17 ms·

Tor Browser 12.0

379 points by soheilpro 4y ago

encryptluks2 4y ago
I'm surprised that they haven't bundled Arti, their Rust-based tor client implementation. I will say I am thankful for Tor Browser, but any JavaScript-enabled browser seems like the wrong choice for privacy and security.
- ravenstine 4y ago
  I've basically come to the same conclusion having attempted to use a lot of Tor Browser's default config in Firefox. Most of it is a good idea, but trying to be untrackable while JavaScript is turned on seems futile. Every single browser's APIs are leaky as hell. No matter how many things are turned off or obfuscated, there's always a few unique-ish details that are exposed that create a fingerprint. There was one point where my anti-fingerprinting tactics did appear to fool Panopticlick, but that apparently didn't last long. Fingerprinting and anti-fingerprinting are a cat and mouse game, and much worse so than just ad-blocking because there's more at stake than just being annoyed by banners. There's also way too many websites doing everything, and I mean everything with JS. Fricking blog sites half the time display nothing more than a motionless loading spinner if you don't have JS turned on. And if you turn JS on well good luck because lots of things want to use <canvas> to render things that don't even strictly need it, and you're really not going to casually enable canvas for certain things? Even the list of fonts is a decent metric for fingerprinting, yet that's rarely taken seriously because even privacy experts seem to believe that every website needs to display its own fonts for "brand identity." Though I would stay away from Tor anyway, if I were to use it, JS would have to be turned off entirely.
  - rodric 4y ago
    My default browser is Librewolf with JavaScript turned off. If a page fails to load correctly, I reopen it in Firefox private browsing mode (or, if it still fails, Chrome incognito mode). If it’s a site I expect to come back to in future, I bookmark it in Firefox and assign it its own container using the Multi-Account Containers extension.
- bawolff 4y ago
  Security is always a compromise between competing concerns. A browser that cannot browse a significant chunk of the internet doesn't get used and helps nobody.
- Aisen8010 4y ago
  I installed the Tor Browser to access the Z Library a few days ago. I guess I shouldn't complain, but the downloads are very slow (I'm not sure if the problem is in my end).
  - Synaesthesia 4y ago
    In general connecting over Tor or I2p is slow.
  - edgyquant 4y ago
    Tor works by proxying through (at least) 3 PCs before hitting the open web. The problem is that you’re trying to download big files which is not a use case for tor. It’s specifically for browsing the web anonymously.
    - ehPReth 4y ago
      Was it always 7? I seem to remember it being like 3-4?
      - super256 4y ago
        https://i.imgur.com/h1vlxNh.png https://i.imgur.com/h1vlxNh.png
      - makerofspoons 4y ago
        Connecting to hidden services it's 6 hops, reaching out to the internet it's 3 hops.
      - bauruine 4y ago
        For a circuit to clearnet it's 3. Guard --> Middle --> Exit. For a onion service it's 6 and the connection is a bit more complicated [0]. The speed varies from very fast to unbearable depending on your circuit and how bad the ddos is at that moment. [1] You can try to create a new and hopefully faster circuit by clicking on the onion symbol on the left in the address bar. [0] https://github.com/mikeperry-tor/vanguards/blob/master/README_TECHNICAL.md#onion-service-overview https://github.com/mikeperry-tor/vanguards/blob/master/READM... [1] https://status.torproject.org/issues/2022-06-09-network-ddos/ https://status.torproject.org/issues/2022-06-09-network-ddos...
- capableweb 4y ago
  1) Arti is basically a prototype at this point, including it already would be reckless, 2) Arti is a client for the Tor protocol, and including it in the browser wouldn't have any impact if JavaScript ships enabled/disabled by default in Tor Browser, 3) if you really want to, you can easily change the "Security Level" in Tor Browser to disable JavaScript for all websites by default. As an alternative for the last point, turn the Security Level to "Safest" or however it's worded, then use the included NoScript addon to enable it for just sites that just won't work without JavaScript. You get functional web + JS disabled in most places where you can.
- nibbleshifter 4y ago
  Arti isn't ready for production use yet. Its a long ways away from being usable in TBB or as a full drop in for tor itself. I think in a years time that will change.
- dinosaurdynasty 4y ago
  Arti doesn't even support hidden services yet.
deadfromtor 4y ago
Just FYI that HN is very anti-tor. I made this account via Tor just now to prove the point. It will be dead by default (unless someone "vouches" for it). It's a very user-hostile stance that HN takes (along with not letting you delete your account). It really makes you wonder what they're doing with all this data? Doxxing is almost a given.
- alexb_ 4y ago
  Or they realize that letting Tor users makes spam explode.
- ehPReth 4y ago
  most sites seem to treat Tor poorly, possibly due to abuse. well-used VPNs also can suffer from Google captchas etc. not that I like that fact, but it seems to be inescapable
- amideadfromtor 4y ago
  Different poster here. This account and post were done over Tor. Let's see if this holds. EDIT: Yup; dead on arrival.
  - torified 4y ago
    Not dead.
- sterlind 4y ago
  it's more likely they do this to combat spamming. accounts created by Tor are more likely to be used for spam than for legitimate discussion, since Tor evades IP reputation. I'm sure you could email @dang and ask to be un-shadow-banned, and he would do so.
  - jbm 4y ago
    Wouldn't emailing @dang be against the purpose of Tor, which is to enhance privacy?
optimalsolver 4y ago
The inescapable fact about Tor is that its traffic patterns make you stand out prominently. Just the fact you’re using it automatically makes you interesting and worthy of a closer look. All well and good if you’re just maintaining a cookie recipe site on the dark web, but it’s rarely ever that, is it?
- acapybara 4y ago
  Maybe this could be a good thing for business development? Could we convert our "observers" into early customers?
- deleted 4y ago
  [deleted]
- pr337h4m 4y ago
  The Brave browser has around 60 million MAUs and has Tor bundled with it, so Tor traffic is unlikely to stand out as much as before.
  - thekyle 4y ago
    I believe the Tor feature of Brave is an optional setting, so I assume only a small fraction of their MAU use it.
    - Gigachad 4y ago
      It’s not a setting, it’s like their version of an incognito tab. You can right click a link to “open in tor”
      - Mistletoe 4y ago
        Wow this is really cool. I need to look into Brave again.
      - dhaavi 4y ago
        Afaik, it does not use Tor from within the browser, but uses a proxy server into Tor. That could have changed though.
mothsonasloth 4y ago
- sasattack 4y ago
  Could we maybe not on this website use the term glowie considering it's explicitly sourced from a neo nazi and a phrase involving the n word. seems like maybe not real in line with HN rules....
  - mothsonasloth 4y ago
    It originated from Terry Davis the creator of TempleOS, but okay I get your point.
    - sasattack 4y ago
      True I miss remembered the details. but it has been so amplified by neo nazis that wikitionary sources them as popularizing it .
    - user764743 4y ago
      /pol/ popularized it through him since they were big fans
  - orthecreedence 4y ago
    I thought glowie was a term used to describe undercover FBI/CIA agents. It's in frequent use in leftist (communist/anarchist, not liberal democrat) forums. Is there actual substance behind this claim of its origins or is it yet another tired attempt to rewrite language for no particular reason?
    - DoItToMe81 4y ago
      [dead]
  - throwaway0x7E6 4y ago
    nice try, glowie
agilob 4y ago
So I guess Mozilla isn't working on unforking tor browser?
- chungy 4y ago
  It's pretty much already happened. Tor Browser is little more than stock Firefox with some of the settings changed.
  - HackerNCoder 4y ago
  - webmobdev 4y ago
    There's also a bug report (not fixed for a long time - https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/40788 https://gitlab.torproject.org/tpo/applications/tor-browser/-... ) that the Tor Browser also phones some Mozilla / Firefox every time it starts and there is no option to disable it.
- Gigachad 4y ago
  They are probably not satisfied that Tor doesn’t have a deplatforming mechanism.
  - goatcode 4y ago
    I'm glad this knowledge and discussion is still alive and well. F them for this.
  - orthecreedence 4y ago
    Can you elaborate on this? I think I'm missing some context.
    - Gigachad 4y ago
      Based on their blog post where they want more deplatforming capabilities https://blog.mozilla.org/en/mozilla/we-need-more-than-deplatforming/ https://blog.mozilla.org/en/mozilla/we-need-more-than-deplat... There was also a comment from one of the Tor foundation members about how they wish they were able to deplatform kiwi farms from tor but it’s technically not possible.
autoexec 4y ago
Regardless of the issues with TOR itself, or the areas where I disagree with Tor Browser's approach, I love the project anyway because they're great about identifying and tracking all the things Firefox does that could put our privacy at risk. Having more eyes on Firefox update after update is wonderful and I've been incorporating many of their setting changes for years. I hope they can keep doing what they do for a long time!
goombacloud 4y ago
It's sad to see that Apple Silicon gets extra treatment and arm64 work suddenly gets done while for Linux it's still amd64-only. With Signal it's the same and they also don't offer arm64 builds. Nowadays it's very easy to build for arm64 - you either go the way with cross compilation or you go the way with full qemu binary emulation which is as simple as it gets because you would build within an arm64 docker image, e.g., docker.io/arm64v8/alpine or docker.io/arm64v8/ubuntu and qemu-static handles the emulation (it will be slower than cross compilation but as long as speed is acceptable you can go this easy way).
data_maan 4y ago
All comments here focus on extreme cases: The police viewing you as a possible suspect, FBI becoming interested in you etc. Here is a much more mundane problem: Using Tor (even a VPN) while logging in to most big Silicon Valley firma that make money with your data (LinkedIn, Facebook, Tinder etc.) will result in your profile being suspended REAL FAST with the only way out to upload your gov't ID, i.e. complete deanonimization (perhaps as a kind of punishment). Any solutions?
- New_California 4y ago
  I struggle with the very same problem. Even connecting a real physical SIM won't protect accounts from suspension. This is crazy because it isn't based on behavior on the platform (like posting too much or liking too much) but merely on the IP and browser fingerprint. Unfortunately, no solutions in sight.
  - torified 4y ago
    The solution is simple. Don't use a site that abuses your privacy.
- ipaddr 4y ago
  Stop using those services. This is a clear message that you cannot use them privately.
  - data_maan 4y ago
    C'mon, for a forum of hackers that's a pretty lame answer, isn't it? :P
    - matheusmoreira 4y ago
      People from a forum of hackers should be above depending on Big Tech corporations for anything. Easier said than done but it should still be the general goal.
- easrng 4y ago
data_maan 4y ago
I once spoke with someone who knew someone who ran an exit node in Europe. He told crazy stories with police knocking every once in a while. Also the legal structure to do that was tricky, because you want to avoid the police searching your house; you'd also like tl spread responsability on multiple shoulders. So you have to create a kind of non-profit organization and run the exit node through that. It's very hard work and we should be thankful for the people who do it. Does anybody know more about how exit nodes are being run?
- robert_foss 4y ago
  I ran one in my student housing wardrobe a decade or so ago. I too have some stories, but no one ever met up with me in the flesh.
  - jason-phillips 4y ago
    Come on then, no need to be coy.
    - robert_foss 4y ago
      For example, once or twice people called me (somehow) and asked why I was hacking their websites. I tried to explain, but I doubt I convinced anyone.
      - chinabot 4y ago
        How would a non government entity get a physical address or phone number from an IP ?
        Ralo 4y ago
        Social engineering can be very powerful. Small ISPs could fall victim to this easier.
      - Nathanba 4y ago
privatecloud 4y ago
How much do you believe what this book (by Yasha Levine, writer for Wired, New York Observer, etc) states — that Tor is funded by the CIA and has backdoors? https://www.amazon.com/Surveillance-Valley-Military-History-Internet/dp/1610398025 https://www.amazon.com/Surveillance-Valley-Military-History-...
- humanistbot 4y ago
  It is 100% false that Tor was funded by the CIA. However, it is a very well documented fact that Tor was initially funded by the US Naval Research Laboratory, which also has a mandate for international intelligence gathering. Get your organizations right.
- HackerNCoder 4y ago
  It's very... problematic. And Yasha clearly displays a lack of knowledge (or is knowingly lying) by making the claim that the Tor Project is tipping of the US government to vulnerabilities. Here is why: https://blog.erratasec.com/2018/03/askrob-does-tor-let-government-peek-at.html#.Y5Go9ffLfbY https://blog.erratasec.com/2018/03/askrob-does-tor-let-gover... Some more Yasha stuff: https://micahflee.com/2014/12/fact-checking-pandos-smears-against-tor/ https://micahflee.com/2014/12/fact-checking-pandos-smears-ag...
ec109685 4y ago
“ In May 2020 we found a group of Tor exit relays that were messing with exit traffic. Specifically, they left almost all exit traffic alone, and they intercepted connections to a small number of cryptocurrency exchange websites. If a user visited the HTTP version (i.e. the unencrypted, unauthenticated version) of one of these sites, they would prevent the site from redirecting the user to the HTTPS version (i.e. the encrypted, authenticated version) of the site. If the user didn't notice that they hadn't ended up on the HTTPS version of the site (no lock icon in the browser) and proceeded to send or receive sensitive information, this information could be intercepted by the attacker.” This seems like a dumb way to exploit an http downgrade attack. Far better, would be to redirect the user to a fake looking https site and collect the user data there. As with many such attacks, a password manager can help mitigate or WebAuthN. Though I am not sure how that would play with Tor and the privacy guarantees users are looking for.
Lindalee51 4y ago
macrolime 4y ago
I've tried to use Tor, but it seems the majority of of websites will just straight out block you if you do, so it doesn't seem of much use.
krasi0 4y ago
Perhaps, if we encourage more people to use privacy preserving tools like Tor browser, signal, etc., then privacy for everyone will be normalized again. One can only hope
basedrum 4y ago
Somehow I knew if I looked at these comments, I'd see the top poster be something like "I know someone, who knows someone, who heard from someone else that this one time in bandcamp..."

379 points by soheilpro 4y ago

I'm surprised that they haven't bundled Arti, their Rust-based tor client implementation. I will say I am thankful for Tor Browser, but any JavaScript-enabled browser seems like the wrong choice for privacy and security.

ravenstine 4y ago
I've basically come to the same conclusion having attempted to use a lot of Tor Browser's default config in Firefox. Most of it is a good idea, but trying to be untrackable while JavaScript is turned on seems futile. Every single browser's APIs are leaky as hell. No matter how many things are turned off or obfuscated, there's always a few unique-ish details that are exposed that create a fingerprint. There was one point where my anti-fingerprinting tactics did appear to fool Panopticlick, but that apparently didn't last long. Fingerprinting and anti-fingerprinting are a cat and mouse game, and much worse so than just ad-blocking because there's more at stake than just being annoyed by banners. There's also way too many websites doing everything, and I mean everything with JS. Fricking blog sites half the time display nothing more than a motionless loading spinner if you don't have JS turned on. And if you turn JS on well good luck because lots of things want to use <canvas> to render things that don't even strictly need it, and you're really not going to casually enable canvas for certain things? Even the list of fonts is a decent metric for fingerprinting, yet that's rarely taken seriously because even privacy experts seem to believe that every website needs to display its own fonts for "brand identity." Though I would stay away from Tor anyway, if I were to use it, JS would have to be turned off entirely.
- rodric 4y ago
  My default browser is Librewolf with JavaScript turned off. If a page fails to load correctly, I reopen it in Firefox private browsing mode (or, if it still fails, Chrome incognito mode). If it’s a site I expect to come back to in future, I bookmark it in Firefox and assign it its own container using the Multi-Account Containers extension.
bawolff 4y ago
Security is always a compromise between competing concerns. A browser that cannot browse a significant chunk of the internet doesn't get used and helps nobody.
Aisen8010 4y ago
I installed the Tor Browser to access the Z Library a few days ago. I guess I shouldn't complain, but the downloads are very slow (I'm not sure if the problem is in my end).
- Synaesthesia 4y ago
  In general connecting over Tor or I2p is slow.
- edgyquant 4y ago
  Tor works by proxying through (at least) 3 PCs before hitting the open web. The problem is that you’re trying to download big files which is not a use case for tor. It’s specifically for browsing the web anonymously.
  - ehPReth 4y ago
    Was it always 7? I seem to remember it being like 3-4?
    - super256 4y ago
      https://i.imgur.com/h1vlxNh.png https://i.imgur.com/h1vlxNh.png
    - makerofspoons 4y ago
      Connecting to hidden services it's 6 hops, reaching out to the internet it's 3 hops.
    - bauruine 4y ago
      For a circuit to clearnet it's 3. Guard --> Middle --> Exit. For a onion service it's 6 and the connection is a bit more complicated [0]. The speed varies from very fast to unbearable depending on your circuit and how bad the ddos is at that moment. [1] You can try to create a new and hopefully faster circuit by clicking on the onion symbol on the left in the address bar. [0] https://github.com/mikeperry-tor/vanguards/blob/master/README_TECHNICAL.md#onion-service-overview https://github.com/mikeperry-tor/vanguards/blob/master/READM... [1] https://status.torproject.org/issues/2022-06-09-network-ddos/ https://status.torproject.org/issues/2022-06-09-network-ddos...
capableweb 4y ago
1) Arti is basically a prototype at this point, including it already would be reckless, 2) Arti is a client for the Tor protocol, and including it in the browser wouldn't have any impact if JavaScript ships enabled/disabled by default in Tor Browser, 3) if you really want to, you can easily change the "Security Level" in Tor Browser to disable JavaScript for all websites by default. As an alternative for the last point, turn the Security Level to "Safest" or however it's worded, then use the included NoScript addon to enable it for just sites that just won't work without JavaScript. You get functional web + JS disabled in most places where you can.
nibbleshifter 4y ago
Arti isn't ready for production use yet. Its a long ways away from being usable in TBB or as a full drop in for tor itself. I think in a years time that will change.
dinosaurdynasty 4y ago
Arti doesn't even support hidden services yet.

deadfromtor 4y ago

Just FYI that HN is very anti-tor. I made this account via Tor just now to prove the point. It will be dead by default (unless someone "vouches" for it). It's a very user-hostile stance that HN takes (along with not letting you delete your account). It really makes you wonder what they're doing with all this data? Doxxing is almost a given.

alexb_ 4y ago
Or they realize that letting Tor users makes spam explode.
ehPReth 4y ago
most sites seem to treat Tor poorly, possibly due to abuse. well-used VPNs also can suffer from Google captchas etc. not that I like that fact, but it seems to be inescapable
amideadfromtor 4y ago
Different poster here. This account and post were done over Tor. Let's see if this holds. EDIT: Yup; dead on arrival.
- torified 4y ago
  Not dead.
sterlind 4y ago
it's more likely they do this to combat spamming. accounts created by Tor are more likely to be used for spam than for legitimate discussion, since Tor evades IP reputation. I'm sure you could email @dang and ask to be un-shadow-banned, and he would do so.
- jbm 4y ago
  Wouldn't emailing @dang be against the purpose of Tor, which is to enhance privacy?

optimalsolver 4y ago

The inescapable fact about Tor is that its traffic patterns make you stand out prominently. Just the fact you’re using it automatically makes you interesting and worthy of a closer look. All well and good if you’re just maintaining a cookie recipe site on the dark web, but it’s rarely ever that, is it?

acapybara 4y ago
Maybe this could be a good thing for business development? Could we convert our "observers" into early customers?
deleted 4y ago
[deleted]
pr337h4m 4y ago
The Brave browser has around 60 million MAUs and has Tor bundled with it, so Tor traffic is unlikely to stand out as much as before.
- thekyle 4y ago
  I believe the Tor feature of Brave is an optional setting, so I assume only a small fraction of their MAU use it.
  - Gigachad 4y ago
    It’s not a setting, it’s like their version of an incognito tab. You can right click a link to “open in tor”
    - Mistletoe 4y ago
      Wow this is really cool. I need to look into Brave again.
    - dhaavi 4y ago
      Afaik, it does not use Tor from within the browser, but uses a proxy server into Tor. That could have changed though.

mothsonasloth 4y ago

sasattack 4y ago
Could we maybe not on this website use the term glowie considering it's explicitly sourced from a neo nazi and a phrase involving the n word. seems like maybe not real in line with HN rules....
- mothsonasloth 4y ago
  It originated from Terry Davis the creator of TempleOS, but okay I get your point.
  - sasattack 4y ago
    True I miss remembered the details. but it has been so amplified by neo nazis that wikitionary sources them as popularizing it .
  - user764743 4y ago
    /pol/ popularized it through him since they were big fans
- orthecreedence 4y ago
  I thought glowie was a term used to describe undercover FBI/CIA agents. It's in frequent use in leftist (communist/anarchist, not liberal democrat) forums. Is there actual substance behind this claim of its origins or is it yet another tired attempt to rewrite language for no particular reason?
  - DoItToMe81 4y ago
    [dead]
- throwaway0x7E6 4y ago
  nice try, glowie

agilob 4y ago

So I guess Mozilla isn't working on unforking tor browser?

chungy 4y ago
It's pretty much already happened. Tor Browser is little more than stock Firefox with some of the settings changed.
- HackerNCoder 4y ago
- webmobdev 4y ago
  There's also a bug report (not fixed for a long time - https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/40788 https://gitlab.torproject.org/tpo/applications/tor-browser/-... ) that the Tor Browser also phones some Mozilla / Firefox every time it starts and there is no option to disable it.
Gigachad 4y ago
They are probably not satisfied that Tor doesn’t have a deplatforming mechanism.
- goatcode 4y ago
  I'm glad this knowledge and discussion is still alive and well. F them for this.
- orthecreedence 4y ago
  Can you elaborate on this? I think I'm missing some context.
  - Gigachad 4y ago
    Based on their blog post where they want more deplatforming capabilities https://blog.mozilla.org/en/mozilla/we-need-more-than-deplatforming/ https://blog.mozilla.org/en/mozilla/we-need-more-than-deplat... There was also a comment from one of the Tor foundation members about how they wish they were able to deplatform kiwi farms from tor but it’s technically not possible.

autoexec 4y ago

Regardless of the issues with TOR itself, or the areas where I disagree with Tor Browser's approach, I love the project anyway because they're great about identifying and tracking all the things Firefox does that could put our privacy at risk. Having more eyes on Firefox update after update is wonderful and I've been incorporating many of their setting changes for years. I hope they can keep doing what they do for a long time!

goombacloud 4y ago

It's sad to see that Apple Silicon gets extra treatment and arm64 work suddenly gets done while for Linux it's still amd64-only. With Signal it's the same and they also don't offer arm64 builds. Nowadays it's very easy to build for arm64 - you either go the way with cross compilation or you go the way with full qemu binary emulation which is as simple as it gets because you would build within an arm64 docker image, e.g., docker.io/arm64v8/alpine or docker.io/arm64v8/ubuntu and qemu-static handles the emulation (it will be slower than cross compilation but as long as speed is acceptable you can go this easy way).

data_maan 4y ago

All comments here focus on extreme cases: The police viewing you as a possible suspect, FBI becoming interested in you etc. Here is a much more mundane problem: Using Tor (even a VPN) while logging in to most big Silicon Valley firma that make money with your data (LinkedIn, Facebook, Tinder etc.) will result in your profile being suspended REAL FAST with the only way out to upload your gov't ID, i.e. complete deanonimization (perhaps as a kind of punishment). Any solutions?

New_California 4y ago
I struggle with the very same problem. Even connecting a real physical SIM won't protect accounts from suspension. This is crazy because it isn't based on behavior on the platform (like posting too much or liking too much) but merely on the IP and browser fingerprint. Unfortunately, no solutions in sight.
- torified 4y ago
  The solution is simple. Don't use a site that abuses your privacy.
ipaddr 4y ago
Stop using those services. This is a clear message that you cannot use them privately.
- data_maan 4y ago
  C'mon, for a forum of hackers that's a pretty lame answer, isn't it? :P
  - matheusmoreira 4y ago
    People from a forum of hackers should be above depending on Big Tech corporations for anything. Easier said than done but it should still be the general goal.
easrng 4y ago

data_maan 4y ago

I once spoke with someone who knew someone who ran an exit node in Europe. He told crazy stories with police knocking every once in a while. Also the legal structure to do that was tricky, because you want to avoid the police searching your house; you'd also like tl spread responsability on multiple shoulders. So you have to create a kind of non-profit organization and run the exit node through that. It's very hard work and we should be thankful for the people who do it. Does anybody know more about how exit nodes are being run?

robert_foss 4y ago
I ran one in my student housing wardrobe a decade or so ago. I too have some stories, but no one ever met up with me in the flesh.
- jason-phillips 4y ago
  Come on then, no need to be coy.
  - robert_foss 4y ago
    For example, once or twice people called me (somehow) and asked why I was hacking their websites. I tried to explain, but I doubt I convinced anyone.
    - chinabot 4y ago
      How would a non government entity get a physical address or phone number from an IP ?
      - Ralo 4y ago
        Social engineering can be very powerful. Small ISPs could fall victim to this easier.
    - Nathanba 4y ago

privatecloud 4y ago

How much do you believe what this book (by Yasha Levine, writer for Wired, New York Observer, etc) states — that Tor is funded by the CIA and has backdoors? https://www.amazon.com/Surveillance-Valley-Military-History-Internet/dp/1610398025 https://www.amazon.com/Surveillance-Valley-Military-History-...

humanistbot 4y ago
It is 100% false that Tor was funded by the CIA. However, it is a very well documented fact that Tor was initially funded by the US Naval Research Laboratory, which also has a mandate for international intelligence gathering. Get your organizations right.
HackerNCoder 4y ago
It's very... problematic. And Yasha clearly displays a lack of knowledge (or is knowingly lying) by making the claim that the Tor Project is tipping of the US government to vulnerabilities. Here is why: https://blog.erratasec.com/2018/03/askrob-does-tor-let-government-peek-at.html#.Y5Go9ffLfbY https://blog.erratasec.com/2018/03/askrob-does-tor-let-gover... Some more Yasha stuff: https://micahflee.com/2014/12/fact-checking-pandos-smears-against-tor/ https://micahflee.com/2014/12/fact-checking-pandos-smears-ag...

ec109685 4y ago

“ In May 2020 we found a group of Tor exit relays that were messing with exit traffic. Specifically, they left almost all exit traffic alone, and they intercepted connections to a small number of cryptocurrency exchange websites. If a user visited the HTTP version (i.e. the unencrypted, unauthenticated version) of one of these sites, they would prevent the site from redirecting the user to the HTTPS version (i.e. the encrypted, authenticated version) of the site. If the user didn't notice that they hadn't ended up on the HTTPS version of the site (no lock icon in the browser) and proceeded to send or receive sensitive information, this information could be intercepted by the attacker.” This seems like a dumb way to exploit an http downgrade attack. Far better, would be to redirect the user to a fake looking https site and collect the user data there. As with many such attacks, a password manager can help mitigate or WebAuthN. Though I am not sure how that would play with Tor and the privacy guarantees users are looking for.

Lindalee51 4y ago

macrolime 4y ago

I've tried to use Tor, but it seems the majority of of websites will just straight out block you if you do, so it doesn't seem of much use.

krasi0 4y ago

Perhaps, if we encourage more people to use privacy preserving tools like Tor browser, signal, etc., then privacy for everyone will be normalized again. One can only hope

basedrum 4y ago

Somehow I knew if I looked at these comments, I'd see the top poster be something like "I know someone, who knows someone, who heard from someone else that this one time in bandcamp..."