4 ms·
Using Tor may actually be less secure that using a normal browser. At least when I connect to Microsoft, Google, Facebook, etc. I don't expect to get hit by a
by nixos 10y ago
Using Tor may actually be less secure that using a normal browser.
At least when I connect to Microsoft, Google, Facebook, etc. I don't expect to get hit by a driveby JS exploit, and Google does help with "safe browsing".
With Tor, you're one HTTP website (or not HSTS website) away from a driveby virus, with no way to tell that you're connecting to a dangerous exit node
- tedks 10y agoTor Project runs several scanners for this behavior. Arguably, unless your ISP, ISP's ISP, coffee shop, etc., are all 100% on top of their game, this could happen in any one of those environments too.
- nixos 10y agoSo they shut down a node, the node operator notices and restarts it. The problem is that people actually make money from malware. It's not bored college kids showing off skills. It's pros. So think like a pro. You use a zero day to hack into Verizon to feed malware, get noticed, and your hack gets reversed after an hour. You open an exit Tor node on a VPS, use it to feed malware, profit. They close it, you re-open it on another host. They play wack-a-mole, and you rake it in.
- tedks 10y agoThe thing is that it takes a significant amount of time and bandwidth to get flagged as an exit and included on circuits. So your set of hosts is going to be pretty limited to start; most hosts are pretty hostile to Tor exits as it is, and are going to shut down an exit hosted in their IP space because they don't want to deal with the abuse complaints. In contrast, the exit scanner can be part of the first users of an exit node. You could try to detect the scanner, but the nature of Tor is that this isn't feasible. In any case, you can solve the problem of distributing software over Tor by setting up a hidden service. The Tor devs have been making noise for a while about creating an "onion service" that isn't hidden, but has the same guarantees as a hidden service (an improved version of exit enclaving).
- makomk 10y agoLast time I checked, the Tor Project's handling of malicious exit nodes was one guy who didn't really care all that much about reports of active MITM attacks that were actually robbing people of money (well, Bitcoins anyway). Just flat out refused to pull the nodes doing it.
- tedks 10y agoDid you check prior to the multiple years of work on the exit scanner? Just lurking on tor-relays and tor-talk shows a lot of responsiveness on the part of the dirauths.
- kevin_thibedeau 10y agoThe security conscious should be running noscript anyway.
- nixos 10y agoBut then you'd become fingerprintable by staying out of the crowd
- breakingcups 10y agoBy default Tor Browser runs noscript.
- heinrich5991 10y agoWhen you connect to Microsoft, Google, Facebook, etc., you're connecting via HTTPS, so there's nothing malicious a Tor exit node could do in these cases.