7 ms·

Anonabox: a Tor hardware router

56 points by chermanowicz 12y ago

dang 12y ago
Url changed from http://www.wired.com/2014/10/tiny-box-can-anonymize-everything-online/ http://www.wired.com/2014/10/tiny-box-can-anonymize-everythi..., which points to this.
josu 12y ago
This has already been done: http://www.technologyreview.com/news/521676/online-anonymity-in-a-box-for-49/ http://www.technologyreview.com/news/521676/online-anonymity... You can buy the product here [1] for $49. As far as I can tell, the only difference is that one is opensource while the other doesn't seem to be. [1] https://pogoplug.com/safeplug https://pogoplug.com/safeplug
- selectout 12y ago
  This is mentioned in the article including a couple points about the size (safeplug is twice the size so less convenient for taking with you) as well as the security flaws found in September.
  - josu 12y ago
    The article he is referring to is this one: http://www.wired.com/2014/10/tiny-box-can-anonymize-everything-online/ http://www.wired.com/2014/10/tiny-box-can-anonymize-everythi... The kickstarter page makes no mention to other similar products, which to me seems pretty dishonest. Nobody uses the "Risks and challenges" section correctly.
    - selectout 12y ago
      Ah yea, thanks for that. When I originally clicked the link it was to the wired article, must have been updated to the kickstarter page.
- joshwayne 12y ago
  I think Anonabox will have more success than Safeplug because it's open source. Selling a black box to the privacy conscious never sounded like a good idea.
  - josu 12y ago
    Yeah, it seems that they are marketing to different groups of people.
- acabal 12y ago
  That's a huge and critical difference. Open source down to the hardware is the only way you can be sure that what you're getting is actually Tor and not Tor + secret backdoor. (Though I suppose you still have to trust the hardware manufacturer, but the buck does have to stop somewhere.)
sbierwagen 12y ago
Note that Tor is still being actively funded by US law enforcement (http://pando.com/2014/07/16/tor-spooks/ http://pando.com/2014/07/16/tor-spooks/) and that Tor's security has been repeatedly broken by US law enforcement in order to take down sites illegal under US law. (http://www.wired.com/2014/09/fbi-silk-road-hacking-question/ http://www.wired.com/2014/09/fbi-silk-road-hacking-question/) It is debatable if Tor provides any more security than just using someone else's open wifi point. Great for evading bans on online forums, worthless against the DEA.
- greenyoda 12y ago
  Not sure why the above post is being downvoted. I read the Pando article, and it seems to be a comprehensive and well-researched piece that documented: - How Tor was created by the U.S. government (Naval Research Lab) for the purpose of providing anonymity to intelligence agencies. It is now also widely used by law enforcement agencies to maintain anonymity in criminal investigations. - How the project was funded primarily by intelligence agencies. - How the NSA, which can monitor a large fraction of internet traffic, can unmask Tor users by correlating traffic directed at Tor entry points with traffic observed at Tor exit points. Snowden's leaks revealed that the NSA was working on breaking Tor anonymity and believed its efforts were "pretty much guaranteed to succeed".
  - atmosx 12y ago
    The above comments is downvoted IMHO because of: It is debatable if Tor provides any more security than just using someone else's open wifi point. That's absolutely not true and if the author doesn't understand why, then he doesn't have a clue about what he is talking about.
    - sbierwagen 12y ago
      Tor traffic is monitored. Many high-bandwidth endpoints and relays are run by law enforcement, and Tor is configured to preferentially use high-bandwidth nodes. It is a given that, at minimum, all Tor metadata is logged; if not all content. Additionally, the list of exit nodes is open and public, (https://www.torproject.org/projects/tordnsel.html.en https://www.torproject.org/projects/tordnsel.html.en) so any given server can tell if you're using Tor. Comparing Tor to your neighbor's open wifi was an example of how poor Tor's anonymity is, rather than how good your neighbor's connection is.
dublinben 12y ago
As a user and proponent of Tor, I think products like this are a bad idea. Buying a box that promises "reliable anonymity" without understanding all the behavioral changes necessary to support that is dangerous. Educating users all over the world on how to resist censorship and protect their anonymity is important. Buying a piece of hardware doesn't achieve that.
- pfg 12y ago
  Pointing out that just using Tor without changing your behavior might not be enough is definitely important. Using a separate piece of hardware that's dedicated just to routing all your traffic through Tor still has a lot of security benefits, since it limits the target surface just to Tor (and the OS stack required to run Tor), as opposed to your browser, OS or any other software you might use that could potentially leak your true identity.
  - atmosx 12y ago
    What benefits does it have (except anonymity)?
  - opendais 12y ago
    No, it doesn't. You are sorely, severely mistaken and misguided (just like the people creating this Tor product). > since it limits the target surface just to Tor (and the OS stack required to run Tor) as opposed to your browser, OS or any other software you might use that could potentially leak your true identity. That is completely 100% false. The attack surface of the browser remains along with the attack surface of the OS. All this does is mask your IP address/network origins. Tor is no more effective at "reducing the attack surface" of your OS & Browser as a VPN.
    - pfg 12y ago
      Of course it's still possible to exploit any software you might be running behind the router. That is why I agree it should be just one of many steps you ought to take if you care about anonymity. I never said this is a plug-and-play solution to internet anonymity. Still, hiding your IP address is one important factor in anonymity and probably the biggest use-case for Tor. Using a separate, dedicated device for this purpose makes it practically impossible for your IP address to leak e.g. because of a browser exploit. Case in point, when the FBI busted users of child porn sites in 2013, they used a Zero-day in Firefox [1] to leak the users IP addresses. This would not have worked for users with a device like this. They could've tried to gather evidence through other means using this exploit, but that's definitely harder than simply opening a network connection and would only work in cases where the exploit could access anything that would identify the user. (Obviously I'm not unhappy about child porn users getting busted, but I thought it would serve as a good example.) [1]: https://www.mozilla.org/security/announce/2013/mfsa2013-53.html https://www.mozilla.org/security/announce/2013/mfsa2013-53.h...
mrbill 12y ago
Also see the PORTAL travel router: https://github.com/grugq/portal https://github.com/grugq/portal It uses the GL-Inet travel router. They already run OpenWRT by default and have both LAN and WAN ports. Eliminates the problems of Kickstarter. I may do this tonight, as I have a few of them at home (they're great for "need a wifi bridge", "need a repeater", "friend needs a replacement router" type tasks). http://www.amazon.com/Gl-iNet-Router-Openwrt-Mobile-Control/dp/B00JKFE0FW http://www.amazon.com/Gl-iNet-Router-Openwrt-Mobile-Control/...
adultSwim 12y ago
Does anyone know if the following is a good idea: Run two SSIDs on a router: one regular internet, the other TOR only. TOR would be running on the router itself. Are routers too underpowered to run TOR? PORTAL looks good. Not sure why it has to have a separate 3g modem/wireless card. Any good reason to avoid ethernet? Reason to have this as a separate box?
- atmosx 12y ago
  Hello, I won't comment on the configuration because I don't know what you'd like to achieve. A router could run a tor node if the traffic is limited. If the traffic up/down increases (e.g. 50 Mbits up/down) then it can't handle on-the-fly encryption/decryption. However, you could install/run a tor node (private) on digital ocean for 5 USD/month and route all your traffic through the VPS. You could use Tor Browser or custom running on your Desktop. The configuration depends on how often you use tor and for what reason.
rsync 12y ago
What hardware is that ? Is that custom designed for their project, or are they using an existing travel router whose form factor I have never seen before ? I am always interested in the smallest possible non-wireless device with two ethernet ports ... all of the dual ethernet tp-link devices have wireless capability, so they are disqualified. Related: this, and every device like it, should be a plug ... even at the expense of compactness...
- atmosx 12y ago
  Hm, Carambola (without the WiFi module)?
- noyesno 12y ago
  Though they claim to have designed the hardware themselves, it looks very much like the NEXX mini-router: http://www.atupapa.com/17043400030en.html http://www.nexx.com.cn/index.php/home/detail?pid=199
atmosx 12y ago
Apparently the product was a huge success. I don't understand it's use case. Seriously I don't: * Is it hard to buy an RPi and set-it-up for a home Tor node? * To buy a VPS and setup a Tor-node then route all the traffic through it?! * Run tor-browser on your desktop when/if you need Tor? A use how has avg Joe's internet's workflow through Tor, protects himself from whom? Rogue internet caffe access points?! Anyway it seems neat but to me is pointless.
- vertex-four 12y ago
  > I don't understand it's use case. If there's a chance that the Government or some other entity will come after you for whatever you're doing on Tor, and you don't want there to be any way that your machines (clients or servers) could leak their public IP address, you could put them behind this.
  - opendais 12y ago
    They can deanonymize you at the NSA's scale. They can deanonymize you with browser exploits at the FBI's scale. If you are going to be actively targeted using Tor is not sufficient. Tor is an effective defense against passive, generalized surveillance. It isn't effective against FBI/NSA-level resources because they will just drop 0 days in your path until you get hit by one.
    - vertex-four 12y ago
      We know of at least one Tor hidden service which was deanonymized because it leaked an IP address at some point. This protects against that flaw being likely to happen again. That is what the use case of this is. Of course it's not enough on its own. It protects against a specific attack in an easy-to-setup way.
      - opendais 12y ago
        IF you were serious about this, setup a router to TOR correctly using quality hardware. Use a router distribution (e.g. PFSense) on real hardware. Otherwise, you'll be just as screwed because your service will be ridiculously slow. This wouldn't be able to handle anything more than a consumer grade internet connection at relatively low speeds. "By our fourth round of prototypes we had created a model with 64mb memory and a 580mhz CPU. This not only runs the software well, it flies! At last happy with the board, we designed a simple, minimalist case in plain white to house it. The end result is our current model. We decided to name it the anonabox." Running CPU intensive processes (e.g. encryption) on a high throughput connection (e.g. web server) isn't going to work unless its only used by you and your 5 friends.
Xeoncross 12y ago
My problem with this is that I only want 10% of my traffic filtered over tor. This is useless to most people that want to stream movies or need some of their traffic over a regular network. I guess that you use the wired connection for Tor, wifi from the router for everything else? Then you still have to enable/disable the network card you want to use at the time. The current tor browser is perfect. I just switch back and forth between it and my regular browsers as needed.
- deleted 12y ago
  [deleted]
- corysama 12y ago
  If you are using Tor for a serious reason, you should have separate machines for Tor vs non-Tor activity. There was recently a high profile case (silk road?) where a user forgot to switch browser modes once before logging in to an monitored account to post a quick comment. It only takes once.
  - Xeoncross 12y ago
    Good point, better safe than sorry, but in my case (and probably a large number of Tor users - I don't use Tor for "serious" reasons. Mostly to support privacy.
fuzzywalrus 12y ago
I'm pretty sure a VPN would achieve the level of security that most users looking for a "Tor" router would want, as Tor is a bit overkill, and silly if you're willing to commit to the behavior changes to make it effective. Perhaps someone should partner with a popular VPN like PrivateInternetAccess or another major VPN, as it'd allow people to continue using the services they know and love, and keep some of the prying eyes away from their unencrypted traffic.

56 points by chermanowicz 12y ago

dang 12y ago

Url changed from http://www.wired.com/2014/10/tiny-box-can-anonymize-everything-online/ http://www.wired.com/2014/10/tiny-box-can-anonymize-everythi..., which points to this.

josu 12y ago

This has already been done: http://www.technologyreview.com/news/521676/online-anonymity-in-a-box-for-49/ http://www.technologyreview.com/news/521676/online-anonymity... You can buy the product here [1] for $49. As far as I can tell, the only difference is that one is opensource while the other doesn't seem to be. [1] https://pogoplug.com/safeplug https://pogoplug.com/safeplug

selectout 12y ago
This is mentioned in the article including a couple points about the size (safeplug is twice the size so less convenient for taking with you) as well as the security flaws found in September.
- josu 12y ago
  The article he is referring to is this one: http://www.wired.com/2014/10/tiny-box-can-anonymize-everything-online/ http://www.wired.com/2014/10/tiny-box-can-anonymize-everythi... The kickstarter page makes no mention to other similar products, which to me seems pretty dishonest. Nobody uses the "Risks and challenges" section correctly.
  - selectout 12y ago
    Ah yea, thanks for that. When I originally clicked the link it was to the wired article, must have been updated to the kickstarter page.
joshwayne 12y ago
I think Anonabox will have more success than Safeplug because it's open source. Selling a black box to the privacy conscious never sounded like a good idea.
- josu 12y ago
  Yeah, it seems that they are marketing to different groups of people.
acabal 12y ago
That's a huge and critical difference. Open source down to the hardware is the only way you can be sure that what you're getting is actually Tor and not Tor + secret backdoor. (Though I suppose you still have to trust the hardware manufacturer, but the buck does have to stop somewhere.)

sbierwagen 12y ago

Note that Tor is still being actively funded by US law enforcement (http://pando.com/2014/07/16/tor-spooks/ http://pando.com/2014/07/16/tor-spooks/) and that Tor's security has been repeatedly broken by US law enforcement in order to take down sites illegal under US law. (http://www.wired.com/2014/09/fbi-silk-road-hacking-question/ http://www.wired.com/2014/09/fbi-silk-road-hacking-question/) It is debatable if Tor provides any more security than just using someone else's open wifi point. Great for evading bans on online forums, worthless against the DEA.

greenyoda 12y ago
Not sure why the above post is being downvoted. I read the Pando article, and it seems to be a comprehensive and well-researched piece that documented: - How Tor was created by the U.S. government (Naval Research Lab) for the purpose of providing anonymity to intelligence agencies. It is now also widely used by law enforcement agencies to maintain anonymity in criminal investigations. - How the project was funded primarily by intelligence agencies. - How the NSA, which can monitor a large fraction of internet traffic, can unmask Tor users by correlating traffic directed at Tor entry points with traffic observed at Tor exit points. Snowden's leaks revealed that the NSA was working on breaking Tor anonymity and believed its efforts were "pretty much guaranteed to succeed".
- atmosx 12y ago
  The above comments is downvoted IMHO because of: It is debatable if Tor provides any more security than just using someone else's open wifi point. That's absolutely not true and if the author doesn't understand why, then he doesn't have a clue about what he is talking about.
  - sbierwagen 12y ago
    Tor traffic is monitored. Many high-bandwidth endpoints and relays are run by law enforcement, and Tor is configured to preferentially use high-bandwidth nodes. It is a given that, at minimum, all Tor metadata is logged; if not all content. Additionally, the list of exit nodes is open and public, (https://www.torproject.org/projects/tordnsel.html.en https://www.torproject.org/projects/tordnsel.html.en) so any given server can tell if you're using Tor. Comparing Tor to your neighbor's open wifi was an example of how poor Tor's anonymity is, rather than how good your neighbor's connection is.

dublinben 12y ago

As a user and proponent of Tor, I think products like this are a bad idea. Buying a box that promises "reliable anonymity" without understanding all the behavioral changes necessary to support that is dangerous. Educating users all over the world on how to resist censorship and protect their anonymity is important. Buying a piece of hardware doesn't achieve that.

pfg 12y ago
Pointing out that just using Tor without changing your behavior might not be enough is definitely important. Using a separate piece of hardware that's dedicated just to routing all your traffic through Tor still has a lot of security benefits, since it limits the target surface just to Tor (and the OS stack required to run Tor), as opposed to your browser, OS or any other software you might use that could potentially leak your true identity.
- atmosx 12y ago
  What benefits does it have (except anonymity)?
- opendais 12y ago
  No, it doesn't. You are sorely, severely mistaken and misguided (just like the people creating this Tor product). > since it limits the target surface just to Tor (and the OS stack required to run Tor) as opposed to your browser, OS or any other software you might use that could potentially leak your true identity. That is completely 100% false. The attack surface of the browser remains along with the attack surface of the OS. All this does is mask your IP address/network origins. Tor is no more effective at "reducing the attack surface" of your OS & Browser as a VPN.
  - pfg 12y ago
    Of course it's still possible to exploit any software you might be running behind the router. That is why I agree it should be just one of many steps you ought to take if you care about anonymity. I never said this is a plug-and-play solution to internet anonymity. Still, hiding your IP address is one important factor in anonymity and probably the biggest use-case for Tor. Using a separate, dedicated device for this purpose makes it practically impossible for your IP address to leak e.g. because of a browser exploit. Case in point, when the FBI busted users of child porn sites in 2013, they used a Zero-day in Firefox [1] to leak the users IP addresses. This would not have worked for users with a device like this. They could've tried to gather evidence through other means using this exploit, but that's definitely harder than simply opening a network connection and would only work in cases where the exploit could access anything that would identify the user. (Obviously I'm not unhappy about child porn users getting busted, but I thought it would serve as a good example.) [1]: https://www.mozilla.org/security/announce/2013/mfsa2013-53.html https://www.mozilla.org/security/announce/2013/mfsa2013-53.h...

mrbill 12y ago

Also see the PORTAL travel router: https://github.com/grugq/portal https://github.com/grugq/portal It uses the GL-Inet travel router. They already run OpenWRT by default and have both LAN and WAN ports. Eliminates the problems of Kickstarter. I may do this tonight, as I have a few of them at home (they're great for "need a wifi bridge", "need a repeater", "friend needs a replacement router" type tasks). http://www.amazon.com/Gl-iNet-Router-Openwrt-Mobile-Control/dp/B00JKFE0FW http://www.amazon.com/Gl-iNet-Router-Openwrt-Mobile-Control/...

adultSwim 12y ago

Does anyone know if the following is a good idea: Run two SSIDs on a router: one regular internet, the other TOR only. TOR would be running on the router itself. Are routers too underpowered to run TOR? PORTAL looks good. Not sure why it has to have a separate 3g modem/wireless card. Any good reason to avoid ethernet? Reason to have this as a separate box?

atmosx 12y ago
Hello, I won't comment on the configuration because I don't know what you'd like to achieve. A router could run a tor node if the traffic is limited. If the traffic up/down increases (e.g. 50 Mbits up/down) then it can't handle on-the-fly encryption/decryption. However, you could install/run a tor node (private) on digital ocean for 5 USD/month and route all your traffic through the VPS. You could use Tor Browser or custom running on your Desktop. The configuration depends on how often you use tor and for what reason.

rsync 12y ago

What hardware is that ? Is that custom designed for their project, or are they using an existing travel router whose form factor I have never seen before ? I am always interested in the smallest possible non-wireless device with two ethernet ports ... all of the dual ethernet tp-link devices have wireless capability, so they are disqualified. Related: this, and every device like it, should be a plug ... even at the expense of compactness...

atmosx 12y ago
Hm, Carambola (without the WiFi module)?
noyesno 12y ago
Though they claim to have designed the hardware themselves, it looks very much like the NEXX mini-router: http://www.atupapa.com/17043400030en.html http://www.nexx.com.cn/index.php/home/detail?pid=199

atmosx 12y ago

Apparently the product was a huge success. I don't understand it's use case. Seriously I don't: * Is it hard to buy an RPi and set-it-up for a home Tor node? * To buy a VPS and setup a Tor-node then route all the traffic through it?! * Run tor-browser on your desktop when/if you need Tor? A use how has avg Joe's internet's workflow through Tor, protects himself from whom? Rogue internet caffe access points?! Anyway it seems neat but to me is pointless.

vertex-four 12y ago
> I don't understand it's use case. If there's a chance that the Government or some other entity will come after you for whatever you're doing on Tor, and you don't want there to be any way that your machines (clients or servers) could leak their public IP address, you could put them behind this.
- opendais 12y ago
  They can deanonymize you at the NSA's scale. They can deanonymize you with browser exploits at the FBI's scale. If you are going to be actively targeted using Tor is not sufficient. Tor is an effective defense against passive, generalized surveillance. It isn't effective against FBI/NSA-level resources because they will just drop 0 days in your path until you get hit by one.
  - vertex-four 12y ago
    We know of at least one Tor hidden service which was deanonymized because it leaked an IP address at some point. This protects against that flaw being likely to happen again. That is what the use case of this is. Of course it's not enough on its own. It protects against a specific attack in an easy-to-setup way.
    - opendais 12y ago
      IF you were serious about this, setup a router to TOR correctly using quality hardware. Use a router distribution (e.g. PFSense) on real hardware. Otherwise, you'll be just as screwed because your service will be ridiculously slow. This wouldn't be able to handle anything more than a consumer grade internet connection at relatively low speeds. "By our fourth round of prototypes we had created a model with 64mb memory and a 580mhz CPU. This not only runs the software well, it flies! At last happy with the board, we designed a simple, minimalist case in plain white to house it. The end result is our current model. We decided to name it the anonabox." Running CPU intensive processes (e.g. encryption) on a high throughput connection (e.g. web server) isn't going to work unless its only used by you and your 5 friends.

Xeoncross 12y ago

My problem with this is that I only want 10% of my traffic filtered over tor. This is useless to most people that want to stream movies or need some of their traffic over a regular network. I guess that you use the wired connection for Tor, wifi from the router for everything else? Then you still have to enable/disable the network card you want to use at the time. The current tor browser is perfect. I just switch back and forth between it and my regular browsers as needed.

deleted 12y ago
[deleted]
corysama 12y ago
If you are using Tor for a serious reason, you should have separate machines for Tor vs non-Tor activity. There was recently a high profile case (silk road?) where a user forgot to switch browser modes once before logging in to an monitored account to post a quick comment. It only takes once.
- Xeoncross 12y ago
  Good point, better safe than sorry, but in my case (and probably a large number of Tor users - I don't use Tor for "serious" reasons. Mostly to support privacy.

fuzzywalrus 12y ago

I'm pretty sure a VPN would achieve the level of security that most users looking for a "Tor" router would want, as Tor is a bit overkill, and silly if you're willing to commit to the behavior changes to make it effective. Perhaps someone should partner with a popular VPN like PrivateInternetAccess or another major VPN, as it'd allow people to continue using the services they know and love, and keep some of the prying eyes away from their unencrypted traffic.