6 ms·

As a user and proponent of Tor, I think products like this are a bad idea. Buying a box that promises "reliable anonymity" without understanding all the behavi

As a user and proponent of Tor, I think products like this are a bad idea. Buying a box that promises "reliable anonymity" without understanding all the behavioral changes necessary to support that is dangerous. Educating users all over the world on how to resist censorship and protect their anonymity is important. Buying a piece of hardware doesn't achieve that.

pfg 12y ago
Pointing out that just using Tor without changing your behavior might not be enough is definitely important. Using a separate piece of hardware that's dedicated just to routing all your traffic through Tor still has a lot of security benefits, since it limits the target surface just to Tor (and the OS stack required to run Tor), as opposed to your browser, OS or any other software you might use that could potentially leak your true identity.
- atmosx 12y ago
  What benefits does it have (except anonymity)?
- opendais 12y ago
  No, it doesn't. You are sorely, severely mistaken and misguided (just like the people creating this Tor product). > since it limits the target surface just to Tor (and the OS stack required to run Tor) as opposed to your browser, OS or any other software you might use that could potentially leak your true identity. That is completely 100% false. The attack surface of the browser remains along with the attack surface of the OS. All this does is mask your IP address/network origins. Tor is no more effective at "reducing the attack surface" of your OS & Browser as a VPN.
  - pfg 12y ago
    Of course it's still possible to exploit any software you might be running behind the router. That is why I agree it should be just one of many steps you ought to take if you care about anonymity. I never said this is a plug-and-play solution to internet anonymity. Still, hiding your IP address is one important factor in anonymity and probably the biggest use-case for Tor. Using a separate, dedicated device for this purpose makes it practically impossible for your IP address to leak e.g. because of a browser exploit. Case in point, when the FBI busted users of child porn sites in 2013, they used a Zero-day in Firefox [1] to leak the users IP addresses. This would not have worked for users with a device like this. They could've tried to gather evidence through other means using this exploit, but that's definitely harder than simply opening a network connection and would only work in cases where the exploit could access anything that would identify the user. (Obviously I'm not unhappy about child porn users getting busted, but I thought it would serve as a good example.) [1]: https://www.mozilla.org/security/announce/2013/mfsa2013-53.html https://www.mozilla.org/security/announce/2013/mfsa2013-53.h...
atmosx 12y ago
I'm 100% that most of the people who use tor through these devices, use it because it's cool. They will try login to their Gmail account and their Facebook page or watch Netflix through it. Some might use it for torrents. That's about it... I don't believe that it will be used to anonymise their internet profiles. They probably need just some sort of authority circumvention.
- opendais 12y ago
  That is what I'm afraid of. Popularizing Tor in this manner is actively harmful to the Tor network and doesn't provide any real benefits. Tor operates its network on a limited budget. The people this is marketed too should use a VPN if they want to circumvent local network policies. https://blog.torproject.org/blog/bittorrent-over-tor-isnt-good-idea https://blog.torproject.org/blog/bittorrent-over-tor-isnt-go... > The attack is actually worse than that: apparently in some cases uTorrent, BitSpirit, and libTorrent simply write your IP address directly into the information they send to the tracker and/or to other peers. Tor is doing its job: Tor is _anonymously_ sending your IP address to the tracker or peer. Nobody knows where you're sending your IP address from. But that probably isn't what you wanted your Bittorrent client to send. > So what's the fix? There are two answers here. The first answer is "don't run Bittorrent over Tor". We've been saying for years not to run Bittorrent over Tor, because the Tor network can't handle the load; perhaps these attacks will convince more people to listen. The second answer is that if you want your Bittorrent client to actually provide privacy when using a proxy, you need to get the application and protocol developers to fix their applications and protocols. Tor can't keep you safe if your applications leak your identity.
  - blacksmith_tb 12y ago
    I am surprised in fact that some of the VPN providers don't sell small cheap routers like these, set up to route all traffic through their VPN.
    - amalag 12y ago
      VPN providers do sell them. Not so cheap though. It is time intensive, they have to get regular routers and install Tomato or DDWRT. Is kind of interesting since you can get ASUS N routers that can run DD-WRT for $20-$25. They don't sell much because tech savvy people will just do it themselves.

pfg 12y ago

Pointing out that just using Tor without changing your behavior might not be enough is definitely important. Using a separate piece of hardware that's dedicated just to routing all your traffic through Tor still has a lot of security benefits, since it limits the target surface just to Tor (and the OS stack required to run Tor), as opposed to your browser, OS or any other software you might use that could potentially leak your true identity.

atmosx 12y ago
What benefits does it have (except anonymity)?
opendais 12y ago
No, it doesn't. You are sorely, severely mistaken and misguided (just like the people creating this Tor product). > since it limits the target surface just to Tor (and the OS stack required to run Tor) as opposed to your browser, OS or any other software you might use that could potentially leak your true identity. That is completely 100% false. The attack surface of the browser remains along with the attack surface of the OS. All this does is mask your IP address/network origins. Tor is no more effective at "reducing the attack surface" of your OS & Browser as a VPN.
- pfg 12y ago
  Of course it's still possible to exploit any software you might be running behind the router. That is why I agree it should be just one of many steps you ought to take if you care about anonymity. I never said this is a plug-and-play solution to internet anonymity. Still, hiding your IP address is one important factor in anonymity and probably the biggest use-case for Tor. Using a separate, dedicated device for this purpose makes it practically impossible for your IP address to leak e.g. because of a browser exploit. Case in point, when the FBI busted users of child porn sites in 2013, they used a Zero-day in Firefox [1] to leak the users IP addresses. This would not have worked for users with a device like this. They could've tried to gather evidence through other means using this exploit, but that's definitely harder than simply opening a network connection and would only work in cases where the exploit could access anything that would identify the user. (Obviously I'm not unhappy about child porn users getting busted, but I thought it would serve as a good example.) [1]: https://www.mozilla.org/security/announce/2013/mfsa2013-53.html https://www.mozilla.org/security/announce/2013/mfsa2013-53.h...

atmosx 12y ago

I'm 100% that most of the people who use tor through these devices, use it because it's cool. They will try login to their Gmail account and their Facebook page or watch Netflix through it. Some might use it for torrents. That's about it... I don't believe that it will be used to anonymise their internet profiles. They probably need just some sort of authority circumvention.

opendais 12y ago
That is what I'm afraid of. Popularizing Tor in this manner is actively harmful to the Tor network and doesn't provide any real benefits. Tor operates its network on a limited budget. The people this is marketed too should use a VPN if they want to circumvent local network policies. https://blog.torproject.org/blog/bittorrent-over-tor-isnt-good-idea https://blog.torproject.org/blog/bittorrent-over-tor-isnt-go... > The attack is actually worse than that: apparently in some cases uTorrent, BitSpirit, and libTorrent simply write your IP address directly into the information they send to the tracker and/or to other peers. Tor is doing its job: Tor is _anonymously_ sending your IP address to the tracker or peer. Nobody knows where you're sending your IP address from. But that probably isn't what you wanted your Bittorrent client to send. > So what's the fix? There are two answers here. The first answer is "don't run Bittorrent over Tor". We've been saying for years not to run Bittorrent over Tor, because the Tor network can't handle the load; perhaps these attacks will convince more people to listen. The second answer is that if you want your Bittorrent client to actually provide privacy when using a proxy, you need to get the application and protocol developers to fix their applications and protocols. Tor can't keep you safe if your applications leak your identity.
- blacksmith_tb 12y ago
  I am surprised in fact that some of the VPN providers don't sell small cheap routers like these, set up to route all traffic through their VPN.
  - amalag 12y ago
    VPN providers do sell them. Not so cheap though. It is time intensive, they have to get regular routers and install Tomato or DDWRT. Is kind of interesting since you can get ASUS N routers that can run DD-WRT for $20-$25. They don't sell much because tech savvy people will just do it themselves.