3 ms·

So how would you suggest browsing privately then?

by jhlgkhkhil 10y ago

tptacek 10y ago
I would start by learning the difference between Tor and Tor Browser.
- jhlgkhkhil 10y ago
  OK this advice is dangerous. The reason Tor Browser exists is because configuring Tor for safe use is difficult...
  - tptacek 10y ago
    I'm confident that it's the opposite of dangerous advice.
    - jhlgkhkhil 10y ago
      Interesting please tell me more.
      - mjg59 10y ago
        Using Tor Browser as your primary browser is a bad idea because it's way behind on security features and you mark yourself out as an interesting target. Using Chrome over Tor is strictly better from a privacy viewpoint than using Chrome on its own. So it depends what you're optimising for. If privacy is your absolute priority, the Tor Browser reduces the number of cases of information leakage but still requires you to have the discipline to avoid any other methods of leaking your identity. If you understand all the issues around that then you probably also understand enough to ignore Tptacek and use it anyway. But if you don't, using the Tor Browser leaves you in a worse position than you'd otherwise be in - you're less secure and you're probably leaking PII anyway. There are cases where using the Tor Browser makes sense, but it's a terrible blanket recommendation. If you're not actively trying to hide your identity, using it will make you less secure than you would otherwise be.
        JupiterMoon 10y ago
        > Using Tor Browser as your primary browser is a bad idea because it's way behind on security features Is it? Please provide references. > and you mark yourself out as an interesting target/ Yeah that seems likely. > Using Chrome over Tor is strictly better from a privacy viewpoint than using Chrome on its own. Is it? If Chrome leaks any local information this is not true. NB I do not know if Chrome does so but please refer to https://blog.torproject.org/blog/bittorrent-over-tor-isnt-good-idea https://blog.torproject.org/blog/bittorrent-over-tor-isnt-go... for an example of what I am getting at. > If privacy is your absolute priority, the Tor Browser reduces the number of cases of information leakage but still requires you to have the discipline to avoid any other methods of leaking your identity. Yes. But Tor Browser is released specifically to help you manage this. Information leakage through the web browser is amazingly easy - and it doesn't take logging onto a website to be finger printed (Chrome over Tor is probably a fairly unique fingerprint on its own). Why not find out for your self how unique at https://panopticlick.eff.org/ https://panopticlick.eff.org/ > If you understand all the issues around that then you probably also understand enough to ignore Tptacek and use it anyway. No comment. > But if you don't, using the Tor Browser leaves you in a worse position than you'd otherwise be in - you're less secure and you're probably leaking PII anyway. Doubt it but again citations needed. > There are cases where using the Tor Browser makes sense, agreed. > but it's a terrible blanket recommendation. Citation needed. > using it will make you less secure than you would otherwise be. Citation needed.
        mjg59 10y ago
        > Is it? Please provide references. Sandboxing alone justifies this. > If Chrome leaks any local information this is not true. Leaking information over Tor is no worse than leaking it over non-Tor, and in general cases Chrome isn't directly sending information that allows a single site to identify you. > Chrome over Tor is probably a fairly unique fingerprint on its own What's your threat model? That's a serious question.
        JupiterMoon 10y ago
        Sandboxing does not have to be provided at application level. The OS or a virtual machine can take case of confinement. > Leaking information over Tor is no worse than leaking it over non-Tor, and in general cases Chrome isn't directly sending information that allows a single site to identify you. More like: Leaking local information over Tor is equivalent to not using Tor, and in general cases the user has no control over what data Chrome is sending.

So how would you suggest browsing privately then?

tptacek 10y ago

I would start by learning the difference between Tor and Tor Browser.

jhlgkhkhil 10y ago
OK this advice is dangerous. The reason Tor Browser exists is because configuring Tor for safe use is difficult...
- tptacek 10y ago
  I'm confident that it's the opposite of dangerous advice.
  - jhlgkhkhil 10y ago
    Interesting please tell me more.
    - mjg59 10y ago
      Using Tor Browser as your primary browser is a bad idea because it's way behind on security features and you mark yourself out as an interesting target. Using Chrome over Tor is strictly better from a privacy viewpoint than using Chrome on its own. So it depends what you're optimising for. If privacy is your absolute priority, the Tor Browser reduces the number of cases of information leakage but still requires you to have the discipline to avoid any other methods of leaking your identity. If you understand all the issues around that then you probably also understand enough to ignore Tptacek and use it anyway. But if you don't, using the Tor Browser leaves you in a worse position than you'd otherwise be in - you're less secure and you're probably leaking PII anyway. There are cases where using the Tor Browser makes sense, but it's a terrible blanket recommendation. If you're not actively trying to hide your identity, using it will make you less secure than you would otherwise be.
      - JupiterMoon 10y ago
        > Using Tor Browser as your primary browser is a bad idea because it's way behind on security features Is it? Please provide references. > and you mark yourself out as an interesting target/ Yeah that seems likely. > Using Chrome over Tor is strictly better from a privacy viewpoint than using Chrome on its own. Is it? If Chrome leaks any local information this is not true. NB I do not know if Chrome does so but please refer to https://blog.torproject.org/blog/bittorrent-over-tor-isnt-good-idea https://blog.torproject.org/blog/bittorrent-over-tor-isnt-go... for an example of what I am getting at. > If privacy is your absolute priority, the Tor Browser reduces the number of cases of information leakage but still requires you to have the discipline to avoid any other methods of leaking your identity. Yes. But Tor Browser is released specifically to help you manage this. Information leakage through the web browser is amazingly easy - and it doesn't take logging onto a website to be finger printed (Chrome over Tor is probably a fairly unique fingerprint on its own). Why not find out for your self how unique at https://panopticlick.eff.org/ https://panopticlick.eff.org/ > If you understand all the issues around that then you probably also understand enough to ignore Tptacek and use it anyway. No comment. > But if you don't, using the Tor Browser leaves you in a worse position than you'd otherwise be in - you're less secure and you're probably leaking PII anyway. Doubt it but again citations needed. > There are cases where using the Tor Browser makes sense, agreed. > but it's a terrible blanket recommendation. Citation needed. > using it will make you less secure than you would otherwise be. Citation needed.
        mjg59 10y ago
        > Is it? Please provide references. Sandboxing alone justifies this. > If Chrome leaks any local information this is not true. Leaking information over Tor is no worse than leaking it over non-Tor, and in general cases Chrome isn't directly sending information that allows a single site to identify you. > Chrome over Tor is probably a fairly unique fingerprint on its own What's your threat model? That's a serious question.
        JupiterMoon 10y ago
        Sandboxing does not have to be provided at application level. The OS or a virtual machine can take case of confinement. > Leaking information over Tor is no worse than leaking it over non-Tor, and in general cases Chrome isn't directly sending information that allows a single site to identify you. More like: Leaking local information over Tor is equivalent to not using Tor, and in general cases the user has no control over what data Chrome is sending.