10 ms·

This is really dangerous. Even enthusiasts mix up the anonymity offered with Tor with security. I can almost guarantee that this will do waaaay more harm than

by tjoff 13y ago

This is really dangerous. Even enthusiasts mix up the anonymity offered with Tor with security. I can almost guarantee that this will do waaaay more harm than good. People will enable this and think they are safe while they are suddenly routing all their cleartext through an untrusted third party (that is, very often, malicious). At the very least a lot of passwords will be gathered (alongside email in a lot of cases) in insecure and unencrypted forums etc. And since most people have the same password for unencrypted forums as their email, facebook and twitter... For this to work it will have to be an option buried deep and before enabling it you'd have to have a huge nag box (the size of a blue screen) that clearly shows the dangers of this. And although many have tried I haven't seen any implementation of such a nag box that actually works (forces the user to think and not just press "OK"/"YES"). And even if it did work people won't understand it, at most they will understand that "okay, this is risky" but they have no way of evaluating that risk since they have no idea what they really are enabling. That said, Tor inbuilt into firefox would be awesome. I just can't imagine it doing more good than harm.

pgeorgi 13y ago
So only support TOR for TLS-managed connections and .onion sites. As for TLS, something like http://convergence.io/ http://convergence.io/ would be a nice thing to add by default.
denzil_correa 13y ago
You can actually put up the "this is dangerous" sign for pretty much any invention out there. I understand that you are not advocating "this should not be done" but like any other feature one needs to be vigilant with Tor.
bad_user 13y ago
It's not more dangerous than connecting through a regular proxy, or through a Wifi network at some coffee shop or hotel. And how trustworthy is your ISP exactly? For example, while I visited the US it happened at 2 motels I stayed at for their network to insert ads in the web pages I was visiting. So they where not only snooping my traffic, but going further into altering it. Also, go to any conference or gathering of people, create an open Wifi hotspot (like, with your phone) and then enjoy all the cookies and passwords flowing through, from all the clueless people that connect to it. Truth of the matter is, websites should be secure by default. Those that aren't represent a huge security risk. Fortunately many of the big ones are (e.g. GMail, Twitter, Facebook, etc...) Also see: [1] http://en.wikipedia.org/wiki/Firesheep http://en.wikipedia.org/wiki/Firesheep [2] http://faceniff.ponury.net/ http://faceniff.ponury.net/
- ianstormtaylor 13y ago
  (I know nothing about this.) I interpreted tjoff's argument to be that the average Tor exit node is more malicious than any of the other average ways for proxies to be dangerous. In other words, yes coffee shops could be dangerous, but they are most often safe, whereas if you're getting routed through a bunch of exit nodes over a period of time (is that even how it works?) you stand a much greater chance of running into malice. Would love to hear someone address that claim as I understood it.
  - bad_user 13y ago
    If you care about your security (or as a service provider, the security of your users) and if you can't establish a chain of trust, then you can't call a solution secure. If the connection is encrypted, then you have to trust the certificate authority, the browser and the service provider. If the connection is unencrypted, then in addition to the above, you have to trust that nobody is listening on that connection and that's a really tough pill to swallow, even if nothing bad happened to you in the past (just like with car accidents, it needs to happen only once to mess up your life). If you don't think bad things happen all the time in the wild, see this story of Ashton Kutcher's Twitter account being hacked while attending TED: http://www.huffingtonpost.com/2011/03/02/ashton-kutcher-twitter-hacked_n_830619.html http://www.huffingtonpost.com/2011/03/02/ashton-kutcher-twit...
    - jerguismi 13y ago
      There is different _probability_ of having malicious network sniffer with different service providers. I would bet my left testicle that the probability with tor is higher than average ISP. If you want to speak about security _theory_, then please state so. Usually in these kind of discussions people speak about practical security, which means trusting different people different amounts, and trading theoretical security with trust.
- jerguismi 13y ago
  "It's not more dangerous than connecting through a regular proxy, or through a Wifi network at some coffee shop or hotel. And how trustworthy is your ISP exactly?" Totally false claim. I would bet my ass that there is higher probability to have your traffic sniffed by tor exit nodes than by regular ISP's. At least for short-term malicious purposes, like email snooping and credit cards. (For more long-term malicious purporses, NSA etc., you can't be really sure.)
cupcake-unicorn 13y ago
Are you saying that tor exit nodes are generally malicious? I mean, I understand the precautions involved in routing the data like that, and that there's the possibility, but is it really that rampant?
- willvarfar 13y ago
  My understanding is that its the vast majority.
- tdec 13y ago
  Regardless of the real situation, it is to be assumed.
- mike-cardwell 13y ago
  Tor is a very attractive target for such behaviour. It takes very little effort to set up a Tor exit node and to start passively sniffing traffic. It would surprise me more to find out that this behaviour wasn't rampant.
yk 13y ago
Probably, if FF implements a 'native Tor button.' The other possibility would be, to only support hidden services natively for .onion URLs. ( And use standard TCP/IP for everything else.)
- antonios 13y ago
  This sounds like a great default behavior.
derrida 13y ago
So the way to fix this is to get involved and write some software instead of commenting in a forum as if software is a static problem. Why not open a bug report? Maybe we can prevent password reuse by the browser taking a hash of the password being entered in a form and comparing it against other password hashes locally? These issues are trivial compared to the bigger issue at play: the right to read and to write without exception. That is what is at stake here. Exits sniffing passwords for plain-text forums is a minor concern compared to the bigger issues at play. I'd like to point out that it's trivial to test for this too...(create some plaintext accounts on forums, post there, then run a honeypot server with your own email address and see if you get a login, do this automatically for each exit) However the time commitment isn't so trivial: If you wrote such a program it would be appreciated, please yell loudly about it on the tor-talk list if you do! Tor works by and large by people following some basic principles, like "if you think it should be done, do it". You could also see the issues with plaintext passwords on HTTP sites and password reuse as a problem of user education. If you're not up for writing software, why not open a bug and suggest some wireframed ideas for how a UI could look to prevent password reuse? There is a whole bunch of ways to contribute. There are literally 100's of problems like this Mozilla or Tor could get help with... get involved instead of ahead of time saying "This can almost guarantee that this will do waaaay more harm than good." I hope to see your responsible posting of these concerns to a bug tracker. A lot of what gets done in FOSS projects like Tor really is just a bunch of people who've decided "hey, if I don't do this, who will?". As for doing more harm than good: I can't possibly see how this does more harm than NSA domestic surveillance.
- rmc 13y ago
  Maybe we can prevent password reuse by the browser taking a hash of the password being entered in a form and comparing it against other password hashes locally? Won't work. People have too many accounts to be able to remember unique passwords. A large percentage of mundane users won't understand these things and will just be nagged all the time that they cannot log into their accounts with this new Firething.
  - derrida 13y ago
    We could warn "this is the same as site X which is HTTP". If it's a throw away, that is fine. If it's not, that might matter.
chongli 13y ago
People will enable this and think they are safe while they are suddenly routing all their cleartext through an untrusted third party (that is, very often, malicious). So wouldn't the fix for this be to have the browser warn/refuse to send cleartext over Tor?
Houshalter 13y ago
Would it be possible to make it so it just won't connect to a website unless it's encrypted or a .onion domain? You could get past it by going through said warnings and nagging, so users who know what they are doing wouldn't be troubled.
rmc 13y ago
Probably the best way would be to only route HTTPS traffic (with certificate pinning & checking) through tor. Plain HTTP traffic would go through your regular ISP. That avoids the "password collection"/MITM attack?
- chakalakasp 13y ago
  It would be better to have it not route at all if unencrypted and the Tor feature is turned on. The idea is anonymity. Having it suddenly use your real-world IP because it sees you aren't using TLS breaks this.
IgorPartola 13y ago
The way to fix this is to throw up a giant warning (al la untrusted SSL cert) when using the Tor mode and accessing a site that does not support HTTPS.
belorn 13y ago
Tor inbuilt into firefox would be really good. It would push for more secure practices, and would complement Mozillas current efforts with Persona. Site that do not use https, Persona, OpenID, google/facebook/microsoft/what-ever-authentication-system is a problem, but better served by some form of detection mechanism. incognito mode could simply try detect the common exceptional cases, and then provide a user warning. As such, user would report the warning to the forum/wp admin, and the web would improve as an result. Second, the tor exist node are not more risky than using local ISP, coffee shops, or a business/school network. Who is more likely to secure the network routes against malicious attacks: a underpaid janitor, restaurant worker, teacher, or a several year established tor enthusiast? Most tor traffic flow through the biggest and most established nodes, and those has a lot to loose from sniffing the network. Can the same be said about the person behind the counter at the local coffee shop?
claudius 13y ago
One possible way to implement ‘buried deep down’ would be with a command-line option (--enable-tor) that requires input on the console to continue launching the browser. Something like the following: $ iceweasel --enable-tor The option --enable-tor will route _all_ traffic generated by Iceweasel through possibly-malicious TOR exit nodes. Please read http://example.com/TOR for more information on how TOR works and then type "Enable TOR" to continue launching Iceweasel with TOR enabled. Awaiting Input: <user types Enable TOR + Enter> <Iceweasel starts> Sure, people could build scripts with expect or so, but I would assume this to deter most unknowing users from enabling TOR accidentally (idea stolen from apt-get’s ‘Yes, do as I say!’).
notatoad 13y ago
>That said, Tor inbuilt into firefox would be awesome. I just can't imagine it doing more good than harm. try this: https://www.torproject.org/projects/torbrowser.html.en https://www.torproject.org/projects/torbrowser.html.en
mike-cardwell 13y ago
Also, try and use your online banking through Tor. You might be using HTTPS, but watch as your account is frozen when they detect you accessing it from multiple different countries in a short period of time. Tor is unsafe to use unless you understand how it works and use it selectively and carefully. Selectively and carefully is not a way I would describe the average persons browsing technique.
spellboots 13y ago
Here is a nag box implementation that actually works: To continue, please type the following phrase in the text box: I UNDERSTAND THAT ENABLING THIS FEATURE WILL CAUSE HACKERS TO STEAL ALL MY MONEY Type the phrase: _______________________________________________________ [Ok] [Cancel]
- jlgreco 13y ago
  Page 1: [...information about the feature...] [Ok][Cancel] Page 2: Which of the following are true? [multiple choice answers about the feature] User friendly? More like user hostile... But that is what is needed.

by tjoff 13y ago

pgeorgi 13y ago

So only support TOR for TLS-managed connections and .onion sites. As for TLS, something like http://convergence.io/ http://convergence.io/ would be a nice thing to add by default.

denzil_correa 13y ago

You can actually put up the "this is dangerous" sign for pretty much any invention out there. I understand that you are not advocating "this should not be done" but like any other feature one needs to be vigilant with Tor.

bad_user 13y ago

It's not more dangerous than connecting through a regular proxy, or through a Wifi network at some coffee shop or hotel. And how trustworthy is your ISP exactly? For example, while I visited the US it happened at 2 motels I stayed at for their network to insert ads in the web pages I was visiting. So they where not only snooping my traffic, but going further into altering it. Also, go to any conference or gathering of people, create an open Wifi hotspot (like, with your phone) and then enjoy all the cookies and passwords flowing through, from all the clueless people that connect to it. Truth of the matter is, websites should be secure by default. Those that aren't represent a huge security risk. Fortunately many of the big ones are (e.g. GMail, Twitter, Facebook, etc...) Also see: [1] http://en.wikipedia.org/wiki/Firesheep http://en.wikipedia.org/wiki/Firesheep [2] http://faceniff.ponury.net/ http://faceniff.ponury.net/

ianstormtaylor 13y ago
(I know nothing about this.) I interpreted tjoff's argument to be that the average Tor exit node is more malicious than any of the other average ways for proxies to be dangerous. In other words, yes coffee shops could be dangerous, but they are most often safe, whereas if you're getting routed through a bunch of exit nodes over a period of time (is that even how it works?) you stand a much greater chance of running into malice. Would love to hear someone address that claim as I understood it.
- bad_user 13y ago
  If you care about your security (or as a service provider, the security of your users) and if you can't establish a chain of trust, then you can't call a solution secure. If the connection is encrypted, then you have to trust the certificate authority, the browser and the service provider. If the connection is unencrypted, then in addition to the above, you have to trust that nobody is listening on that connection and that's a really tough pill to swallow, even if nothing bad happened to you in the past (just like with car accidents, it needs to happen only once to mess up your life). If you don't think bad things happen all the time in the wild, see this story of Ashton Kutcher's Twitter account being hacked while attending TED: http://www.huffingtonpost.com/2011/03/02/ashton-kutcher-twitter-hacked_n_830619.html http://www.huffingtonpost.com/2011/03/02/ashton-kutcher-twit...
  - jerguismi 13y ago
    There is different _probability_ of having malicious network sniffer with different service providers. I would bet my left testicle that the probability with tor is higher than average ISP. If you want to speak about security _theory_, then please state so. Usually in these kind of discussions people speak about practical security, which means trusting different people different amounts, and trading theoretical security with trust.
jerguismi 13y ago
"It's not more dangerous than connecting through a regular proxy, or through a Wifi network at some coffee shop or hotel. And how trustworthy is your ISP exactly?" Totally false claim. I would bet my ass that there is higher probability to have your traffic sniffed by tor exit nodes than by regular ISP's. At least for short-term malicious purposes, like email snooping and credit cards. (For more long-term malicious purporses, NSA etc., you can't be really sure.)

cupcake-unicorn 13y ago

Are you saying that tor exit nodes are generally malicious? I mean, I understand the precautions involved in routing the data like that, and that there's the possibility, but is it really that rampant?

willvarfar 13y ago
My understanding is that its the vast majority.
tdec 13y ago
Regardless of the real situation, it is to be assumed.
mike-cardwell 13y ago
Tor is a very attractive target for such behaviour. It takes very little effort to set up a Tor exit node and to start passively sniffing traffic. It would surprise me more to find out that this behaviour wasn't rampant.

yk 13y ago

Probably, if FF implements a 'native Tor button.' The other possibility would be, to only support hidden services natively for .onion URLs. ( And use standard TCP/IP for everything else.)

antonios 13y ago
This sounds like a great default behavior.

derrida 13y ago

So the way to fix this is to get involved and write some software instead of commenting in a forum as if software is a static problem. Why not open a bug report? Maybe we can prevent password reuse by the browser taking a hash of the password being entered in a form and comparing it against other password hashes locally? These issues are trivial compared to the bigger issue at play: the right to read and to write without exception. That is what is at stake here. Exits sniffing passwords for plain-text forums is a minor concern compared to the bigger issues at play. I'd like to point out that it's trivial to test for this too...(create some plaintext accounts on forums, post there, then run a honeypot server with your own email address and see if you get a login, do this automatically for each exit) However the time commitment isn't so trivial: If you wrote such a program it would be appreciated, please yell loudly about it on the tor-talk list if you do! Tor works by and large by people following some basic principles, like "if you think it should be done, do it". You could also see the issues with plaintext passwords on HTTP sites and password reuse as a problem of user education. If you're not up for writing software, why not open a bug and suggest some wireframed ideas for how a UI could look to prevent password reuse? There is a whole bunch of ways to contribute. There are literally 100's of problems like this Mozilla or Tor could get help with... get involved instead of ahead of time saying "This can almost guarantee that this will do waaaay more harm than good." I hope to see your responsible posting of these concerns to a bug tracker. A lot of what gets done in FOSS projects like Tor really is just a bunch of people who've decided "hey, if I don't do this, who will?". As for doing more harm than good: I can't possibly see how this does more harm than NSA domestic surveillance.

rmc 13y ago
Maybe we can prevent password reuse by the browser taking a hash of the password being entered in a form and comparing it against other password hashes locally? Won't work. People have too many accounts to be able to remember unique passwords. A large percentage of mundane users won't understand these things and will just be nagged all the time that they cannot log into their accounts with this new Firething.
- derrida 13y ago
  We could warn "this is the same as site X which is HTTP". If it's a throw away, that is fine. If it's not, that might matter.

chongli 13y ago

People will enable this and think they are safe while they are suddenly routing all their cleartext through an untrusted third party (that is, very often, malicious). So wouldn't the fix for this be to have the browser warn/refuse to send cleartext over Tor?

Houshalter 13y ago

Would it be possible to make it so it just won't connect to a website unless it's encrypted or a .onion domain? You could get past it by going through said warnings and nagging, so users who know what they are doing wouldn't be troubled.

rmc 13y ago

Probably the best way would be to only route HTTPS traffic (with certificate pinning & checking) through tor. Plain HTTP traffic would go through your regular ISP. That avoids the "password collection"/MITM attack?

chakalakasp 13y ago
It would be better to have it not route at all if unencrypted and the Tor feature is turned on. The idea is anonymity. Having it suddenly use your real-world IP because it sees you aren't using TLS breaks this.

IgorPartola 13y ago

The way to fix this is to throw up a giant warning (al la untrusted SSL cert) when using the Tor mode and accessing a site that does not support HTTPS.

belorn 13y ago

Tor inbuilt into firefox would be really good. It would push for more secure practices, and would complement Mozillas current efforts with Persona. Site that do not use https, Persona, OpenID, google/facebook/microsoft/what-ever-authentication-system is a problem, but better served by some form of detection mechanism. incognito mode could simply try detect the common exceptional cases, and then provide a user warning. As such, user would report the warning to the forum/wp admin, and the web would improve as an result. Second, the tor exist node are not more risky than using local ISP, coffee shops, or a business/school network. Who is more likely to secure the network routes against malicious attacks: a underpaid janitor, restaurant worker, teacher, or a several year established tor enthusiast? Most tor traffic flow through the biggest and most established nodes, and those has a lot to loose from sniffing the network. Can the same be said about the person behind the counter at the local coffee shop?

claudius 13y ago

One possible way to implement ‘buried deep down’ would be with a command-line option (--enable-tor) that requires input on the console to continue launching the browser. Something like the following: $ iceweasel --enable-tor The option --enable-tor will route _all_ traffic generated by Iceweasel through possibly-malicious TOR exit nodes. Please read http://example.com/TOR for more information on how TOR works and then type "Enable TOR" to continue launching Iceweasel with TOR enabled. Awaiting Input: <user types Enable TOR + Enter> <Iceweasel starts> Sure, people could build scripts with expect or so, but I would assume this to deter most unknowing users from enabling TOR accidentally (idea stolen from apt-get’s ‘Yes, do as I say!’).

notatoad 13y ago

>That said, Tor inbuilt into firefox would be awesome. I just can't imagine it doing more good than harm. try this: https://www.torproject.org/projects/torbrowser.html.en https://www.torproject.org/projects/torbrowser.html.en

mike-cardwell 13y ago

Also, try and use your online banking through Tor. You might be using HTTPS, but watch as your account is frozen when they detect you accessing it from multiple different countries in a short period of time. Tor is unsafe to use unless you understand how it works and use it selectively and carefully. Selectively and carefully is not a way I would describe the average persons browsing technique.

spellboots 13y ago

Here is a nag box implementation that actually works: To continue, please type the following phrase in the text box: I UNDERSTAND THAT ENABLING THIS FEATURE WILL CAUSE HACKERS TO STEAL ALL MY MONEY Type the phrase: _______________________________________________________ [Ok] [Cancel]

jlgreco 13y ago
Page 1: [...information about the feature...] [Ok][Cancel] Page 2: Which of the following are true? [multiple choice answers about the feature] User friendly? More like user hostile... But that is what is needed.