3 ms·

This is a terribly marketed idea. Totally anonymous? Sure, just don't log into anything you've logged into before. Or use Flash. Or forget to dump your cook

This is a terribly marketed idea. Totally anonymous? Sure, just don't log into anything you've logged into before. Or use Flash. Or forget to dump your cookies before you start. Perfectly secure? Sure, if you use TLS. But then it's really TLS protecting you, not tor, isn't it? There are plenty of naughty exit nodes out there and I'd never log into an account I cared about via Tor without TLS. I like Tor and think that making it easier is a great idea, but when you sell it as an easy path to security and anonymity, you are going to get some people hurt. Tor can be both anonymous and secure if you take certain paranoid precautions when you use it, but are general consumers going to have any idea about those precautions? It's a challenge to get people to not just bypass browser cert errors or to secure their Wi-Fi, advanced tor browsing precautions may as well be instructions for using a zero G space toilet.

derefr 13y ago
> Tor can be both anonymous and secure if you take certain paranoid precautions when you use it Downloading the Tor Browser Bundle is "taking paranoid precautions"? It already has HTTPSEverywhere built in, disables JavaScript by default, etc.
- agildehaus 13y ago
  FYI: Tor Browser, in its current iteration, does not disable Javascript by default, and the NoScript is configured to allow Javascript by default. There's also a large concern that using NoScript in any form harms anonymity, as your NoScript whitelist/blacklist is somewhat detectable by websites and can act as a fingerprint.
  - LionRoar 13y ago
    Tor browser (package tor-browser-2.3.25-15_en-US, latest bundle) does have Javascript disabled by default. Please check options-content->enable Javascript. If I am mistaken I am delighted to hear otherwise.
deleted 13y ago
[deleted]
sparkie 13y ago
I agree that overselling the security of any product is bad - it should generally be considered defective to begin with. I can't even find enough information about Safeplug to begin analyzing their security as they don't provide any link to the source code, build process or any documentation. There's no way I could recommend this to anybody. Also, on TLS, you will not be perfectly secure, and I think it's dangerous to consider yourself secure against a state-sponsored actor by using it. TLS has quite a large surface area for attack in its current form - The PKI. If you're going to take paranoid precautions, it's probably best to assume one or more CAs are rogue/compromised already (or that they could become so at any time).

derefr 13y ago

> Tor can be both anonymous and secure if you take certain paranoid precautions when you use it Downloading the Tor Browser Bundle is "taking paranoid precautions"? It already has HTTPSEverywhere built in, disables JavaScript by default, etc.

agildehaus 13y ago
FYI: Tor Browser, in its current iteration, does not disable Javascript by default, and the NoScript is configured to allow Javascript by default. There's also a large concern that using NoScript in any form harms anonymity, as your NoScript whitelist/blacklist is somewhat detectable by websites and can act as a fingerprint.
- LionRoar 13y ago
  Tor browser (package tor-browser-2.3.25-15_en-US, latest bundle) does have Javascript disabled by default. Please check options-content->enable Javascript. If I am mistaken I am delighted to hear otherwise.

deleted 13y ago

[deleted]

sparkie 13y ago

I agree that overselling the security of any product is bad - it should generally be considered defective to begin with. I can't even find enough information about Safeplug to begin analyzing their security as they don't provide any link to the source code, build process or any documentation. There's no way I could recommend this to anybody. Also, on TLS, you will not be perfectly secure, and I think it's dangerous to consider yourself secure against a state-sponsored actor by using it. TLS has quite a large surface area for attack in its current form - The PKI. If you're going to take paranoid precautions, it's probably best to assume one or more CAs are rogue/compromised already (or that they could become so at any time).