8 ms·

What does Tor have to do with anything, I thought it was just a normal app which routes its connections by itself?

by blub 6y ago

pfortuny 6y ago
The thing is... You use tor because you think you can prevent ALL of the traffic from being visible (similar to a VPN). Now you cannot trust the kernel not to reveal anything to Apple.
- MagnumOpus 6y ago
  And by "reveal to Apple" he means "reveal to every bent cop who's listening in on the wire that you wanted to avoid by using a VPN"
- tpush 6y ago
  ?? This was always possible and has nothing to do with Apple exempting their apps from the firewall and VPNs.
  - pfortuny 6y ago
    No: you can trust a kernel or you cannot. “all this traffic must go this way”... Kernel: I don’t care. There is no meaningful tor under those conditions.
    - blub 6y ago
      Last time I checked Tor was managing its own encryption and routing without relying on any macOS VPN or firewall API. Several years ago it was making direct connections to various IPs and sending the encrypted information. It makes no sense for Tor to use those APIs since they're designed for other use cases.
- blub 6y ago
  Tor browser only routes its own traffic through the Tor network. By the time that traffic hits the kernel it should already be encrypted.
  - arthur_sav 6y ago
    Yes but Apple keeps track of the application you open and sends that data through 3rd parties unencrypted. Imagine you open Tor in your mac, Apple will send a request with Date, Time, Computer, ISP, City, State and Application Hash through the open internet for everyone that listens. That by itself is not very interesting but if you combine that with all the other data hoarding that happens it can trace back to you.
    - lawnchair_larry 6y ago
      This is completely false, Jeffrey Paul was extremely dishonest about the location data which is not sent at all, and he misunderstood how OSCP works. It doesn’t send the hash of the binary. Others have cleared this up and Apple released a statement.
      - jlokier 6y ago
        It's not false except in some insignificant details. The OCSP request still tells Apple the developer ID, which for some software is just as revealing. For the Tor Browser, the developer ID used with OCSP is: The Tor Project, Inc (MADPSAYN6T) That's certainly enough to tell Apple you are running Tor Browser, Tor itself, or something else from the Tor project! Also that's only OCSP which runs often. Gatekeeper also runs, though only the first time each new executable is run. Gatekeeper does tell Apple the hash of the application. That will show up each time you run it after updating to a new version. The stuff about street address etc is wrong, but not completely wrong. Because the request is sent when you open the application, as a side effect it reveals your approximate location (to anyone third-party eavesdroppers not just Apple) and an accurate timestamp, of the moment when you opened Tor. Of course anyone eavesdropping nearby can detect the Tor traffic itself. However, only on the paths used to the Tor exit node. Separate from the Tor traffic, Apple and any routers along the path to Apple (e.g. "great firewall") can identify devices running Tor from far away, even if they don't have direct evidence of Tor traffic from those devices. I think it quite likely that CCP (among others) will be logging these OCSP requests at the great firewall already. Here's a "cleared up" version of the story from https://www.theverge.com/2020/11/16/21569316/apple-mac-ocsp-server-developer-id-authentication-privacy-concerns-encryption-promises-fix https://www.theverge.com/2020/11/16/21569316/apple-mac-ocsp-... : > the data sent to Apple’s OCSP server contains information relating to an app’s developer but not the app itself. It adds that Apple’s Gatekeeper service can send the hash of an executable, but that this is separate to OCSP and happens over an encrypted connection. Apple’s own support page notes that Gatekeeper uses “an encrypted connection that is resilient to server failures.” > In its updated support document, Apple makes clear that security checks it makes when authenticating software do not include a user’s Apple ID or device identity. The company also says it’s stopped logging IP addresses associated with the Developer ID certificate checks. “We have never combined data from these checks with information about Apple users or their devices,” writes the iPhone-maker. “We do not use data from these checks to learn what individual users are launching or running on their devices.”
- Hizonner 6y ago
  Tor does not, never has, and never has even tried to, capture "ALL" of the traffic on any OS. It's just a SOCKS proxy, period. If you ever thought Tor could do that, you were just wrong. There are various third party add-ons for various systems that do try to funnel "ALL" traffic through Tor in various ways. ORBot for Android tries to act like a VPN for the phone. Outboard hardware like the Pi-hole will try to put everything on a subnet through Tor. Tor-centric OSes like Whonix and TAILS put all of their traffic through Tor. You can hack something up to do it on vanilla Linux. ... but so far as I know, there has never been anything that tried to do it on MacOS. Maybe I just don't know about some weird hack that's available, but even if there is one, it's not part of Tor proper. It's also not something anybody should ever have relied on anyway, because trying to "act like a VPN", on a general-purpose OS that's not cooperating, is prone to be leaky regardless of the OS. As long as programs running in an OS can find out the system's "real" IP address, they can leak it, so if you're serious about containing non-cooperative programs, you need to deprive them of that information. The Tor Browser doesn't do any that. It just sends the traffic from the browser app itself over Tor using SOCKS, and Apple has not broken that here. What Apple is doing is obnoxious and unacceptable and yet another reason never, ever to use an Apple product for anything... but it has zero impact on Tor.

What does Tor have to do with anything, I thought it was just a normal app which routes its connections by itself?

by blub 6y ago

What does Tor have to do with anything, I thought it was just a normal app which routes its connections by itself?

The thing is... You use tor because you think you can prevent ALL of the traffic from being visible (similar to a VPN). Now you cannot trust the kernel not to reveal anything to Apple.

MagnumOpus 6y ago
And by "reveal to Apple" he means "reveal to every bent cop who's listening in on the wire that you wanted to avoid by using a VPN"
tpush 6y ago
?? This was always possible and has nothing to do with Apple exempting their apps from the firewall and VPNs.
- pfortuny 6y ago
  No: you can trust a kernel or you cannot. “all this traffic must go this way”... Kernel: I don’t care. There is no meaningful tor under those conditions.
  - blub 6y ago
    Last time I checked Tor was managing its own encryption and routing without relying on any macOS VPN or firewall API. Several years ago it was making direct connections to various IPs and sending the encrypted information. It makes no sense for Tor to use those APIs since they're designed for other use cases.
blub 6y ago
Tor browser only routes its own traffic through the Tor network. By the time that traffic hits the kernel it should already be encrypted.
- arthur_sav 6y ago
  Yes but Apple keeps track of the application you open and sends that data through 3rd parties unencrypted. Imagine you open Tor in your mac, Apple will send a request with Date, Time, Computer, ISP, City, State and Application Hash through the open internet for everyone that listens. That by itself is not very interesting but if you combine that with all the other data hoarding that happens it can trace back to you.
  - lawnchair_larry 6y ago
    This is completely false, Jeffrey Paul was extremely dishonest about the location data which is not sent at all, and he misunderstood how OSCP works. It doesn’t send the hash of the binary. Others have cleared this up and Apple released a statement.
    - jlokier 6y ago
      It's not false except in some insignificant details. The OCSP request still tells Apple the developer ID, which for some software is just as revealing. For the Tor Browser, the developer ID used with OCSP is: The Tor Project, Inc (MADPSAYN6T) That's certainly enough to tell Apple you are running Tor Browser, Tor itself, or something else from the Tor project! Also that's only OCSP which runs often. Gatekeeper also runs, though only the first time each new executable is run. Gatekeeper does tell Apple the hash of the application. That will show up each time you run it after updating to a new version. The stuff about street address etc is wrong, but not completely wrong. Because the request is sent when you open the application, as a side effect it reveals your approximate location (to anyone third-party eavesdroppers not just Apple) and an accurate timestamp, of the moment when you opened Tor. Of course anyone eavesdropping nearby can detect the Tor traffic itself. However, only on the paths used to the Tor exit node. Separate from the Tor traffic, Apple and any routers along the path to Apple (e.g. "great firewall") can identify devices running Tor from far away, even if they don't have direct evidence of Tor traffic from those devices. I think it quite likely that CCP (among others) will be logging these OCSP requests at the great firewall already. Here's a "cleared up" version of the story from https://www.theverge.com/2020/11/16/21569316/apple-mac-ocsp-server-developer-id-authentication-privacy-concerns-encryption-promises-fix https://www.theverge.com/2020/11/16/21569316/apple-mac-ocsp-... : > the data sent to Apple’s OCSP server contains information relating to an app’s developer but not the app itself. It adds that Apple’s Gatekeeper service can send the hash of an executable, but that this is separate to OCSP and happens over an encrypted connection. Apple’s own support page notes that Gatekeeper uses “an encrypted connection that is resilient to server failures.” > In its updated support document, Apple makes clear that security checks it makes when authenticating software do not include a user’s Apple ID or device identity. The company also says it’s stopped logging IP addresses associated with the Developer ID certificate checks. “We have never combined data from these checks with information about Apple users or their devices,” writes the iPhone-maker. “We do not use data from these checks to learn what individual users are launching or running on their devices.”
Hizonner 6y ago
Tor does not, never has, and never has even tried to, capture "ALL" of the traffic on any OS. It's just a SOCKS proxy, period. If you ever thought Tor could do that, you were just wrong. There are various third party add-ons for various systems that do try to funnel "ALL" traffic through Tor in various ways. ORBot for Android tries to act like a VPN for the phone. Outboard hardware like the Pi-hole will try to put everything on a subnet through Tor. Tor-centric OSes like Whonix and TAILS put all of their traffic through Tor. You can hack something up to do it on vanilla Linux. ... but so far as I know, there has never been anything that tried to do it on MacOS. Maybe I just don't know about some weird hack that's available, but even if there is one, it's not part of Tor proper. It's also not something anybody should ever have relied on anyway, because trying to "act like a VPN", on a general-purpose OS that's not cooperating, is prone to be leaky regardless of the OS. As long as programs running in an OS can find out the system's "real" IP address, they can leak it, so if you're serious about containing non-cooperative programs, you need to deprive them of that information. The Tor Browser doesn't do any that. It just sends the traffic from the browser app itself over Tor using SOCKS, and Apple has not broken that here. What Apple is doing is obnoxious and unacceptable and yet another reason never, ever to use an Apple product for anything... but it has zero impact on Tor.