4 ms·
It would be so great if Mozilla integrated Tor. Beyond the curse of success mentioned in the article, it would really lower the burden on the Tor developers, wh
by tedks 12y ago
It would be so great if Mozilla integrated Tor. Beyond the curse of success mentioned in the article, it would really lower the burden on the Tor developers, who have had to support a lot of patches from Firefox that Mozilla have been slow to merge.
My main concern is that this will be hidden behind an option or an "extreme private" mode -- Tor seems too high-latency for the typical use-case of private browsing (image viewing and video streaming).
If you run a web service and would like to provide high-security anonymous access, consider running an Exit Enclave -- a Tor exit configured to exit only to your site. If Tor detects that your exit and your site share an IP address, it will automatically extend the normally 3-hop circuit to your node, and the traffic will exit the Tor network on your machine rather than an arbitrary node (which could be malicious).
I hope this finally kills the "only criminals use Tor" narrative the NSA and periodically, the media push. Everyone deserves strong anonymity.
- ChrisAntaki 12y ago> My main concern is that this will be hidden behind an option or an "extreme private" mode To add to your point, effectively using Tor means disabling JavaScript.
- wtallis 12y agoWhy do you say that? According to the Tor Project FAQ for their browser bundle, they leave JavaScript enabled. The only problem they mention is that selectively allowing scripts via NoScript permissions leaks information, so it's an all-or-nothing decision with regards to third-party scripts for any given site and they choose to make the default the one that breaks fewer sites. (And really, you're still free to block scripts from any third-party site that has an effective surrogate script bundled with NoScript.)
- ChrisAntaki 12y agoTor has been exploited in the past in ways which only affected those who kept JavaScript enabled [1]. I actually love JavaScript, and the doors it can open for trustworthy developers, but I don't think a deep cover journalist or whistleblower should be browsing with it. [1] https://blog.torproject.org/blog/tor-security-advisory-old-tor-browser-bundles-vulnerable https://blog.torproject.org/blog/tor-security-advisory-old-t...
- wtallis 12y agoSo, that's not Tor being exploited, that's just a Firefox bug that was used to get at Tor users because they're more interesting targets. It wasn't a case of JavaScript making Tor less private or less secure except in that it was JavaScript making everything less private and secure, and Tor doesn't protect you from that because Tor isn't a security tool.
- ChrisAntaki 12y agoRight, the Tor browser bundle was exploited. The context of this thread is browser usage of Tor.
- chimeracoder 12y ago> If you run a web service and would like to provide high-security anonymous access, consider running an Exit Enclave -- a Tor exit configured to exit only to your site. If Tor detects that your exit and your site share an IP address, it will automatically extend the normally 3-hop circuit to your node, and the traffic will exit the Tor network on your machine rather than an arbitrary node (which could be malicious). For what it's worth, DuckDuckGo has done this for the past 4 years[0]. I think StartPage is still the default for the Tor browser bundle, but I'm not sure if they have an exit enclave as well. [0] http://www.gabrielweinberg.com/blog/2010/08/duckduckgo-now-operates-a-tor-exit-enclave.html http://www.gabrielweinberg.com/blog/2010/08/duckduckgo-now-o...
- deleted 12y ago[deleted]
- robertfw 12y agoI hadn't heard of Exit Enclaves before, when I looked it up in the docs [0] it appears that they are not going to be supported in versions > 0.2.3.x. [0] https://trac.torproject.org/projects/tor/wiki/doc/ExitEnclave https://trac.torproject.org/projects/tor/wiki/doc/ExitEnclav...: