4 ms·

Can you imagine if Mozilla went with the nuclear option and replaced "private" tabs with Tor tabs? Going further, what if every Tor tab (by default, letting you

by zionic 7y ago

Can you imagine if Mozilla went with the nuclear option and replaced "private" tabs with Tor tabs? Going further, what if every Tor tab (by default, letting you opt out) acted as a node on the network and donated some minuscule bandwidth? I can see some tech heads being against such a thing, but your average user would have no idea 0.5Mb/sec (or some % of a speed tested value) is being used while their private tab is open and the number of users/nodes would skyrocket. Imagine the ever Tor tab potentially being an exit node!

mschuster91 7y ago
For many people, half a megabit is more than their Internet uplink speed, and many are on capped/metered connections as well.
- zionic 7y ago
  I haven't checked, but I imagine there's a "Metered connection mode" that limits things like auto-updates and perhaps loads lower resolution images. That could also disable bandwidth donation. You could also set the bandwidth to scale based on a speed test instead of a flat rate.
deleted 7y ago
[deleted]
schoen 7y ago
The Tor FAQ addresses this at https://2019.www.torproject.org/docs/faq.html.en#EverybodyARelay https://2019.www.torproject.org/docs/faq.html.en#EverybodyAR... Some other problems: * Possibly Sybil attacks get worse or harder to detect, because attackers can convincing simulate being a bunch of regular users with a browser * Possibly mitigating malicious nodes gets harder, because people can create lots of super-ephemeral nodes that fail to forward traffic, but there's no way to notice this in time to protect other users * Users could be very angry about relaying exit traffic without expecting it, especially if they got in legal trouble as a result (when EFF ran a campaign to encourage people to run Tor nodes, we discouraged people from running exit nodes in their homes)
icelancer 7y ago
And leading to wide swaths of users being banned from tons of sites that use one of the many publicly-available tor banlists for some reason they have zero understanding of.
- zionic 7y ago
  Or make banning tor unpalatable.
frankharv 7y ago
I must admit I am perplexed by the last line in the story: "Donate today, and Mozilla will match every dollar of your donation." I personally do not think that Mozilla is doing enough to protect its users and is partially to blame for where we are. They seem to be piling more and more features on that users don't want.
skybrian 7y ago
Sure, a lot more people would try it if Firefox made it easy. However, they might also stop using it pretty quickly if it's inconvenient. Here's a similar experience I had: for a while I would open any news link shared on Hacker News in Incognito mode, but at this point it gets blocked so often there's not much point.
aloknnikhil 7y ago
> Can you imagine if Mozilla went with the nuclear option and replaced "private" tabs with Tor tabs? That's one thing I really like about Brave. There's an option for a private Tor session.
- ignoramous 7y ago
  Sending traffic over Tor and using the Tor browser are different things: The former is just a proxy, the latter an anonymity tool. Is Brave doing the former or the latter?
  - woodandsteel 7y ago
    I'm confused as to what you are trying to say. When you use the Tor browser, it sends all your traffic over the Tor network. That's how it keeps you anonymous. Perhaps you are thinking of hidden services.
    - bcrypt 7y ago
      Tor Browser does more than just proxying. See my response above.
  - bcrypt 7y ago
    i run security at Brave and here's the answer from Taylor, our lead Tor dev: Using the Tor network is one part of internet anonymity, serving to conceal where you are. But using the Tor network does no good if the application helpfully adds X-My-Actual-IP-Address: 123.45.67.8 to every HTTP request, and browsers tend to do a lot of things like that which we have to play whack-a-mole with. What we implement in Brave is somewhere between (a) naively just setting a SOCKS proxy, like you can do in vanilla Firefox or Chromium, and (b) mimicking everything about the Tor Browser and following the Tor Browser Design Document to the letter (https://2019.www.torproject.org/projects/torbrowser/design/ https://2019.www.torproject.org/projects/torbrowser/design/). So, while you are right that there's more to Tor and that we're not the Tor Browser (and that's why we are careful to say 'private windows with Tor' and not 'Tor windows', per agreement with the Tor Project about branding), there's also more to what Brave does than just setting a SOCKS proxy like in Firefox or Chromium and leaving it at that.
gambler 7y ago
>Can you imagine if Mozilla went with the nuclear option and replaced "private" tabs with Tor tabs? Considering they don't even have a built-in PGP implementation in Firefox, which would make so much sense, I honestly can't imagine what you described. Tor is a relatively complex technology that requires knowledgeable use on user's part. (I.e. you're not supposed to resize windows, the browsers can't do certain things, it gets chewed up by Cloudflare and so on.)
namewasmypw 7y ago
> but your average user would have no idea 0.5Mb/sec (or some % of a speed tested value) is being used This is quite wrong
- zionic 7y ago
  FWIW I'm not. I believe the "some % of a speed tested value" covers that scenario though. It's not a hard problem.

by zionic 7y ago

mschuster91 7y ago

For many people, half a megabit is more than their Internet uplink speed, and many are on capped/metered connections as well.

zionic 7y ago
I haven't checked, but I imagine there's a "Metered connection mode" that limits things like auto-updates and perhaps loads lower resolution images. That could also disable bandwidth donation. You could also set the bandwidth to scale based on a speed test instead of a flat rate.

deleted 7y ago

[deleted]

schoen 7y ago

The Tor FAQ addresses this at https://2019.www.torproject.org/docs/faq.html.en#EverybodyARelay https://2019.www.torproject.org/docs/faq.html.en#EverybodyAR... Some other problems: * Possibly Sybil attacks get worse or harder to detect, because attackers can convincing simulate being a bunch of regular users with a browser * Possibly mitigating malicious nodes gets harder, because people can create lots of super-ephemeral nodes that fail to forward traffic, but there's no way to notice this in time to protect other users * Users could be very angry about relaying exit traffic without expecting it, especially if they got in legal trouble as a result (when EFF ran a campaign to encourage people to run Tor nodes, we discouraged people from running exit nodes in their homes)

icelancer 7y ago

And leading to wide swaths of users being banned from tons of sites that use one of the many publicly-available tor banlists for some reason they have zero understanding of.

zionic 7y ago
Or make banning tor unpalatable.

frankharv 7y ago

I must admit I am perplexed by the last line in the story: "Donate today, and Mozilla will match every dollar of your donation." I personally do not think that Mozilla is doing enough to protect its users and is partially to blame for where we are. They seem to be piling more and more features on that users don't want.

skybrian 7y ago

Sure, a lot more people would try it if Firefox made it easy. However, they might also stop using it pretty quickly if it's inconvenient. Here's a similar experience I had: for a while I would open any news link shared on Hacker News in Incognito mode, but at this point it gets blocked so often there's not much point.

aloknnikhil 7y ago

> Can you imagine if Mozilla went with the nuclear option and replaced "private" tabs with Tor tabs? That's one thing I really like about Brave. There's an option for a private Tor session.

ignoramous 7y ago
Sending traffic over Tor and using the Tor browser are different things: The former is just a proxy, the latter an anonymity tool. Is Brave doing the former or the latter?
- woodandsteel 7y ago
  I'm confused as to what you are trying to say. When you use the Tor browser, it sends all your traffic over the Tor network. That's how it keeps you anonymous. Perhaps you are thinking of hidden services.
  - bcrypt 7y ago
    Tor Browser does more than just proxying. See my response above.
- bcrypt 7y ago
  i run security at Brave and here's the answer from Taylor, our lead Tor dev: Using the Tor network is one part of internet anonymity, serving to conceal where you are. But using the Tor network does no good if the application helpfully adds X-My-Actual-IP-Address: 123.45.67.8 to every HTTP request, and browsers tend to do a lot of things like that which we have to play whack-a-mole with. What we implement in Brave is somewhere between (a) naively just setting a SOCKS proxy, like you can do in vanilla Firefox or Chromium, and (b) mimicking everything about the Tor Browser and following the Tor Browser Design Document to the letter (https://2019.www.torproject.org/projects/torbrowser/design/ https://2019.www.torproject.org/projects/torbrowser/design/). So, while you are right that there's more to Tor and that we're not the Tor Browser (and that's why we are careful to say 'private windows with Tor' and not 'Tor windows', per agreement with the Tor Project about branding), there's also more to what Brave does than just setting a SOCKS proxy like in Firefox or Chromium and leaving it at that.

gambler 7y ago

>Can you imagine if Mozilla went with the nuclear option and replaced "private" tabs with Tor tabs? Considering they don't even have a built-in PGP implementation in Firefox, which would make so much sense, I honestly can't imagine what you described. Tor is a relatively complex technology that requires knowledgeable use on user's part. (I.e. you're not supposed to resize windows, the browsers can't do certain things, it gets chewed up by Cloudflare and so on.)

namewasmypw 7y ago

> but your average user would have no idea 0.5Mb/sec (or some % of a speed tested value) is being used This is quite wrong

zionic 7y ago
FWIW I'm not. I believe the "some % of a speed tested value" covers that scenario though. It's not a hard problem.