3 ms·

DO NOT ROUTE REGULAR TRAFFIC OVER TOR TRANSPARENTLY Sorry for the uppercase, but transparent proxies are dangerous, especially if users are not aware of them

by TorDev 6y ago

DO NOT ROUTE REGULAR TRAFFIC OVER TOR TRANSPARENTLY Sorry for the uppercase, but transparent proxies are dangerous, *especially* if users are not aware of them. Applications that are not explicitly designed to use Tor can often leak data or be vulnerable to malicious exit nodes. Also, this pattern can create false sense of security. See warnings: https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TransparentProxy#warning https://gitlab.torproject.org/legacy/trac/-/wikis/doc/Transp...

devwastaken 6y ago
So this is something you should only be using tor applications through? The benefit of a tor box is that it's much more immune to exploitation from the local machine leaking data - if done right. It'd be nice if you could simply point tails at this but afaik it's bad to do tor over tor.
- arsome 6y ago
  Not necessarily only Tor applications, also works well for VMs/physical machines created specifically to be used directly in a Tor only environment, where none of your data is otherwise associated with them. I use this for malware reverse engineering for example.
- EveYoung 6y ago
  You could use Whonix instead and run the Whonix-Gateway on a different machine (e.g., Rasperry Pi).
GoblinSlayer 6y ago
>Also, this pattern can create false sense of security. Tor provides obscurity, not security, even for applications designed to use tor. And even then obscurity isn't lower, in clearnet you have zero obscurity.
vmception 6y ago
Correct, I think the best use case for this is if it functioned as a dedicated Tor Exit Node, but I don't get the impression that it does that
hnjst 6y ago
I couldn't agree more. The proposed setup also makes devices properly configured to leverage tor "anonymity" features vulnerable to misconfigurations of other devices using the network that is routed over tor (through the same circuit) in various ways.

DO NOT ROUTE REGULAR TRAFFIC OVER TOR TRANSPARENTLY Sorry for the uppercase, but transparent proxies are dangerous, *especially* if users are not aware of them

by TorDev 6y ago

devwastaken 6y ago

So this is something you should only be using tor applications through? The benefit of a tor box is that it's much more immune to exploitation from the local machine leaking data - if done right. It'd be nice if you could simply point tails at this but afaik it's bad to do tor over tor.

arsome 6y ago
Not necessarily only Tor applications, also works well for VMs/physical machines created specifically to be used directly in a Tor only environment, where none of your data is otherwise associated with them. I use this for malware reverse engineering for example.
EveYoung 6y ago
You could use Whonix instead and run the Whonix-Gateway on a different machine (e.g., Rasperry Pi).

GoblinSlayer 6y ago

>Also, this pattern can create false sense of security. Tor provides obscurity, not security, even for applications designed to use tor. And even then obscurity isn't lower, in clearnet you have zero obscurity.

vmception 6y ago

Correct, I think the best use case for this is if it functioned as a dedicated Tor Exit Node, but I don't get the impression that it does that

hnjst 6y ago

I couldn't agree more. The proposed setup also makes devices properly configured to leverage tor "anonymity" features vulnerable to misconfigurations of other devices using the network that is routed over tor (through the same circuit) in various ways.