannon/ https://citizenlab.org/2015/04/chinas-great-cannon/

mirimir 10y ago

It would also be useful to point out limitations and vulnerabilities. Tor browser has no protection against malware that hits the Internet directly, bypassing Tor circuits. But Tor Project does not prominently warn users about that on its website. While Tor Project does acknowledge Tor's vulnerability to global adversaries, there's also no prominent warning about that. If you run Tor in a terminal, you see "This is experimental software. Do not rely on it for strong anonymity." But how many users will ever see that warning?

beardog 10y ago
Even worse is that javascript is default enabled, making the security as strong as the Firefox sandbox.
nbraud 10y ago
That's FUD and untrue. The first thing you see in Tor Browser is a tab explaining that you got properly connected to Tor, but that Tor in itself is not a complete solution to online privacy and suggests you follow a link to an informative document written by the Tor Project.

0xmohit 10y ago

Another 3 part series: http://jordan-wright.com/blog/2015/02/28/how-tor-works-part-one/ http://jordan-wright.com/blog/2015/02/28/how-tor-works-part-... http://jordan-wright.com/blog/2015/05/09/how-tor-works-part-two-relays-vs-bridges/ http://jordan-wright.com/blog/2015/05/09/how-tor-works-part-... http://jordan-wright.com/blog/2015/05/14/how-tor-works-part-three-the-consensus/ http://jordan-wright.com/blog/2015/05/14/how-tor-works-part-...

jwcrux 10y ago
Hey there! I'm the author of this series - happy to answer any questions. Edit: I've also had some posts about Tor that did not fall exactly under this series format but should be helpful: http://jordan-wright.com/blog/tags/tor/ http://jordan-wright.com/blog/tags/tor/

known 10y ago

Remember that Tor anonymizes the origin of your traffic, and it encrypts everything inside the Tor network, but it can't encrypt your traffic between the Tor network and its final destination. If you are communicating sensitive information, you should use as much care as you would on the normal scary Internet — use HTTPS or other end-to-end encryption and authentication. https://www.torproject.org/projects/torbrowser.html.en https://www.torproject.org/projects/torbrowser.html.en

kefka 10y ago

I've also written up a comprehensive IoT infrastructure using Tor, Node-Red, MQTT, and sensor/actuator nodes as you choose. It's all documented here: https://hackaday.io/project/12985-multisite-homeofficehackerspace-automation https://hackaday.io/project/12985-multisite-homeofficehacker...