18 ms·

Tor’s shadowy reputation will only end if we all use it

341 points by mikece 3y ago

jfengel 3y ago
Sure. But why? Right now it has a shadowy reputation because the only people who require that feature are criminals. A few of those are committing crimes against unjust laws, but they are badly outnumbered by widely-disapproved-of behavior. The anonymity comes with a cost. Tracking makes for a smoother web experience for most people. So it's a hard sell to say, "Hey, you should do this thing that makes your life harder, in order to help disguise criminals". There's good reason to think that ordinary people should take better care of their privacy, even if they don't realize it, but I don't think that they're itching to apply a technology that has a "shadowy reputation" for a reason.
- netbioserror 3y ago
  If everything is cost-benefit right down to atoms and energy, damn any principles, then what's the point? I'd rather take a stand for my privacy than make my life inconsequentially easier by assisting yet another questionable online service with tracking info. I highly doubt that info is as ubiquitously necessary as is asserted.
- soco 3y ago
  Can you please explain how is tracking making a smoother web experience for me? I mean really, what context am I missing here, that I can't grasp your statement?
  - throwawaysleep 3y ago
    Allows the web to not cost you any money and for you not to have to pull out your credit card constantly.
    - jfengel 3y ago
      Also not having to constantly perform CAPTCHAs. A lot of web sites are happy to provide service for free, but don't want it bombarded with bots. They can record you to ascertain that you behave like a human, at a cost to privacy. Faced with privacy-preserving tools like TOR, they revert to inconveniences like CAPTCHA.
- jamal-kumar 3y ago
  Because what qualifies you as a criminal in one country qualifies you as a normal person just doing their thing in another, is that so hard to fathom? Most of us don't live in authoritarian regimes where something as silly as saying the king looks like an idiot is a crime
  - shrimp_emoji 3y ago
    You can go to jail for insulting the Italian prime minister! And, in some (West!) European countries, even for insulting other countries' heads of state: https://www.politico.eu/article/european-countries-where-insulting-head-of-state-can-land-prison-belgium-denmark-france-germany/ https://www.politico.eu/article/european-countries-where-ins... Also, deities: https://en.m.wikipedia.org/wiki/Blasphemy_law https://en.m.wikipedia.org/wiki/Blasphemy_law
    - jamal-kumar 3y ago
      And more specifically for royalty or heads of state: https://en.wikipedia.org/wiki/L%C3%A8se-majest%C3%A9 https://en.wikipedia.org/wiki/L%C3%A8se-majest%C3%A9
  - zirgs 3y ago
    Shit like CSAM is illegal pretty much everywhere though.
- pkoird 3y ago
  I would rather have an untracked janky web experience. I think you should think it through before speaking for others.
- MattPalmer1086 3y ago
  Not just criminals, also the intelligence community and people who are really into privacy.
- pjc50 3y ago
  I agree that most people don't care, but "Tracking makes for a smoother web experience for most people" is just nonsense - tracking slows down almost every single web page that uses it!
jbirer 3y ago
The internet has become progressively worse with the invention of smartphones and lowering the barrier of access for the common people, I would not like to see the same happen to Tor. If the long winded forum discussions and info sharing turns into Facebook tier posting I'll become depressed.
- veave 3y ago
  Are there any forums with "long-winded discussions" that exist in Tor only, other than kiwifarms?
  - swapfile 3y ago
    Yes.
- RajT88 3y ago
  If you have forums that haven't been raided by trolls and idiots, it's because they have a good moderation system in place. That includes being selective about who you allow to have an account.
- tenebrisalietum 3y ago
  A long time ago ... I recall certain sites and services (like a MUD I tried to join) would not allow you to make an account if you were from AOL. I forget if it was just by email address or if they actually checked the IP address. Would love a reputation service that correlates IPs and/or email addresses to the amount time users spend on Facebook. I'm sure this data is out there and purchaseable, to be honest.
pkoird 3y ago
People who are generally ambivalent on TOR are the ones that we need to convert. I believe the message needs to be that anonymity is not only desirable but mandatory as well, especially because of the rise of platforms that literally track each and every possible metric about your daily life and habits. Besides, even if someone says that TOR is used for illegal purposes, we all need to remind them that legality is distinct from morality and is always defined by those currently in power.
- mikece 3y ago
  "Tor is only used for illegal purposes" is as valid as saying "only criminals use cash so they can buy things without a digital trail." I pay cash -- and refuse to use affinity/shopper cards because I would rather pay for my privacy which is worth more to me than 4 cents/gallon off on gasoline.
  - deleted 3y ago
    [deleted]
  - pixelpoet 3y ago
    Cash is still king in Germany, and it always weirds tourists out. Personally I think it's great, and just like you do much of my shopping in cash because I don't want my bank knowing everything about my diet etc.
    - solarkraft 3y ago
      Every time I think about leaving Germany I think about some small things we have that are really nice. That said ... paying electronically is so convenient, damn it.
    - throwaway290 3y ago
      The opposite here, whenever I encounter a cashless-only shop it really weirds me out. Like, legal tender anyone?? (haven't been to Germany)
rashkov 3y ago
I was pleasantly surprised to find Tor mode in Brave browser. I was looking for private browsing mode and it was right there. It was pretty darn fast and usable too. I honestly hope this feature and browser get more uptake
- pawelduda 3y ago
  Brave has loads of good features Chrome doesn't but people are put off by it because "muh crypto integration", which can be disabled permanently in settings.
  - deleted 3y ago
    [deleted]
  - shrimp_emoji 3y ago
    Yeah, to me it seems like a skeevy browser for people without the IQ to use Firefox with good add-ons like uBlock Origin and not be put off by crypto integration.
    - intelVISA 3y ago
      FF is pretty crap these days (as a lifelong FF fanboy). I'd hesitate to use it except for HN where its low speed and security are part of the experience.
      - mplewis 3y ago
        Firefox outperforms Chrome on web benchmarks, and it leaks less of your personal info to Google.
        Sohcahtoa82 3y ago
        [citation needed] Chrome feels a lot faster than Firefox to me (Especially on Facebook!), yet I still use Firefox to resist Google's stranglehold on the web.
fimmy 3y ago
it's slow as a wet week
NoZebra120vClip 3y ago
For what? What would I use it for? Practically everything I do on the web involves authentication and a login and an identity. They're all US-based services. It's stuff that I use to manage my household, and finances. It's also social media stuff; some of it's pseudonymous, but I've got Facebook too. These services factor in security hints such as device fingerprinting, and a consistent local IP address that belongs to an ISP account I pay for. That's as safe as it gets in this modern digital jungle. I also use Chrome. I don't use Firefox. Don't try to get me using Firefox; it's incompatible with my workflow. I don't even have it installed to debug website errors. I also own a Chromebook and I do a lot on the Chromebook. 100% of my employment relies on it, and 20% of my personal use is there, too. TOR isn't compatible with ChromeOS (prove me wrong.) The #1 error of TOR users is that they eventually reveal themselves online, by authenticating to some service, or by going to haunt specific websites or URLs they like. This is similar to people in Witness Protection or abuse victims who run away: they eventually contact family or friends and reveal personal details, and then they're re-victimized. Sorry TOR, you're not for me.
- ipaddr 3y ago
  https://www.google.com/amp/s/beebom.com/how-install-tor-browser-chromebook/amp/ https://www.google.com/amp/s/beebom.com/how-install-tor-brow... If you reveal yourself by logging today none of your other sessions from yesterday or tomorrow will be revealed or connected.
- andrewfurey2003 3y ago
  Pls dont use chrome, theyre pushing drm on the internet
- rightbyte 3y ago
  > TOR isn't compatible with ChromeOS (prove me wrong.) It seems futile to use Tor when the OS itself is made by a notorious spyware vendor. But there are Tor browsers for Android that should work.
  - NoZebra120vClip 3y ago
    > notorious spyware vendor So, like, Windows 10?
RajT88 3y ago
I think more people would become interested in Tor if they could see everything advertisers know about you. I have yet to find something which lets you get a good peek at that data. Does anyone know of anything?
- mtlmtlmtlmtl 3y ago
  If you live in a GDPR jurisdiction, Facebook has a way for you to look at everything they have on you(and delete it). I had a look when I went in there a few years ago to disable all their collection and they basically know every website you go to.
  - RajT88 3y ago
    I am off facebook. I think they are not the bulk of the problem anyways. You can see something similar with your Google ads profile, but only if you have personalized ads on. (I am sure they still have the profile on you, you just can't view it)
- ramesh31 3y ago
  >I have yet to find something which lets you get a good peek at that data. Does anyone know of anything? You don't need Tor to avoid advertisers. Blocking all cookies and browsing in private mode will get you 99% of the way there. Throw in an ad-blocking VPN and there's basically nothing anyone can know about you that you aren't explicitly sharing.
  - somenameforme 3y ago
    This is not really true, because of how centralized the web is. From Google fonts to jquery and the million in between endpoints, most sites you visit are going to be reporting you to Google. Logging into a single identity verifying site or even just viewing a distinct set of sites can all work as instant deanonymizers. A VPN that has multiple users using the same IP simultaneously can help on this front, but I don't know how common this is? Basically emulating how Tor exit nodes work. Though even that is also almost certainly possible to break.
bell-cot 3y ago
Reaction: Sounds nice...but the author seems oblivious to the motivations and technical skill levels of >95% of web users. And to TOR's (in)ability to grow its infrastructure, to support anything resembling the traffic that would result from anything resembling a "we all use it" scenario.
- matricaria 3y ago
  What technical skills are needed to browse with Tor that are not needed in any other browser?
  - bell-cot 3y ago
    Well, if Tor isn't the pre-installed default browser on Joe User's new computer or smart phone, then...
    - matricaria 3y ago
      Neither are Chrome and Firefox, everyone manages to install those to.
_fat_santa 3y ago
I haven't used TOR recently but from my memory one of the biggest issues with is was speed. Yes you get anonymity but websites also load 2-3x slower because they have to go through all the nodes on the network. The people that care about privacy at the expense of speed already use TOR, and for everyone else it's going to be a very hard sell.
- teddyh 3y ago
  In my experience Tor has not been slow for years now.
  - nebulous1 3y ago
    Tor is faster than it used to be but this person is not wrong. 2-3x slower is a conservative estimate.
    - causi 3y ago
      Yeah I was going to say, if Tor is only 3x slower I'm switching right now. Last time I used it it was on the order of 20x slower.
      - flagrant_taco 3y ago
        I think it's heavily dependant on the site you're using. Loading this page in Firefox on android with a pretty crappy connection took ~2 seconds. In the Tor browser it was ~6seconds Definitely slower and this is a pretty minimal page, but I've got a hunch it really starts to choke when a page is loading a ton of different css/js assets at load
      - metalforever 3y ago
        No its not this slow . You can basically use to to web browse normally , even on heavy js pages.
        holmesworcester 3y ago
Name_Chawps 3y ago
Why use slow internet when fast internet do trick?
- tenebrisalietum 3y ago
  Road A: Takes 2 minutes, chance of getting robbed is 80% Road B: Takes 2 hours, chance of getting robbed is 2%.
  - woodruffw 3y ago
    What’s the robbery in this analogy? From a liability perspective, using Tor is strictly more risky than routing over the ordinary Internet.
    - timbit42 3y ago
      Identity.
  - Sohcahtoa82 3y ago
    I've been on the Internet for 25 years and only got robbed once, and even then, the credit card charges were reversed so it didn't cost me anything other than the annoyance of updating some accounts once I got my new credit card number.
apples_oranges 3y ago
It won’t if we can’t even be bothered to delete cookies or use private mode in our normal browsers.
userforcomment 3y ago
Try visiting this from incognito and clearing cache/cookies: https://fingerprint.com https://fingerprint.com. This can't be legal, right?
- izzdrasil 3y ago
  This is the "workaround" now that websites aren't given free range access to your cookie jar. They make a unique identifier out of a range of info like OS, browser, screen size, whatever seemingly harmless info they can get.
  - DANmode 3y ago
    Fonts you have installed, what certs or APIs you have enabled in your browser, someone else can continue with their favorites..
- MayeulC 3y ago
  Sounds like it should be illegal. That said, changing my User Agent to IE+Win7 changed the identifier for me. Looks like Firefox's "resist fingerprinting" setting also works. I wish there was a separare setting for private browsing. That said, that was enlightening, thank you for pointing this out. It's disgusting that there are companies selling this.
- monetus 3y ago
  > Permanent identifier Consistent visitor ID over months or years, even as browsers are upgraded. This advertisement implies some things that could potentially be illegal, but I don't think that practice is by itself. Stalking as a service really gives Saas a new meaning .
- drc500free 3y ago
  https://amiunique.org/fingerprint https://amiunique.org/fingerprint gives some insight into what is used for fingerprinting, if you want to randomize your profile. This one overestimates uniqueness because it doesn't consider stability (e.g. it uses your current battery charge level as a uniqueness measure, which is obviously not stable minute-to-minute let alone day-to-day).
izzdrasil 3y ago
I like the idea of Tor but I don't like the idea of federal governments running nodes and snooping.
- northrup 3y ago
  This right here… when the government can just run exit nodes and case after case comes out about the government capturing data from a tor node they operated, that problem needs solved first.
zirgs 3y ago
I would love to help a dissident to bypass internet filters, but I don't want to get anywhere near illegal stuff.
- PheonixPharts 3y ago
  > but I don't want to get anywhere near illegal stuff. Then you should probably stop using the web altogether. I'm seriously confused how using Tor places you closer to "illegal stuff" then browsing as you do? Could you clarify? Even if we're going to draw the distinction between .onion sites and the plain web (and there's nothing about Tor that requires you to visit or interact with .onion sites) I'm nearly certain that there are many orders of magnitude more "illegal stuff" being shared on traditional websites than the "dark web". Plenty of drugs are purchased through Venmo, and Tumblr and Twitter have had pretty high incidents of child exploitation materials being shared on there (and, despite having been a heavy user of those sites at some point, never came across any content close to that). My experience has been that, barring 4chan 10 years ago, it is extremely rare that you'll ever come across any "illegal stuff" unless you are looking for it.
  - zirgs 3y ago
    I was talking about running an exit node. In an ideal world everyone could run an exit node and help others to bypass censorship. Unfortunately sooner or later some sick fuck would abuse it to post CSAM or hack something. And then good luck explaining the cops that it wasn't you.
- JimDabell 3y ago
  Helping a dissident bypass Internet filters is illegal stuff.
  - zirgs 3y ago
    In their country not mine. Meanwhile shit like CSAM distribution is illegal everywhere.
causi 3y ago
I very rarely use Tor because using Tor without being an exit node just slows it down for everyone else using it and running an exit node means CSAM passing through your router sooner or later which I find unacceptable. Most of my privacy needs are met by a commercial VPN.
- amiga386 3y ago
  Here's a novel thought: take the money you give to the commercial VPN provider and donate it to Tor instead. They can spend it on running more exit nodes themselves, which fixes both the issues you say you have with it.
  - causi 3y ago
    It would make up for it, but not fix it. The network would still be faster without my traffic. Plus, torrenting hundreds of gigabytes of data over Tor would be rather abusive.
    - amiga386 3y ago
      In that case, donate them money and don't use it? I'm not sure how this private VPN you're using is any better - it too would be faster without your traffic. They spend your money on the same thing the Tor project could spend it on. We agree it would be a very bad fit to use the torrent protocol over Tor, a seedbox would be better for your purposes.
      - causi 3y ago
        The Tor Project is a non-profit and the Tor service is used not just by criminals but people under repressive regimes around the world, and there are no real alternatives to it. My VPN provider is a for-profit company and its users are free to choose another company. a seedbox would be better for your purposes. A seedbox would suit my torrenting needs but it doesn't fulfil the additional roles of bypassing video stream throttling on my mobile network or letting my overseas friends bypass network censorship.
Renaud 3y ago
Are there any app that uses the Tor network and existing hidden protocols to provide anonymous chat? This could be an alternative to some of the instant messaging systems that provide privacy but not anonymity. I know that some chat messaging systems can use Tor as the transport, but they have problems of their own. What I'm thinking about is something along the lines that each user app hosts a hidden service that receives messages through a standard HTTP API. Users need to hand their hidden service address to friends. The protocol itself already handles payload encryption and routing but messages could be further encrypted at the app level before being sent (using the other user's public key once an initial exchange has been done). Granted, sending a message would require all parties to be online at the same time, but there could be a set of relay servers to hold messages until they get fetched. I'm sure there are lots of hairy issues to take into account, but I would expect the existing protocol to mitigate some of these compared to a ground-up approach (like Session is doing). Tor is fairly mature and, despite all attacks on its infrastructure and protocol, it is still standing. I'm also wondering if such a messaging system couldn't be useful for some IoT types of scenarios, as it would protect the location and communication of the source of the data, so the devices could not be easily physically found and hacked. None of this would be useful for high-bandwidth real-time data, but you can get reasonable latencies and traffic sent this way. Maybe it's all just a dumb idea...
- mikece 3y ago
  There is Session which combines TOR message routing with a message encryption scheme which is inspired by Signal. Is that what you mean?
- dabber21 3y ago
  there was a project https://blog.torproject.org/tor-messenger-beta-chat-over-tor-easily/ https://blog.torproject.org/tor-messenger-beta-chat-over-tor... but I don't know what the status is, quick google searches make it seem abandoned
  - holmesworcester 3y ago
    Yeah. Also there's Ricochet and its continuation Ricochet Refresh, but these only do 1:1 messaging AFAIK.[1][2] Ricochet was a big inspiration for my project Quiet.[3] Cwtch also deserves a mention, though it depends on ephemeral servers and isn't fully p2p. Briar is another and frequently comes up on HN. [4][5] 1. https://en.wikipedia.org/wiki/Ricochet_(software) https://en.wikipedia.org/wiki/Ricochet_(software) 2. https://www.ricochetrefresh.net/ https://www.ricochetrefresh.net/ 3. https://tryquiet.org/ https://tryquiet.org/ 4. https://cwtch.im/ https://cwtch.im/ 5. https://briarproject.org/ https://briarproject.org/
a_vanderbilt 3y ago
I use Tor occasionally to see what's going on in the flip side of the net and to contribute to routing, but honestly you aren't going to convince anyone who isn't ideologically inclined to support it. It doesn't help that Tor itself is full of scams and dark markets selling who knows what. It seems to have gotten better over the years, but normal people aren't going to put up with that. Nobody wants to see that stuff.
- throwaway290 3y ago
  If you use a Tor browser you see the same web as with your "normal" browser. You'd need to actively search for dark web and shady markets (and no you can't just google that up either, you'd need to lurk much deeper). It's not possible, never was, to "accidentally" see that stuff if you use web the way you did it before Tor.
  - networkchad 3y ago
    [dead]
  - WallyFunk 3y ago
    Yes. I don't get ambushed by illegal content, as most of my surfing with Tor is for browsing the clearnet, (which is fairly innocuous and more sanitized than the dark web). I do use the 'real world' onions[0] to read The New York Times, etc [0] https://github.com/alecmuffett/real-world-onion-sites https://github.com/alecmuffett/real-world-onion-sites
- swapfile 3y ago
  >Tor itself is full of scams and dark markets selling who knows what. Did you forget to read the article? They make the point that this is not the case. Tor Browser can be used to access most of the web besides aggressively anti-privacy platforms like Meta. If you choose to go on a "Dark Web Search Engine" and that's what you find, that's entirely your decision and not something you would stumble upon. >but normal people aren't going to put up with that. Nobody wants to see that stuff. They would never see that stuff by accident, as they never do right now.
nebulous1 3y ago
Does anybody use Tor for everything? I'd be interested in hearing their experience if so. There are sites that I have been unable to get working in tor, usually due to the browser. Some services actively block it. There's also a performance hit. Also, while you should always assume your traffic is open to inspection/modification before it reaches its destination, this is more likely to happen with tor, not less likely. The Tor browser does help here, by not easily allowing obvious mistakes like using http.
- swapfile 3y ago
  I use Tor for everything that doesn't require identification, and I use very few of those services. For example, this HN account and the email for it have never been used without connecting through Tor. Feel free to ask me anything. >There are sites that I have been unable to get working This happens, most of the time because of Cloudflare. A solution is to get a new Tor circuit 3-5 times, and then the page will load. If a site simply won't work, like Meta platforms I won't use them. Using alternative front-ends[1] makes most sites that usually wouldn't work, work as well. >The Tor browser does help here, by not easily allowing obvious mistakes like using http. This is false, HTTPS only is enabled by default in Tor Browser. It's common knowledge for everyone including users of Google Chrome and Firefox to not use HTTP sites. [1]: https://github.com/mendel5/alternative-front-ends https://github.com/mendel5/alternative-front-ends
  - nebulous1 3y ago
    Thanks. > This is false, HTTPS only is enabled by default in Tor Browser I think you misread me. I said the Tor browser does help here.
    - swapfile 3y ago
      >I think you misread me. I said the Tor browser does help here. My bad, you're right! That shows my bias when it comes to this topic, way too much FUD.
- fruitreunion1 3y ago
yankput 3y ago
If we all use it, it will slow to a crawl. Even more than now. Nobody that’s not halfway suicidal is running exit nodes on their home machines (I won’t, I don’t want police knocking on my door). And just for the onionspace… yeah I saw some bad stuff there. After what I saw I don’t think anonymity is a good idea. There is darkness inside people that lack of rules, lack of order, lack of accountability brings out.
- aredox 3y ago
  And in the end it can't circumvent stuff like the great firewall of China. In the end Toe is just a legacy project from the CIA/NSA that has outlived it's usefulness. The NSA has certainly redteamed all the ways to take it down or uncloak users, if needs be, so it's not even a tool against a potential fall into dictatorship of the USA.
  - holmesworcester 3y ago
    > And in the end it can't circumvent stuff like the great firewall of China. Actually, this isn't true: Tor with private Snowflake bridges can be very effective against the Great Firewall. I'm an activist who works in this area and I've spoken with activists who were using it as recently as this year. The issue is scaling bridge discovery, since any automated bridge discovery mechanism rapidly exposes available bridges to a determined censor. But any team doing high profile, notable, or sensitive work can find an individual or organization outside China to provide them with private bridges. So Tor is one effective option now for key activists in China, just not a mass-scale solution for everyone.
    - solanav 3y ago
      is it better than something like shadowsocks?
      - cosentiyes 3y ago
        for anonymity, yes (if using a "private" snowflake). for daily use or basic firewall circumvention, not really. as others have mentioned, it is more convenient and faster to just use shadowsocks to a digital ocean droplet or other vm.
634636346 3y ago
I wouldn't be surprised if the author, and a large segment of HNers agreeing with her, did a swift about-face when they realized that Tor also provides an end-run around the internet backbone black-holing of IPs that some Tier 1 ISPs did to KiwiFarms last year, during the height of the campaign to deplatform it. More people using Tor in general means more people having the means and know-how to evade censorship, and we can't have that, can we?
- somehnguy 3y ago
  I don't think anyone would be surprised - what you're describing is pretty obvious to anyone who has ever looked into Tor for more than .1 seconds. It's also pretty well understood that when restrictions can be evaded it will be used for both good & bad purposes, that's just the nature of it.
- tekla 3y ago
  We want privacy for everyone, except for the people we don't like.
  - Sohcahtoa82 3y ago
    Describing KiwiFarms as "people we don't like" is dishonest. The people on KiwiFarms are actively harmful and engage in illegal harassment activities. https://en.wikipedia.org/wiki/Kiwi_Farms#Harassment https://en.wikipedia.org/wiki/Kiwi_Farms#Harassment
    - tekla 3y ago
      Ok fine. Everyone deserves privacy except those people
    - wikimarfer 3y ago
      That accusation has been repeatedly debunked. Also, on a more positive note, amongst all the gossiping and somewhat rude behaviour, they've documented a significant amount of illegal activity by others. In particular, how certain individuals of gender have been grooming children and committing sex crimes - which is why these creeps tried so hard to take Kiwifarms offline. And ultimately failed, as it's still up and running, even on the clearnet.
captainbland 3y ago
To be honest despite agreeing with many arguments around privacy, they're not quite compelling enough to convince me to adopt Tor's approach to it which in my mind is akin to hiding in a bin. Sure, you're hidden, but you're also in with a lot of stuff you don't want to be in with and that can come with legal liabilities and ethical issues that I don't feel qualified to mitigate. And as other people have pointed out maybe the government or your least favourite company actually has a camera in the bin you chose to hide in.
- holmesworcester 3y ago
  A common misconception about Tor is that by using Tor as an end user you are also hosting and relaying stuff on the Tor network for other users. This is not the case, unless you explicitly set up a relay node or volunteer to run a Snowflake bridge. True, you're mixed in with other users from the point of view of websites that might treat you as spam, say. But you aren't taking on any liability unless you run an exit node, and even that is fairly well-established as safe in at least some jurisdictions.
  - vorticalbox 3y ago
    Snowflake as far as I am aware only helps people connect to tor, it doesn't route any traffic after that point.
  - captainbland 3y ago
    I think even as a user, the risk then is that law enforcement agencies want to unmask/correlate users which leads to the possibility of them screwing that up and conflating people's identities. Arguably this is more of an issue with trust in those performing/acting on the analysis but on an individual level still factors into the "do I want to use tor?" mental model.
    - twosdai 3y ago
      Couldn't you make the same argument about https requests over the clear net? You're request is being processed by intermediaries through your isp which three letter agencies could incorrectly correlate with you. I know there are deep fundamental technical differences, but I could see an outcome where the end result is the same across both services. I'm not trying to justify to use tor as well, just that I don't think the argument of guilt through incorrect association is solved by not using tor.
m3kw9 3y ago
Pita to use and slow af
superkuh 3y ago
Tor doesn't want people using it for building normal communities. Their treatment of tor v2 and the wiping away of all those links, indices, and sites shows this. Yes, 1 year of warning that all of .onion domains were going away was given, thanks The Tor Project. But why bother building a community on an onion domain when they're only treated as temporary and transient identifiers by the tor project? No, I tried building normal websites and community on tor for 10 years. Then the tor porject wiped it out for potential future security. They will always prioritize the needs of the people who really need privacy over us. And that's fine. But I will not make the mistake of building on tor again.
- holmesworcester 3y ago
  According to Tor Project, v2 onion services were "fundamentally insecure" [1]. It sucks that you lost your URL, but wasn't redirection an option? Tor definitely has a commitment to people building communities using hidden services, but they also have a commitment to your community members' expectations of security, no? 1. https://support.torproject.org/onionservices/v2-deprecation/ https://support.torproject.org/onionservices/v2-deprecation/
  - superkuh 3y ago
    You can't redirect clients that cannot even parse your domain name. I can't update the links in all the indices and search engines built the last decade. I can't change the links to my .onion site on other people's sites. No, most .onion domains just went away, poof, inaccessible and sit unvisited while the remaining tor v2 infrastructure goes unused because the tor project clients dropped support. There's more to a web than any single site. And that web of interconnected links was destroyed with no recourse. As for fundementally insecure, yeah, in a few years maybe by spending $10k you could brute force a hash and take over a domain. So they killed it entirely to protect the people that need absolute privacy and security. They could've left v2 alongside v3 and let people choose but the tor project considers that too risky for their prized use case. Those of us just using tor for owning our own domains were not important in comparison. That "not being important" will continue. Shadowy users are what tor cares about. Not open communities. Tor is great for pseudo-privacy. It is not great for people wanting to make normal sites on it.
AlbertCory 3y ago
"Tor’s shadowy reputation will only end when normies become human shields for the truly bad people." Fixed it. No, using Tor is equivalent to holding up a sign to the spooks "Hey, over here! Look at me!"
jacobsenscott 3y ago
I've tried tor a few times, but unless you enjoy solving captchas as a hobby it is only worth using when you actually need some anonymity.
- swapfile 3y ago
  >unless you enjoy solving captchas as a hobby it is only worth using when you actually need some anonymity. Use services that respect your freedom. Hacker News works just fine using Tor Browser. ;)
rambojohnson 3y ago
oh no, let's save all these shadowy technologies by using them. why? lol
- timbit42 3y ago
  Some people don't like their government and corporations knowing everything about them.
lll-o-lll 3y ago
Tor is not what I want. Humans are, by and large, not equipped to handle anonymity while maintaining ethical behavior. We thrive in accountable communities. Even with pseudo-anonymity, there’s still a karma or reputation to think of! I will feel bad as this post gets modded down. I think all communication and activity should be anonymous to companies, somewhat visible to your inner circle, and able to be exposed to authorities only when they have something akin to a warrant. That sounds hard to achieve in practice, but Tor is not the answer to any of it.
- samsin 3y ago
  Tor is surely the answer to having your activity be anonymous to companies, how else would you achieve that?
  - lll-o-lll 3y ago
    How do you interact with companies while maintaining anonymity? How to I buy something online? What stops companies from using various fingerprinting techniques to continue to track me online? Does Tor stop JavaScript running client side?
    - hellojesus 3y ago
      You can turn Javascript off just like in normal Firefox.
      - lll-o-lll 3y ago
        > You can turn Javascript off just like in normal Firefox. So you agree that Tor is not the answer to preventing corporate invasion of privacy. As I said, Tor isn’t the answer to any of the true challenges. Balancing accountability and privacy. Allowing law enforcement to be effective. Preventing large corporations from abusing tracking. Those things do actually matter, but they aren’t technical problems inherently, they’re people problems. Technology comes into the mix as part of the solution, but Tor does not factor.
alkonaut 3y ago
And we’ll only use it if it comes at nearly zero cost in performance and convenience. It’s as simple as that.
Imnimo 3y ago
>victims of domestic violence looking for resources without their abuser finding out or I don't really understand the threat model that would make Tor helpful here.
- nohankyou 3y ago
  Associated advertising by source IP address. Happens all the time, I see ads pop up on my wife's computer that are definitely meant for me, and based on searches she would never think of.
bratgpttamer 3y ago
I can't decide if it would be easier to convince people of the benefit of extra steps/slow internet/privacy protections, or to reflexively engage their skepticism/critical thinking muscles upon hearing Save-The-Children-and-Stop-The-Terrorists rhetoric. As it stands, it seems most people (of a certain race and class, anyway) feel more threatened by vague stories of child abductors in white vans at WalMart[1,2] or terrorists (c. 2000's generally) than being randomly victimized by our j̶u̶s̶t̶i̶c̶e̶ legal system. Nothing to hide, nothing to fear, as they say. Abstract thought and generalization are hard, I guess. [1] https://www.cnn.com/2019/12/04/tech/facebook-white-vans/index.html https://www.cnn.com/2019/12/04/tech/facebook-white-vans/inde... [2] https://www.snopes.com/fact-check/white-van-facebook-hoax/ https://www.snopes.com/fact-check/white-van-facebook-hoax/
- comfypotato 3y ago
  I got out of academic fingerprinting research when I realized I was on the wrong side of the discussion. I’ve just never seen or heard of privacy violations that particularly bothered me.
  - maxbond 3y ago
    I too have never experienced a violation of privacy which had a significant observable impact on my life. You and I have been fortunate in this respect. Some people are literally targeted for harassment and murder because of some aspect of their identity, journalism, or activism. This isn't a hypothetical. Here's one example from the top of my head: https://www.independent.co.uk/news/world/middle-east/khashoggi-murder-citizen-lab-surveillance-internet-watchdog-experts-spies-toronto-a8747886.html https://www.independent.co.uk/news/world/middle-east/khashog... Tl;Dr the dissident Khashoggi was infected with NSO malware before he was murdered by the Saudi government. That's a pretty clear violation of privacy in service of something I would guess you disagree with. This story isn't an anomaly, I think if you looked into this further you would find innumerable privacy violations which bother you.
    - sebzim4500 3y ago
deleted 3y ago
[deleted]
anthk 3y ago
With i2pd you can set up Web, IRC, Mail and NNTP proxies against retroBBS and chat with people at acceptable speeds. Also, to talk on actual daily lives beyond propaganada with Ukrainians and Russians. Ironically, anonimity here stops terror and helps innocent people. Any terror.
xkcd-sucks 3y ago
By running a Tor node, one helps dissidents / spy assets in Russia get information / communicate with handlers in Ukraine, USA, etc. -- Which is the reason for Tor's existence in the first place. If one is into supporting that kind of thing of course, but defense of Ukraine seems pretty popular in the US
- dathos 3y ago
  Pft, 100% this was developed by a three letter agency in the US.
  - pphysch 3y ago
    It's not even a secret, look at the Tor Project's funding sources (public tax record). State Dept & DoD were their primary funders last time I checked. Hypothetically, if the USG wanted to produce "official" backdoored TOR clients (e.g. only served as prebuilt downloads to IPs geolocated in Iran, etc to make detection difficult), they are in an excellent position to influence that work. And as the story of Julian Assange makes clear, that should concern anyone who purports to care about privacy, human rights, etc.
  - DANmode 3y ago
    Lazy comment - Navy has 4 letters.
neilv 3y ago
As an exercise, I've been using Tor Browser as a daily driver on my personal laptop, and ended up with a 3-browsers approach: * Firefox ESR -- For sites that are necessarily linked to my identity, such as HN and shopping. Sometimes this also gets sites that don't have to be linked to me, such as if I'm too lazy to copy&paste a link from HN into Tor Browser. (Keyboard switching/starting: Mod+F) * Tor Browser -- Almost everything else. This is the bulk of my traffic, and innocuous, not "he just switched to Tor Browser, so must be doing something interesting". (Keyboard switching/starting: Mod+W) * Chromium -- This is my total subjugation browser, used when more-private&secure options fail for something I really need/want to access. No ad blockers, but some awful DRM enabled. Current used only for one obnoxious video streaming service. I would like to get rid of this browser entirely. (Keyboard starting intentionally discouraging: Mod+P C H R O M Enter) My vintage laptop can handle all 3 at once, just fine. Though I usually make them short-lived -- to reduce clutter, free compute resources, and clear trackers. That's the personal laptop. My work laptops will partition browser use differently, such as for whatever the current Web development needs, and keeping all-day corporate SaaSes (e.g., GitLab, and mandated Web apps) open in one browser, while making another browser for short-lived public Web browsing sessions. There's also a place for Tor Browser on the work laptop, for public browsing about topics that you don't want to hypothetically leak to competitors, but some companies will flip out if they detect Tor on the corporate network.
deleted 3y ago
[deleted]
batch12 3y ago
I run a service that scans and documents hidden services. I've actively contributed to the security of the Tor ecosystem by reporting vulnerabilities that would result in de-anonymization. I can say with pretty good authority that most hidden services are deserving of the 'shadowy' label. I agree that the only way to change this is to have other non-shadowy services and uses, but it's a hard sell. How do you convince a company to intentionally stand up an onion site that provides any real value? You lose the ability to apply some defensive controls to thwart attack, you're associating your brand with something identified as 'shadowy', and most customers won't use Tor or even understand what an onion site is. If a company is unwilling to justify the effort or take the chance on standing up a hidden service, why would they be willing to take a similar risk of abuse by allowing traffic sourced from the Tor network?
- hellojesus 3y ago
  How do you perform scans of onion urls? Two things for me come to mind: 1. Follow published links with a crawler 2. Host an exit node and observe where traffic goes
  - batch12 3y ago
    Well, exit nodes aren't used for hidden services. I either discover them from when people give them to me when searching the site, http referrers, a crawler, or through other means of disclosure.
    - hellojesus 3y ago
      Good point on the exit nodes. Forgot those were only for clearnet. Thanks!
substation13 3y ago
I'm not convinced Tor could scale to a significant percentage of internet traffic using it.
tasbir49 3y ago
Adoption is gonna be difficult. Many users don't care that much about privacy in general. So getting them to change their habits is a tall order. Furthermore, a lot of sites see TOR as suspicious and make the effort to block it/put them through captcha hell. I don't see a critical mass of users dropping convenience for the sake of something they don't really care about anytime soon.
- webmobdev 3y ago
  There is a cultural factor also - Tor, like most American BigTech, tries to sell us the idea of "trust the network" over any government as "governments cannot be trusted". Yes, governments cannot be trusted but what is worse is if we lose faith in democracy and give in to the idea that some corporate overlord or a foreign network will do a better job of protecting our rights. It's a ridiculous idea that only Americans seem to buy, while the rest of the world are actually enforcing the protections of their rights through democratic means (demanding regulations and legislation). Personally for me it is about the traffic that may be routed through my computer by the Tor network - I definitely do not want child porn, drugs or terrorist related site transactions packets to even touch my computer. It maybe a rare occurrence, but I want certainty. If we could control the traffic that is allowed on our network / computer, I'd be a more willing user of Tor. (A use case example would be to allow a Tor user to create a white list of onion sites from which they would be willing to accept traffic).
  - tasbir49 3y ago
    I agree. The certainty is reassuring. I also would never want my computer to touch even the most remotely objectionable material. I've contemplated running a Lemmy instance before, but the concerns you've brought forth are the main contributing factors in my decision to not do so. Not only that, but TOR is something that becomes more private the more someone uses it. Iirc it's really easy to distinguish TOR packets from regular packets. Combine that with how few people use TOR, you're job of narrowing down who's abusing it becomes much easier. Finally, just running an exit node opens one up to many legal liabilities. It's not something that's worth the effort, but it's strength comes from many people running one.
tech_ken 3y ago
I don’t think any typical internet user would accept Tor’s latency. User behavior has indicated again and again that convenience and frictionless-ness is the overriding priority for the majority. I appreciate the work done by the Tor community, but I also think we need to be realistic about what the threat model is and what viable solutions are on the table: * If you’re concerned about the MAANGs of the world hoovering data for targeted adverts I think you’d get far more traction with aggressive privacy legislation and brutal oversight, or (and I recognize this is extreme) straight nationalization of some of their products with a mandate to operate them in the public interest like PBS or the Beeb * If you’re concerned about an authoritarian state actor Tor was pwned years ago. TBH I think trying to win against ex. US TLAs in straight cryptography or protocol supremacy is kind of a fools errand (you’re ultimately going to get clobbered purely on the resource differential) and that the best bet is security through obscurity. Just my 2c, maybe overly fatalistic so curious about counter views
- cma 3y ago
  If everyone used it wouldn't latency go down (more nearby nodes), or is it that for privacy via timing attacks they don't preference nearby nodes and/or they add artificial delays?
  - tech_ken 3y ago
    That’s a good question, tbh I have no idea. Yeah presumably if the user base increased then the number of nodes would also grow, but definitely unclear to me what level of latency (if any) is required for privacy
  - r3trohack3r 3y ago
    I might misunderstand how Tor works, but unless you are a relay I don’t think you participate in routing. Unlike BitTorrent, clients don’t automatically contribute resources back to the network.
    - stavros 3y ago
      ~~My (perhaps mistaken) understanding is that all nodes relay, but not all nodes are exit nodes.~~ EDIT: They do not.
anigbrowl 3y ago
Just as with political philosophies like anarchism or communism, if your Great Idea depends on everybody else adopting it to be successful, then it's going to fail.
- timbit42 3y ago
  So like Facebook. Oh. Wait...
WallyFunk 3y ago
> the more people that use it, the more secure it gets, according to Patil. If only certain sensitive groups use it, it’ll be easier to deanonymize and ultimately track down identities. Tor gained a lot of popularity after the Snowden revelations. We would need several Snowden-like leaks over the coming years to ramp Tor usage up substantially. And then there's no way of knowing how Tor would scale to support a new influx of users, year-on-year. But I agree with Patil, the more people that use it, the better. If we could just shake the stigma that Tor = crimeware then that would be great.
_8j50 3y ago
I recommend against using Tor, simply because of exit node hostility and targeted intrusions when you use Tor. Intel agencies also run the majority of relays last I heard of this subject. Perhaps if exit node operators were publicly listed and vetted humans and most relay's owners volunteered who they are and validate that with the project, I could trust it more. IMHO, financial incentives for relay and exit operators is the best way to make sure more people without ulterior motives participate.
r3trohack3r 3y ago
I believe Tor is underrated in P2P systems. Many networks consider NAT traversal mostly (or partially) unsolved. Routing between nodes over Tor immediately solves your NAT traversal problems allowing any device to tunnel to any device (at the expense of latency).
- fruitreunion1 3y ago
  i2p is an alternative with its main focus on hidden services rather than outproxying to the regular net, that seems to be somewhat used with torrents.
lallysingh 3y ago
Lets not forget personal services! You can setup sshd on a box behind NAT as a hidden service. It'll disconnect more than you like but screen or tmux can help with that.
Fatnino 3y ago
I was using tor the other day and my phone battery went below 10% triggering power saving mode. My fault, I should have had my phone charged before. When the phone went into power saving mode, tor closed and lost my place. And since it doesn't keep local browsing history, I was back to square one.
omgmajk 3y ago
Wait, I'm confused. Not all people use Tor? Honestly though, Tor is not the solution for a lot of people. If you're just going for good enough there are other alternatives, if you're already under heat from a big enough actor you are screwed whatever you use. We need a new solution.
null4bl3 3y ago
I have had a plan on my list for years now, to write a medium for IoT devices, that would route all traffic through TOR as a layer of security, while it would also help the TOR network with a lot of fuzzing traffic.
lossolo 3y ago
Please don't. If now suddenly everyone would use TOR then we would get something a lot worse than Google's Web Environment Integrity, let me explain why. As someone being on the other side of things (running different services for years) thank god that all users are not using TOR. 99% of all attacks, spam, password brute forcing etc came from TOR on many services I worked on throughout the years. Eliminating that traffic or adding additional checks and hops for traffic from TOR solves a lot of issues for many services.

341 points by mikece 3y ago

Sure. But why? Right now it has a shadowy reputation because the only people who require that feature are criminals. A few of those are committing crimes against unjust laws, but they are badly outnumbered by widely-disapproved-of behavior. The anonymity comes with a cost. Tracking makes for a smoother web experience for most people. So it's a hard sell to say, "Hey, you should do this thing that makes your life harder, in order to help disguise criminals". There's good reason to think that ordinary people should take better care of their privacy, even if they don't realize it, but I don't think that they're itching to apply a technology that has a "shadowy reputation" for a reason.

netbioserror 3y ago
If everything is cost-benefit right down to atoms and energy, damn any principles, then what's the point? I'd rather take a stand for my privacy than make my life inconsequentially easier by assisting yet another questionable online service with tracking info. I highly doubt that info is as ubiquitously necessary as is asserted.
soco 3y ago
Can you please explain how is tracking making a smoother web experience for me? I mean really, what context am I missing here, that I can't grasp your statement?
- throwawaysleep 3y ago
  Allows the web to not cost you any money and for you not to have to pull out your credit card constantly.
  - jfengel 3y ago
    Also not having to constantly perform CAPTCHAs. A lot of web sites are happy to provide service for free, but don't want it bombarded with bots. They can record you to ascertain that you behave like a human, at a cost to privacy. Faced with privacy-preserving tools like TOR, they revert to inconveniences like CAPTCHA.
jamal-kumar 3y ago
Because what qualifies you as a criminal in one country qualifies you as a normal person just doing their thing in another, is that so hard to fathom? Most of us don't live in authoritarian regimes where something as silly as saying the king looks like an idiot is a crime
- shrimp_emoji 3y ago
  You can go to jail for insulting the Italian prime minister! And, in some (West!) European countries, even for insulting other countries' heads of state: https://www.politico.eu/article/european-countries-where-insulting-head-of-state-can-land-prison-belgium-denmark-france-germany/ https://www.politico.eu/article/european-countries-where-ins... Also, deities: https://en.m.wikipedia.org/wiki/Blasphemy_law https://en.m.wikipedia.org/wiki/Blasphemy_law
  - jamal-kumar 3y ago
    And more specifically for royalty or heads of state: https://en.wikipedia.org/wiki/L%C3%A8se-majest%C3%A9 https://en.wikipedia.org/wiki/L%C3%A8se-majest%C3%A9
- zirgs 3y ago
  Shit like CSAM is illegal pretty much everywhere though.
pkoird 3y ago
I would rather have an untracked janky web experience. I think you should think it through before speaking for others.
MattPalmer1086 3y ago
Not just criminals, also the intelligence community and people who are really into privacy.
pjc50 3y ago
I agree that most people don't care, but "Tracking makes for a smoother web experience for most people" is just nonsense - tracking slows down almost every single web page that uses it!

jbirer 3y ago

The internet has become progressively worse with the invention of smartphones and lowering the barrier of access for the common people, I would not like to see the same happen to Tor. If the long winded forum discussions and info sharing turns into Facebook tier posting I'll become depressed.

veave 3y ago
Are there any forums with "long-winded discussions" that exist in Tor only, other than kiwifarms?
- swapfile 3y ago
  Yes.
RajT88 3y ago
If you have forums that haven't been raided by trolls and idiots, it's because they have a good moderation system in place. That includes being selective about who you allow to have an account.
tenebrisalietum 3y ago
A long time ago ... I recall certain sites and services (like a MUD I tried to join) would not allow you to make an account if you were from AOL. I forget if it was just by email address or if they actually checked the IP address. Would love a reputation service that correlates IPs and/or email addresses to the amount time users spend on Facebook. I'm sure this data is out there and purchaseable, to be honest.

pkoird 3y ago

People who are generally ambivalent on TOR are the ones that we need to convert. I believe the message needs to be that anonymity is not only desirable but mandatory as well, especially because of the rise of platforms that literally track each and every possible metric about your daily life and habits. Besides, even if someone says that TOR is used for illegal purposes, we all need to remind them that legality is distinct from morality and is always defined by those currently in power.

mikece 3y ago
"Tor is only used for illegal purposes" is as valid as saying "only criminals use cash so they can buy things without a digital trail." I pay cash -- and refuse to use affinity/shopper cards because I would rather pay for my privacy which is worth more to me than 4 cents/gallon off on gasoline.
- deleted 3y ago
  [deleted]
- pixelpoet 3y ago
  Cash is still king in Germany, and it always weirds tourists out. Personally I think it's great, and just like you do much of my shopping in cash because I don't want my bank knowing everything about my diet etc.
  - solarkraft 3y ago
    Every time I think about leaving Germany I think about some small things we have that are really nice. That said ... paying electronically is so convenient, damn it.
  - throwaway290 3y ago
    The opposite here, whenever I encounter a cashless-only shop it really weirds me out. Like, legal tender anyone?? (haven't been to Germany)

rashkov 3y ago

I was pleasantly surprised to find Tor mode in Brave browser. I was looking for private browsing mode and it was right there. It was pretty darn fast and usable too. I honestly hope this feature and browser get more uptake

pawelduda 3y ago
Brave has loads of good features Chrome doesn't but people are put off by it because "muh crypto integration", which can be disabled permanently in settings.
- deleted 3y ago
  [deleted]
- shrimp_emoji 3y ago
  Yeah, to me it seems like a skeevy browser for people without the IQ to use Firefox with good add-ons like uBlock Origin and not be put off by crypto integration.
  - intelVISA 3y ago
    FF is pretty crap these days (as a lifelong FF fanboy). I'd hesitate to use it except for HN where its low speed and security are part of the experience.
    - mplewis 3y ago
      Firefox outperforms Chrome on web benchmarks, and it leaks less of your personal info to Google.
      - Sohcahtoa82 3y ago
        [citation needed] Chrome feels a lot faster than Firefox to me (Especially on Facebook!), yet I still use Firefox to resist Google's stranglehold on the web.

fimmy 3y ago

it's slow as a wet week

NoZebra120vClip 3y ago

For what? What would I use it for? Practically everything I do on the web involves authentication and a login and an identity. They're all US-based services. It's stuff that I use to manage my household, and finances. It's also social media stuff; some of it's pseudonymous, but I've got Facebook too. These services factor in security hints such as device fingerprinting, and a consistent local IP address that belongs to an ISP account I pay for. That's as safe as it gets in this modern digital jungle. I also use Chrome. I don't use Firefox. Don't try to get me using Firefox; it's incompatible with my workflow. I don't even have it installed to debug website errors. I also own a Chromebook and I do a lot on the Chromebook. 100% of my employment relies on it, and 20% of my personal use is there, too. TOR isn't compatible with ChromeOS (prove me wrong.) The #1 error of TOR users is that they eventually reveal themselves online, by authenticating to some service, or by going to haunt specific websites or URLs they like. This is similar to people in Witness Protection or abuse victims who run away: they eventually contact family or friends and reveal personal details, and then they're re-victimized. Sorry TOR, you're not for me.

ipaddr 3y ago
https://www.google.com/amp/s/beebom.com/how-install-tor-browser-chromebook/amp/ https://www.google.com/amp/s/beebom.com/how-install-tor-brow... If you reveal yourself by logging today none of your other sessions from yesterday or tomorrow will be revealed or connected.
andrewfurey2003 3y ago
Pls dont use chrome, theyre pushing drm on the internet
rightbyte 3y ago
> TOR isn't compatible with ChromeOS (prove me wrong.) It seems futile to use Tor when the OS itself is made by a notorious spyware vendor. But there are Tor browsers for Android that should work.
- NoZebra120vClip 3y ago
  > notorious spyware vendor So, like, Windows 10?

RajT88 3y ago

I think more people would become interested in Tor if they could see everything advertisers know about you. I have yet to find something which lets you get a good peek at that data. Does anyone know of anything?

mtlmtlmtlmtl 3y ago
If you live in a GDPR jurisdiction, Facebook has a way for you to look at everything they have on you(and delete it). I had a look when I went in there a few years ago to disable all their collection and they basically know every website you go to.
- RajT88 3y ago
  I am off facebook. I think they are not the bulk of the problem anyways. You can see something similar with your Google ads profile, but only if you have personalized ads on. (I am sure they still have the profile on you, you just can't view it)
ramesh31 3y ago
>I have yet to find something which lets you get a good peek at that data. Does anyone know of anything? You don't need Tor to avoid advertisers. Blocking all cookies and browsing in private mode will get you 99% of the way there. Throw in an ad-blocking VPN and there's basically nothing anyone can know about you that you aren't explicitly sharing.
- somenameforme 3y ago
  This is not really true, because of how centralized the web is. From Google fonts to jquery and the million in between endpoints, most sites you visit are going to be reporting you to Google. Logging into a single identity verifying site or even just viewing a distinct set of sites can all work as instant deanonymizers. A VPN that has multiple users using the same IP simultaneously can help on this front, but I don't know how common this is? Basically emulating how Tor exit nodes work. Though even that is also almost certainly possible to break.

bell-cot 3y ago

Reaction: Sounds nice...but the author seems oblivious to the motivations and technical skill levels of >95% of web users. And to TOR's (in)ability to grow its infrastructure, to support anything resembling the traffic that would result from anything resembling a "we all use it" scenario.

matricaria 3y ago
What technical skills are needed to browse with Tor that are not needed in any other browser?
- bell-cot 3y ago
  Well, if Tor isn't the pre-installed default browser on Joe User's new computer or smart phone, then...
  - matricaria 3y ago
    Neither are Chrome and Firefox, everyone manages to install those to.

_fat_santa 3y ago

I haven't used TOR recently but from my memory one of the biggest issues with is was speed. Yes you get anonymity but websites also load 2-3x slower because they have to go through all the nodes on the network. The people that care about privacy at the expense of speed already use TOR, and for everyone else it's going to be a very hard sell.

teddyh 3y ago
In my experience Tor has not been slow for years now.
- nebulous1 3y ago
  Tor is faster than it used to be but this person is not wrong. 2-3x slower is a conservative estimate.
  - causi 3y ago
    Yeah I was going to say, if Tor is only 3x slower I'm switching right now. Last time I used it it was on the order of 20x slower.
    - flagrant_taco 3y ago
      I think it's heavily dependant on the site you're using. Loading this page in Firefox on android with a pretty crappy connection took ~2 seconds. In the Tor browser it was ~6seconds Definitely slower and this is a pretty minimal page, but I've got a hunch it really starts to choke when a page is loading a ton of different css/js assets at load
    - metalforever 3y ago
      No its not this slow . You can basically use to to web browse normally , even on heavy js pages.
      - holmesworcester 3y ago

Name_Chawps 3y ago

Why use slow internet when fast internet do trick?

tenebrisalietum 3y ago
Road A: Takes 2 minutes, chance of getting robbed is 80% Road B: Takes 2 hours, chance of getting robbed is 2%.
- woodruffw 3y ago
  What’s the robbery in this analogy? From a liability perspective, using Tor is strictly more risky than routing over the ordinary Internet.
  - timbit42 3y ago
    Identity.
- Sohcahtoa82 3y ago
  I've been on the Internet for 25 years and only got robbed once, and even then, the credit card charges were reversed so it didn't cost me anything other than the annoyance of updating some accounts once I got my new credit card number.

apples_oranges 3y ago

It won’t if we can’t even be bothered to delete cookies or use private mode in our normal browsers.

userforcomment 3y ago

Try visiting this from incognito and clearing cache/cookies: https://fingerprint.com https://fingerprint.com. This can't be legal, right?

izzdrasil 3y ago
This is the "workaround" now that websites aren't given free range access to your cookie jar. They make a unique identifier out of a range of info like OS, browser, screen size, whatever seemingly harmless info they can get.
- DANmode 3y ago
  Fonts you have installed, what certs or APIs you have enabled in your browser, someone else can continue with their favorites..
MayeulC 3y ago
Sounds like it should be illegal. That said, changing my User Agent to IE+Win7 changed the identifier for me. Looks like Firefox's "resist fingerprinting" setting also works. I wish there was a separare setting for private browsing. That said, that was enlightening, thank you for pointing this out. It's disgusting that there are companies selling this.
monetus 3y ago
> Permanent identifier Consistent visitor ID over months or years, even as browsers are upgraded. This advertisement implies some things that could potentially be illegal, but I don't think that practice is by itself. Stalking as a service really gives Saas a new meaning .
drc500free 3y ago
https://amiunique.org/fingerprint https://amiunique.org/fingerprint gives some insight into what is used for fingerprinting, if you want to randomize your profile. This one overestimates uniqueness because it doesn't consider stability (e.g. it uses your current battery charge level as a uniqueness measure, which is obviously not stable minute-to-minute let alone day-to-day).

izzdrasil 3y ago

I like the idea of Tor but I don't like the idea of federal governments running nodes and snooping.

northrup 3y ago
This right here… when the government can just run exit nodes and case after case comes out about the government capturing data from a tor node they operated, that problem needs solved first.

zirgs 3y ago

I would love to help a dissident to bypass internet filters, but I don't want to get anywhere near illegal stuff.

PheonixPharts 3y ago
> but I don't want to get anywhere near illegal stuff. Then you should probably stop using the web altogether. I'm seriously confused how using Tor places you closer to "illegal stuff" then browsing as you do? Could you clarify? Even if we're going to draw the distinction between .onion sites and the plain web (and there's nothing about Tor that requires you to visit or interact with .onion sites) I'm nearly certain that there are many orders of magnitude more "illegal stuff" being shared on traditional websites than the "dark web". Plenty of drugs are purchased through Venmo, and Tumblr and Twitter have had pretty high incidents of child exploitation materials being shared on there (and, despite having been a heavy user of those sites at some point, never came across any content close to that). My experience has been that, barring 4chan 10 years ago, it is extremely rare that you'll ever come across any "illegal stuff" unless you are looking for it.
- zirgs 3y ago
  I was talking about running an exit node. In an ideal world everyone could run an exit node and help others to bypass censorship. Unfortunately sooner or later some sick fuck would abuse it to post CSAM or hack something. And then good luck explaining the cops that it wasn't you.
JimDabell 3y ago
Helping a dissident bypass Internet filters is illegal stuff.
- zirgs 3y ago
  In their country not mine. Meanwhile shit like CSAM distribution is illegal everywhere.

causi 3y ago

I very rarely use Tor because using Tor without being an exit node just slows it down for everyone else using it and running an exit node means CSAM passing through your router sooner or later which I find unacceptable. Most of my privacy needs are met by a commercial VPN.

amiga386 3y ago
Here's a novel thought: take the money you give to the commercial VPN provider and donate it to Tor instead. They can spend it on running more exit nodes themselves, which fixes both the issues you say you have with it.
- causi 3y ago
  It would make up for it, but not fix it. The network would still be faster without my traffic. Plus, torrenting hundreds of gigabytes of data over Tor would be rather abusive.
  - amiga386 3y ago
    In that case, donate them money and don't use it? I'm not sure how this private VPN you're using is any better - it too would be faster without your traffic. They spend your money on the same thing the Tor project could spend it on. We agree it would be a very bad fit to use the torrent protocol over Tor, a seedbox would be better for your purposes.
    - causi 3y ago
      The Tor Project is a non-profit and the Tor service is used not just by criminals but people under repressive regimes around the world, and there are no real alternatives to it. My VPN provider is a for-profit company and its users are free to choose another company. a seedbox would be better for your purposes. A seedbox would suit my torrenting needs but it doesn't fulfil the additional roles of bypassing video stream throttling on my mobile network or letting my overseas friends bypass network censorship.

Renaud 3y ago

Are there any app that uses the Tor network and existing hidden protocols to provide anonymous chat? This could be an alternative to some of the instant messaging systems that provide privacy but not anonymity. I know that some chat messaging systems can use Tor as the transport, but they have problems of their own. What I'm thinking about is something along the lines that each user app hosts a hidden service that receives messages through a standard HTTP API. Users need to hand their hidden service address to friends. The protocol itself already handles payload encryption and routing but messages could be further encrypted at the app level before being sent (using the other user's public key once an initial exchange has been done). Granted, sending a message would require all parties to be online at the same time, but there could be a set of relay servers to hold messages until they get fetched. I'm sure there are lots of hairy issues to take into account, but I would expect the existing protocol to mitigate some of these compared to a ground-up approach (like Session is doing). Tor is fairly mature and, despite all attacks on its infrastructure and protocol, it is still standing. I'm also wondering if such a messaging system couldn't be useful for some IoT types of scenarios, as it would protect the location and communication of the source of the data, so the devices could not be easily physically found and hacked. None of this would be useful for high-bandwidth real-time data, but you can get reasonable latencies and traffic sent this way. Maybe it's all just a dumb idea...

mikece 3y ago
There is Session which combines TOR message routing with a message encryption scheme which is inspired by Signal. Is that what you mean?
dabber21 3y ago
there was a project https://blog.torproject.org/tor-messenger-beta-chat-over-tor-easily/ https://blog.torproject.org/tor-messenger-beta-chat-over-tor... but I don't know what the status is, quick google searches make it seem abandoned
- holmesworcester 3y ago
  Yeah. Also there's Ricochet and its continuation Ricochet Refresh, but these only do 1:1 messaging AFAIK.[1][2] Ricochet was a big inspiration for my project Quiet.[3] Cwtch also deserves a mention, though it depends on ephemeral servers and isn't fully p2p. Briar is another and frequently comes up on HN. [4][5] 1. https://en.wikipedia.org/wiki/Ricochet_(software) https://en.wikipedia.org/wiki/Ricochet_(software) 2. https://www.ricochetrefresh.net/ https://www.ricochetrefresh.net/ 3. https://tryquiet.org/ https://tryquiet.org/ 4. https://cwtch.im/ https://cwtch.im/ 5. https://briarproject.org/ https://briarproject.org/

a_vanderbilt 3y ago

I use Tor occasionally to see what's going on in the flip side of the net and to contribute to routing, but honestly you aren't going to convince anyone who isn't ideologically inclined to support it. It doesn't help that Tor itself is full of scams and dark markets selling who knows what. It seems to have gotten better over the years, but normal people aren't going to put up with that. Nobody wants to see that stuff.

throwaway290 3y ago
If you use a Tor browser you see the same web as with your "normal" browser. You'd need to actively search for dark web and shady markets (and no you can't just google that up either, you'd need to lurk much deeper). It's not possible, never was, to "accidentally" see that stuff if you use web the way you did it before Tor.
- networkchad 3y ago
  [dead]
- WallyFunk 3y ago
  Yes. I don't get ambushed by illegal content, as most of my surfing with Tor is for browsing the clearnet, (which is fairly innocuous and more sanitized than the dark web). I do use the 'real world' onions[0] to read The New York Times, etc [0] https://github.com/alecmuffett/real-world-onion-sites https://github.com/alecmuffett/real-world-onion-sites
swapfile 3y ago
>Tor itself is full of scams and dark markets selling who knows what. Did you forget to read the article? They make the point that this is not the case. Tor Browser can be used to access most of the web besides aggressively anti-privacy platforms like Meta. If you choose to go on a "Dark Web Search Engine" and that's what you find, that's entirely your decision and not something you would stumble upon. >but normal people aren't going to put up with that. Nobody wants to see that stuff. They would never see that stuff by accident, as they never do right now.

nebulous1 3y ago

Does anybody use Tor for everything? I'd be interested in hearing their experience if so. There are sites that I have been unable to get working in tor, usually due to the browser. Some services actively block it. There's also a performance hit. Also, while you should always assume your traffic is open to inspection/modification before it reaches its destination, this is more likely to happen with tor, not less likely. The Tor browser does help here, by not easily allowing obvious mistakes like using http.

swapfile 3y ago
I use Tor for everything that doesn't require identification, and I use very few of those services. For example, this HN account and the email for it have never been used without connecting through Tor. Feel free to ask me anything. >There are sites that I have been unable to get working This happens, most of the time because of Cloudflare. A solution is to get a new Tor circuit 3-5 times, and then the page will load. If a site simply won't work, like Meta platforms I won't use them. Using alternative front-ends[1] makes most sites that usually wouldn't work, work as well. >The Tor browser does help here, by not easily allowing obvious mistakes like using http. This is false, HTTPS only is enabled by default in Tor Browser. It's common knowledge for everyone including users of Google Chrome and Firefox to not use HTTP sites. [1]: https://github.com/mendel5/alternative-front-ends https://github.com/mendel5/alternative-front-ends
- nebulous1 3y ago
  Thanks. > This is false, HTTPS only is enabled by default in Tor Browser I think you misread me. I said the Tor browser does help here.
  - swapfile 3y ago
    >I think you misread me. I said the Tor browser does help here. My bad, you're right! That shows my bias when it comes to this topic, way too much FUD.
fruitreunion1 3y ago

yankput 3y ago

If we all use it, it will slow to a crawl. Even more than now. Nobody that’s not halfway suicidal is running exit nodes on their home machines (I won’t, I don’t want police knocking on my door). And just for the onionspace… yeah I saw some bad stuff there. After what I saw I don’t think anonymity is a good idea. There is darkness inside people that lack of rules, lack of order, lack of accountability brings out.

aredox 3y ago
And in the end it can't circumvent stuff like the great firewall of China. In the end Toe is just a legacy project from the CIA/NSA that has outlived it's usefulness. The NSA has certainly redteamed all the ways to take it down or uncloak users, if needs be, so it's not even a tool against a potential fall into dictatorship of the USA.
- holmesworcester 3y ago
  > And in the end it can't circumvent stuff like the great firewall of China. Actually, this isn't true: Tor with private Snowflake bridges can be very effective against the Great Firewall. I'm an activist who works in this area and I've spoken with activists who were using it as recently as this year. The issue is scaling bridge discovery, since any automated bridge discovery mechanism rapidly exposes available bridges to a determined censor. But any team doing high profile, notable, or sensitive work can find an individual or organization outside China to provide them with private bridges. So Tor is one effective option now for key activists in China, just not a mass-scale solution for everyone.
  - solanav 3y ago
    is it better than something like shadowsocks?
    - cosentiyes 3y ago
      for anonymity, yes (if using a "private" snowflake). for daily use or basic firewall circumvention, not really. as others have mentioned, it is more convenient and faster to just use shadowsocks to a digital ocean droplet or other vm.

634636346 3y ago

I wouldn't be surprised if the author, and a large segment of HNers agreeing with her, did a swift about-face when they realized that Tor also provides an end-run around the internet backbone black-holing of IPs that some Tier 1 ISPs did to KiwiFarms last year, during the height of the campaign to deplatform it. More people using Tor in general means more people having the means and know-how to evade censorship, and we can't have that, can we?

somehnguy 3y ago
I don't think anyone would be surprised - what you're describing is pretty obvious to anyone who has ever looked into Tor for more than .1 seconds. It's also pretty well understood that when restrictions can be evaded it will be used for both good & bad purposes, that's just the nature of it.
tekla 3y ago
We want privacy for everyone, except for the people we don't like.
- Sohcahtoa82 3y ago
  Describing KiwiFarms as "people we don't like" is dishonest. The people on KiwiFarms are actively harmful and engage in illegal harassment activities. https://en.wikipedia.org/wiki/Kiwi_Farms#Harassment https://en.wikipedia.org/wiki/Kiwi_Farms#Harassment
  - tekla 3y ago
    Ok fine. Everyone deserves privacy except those people
  - wikimarfer 3y ago
    That accusation has been repeatedly debunked. Also, on a more positive note, amongst all the gossiping and somewhat rude behaviour, they've documented a significant amount of illegal activity by others. In particular, how certain individuals of gender have been grooming children and committing sex crimes - which is why these creeps tried so hard to take Kiwifarms offline. And ultimately failed, as it's still up and running, even on the clearnet.

captainbland 3y ago

To be honest despite agreeing with many arguments around privacy, they're not quite compelling enough to convince me to adopt Tor's approach to it which in my mind is akin to hiding in a bin. Sure, you're hidden, but you're also in with a lot of stuff you don't want to be in with and that can come with legal liabilities and ethical issues that I don't feel qualified to mitigate. And as other people have pointed out maybe the government or your least favourite company actually has a camera in the bin you chose to hide in.

holmesworcester 3y ago
A common misconception about Tor is that by using Tor as an end user you are also hosting and relaying stuff on the Tor network for other users. This is not the case, unless you explicitly set up a relay node or volunteer to run a Snowflake bridge. True, you're mixed in with other users from the point of view of websites that might treat you as spam, say. But you aren't taking on any liability unless you run an exit node, and even that is fairly well-established as safe in at least some jurisdictions.
- vorticalbox 3y ago
  Snowflake as far as I am aware only helps people connect to tor, it doesn't route any traffic after that point.
- captainbland 3y ago
  I think even as a user, the risk then is that law enforcement agencies want to unmask/correlate users which leads to the possibility of them screwing that up and conflating people's identities. Arguably this is more of an issue with trust in those performing/acting on the analysis but on an individual level still factors into the "do I want to use tor?" mental model.
  - twosdai 3y ago
    Couldn't you make the same argument about https requests over the clear net? You're request is being processed by intermediaries through your isp which three letter agencies could incorrectly correlate with you. I know there are deep fundamental technical differences, but I could see an outcome where the end result is the same across both services. I'm not trying to justify to use tor as well, just that I don't think the argument of guilt through incorrect association is solved by not using tor.

m3kw9 3y ago

Pita to use and slow af

superkuh 3y ago

Tor doesn't want people using it for building normal communities. Their treatment of tor v2 and the wiping away of all those links, indices, and sites shows this. Yes, 1 year of warning that all of .onion domains were going away was given, thanks The Tor Project. But why bother building a community on an onion domain when they're only treated as temporary and transient identifiers by the tor project? No, I tried building normal websites and community on tor for 10 years. Then the tor porject wiped it out for potential future security. They will always prioritize the needs of the people who really need privacy over us. And that's fine. But I will not make the mistake of building on tor again.

holmesworcester 3y ago
According to Tor Project, v2 onion services were "fundamentally insecure" [1]. It sucks that you lost your URL, but wasn't redirection an option? Tor definitely has a commitment to people building communities using hidden services, but they also have a commitment to your community members' expectations of security, no? 1. https://support.torproject.org/onionservices/v2-deprecation/ https://support.torproject.org/onionservices/v2-deprecation/
- superkuh 3y ago
  You can't redirect clients that cannot even parse your domain name. I can't update the links in all the indices and search engines built the last decade. I can't change the links to my .onion site on other people's sites. No, most .onion domains just went away, poof, inaccessible and sit unvisited while the remaining tor v2 infrastructure goes unused because the tor project clients dropped support. There's more to a web than any single site. And that web of interconnected links was destroyed with no recourse. As for fundementally insecure, yeah, in a few years maybe by spending $10k you could brute force a hash and take over a domain. So they killed it entirely to protect the people that need absolute privacy and security. They could've left v2 alongside v3 and let people choose but the tor project considers that too risky for their prized use case. Those of us just using tor for owning our own domains were not important in comparison. That "not being important" will continue. Shadowy users are what tor cares about. Not open communities. Tor is great for pseudo-privacy. It is not great for people wanting to make normal sites on it.

AlbertCory 3y ago

"Tor’s shadowy reputation will only end when normies become human shields for the truly bad people." Fixed it. No, using Tor is equivalent to holding up a sign to the spooks "Hey, over here! Look at me!"

jacobsenscott 3y ago

I've tried tor a few times, but unless you enjoy solving captchas as a hobby it is only worth using when you actually need some anonymity.

swapfile 3y ago
>unless you enjoy solving captchas as a hobby it is only worth using when you actually need some anonymity. Use services that respect your freedom. Hacker News works just fine using Tor Browser. ;)

rambojohnson 3y ago

oh no, let's save all these shadowy technologies by using them. why? lol

timbit42 3y ago
Some people don't like their government and corporations knowing everything about them.

lll-o-lll 3y ago

Tor is not what I want. Humans are, by and large, not equipped to handle anonymity while maintaining ethical behavior. We thrive in accountable communities. Even with pseudo-anonymity, there’s still a karma or reputation to think of! I will feel bad as this post gets modded down. I think all communication and activity should be anonymous to companies, somewhat visible to your inner circle, and able to be exposed to authorities only when they have something akin to a warrant. That sounds hard to achieve in practice, but Tor is not the answer to any of it.

samsin 3y ago
Tor is surely the answer to having your activity be anonymous to companies, how else would you achieve that?
- lll-o-lll 3y ago
  How do you interact with companies while maintaining anonymity? How to I buy something online? What stops companies from using various fingerprinting techniques to continue to track me online? Does Tor stop JavaScript running client side?
  - hellojesus 3y ago
    You can turn Javascript off just like in normal Firefox.
    - lll-o-lll 3y ago
      > You can turn Javascript off just like in normal Firefox. So you agree that Tor is not the answer to preventing corporate invasion of privacy. As I said, Tor isn’t the answer to any of the true challenges. Balancing accountability and privacy. Allowing law enforcement to be effective. Preventing large corporations from abusing tracking. Those things do actually matter, but they aren’t technical problems inherently, they’re people problems. Technology comes into the mix as part of the solution, but Tor does not factor.

alkonaut 3y ago

And we’ll only use it if it comes at nearly zero cost in performance and convenience. It’s as simple as that.

Imnimo 3y ago

>victims of domestic violence looking for resources without their abuser finding out or I don't really understand the threat model that would make Tor helpful here.

nohankyou 3y ago
Associated advertising by source IP address. Happens all the time, I see ads pop up on my wife's computer that are definitely meant for me, and based on searches she would never think of.

bratgpttamer 3y ago

I can't decide if it would be easier to convince people of the benefit of extra steps/slow internet/privacy protections, or to reflexively engage their skepticism/critical thinking muscles upon hearing Save-The-Children-and-Stop-The-Terrorists rhetoric. As it stands, it seems most people (of a certain race and class, anyway) feel more threatened by vague stories of child abductors in white vans at WalMart[1,2] or terrorists (c. 2000's generally) than being randomly victimized by our j̶u̶s̶t̶i̶c̶e̶ legal system. Nothing to hide, nothing to fear, as they say. Abstract thought and generalization are hard, I guess. [1] https://www.cnn.com/2019/12/04/tech/facebook-white-vans/index.html https://www.cnn.com/2019/12/04/tech/facebook-white-vans/inde... [2] https://www.snopes.com/fact-check/white-van-facebook-hoax/ https://www.snopes.com/fact-check/white-van-facebook-hoax/

comfypotato 3y ago
I got out of academic fingerprinting research when I realized I was on the wrong side of the discussion. I’ve just never seen or heard of privacy violations that particularly bothered me.
- maxbond 3y ago
  I too have never experienced a violation of privacy which had a significant observable impact on my life. You and I have been fortunate in this respect. Some people are literally targeted for harassment and murder because of some aspect of their identity, journalism, or activism. This isn't a hypothetical. Here's one example from the top of my head: https://www.independent.co.uk/news/world/middle-east/khashoggi-murder-citizen-lab-surveillance-internet-watchdog-experts-spies-toronto-a8747886.html https://www.independent.co.uk/news/world/middle-east/khashog... Tl;Dr the dissident Khashoggi was infected with NSO malware before he was murdered by the Saudi government. That's a pretty clear violation of privacy in service of something I would guess you disagree with. This story isn't an anomaly, I think if you looked into this further you would find innumerable privacy violations which bother you.
  - sebzim4500 3y ago

deleted 3y ago

[deleted]

anthk 3y ago

With i2pd you can set up Web, IRC, Mail and NNTP proxies against retroBBS and chat with people at acceptable speeds. Also, to talk on actual daily lives beyond propaganada with Ukrainians and Russians. Ironically, anonimity here stops terror and helps innocent people. Any terror.

xkcd-sucks 3y ago

By running a Tor node, one helps dissidents / spy assets in Russia get information / communicate with handlers in Ukraine, USA, etc. -- Which is the reason for Tor's existence in the first place. If one is into supporting that kind of thing of course, but defense of Ukraine seems pretty popular in the US

dathos 3y ago
Pft, 100% this was developed by a three letter agency in the US.
- pphysch 3y ago
  It's not even a secret, look at the Tor Project's funding sources (public tax record). State Dept & DoD were their primary funders last time I checked. Hypothetically, if the USG wanted to produce "official" backdoored TOR clients (e.g. only served as prebuilt downloads to IPs geolocated in Iran, etc to make detection difficult), they are in an excellent position to influence that work. And as the story of Julian Assange makes clear, that should concern anyone who purports to care about privacy, human rights, etc.
- DANmode 3y ago
  Lazy comment - Navy has 4 letters.

neilv 3y ago

As an exercise, I've been using Tor Browser as a daily driver on my personal laptop, and ended up with a 3-browsers approach: * Firefox ESR -- For sites that are necessarily linked to my identity, such as HN and shopping. Sometimes this also gets sites that don't have to be linked to me, such as if I'm too lazy to copy&paste a link from HN into Tor Browser. (Keyboard switching/starting: Mod+F) * Tor Browser -- Almost everything else. This is the bulk of my traffic, and innocuous, not "he just switched to Tor Browser, so must be doing something interesting". (Keyboard switching/starting: Mod+W) * Chromium -- This is my total subjugation browser, used when more-private&secure options fail for something I really need/want to access. No ad blockers, but some awful DRM enabled. Current used only for one obnoxious video streaming service. I would like to get rid of this browser entirely. (Keyboard starting intentionally discouraging: Mod+P C H R O M Enter) My vintage laptop can handle all 3 at once, just fine. Though I usually make them short-lived -- to reduce clutter, free compute resources, and clear trackers. That's the personal laptop. My work laptops will partition browser use differently, such as for whatever the current Web development needs, and keeping all-day corporate SaaSes (e.g., GitLab, and mandated Web apps) open in one browser, while making another browser for short-lived public Web browsing sessions. There's also a place for Tor Browser on the work laptop, for public browsing about topics that you don't want to hypothetically leak to competitors, but some companies will flip out if they detect Tor on the corporate network.

deleted 3y ago

[deleted]

batch12 3y ago

I run a service that scans and documents hidden services. I've actively contributed to the security of the Tor ecosystem by reporting vulnerabilities that would result in de-anonymization. I can say with pretty good authority that most hidden services are deserving of the 'shadowy' label. I agree that the only way to change this is to have other non-shadowy services and uses, but it's a hard sell. How do you convince a company to intentionally stand up an onion site that provides any real value? You lose the ability to apply some defensive controls to thwart attack, you're associating your brand with something identified as 'shadowy', and most customers won't use Tor or even understand what an onion site is. If a company is unwilling to justify the effort or take the chance on standing up a hidden service, why would they be willing to take a similar risk of abuse by allowing traffic sourced from the Tor network?

hellojesus 3y ago
How do you perform scans of onion urls? Two things for me come to mind: 1. Follow published links with a crawler 2. Host an exit node and observe where traffic goes
- batch12 3y ago
  Well, exit nodes aren't used for hidden services. I either discover them from when people give them to me when searching the site, http referrers, a crawler, or through other means of disclosure.
  - hellojesus 3y ago
    Good point on the exit nodes. Forgot those were only for clearnet. Thanks!

substation13 3y ago

I'm not convinced Tor could scale to a significant percentage of internet traffic using it.

tasbir49 3y ago

Adoption is gonna be difficult. Many users don't care that much about privacy in general. So getting them to change their habits is a tall order. Furthermore, a lot of sites see TOR as suspicious and make the effort to block it/put them through captcha hell. I don't see a critical mass of users dropping convenience for the sake of something they don't really care about anytime soon.

webmobdev 3y ago
There is a cultural factor also - Tor, like most American BigTech, tries to sell us the idea of "trust the network" over any government as "governments cannot be trusted". Yes, governments cannot be trusted but what is worse is if we lose faith in democracy and give in to the idea that some corporate overlord or a foreign network will do a better job of protecting our rights. It's a ridiculous idea that only Americans seem to buy, while the rest of the world are actually enforcing the protections of their rights through democratic means (demanding regulations and legislation). Personally for me it is about the traffic that may be routed through my computer by the Tor network - I definitely do not want child porn, drugs or terrorist related site transactions packets to even touch my computer. It maybe a rare occurrence, but I want certainty. If we could control the traffic that is allowed on our network / computer, I'd be a more willing user of Tor. (A use case example would be to allow a Tor user to create a white list of onion sites from which they would be willing to accept traffic).
- tasbir49 3y ago
  I agree. The certainty is reassuring. I also would never want my computer to touch even the most remotely objectionable material. I've contemplated running a Lemmy instance before, but the concerns you've brought forth are the main contributing factors in my decision to not do so. Not only that, but TOR is something that becomes more private the more someone uses it. Iirc it's really easy to distinguish TOR packets from regular packets. Combine that with how few people use TOR, you're job of narrowing down who's abusing it becomes much easier. Finally, just running an exit node opens one up to many legal liabilities. It's not something that's worth the effort, but it's strength comes from many people running one.

tech_ken 3y ago

I don’t think any typical internet user would accept Tor’s latency. User behavior has indicated again and again that convenience and frictionless-ness is the overriding priority for the majority. I appreciate the work done by the Tor community, but I also think we need to be realistic about what the threat model is and what viable solutions are on the table: * If you’re concerned about the MAANGs of the world hoovering data for targeted adverts I think you’d get far more traction with aggressive privacy legislation and brutal oversight, or (and I recognize this is extreme) straight nationalization of some of their products with a mandate to operate them in the public interest like PBS or the Beeb * If you’re concerned about an authoritarian state actor Tor was pwned years ago. TBH I think trying to win against ex. US TLAs in straight cryptography or protocol supremacy is kind of a fools errand (you’re ultimately going to get clobbered purely on the resource differential) and that the best bet is security through obscurity. Just my 2c, maybe overly fatalistic so curious about counter views

cma 3y ago
If everyone used it wouldn't latency go down (more nearby nodes), or is it that for privacy via timing attacks they don't preference nearby nodes and/or they add artificial delays?
- tech_ken 3y ago
  That’s a good question, tbh I have no idea. Yeah presumably if the user base increased then the number of nodes would also grow, but definitely unclear to me what level of latency (if any) is required for privacy
- r3trohack3r 3y ago
  I might misunderstand how Tor works, but unless you are a relay I don’t think you participate in routing. Unlike BitTorrent, clients don’t automatically contribute resources back to the network.
  - stavros 3y ago
    ~~My (perhaps mistaken) understanding is that all nodes relay, but not all nodes are exit nodes.~~ EDIT: They do not.

anigbrowl 3y ago

Just as with political philosophies like anarchism or communism, if your Great Idea depends on everybody else adopting it to be successful, then it's going to fail.

timbit42 3y ago
So like Facebook. Oh. Wait...

WallyFunk 3y ago

> the more people that use it, the more secure it gets, according to Patil. If only certain sensitive groups use it, it’ll be easier to deanonymize and ultimately track down identities. Tor gained a lot of popularity after the Snowden revelations. We would need several Snowden-like leaks over the coming years to ramp Tor usage up substantially. And then there's no way of knowing how Tor would scale to support a new influx of users, year-on-year. But I agree with Patil, the more people that use it, the better. If we could just shake the stigma that Tor = crimeware then that would be great.

_8j50 3y ago

I recommend against using Tor, simply because of exit node hostility and targeted intrusions when you use Tor. Intel agencies also run the majority of relays last I heard of this subject. Perhaps if exit node operators were publicly listed and vetted humans and most relay's owners volunteered who they are and validate that with the project, I could trust it more. IMHO, financial incentives for relay and exit operators is the best way to make sure more people without ulterior motives participate.

r3trohack3r 3y ago

I believe Tor is underrated in P2P systems. Many networks consider NAT traversal mostly (or partially) unsolved. Routing between nodes over Tor immediately solves your NAT traversal problems allowing any device to tunnel to any device (at the expense of latency).

fruitreunion1 3y ago
i2p is an alternative with its main focus on hidden services rather than outproxying to the regular net, that seems to be somewhat used with torrents.

lallysingh 3y ago

Lets not forget personal services! You can setup sshd on a box behind NAT as a hidden service. It'll disconnect more than you like but screen or tmux can help with that.

Fatnino 3y ago

I was using tor the other day and my phone battery went below 10% triggering power saving mode. My fault, I should have had my phone charged before. When the phone went into power saving mode, tor closed and lost my place. And since it doesn't keep local browsing history, I was back to square one.

omgmajk 3y ago

Wait, I'm confused. Not all people use Tor? Honestly though, Tor is not the solution for a lot of people. If you're just going for good enough there are other alternatives, if you're already under heat from a big enough actor you are screwed whatever you use. We need a new solution.

null4bl3 3y ago

I have had a plan on my list for years now, to write a medium for IoT devices, that would route all traffic through TOR as a layer of security, while it would also help the TOR network with a lot of fuzzing traffic.

lossolo 3y ago

Please don't. If now suddenly everyone would use TOR then we would get something a lot worse than Google's Web Environment Integrity, let me explain why. As someone being on the other side of things (running different services for years) thank god that all users are not using TOR. 99% of all attacks, spam, password brute forcing etc came from TOR on many services I worked on throughout the years. Eliminating that traffic or adding additional checks and hops for traffic from TOR solves a lot of issues for many services.