Is Tor Pozzed?

Do people really trust Tor? >funded by US govt >only 3 hops >academic studies showing how moderately funded adversary (middle class white guy) can control enough nodes to deanonymize people >various people rotting in jail who conducted illegal activities over Tor I'm pretty sure it's pozzed. I'm wondering if it's better to just use a VPN. Threat model I'm thinking of here is someone that's actually doing illegal things on the internet. Disclaimer: I'm posting this over Tor, but only because I'm too poor to buy a VPN. Also I dont do anything illegal over the internet.

if you look at the actual case files for those people who got caught using dank net, they always get caught because they fuarrrk up OPSEC. Tor is not a magic band-aid, but it is not compromised either(at least not the FBI et al) otherwise it would be literally impossible for darknet transactions to take place.

>>8233 I know it's a fallacy to claim conspiracy and make wild assertions, but how amazing would it be (from their perspective) to own the darknet platform? It's not, to the best of everyone's knowledge, compromised. But what a goldmine that'd be. To allow transactions to go through and just watch and collect data. Arrest the important people when you have enough x-INT to justify it wasn't tor/darknet. Total tin-foil hat level, I know, but I mean if you were the NSA/FSB/Chinese Intelligence wouldn't that be the best scenario? Probably get some good blackmail/kompromat, too. If you had (b/m)illions to throw at exploit dev and covert C2 techniques and could break into almost anything, wouldn't you (as an intelligence agency)? In reality if they had that access they'd prob blow their load and arrest people immediately and bork the whole thing.

>funded by US govt Also open source with a public bug tracker. >only 3 hops I'm not aware of any Tor problems that would be mitigated with extra hops. Are you? >academic studies showing how moderately funded adversary (middle class white guy) can control enough nodes to deanonymize people Yeah, it's not perfect. It was never designed to stand up to an attacker that could snoop on all endpoints, for instance. >various people rotting in jail who conducted illegal activities over Tor Name the ones that got rolled up because Tor was broken. >I'm pretty sure it's pozzed. You seem easily convinced.

>>8234 the NSA uses Tor for their own ops. If they can own it, then so can the Chinese. It is in their interest to keep the Tor network secure. They know this, they're not dumb. >Total tin-foil hat level, I know, but I mean if you were the NSA/FSB/Chinese Intelligence wouldn't that be the best scenario? The NSA/FSB/Chinese Intelligence doesn't give two soykafs about civilians using Tor. As I said, it is in there interest to have lots of cover traffic. The FBI is a bunch of bumbling idiots and they are the ones who will try to catch you.

>>8236 I would like to point out that some people involved in darknet drug trafficking have been operating at huge scales for decades. There is no way the DEA/FBI would let that happen for that long.

ok, if your data leaves the US, !!IF YOUR DATA LEAVES THE BOARDERS OF THE UNITED STATES!! then there is a legal loophole that the packets sent WILL be picked up (and decrypted) to prevent muh terrorism Tor makes it so that your data leaves the US, guaranteed. So.... >but muh so many people using it there's no way they could crunch all teh numbres bro o.0 there is a giant datacenter in Germany where they crunch all the numbers

>>8238 how do they have access to literally all the data? The whole advantage of Tor is that having packets at one hop is worthless unless you're *also* running a honeypot which receives the packets, then you can do timing attacks. People get away with things on the Tor network far too often for it to be trivial to de-anonymize users, even for the NSA.

>>8239 also, you said they will decrypt the data... do you think they have a quantum computer already? In that case might as well throw out all internet anyway since that makes public key crypto worthless.

>the NSA uses Tor for their own ops. How do you know? Anyway, wouldnt it be better to route traffic through a botnet of compromised machines? Rather then letting anyone running an exit node inspect, analyze, log, reroute (and in some cases, alter) said traffic? There are only ~6000 relays in the whole network. So someone with enough money to buy a few thousand computers could theoretically perform a correlation attack on a huge portion of the traffic. And these dont exactly need to be super computers.. with a budget of less than 1 million you could spin up enough tor nodes to double the network. >Yeah, it's not perfect. It was never designed to stand up to an attacker that could snoop on all endpoints, for instance. You only need a few thousand nodes and you will see the entry + exit for a large portion of the traffic. Hidden services are even worse. There is some research on this available online, like the academics who took over facebook's hidden service (this is with the budget of a university project - pic related) Plus, darknet markets *are* shut down/seized on a regular basis. >In reality if they had that access they'd prob blow their load and arrest people immediately and bork the whole thing. This fails to take into account that intel agencies are heavily involved in the global drug trade. FBI might care to arrest drug dealers (if some politician gets enough of a hard on and pressures them to), but intel agencies certainly do not. These are their informants, customers and allies. >Total tin-foil hat level, I know, but I mean if you were the NSA/FSB/Chinese Intelligence wouldn't that be the best scenario? I'm not sure this is tinfoil hat. I don't see why the US State Dept. would continue to fund Tor if it's truly an untraceable, anonymous communication channel that any idiot can use. Anonymity is anathema to the dystopia.

>>8232 >only 3 hops It's client-controlled, you know. You can patch the client for more hops. Not that it would be of any help. >>8241 >Anyway, wouldnt it be better to route traffic through a botnet of compromised machines? That would be ideal, yes. Even better, run the tor protocol over a periodically randomized chain of compromised machines, with obfuscation at the entry.

>>8232 Funded by the US government because the military needs TOR, and they need it to work well. It was started by the army and it is used by the army. They also need a way for dissidents, undercover operatives and journalists in other countries to conduct their respective work in a secure and anonymous fashion. Yes the technology gets hijacked and abused by criminals. In the same way explosives, guns and drugs are. Just because a thing has a strong history (like the internet in general) to government research, does not mean it is purposefully compromised, ruining all the goals of it, just so they can catch someone buying weed. Yes AFAIK people who conducted illegal activities over TOR were not busted because of a failure of tor, but due to poor opsec and other security risks. TOR in and of itself is strong. The only issue with it that still needs to be addressed really, is the end points and traffic correlation attacks. If anyone has any thoughts on this, it would be interesting to hear them.

>>8237 >>8236 both very valid points >The FBI is a bunch of bumbling idiots and they are the ones who will try to catch you. and that's what brings me back to reality haha

So much disinformation in this thread. >>8232 > only 3 hops It's only 3 hops if you're using an exit to the clearnet or single hop rendezvous v3 onion service. >>8241 >pic related This vuln was four years old and predates v3 Onion services, which replaced SHA1/DH/RSA1024 with SHA3/ed25519/curve25519, as well as the requirement for the STABLE flag to be able to qualify to be an HSDir. Pure FUD. >>8243 >army It was developed by the Navy and DARPA. In the grand scheme of things, yes, the US has shown they aren't above using parallel construction. And yes, the NSA are gathering as much encrypted comms as they can and are storing them in the Utah datacenter for future decryption. And yes, Tor does have vulnerability to traffic correlation attacks. You can attempt to mitigate this by frequently changing circuits (through a complete reboot, no saving state) and limiting the amount of traffic you send to <100MB per session. I2P is slightly better with regards to the correlation, but it is clunky, cumbersome and slow so there isn't much widespread adoption yet. I was hoping that with all the troubles DNM sites it would have pushed more people toward I2P, but that doesn't appear to be the case. I also wish Sekreta were a thing but it doesn't look like much is happening on that front.

>>8232 reminder to fear the bad guys and not fuarrrking fbi or nsa and show me how a fuarrrking thief or corporation would spend money to get one autists set of connections if you are buy drugs you are already trash. take of your tinfoil hat bucko

>>8241 >How do you know? >Anyway, wouldnt it be better to route traffic through a botnet of compromised machines? Rather then letting anyone running an exit node inspect, analyze, log, reroute (and in some cases, alter) said traffic? if I were an NSA/CIA operator I would partly do that, partly use Tor, because it's basically free cover. Don't want someone to discover your botnet and Tor is pretty easy to see. >Plus, darknet markets *are* shut down/seized on a regular basis. almost always because they are poorly coded and have vulns like any other website. Or because the admins are otherwise idiots. >with a budget of less than 1 million you could spin up enough tor nodes to double the network. This would be noticed pretty fast(people have run experiments and they were noticed within minutes by tor devs) and there are mitigations to prevent too many nodes from joining the network and serving traffic at the same time, for this exact reason. >FBI might care to arrest drug dealers (if some politician gets enough of a hard on and pressures them to), they are under constant pressure. >I don't see why the US State Dept. would continue to fund Tor if it's truly an untraceable, anonymous communication channel that any idiot can use. not any idiot can remain anonymous just by using Tor. Dread Pirate Roberts was an idiot and he got caught for it. Say it with me: the network is usually the strongest link in the anonymity chain!

>>8232 Computer networking is a military invention. If you don't have your main workstation airgapped you might as well hand yourself to the authorities.

>>8245 my main problem with I2P is that the main implementation is pretty clunky and bad, and the DHT is less robust to certain attacks than Tor's authority system. It has gotten *a lot* better recently though, and it would be great to have more diversity in dark nets.

quick reminder that you don't have to totally trust or totally trust the Tor network. Trusting computers totally is bound to get you caught one way or another.

>>8252 *totally trust or totally distrust

>>8232 Literally just use Whonix. Run your own relay too if you want.

>>8252 ^^

I may be wrong, but I think some of the basic assumptions made in this thread are incorrect. >reminder to fear the bad guys and not fuarrrking fbi or nsa >There is no way the DEA/FBI would let that happen for that long (regarding drug trafficking) The primary purpose of intelligence agencies is to preserve the state and to help the state expansion. They don't care about people selling/doing drugs per se, it's the state-level consequences that they care about. Furthermore, if the drug trafficking is beneficial to the state, it is assisted. See the CIA and Kuomintang collusion or CIA and Gulbuddin Hekmatyar in the Afghan War. The SVR (Russian direct counterpart to the CIA, the FSB is more like a counterpart to the FBI) is no different. Chinese MSS is also no different. Everyone just has their own interest. The notion of ethics, ephemeral 'Good' and 'Bad' don't apply here. The ethics through history were mostly a beneficial façade for the elites to fool the masses. The "good guys" and the "bad guys" false dichotomy is the way to make peasants not go crazy. No one cares about "ordinary" people and what happens to them. It's a fact. In the same way the notion of 'ethical hacking' always made me cringe.

>>8308 fuarrrking exactly. The last thing three-letter agencies want is to completely stamp out drug trade. Ever since Nixon, drug legislation and enforcement has existed to provide a handy excuse to bring draconian law enforcement down on politically convenient people without ever getting rid of the problem, not to mention the pervasive sense of fear, the sleaze, the culture of resentment and punishment it inspires in 'good' citizens. It's all a tool of culture war and always has been. A truly ethical hacker right now would create a stuxnet that affects as much industry as possible and shut down all emissions to prevent our biosphere from collapsing and killing us all. That would be proactive and enlightened hacking. But doing damn bug bounties to help surveillance megacorps harden their systems is not white hat at all. That kind of attitude is so out of touch it's unbelievable. I don't understand how those people think they're helping the world. It shows baffling naivete. Well—it's because most of them are from the same culture as those corporations. They're self-declaring themselves just. Now 'hacker' just means any spineless day-job software engineer with no political activation at all, not even of the criminal sort. The ridiculous stock photo hackers wearing balaclavas while they type on their unbranded laptops actually deserve the term more. Regular old software engineers want the badass image but they simultaneously want it to mean something respectable and uncontroversial—they want to have that cake and eat it too. I know the various apocryphal stories of how the term originally started, but come on. That's so lame. Back then engineers were a bit more revolutionary. Oughta be ashamed of yourselves.

>>8308 you're comparing intelligence agencies to policing agencies. They have different aims, different means, different political pressures, etc. The FBI and DEA want to be seen taking down as many criminals as possible. This is a fact.

>>8310 It's different hierarchical levels of the same structure. They want to be seen sweeping up lots of 'bad' people and project lots of strength through constant arrests and action, but rest assured they never want to actually 100% end the drug trade once and for all. The right hand cleans while the left one makes a mess. It's part of the spectacle of power.

>>8311 no, they are separate agencies. It's really helpful to consider it this way, because when you get down to it the government is a big chaotic mess. Sure, the NSA sits "above" the FBI et al. But they don't control the FBI, not directly. And the FBI doesn't have the capabilities that the NSA does. They share some but not all.

>>8311 >>8312 you have to consider that most people in the government, even at the highest levels, are not aware of this over-arching power structure. They are looking out for their careers, and maybe some abstract nationalist ideology too, nothing more.

>>8310 >want to be see I agree, but "to be seen" != "to actually do". You don't tell the crowd all that you do, you just show the "good" things that you do, while omitting the things, which would be seen by the masses as "bad" or the things, which you've fuarrrked up. You'd never tell people you illegally spy on them/kill them/assist criminal activities outside of your country, because for an ordinary citizen that would be considered "bad". That would blow up the existing system and require investing time in producing cover-ups. You wouldn't want to waste time on that. The way I see it, maybe wrongfully so, all "power" agencies (the police/the intelligence/the army/etc.) within any country have a formal or an informal agreement with the elites. Elites reallocate resources in their favor, while the "power" agencies legitimize the reign of elites in exchange for parts of profit of those resources. It's a mutually profitable agreement, thus it works. Revolutions usually happen when the agreement fails (i.e. the elites stop paying the "power" agencies well enough, some of the actors in the "power" agencies diverge too hard from the existing political paradigm, etc.) My fundamental assumption is that all humans are driven by the perspective of individual gain, which makes them naturally form such structures. No one truly cares about drugs/climate/violence/etc. They are just tools of creating a good living for those who stand above the masses. Anything that makes the masses break their mental homeostasis is bad, hence it endangers the profits.

>>8312 >>8313 I'm not implying it's some kind of intentional master conspiracy, it's just emergent power dynamics that comes out of human nature. Like a gigantic Stanford prison experiment. Individuals are washed from responsibility for the greater actions of the system, are freed to pursue careerism and look out for themselves, but everyone is aware they're on the same 'side' and are generally collaborating through individual, atomized actions and campaigns. There doesn't need to be direct orders issued for police to know that the ones roughly providing the greater strategy to their smaller tactics are the feds, and that above them are still more powerful orgs. It's still a hierarchy nonetheless. The obscurity and technicality that denies that is a feature. Authority historically begins as explicit top-down violence, but that structure quickly dies through revolution and the remainders default to this kind of unorganized para-system. The people keep looking out for the old system because they think history literally repeats instead of merely rhyming. It's how modern democracies maintain overt rule. It's still connected, yet more in the same manner of independent cells instead of old-fashioned monoliths. But the results are often the same, save for that resistance is less likely and more difficult to direct.

>>8315 >like a gigantic stanford prison experiment it was only an "experiment" in the loosest meaning of the term.

>>8232 > I'm wondering if it's better to just use a VPN. > I'm too poor to buy a VPN. I guess not for you. And it's the same for many other people. People who use Tor just as a proxy for posting on clearnet, do it usually just because they can't afford a VPN.

>>8232 >I'm posting this over Tor, but only because I'm too poor to buy a VPN. You can find a VPN service with a free plan and no logs policy. They are either slow or have a data limit per month, but it's still something.

Decent, technically sound, reasonably fast, reliable, free VPNs exist. I use a couple of them myself occasionally for casual stuff. I'm not going to name them because I don't want them to go away because they were flooded by skiddies or cp. I only mention them to dispel the notion that they don't exist. There's also no reason whatsoever to avoid using Tor as a VPN type service, if you're not concerned about anonymity. The more users, the better. Many of the circuits are fast nowadays. If you get a slow one, just change circuits. Just don't be a dick and abuse it.

If you want a good video on how not to use TOR watch this. It explains the basics of time-based attacks amongst other things (https://www.youtube.com/watch?v=eQ2OZKitRwc)

Also, in my opinion, it's better to use Tor over some random VPN company. Especially if you have to pay for the VPN service, they have all your information and you have to TRUST that they are not storing logs and won't hand over your information to some government agency.

>>8336 >technically sound maybe for the purpose of a VPN yes, but not for privacy

NSA, probably CIA have compromised Tor. Their motives are deeper than just policing, so they don't care about anything like drugs, cp, weapons, etc. FBI-DEA-ATF-etc hasn't compromised Tor, if they had, it wouldn't be secure for dark markets.

Everyone here acts like parallel construction isn't a thing. https://en.wikipedia.org/wiki/Parallel_construction

>>8341 Oh, horseshit. NSA hasn't "compromised Tor" as far as anyone knows, and I get sick of hearing this stupid soykaf from people who don't know wtf they're talking about.

>>8338 Well, you can send Mullvad cash in an envelope, get an account number in an anonymous email, without providing any personally identifying information. The only thing they know is the connecting IP address, so if you're careful with related opsec they have very little to go on. I guess if you're really paranoid you'd handle the cash and envelope without giving up fingerprints or DNA.

>>8339 Agreed.

The simplest and best answer is to avoid trusting Tor entirely. If you're planning to do something illegal over Tor, why wouldn't you venture out somewhere without cameras at night, connect to some old wi-fi, and use Tor to do whatever you're doing through that? Uncertainty and mistrust can easily be mitigated by layering things.

>>8246 >the US government isn't the bad guys

Whats good opsec if you're just browsing around looking at various onion sites, theres been a nagging curiosity about how things look and function on there

>>8544 Disable scripts. Don't post personal info.

>>8245 >limiting the amount of traffic you send to <100MB per session. how do you do that

>>8550 Any other things I should watch out for?

https://www.mail-archive.com/tor-dev@lists.torproject.org/msg10854.html anyone have any more info on this? looks like traffic correlation is a lot easier and far more accurate than was stated in the past. even though this is a year old there doesn't seem to be much discussion on it. thinking that we should try to have a mass exodus away from tor and go to i2p, but im not sure what the current state of i2p -> clearnet outproxies are.

>>8551 this used to be a decent idea. you would do it by killing the tor service entirely and establishing all new circuits, or the easier/safer option of just rebooting your box. but it looks like that won't be effective anymore, as the DeepCorr attack I mentioned in the other post looks like it only needs about ~900KB for 96% accurate traffic correlation.

>>8558 >96% With a userbase of at least 1 million that's 39,999 false positives

>>8591 I like those odds! Time to hit Vegas!

>>8232 Tor is totally secure. Sure, over 81% of Tor traffic can be de-anonymized http://www.impactlab.net/2014/12/01/81-of-tor-users-can-be-de-anonymized-by-analyzing-router-information-study/ But you could randomly be in the 19% of Tor users that are unable to be tracked unless the trackers deploy any other de-anonymizing techniuque against your unique Tor using ass.... Screw it. We need a Lain friendly system using the internet that keeps us anon. There isn't one because folks that write those get killed or COINTLEPRO'd until they either go nuts or might as well be. See also Ian of Debian going nuts due to COINTELPRO. [Waves... Hi! To the fuarrrkers that be. I got technology too, wanna fuarrrk me good? When I was 16 I fuarrrked you.] Hint, that's a Djed (digit) tower on the USAF 1947 seal, from Egypt? Well, something like that... It's just a coil within a coil of wire than amplifies current and gives the "all seeing eye" the power to see abroad, and guess what? Nowadays the sigil on the shield with Horus (falcon / eagle) and the Sun atop it, doesn't have a SQUARE wave to "square the circle" in the alchemical way, but mine does, fuarrrkers. TL;DR: Passive radar exists, plebs. They see you and can hear your keypresses typing in the password as it interrupts the waveform the radar bounces through your keyboard. fuarrrk off, if you actually need to be dark, you're already a Wizard o the Dark, or else you don't know soykaf and are playing around trying to hide in wires what is seen wirelessly.

>>8348 Parallel construction only exists because the gov wants to hide the Wireless Technology of CELLDAR / passive radar that is spying on your silly asses while you think you're doing something secret with wired tech.

>>8232 The USG is not one agency.

>>8599 kevin mitnick is telling me that the CIA are using passive radar to track my keyboard usage as we speak only on lainchan

>>8599 impressive tenacity lain fuaark geopolitic angle, modern tech agle. specific interest in Djed and lore of this. novel concept please go on

Aaaaaaand we've got full schizoposting. Glad to see this thread get turned into a complete dumpster fire. TL;DR we should migrate to I2P or Sekreta or something, who the fuarrrk knows. Either that or you can lean into the whole "gubbment sees and hears everything you do by wirelessly tapping into everything you type" angle.

>>8614 I was hoping to learn what is good opsec for using tor

>>8232 "US Government" is not one entity. All Tor busts so far are due to bad Opsec; something Tor can't help you with. It's entirely possible they are sitting on a 0-day and just waiting for something major to use it on, however. But your messages are likely not it.

>>8615 Just use the latest release of Tor Browser and check the signature. Set the security setting to maximum so javascript is disabled. Always use TLS so the exit node operator can't read your traffic, or use onion addresses (preferable). Don't put personally identifiable information in the data stream like every fuarrrkhead who ever got caught. Don't do anything that sends trackable information outside of Tor (like torrent). Don't add addons to Tor Browser, change the browser window size, or do anything else that makes it look distinct. Try not to type, browse, or do anything else in a distinctive way. Optionally, use a VPN a lot so your ISP can't easily tell when you're using Tor. In general, use common sense and don't do stupid things. No adversary has super powers.

>>8622 Thanks for the advice lainon, looks like I've been doing most of the stuff you mentioned, what do you mean by browsing in a distinctive way? I know typing is distinct for every person but I can't figure out how browsing can be distinctive, like visiting websites you visit outside tor and doing things the same way?

>>8599 >See also Ian of Debian going nuts due to COINTELPRO. Ian of Debian hadn't existed for many years when Ian of Docker died. I've heard all the goofy conspiracy theories about how the glowniggers had to get to Ian to compromise Debian, but Ian was a regular-ass software architect working in the corporate world when he went nuts, and he had nothing to do with Debian anymore when he became an hero.

>>8232 https://pando.com/2015/03/01/internet-privacy-funded-by-spooks-a-brief-history-of-the-bbg

>>8341 Fun fact: ISIS had a tor hidden service that the alphabet soup agencies gave up and said they couldn't take down because it was a hidden service. Anonymous (or, you know, some kids calling themselves that) figured out that an embedded function was running over the clearnet and figured out where the server was from that.

>>8998 Most of the onion sites are badly configured. You can find the real IP for like, 50%? of them just fuarrrking around on Shodan/Censys. Source: I do it when I'm bored. I don't even work in the infosec field.

So how secure are you with all JS functions disabled and no personal info being entered anywhere

>>9000 >Most of the onion sites are badly configured. Most of the onion sites you hear about getting busted are badly configured. It's called parallel construction. Law enforcement uses undisclosed vulnerabilities to track down onion sites but they don't want to disclose them in court >yes your honor, the defendant's onion site was leaking the real IP address for 5 years and no one noticed because everyone is *that* stupid

Tor is probably not safe to sell drugs on anymore, no.

>>8998 >ISIS had a tor hidden service that the alphabet soup agencies gave up and said they couldn't take down because it was a hidden service why would the alphabet soup want to take down a recruiting site for ISIS, a militia that they support?

>>9009 The implication being that all alphabet soups are on the same side.

What about running Tor through tails

>>9022 That doesn't make a difference. If Tor itself is compromised (IMO it isn't) then it doesn't matter if you use Tails or not - Tor is compromised, and the traffic on it as well, regardless of the OS you use. I'd like to repeat: i highly doubt it's compromised.

>>9023 Tails at least doesn't leave forensic evidence behind so it's still better.

tor's compromisibility isn't a matter of opinion. it is fact that tor is not only vulnerable to correlation attacks but it has already suffered some pretty severe breakages (2015). that said my tor browser just did an auto update? i'm on someone else's windows box (gag), and just recieved a notification that tor browser just updated and it needs to restart. it didn't tell me before hand, it just made a connection on it's own with no notification whatsoever and downloaded some soykaf. that's a great way to break opsec.

>>9025 It's better but it still makes no difference to the topic discussed in this thread, which is "is Tor cyberhumped"? If Tor is "cyberhumped" then Tails is as well; it depends on Tor.

i did some due diligence on the orbot app a few years back and found a forum post from the devleoper while it was still in its early stages. he posted an early version of the project for the other users to look at and some security holes were discovered. it's been a while since i've seen the post so i don't remember exactly how he replied, but it was alarmingly explicit about leaving it open for backdooring the project. i archived it but have since lost the data. anyone else seen this?

>>9032 I'd be very interested in seeing proof of this. I use Orbot now and then. If what you say is true then why was it done on a public forum? It's maintained by the guardian project now I think, so I'd be surprised if these vulns haven't been found and patched by someone else. I'm still interested to see... Keeping my mind open.

>>9028 TBB has never done this to me. That being said I've never run it on Windows (which you shouldn't be doing, anyway). This is a "feature" inherited from Firefox that's enabled by default. You should be able to turn it off in settings pretty easily.

>>9028 > it just made a connection on it's own with no notification whatsoever and downloaded some soykaf. Tor browser is optimized for casuals who don't know what they're doing. All the options for disabling stuff like that are available. You just have to be ... a non-casual and know what you're doing. user_pref("extensions.update.autoUpdateDefault", false); user_pref("extensions.update.enabled", false);

>>9035 sorry i'm not a non-casual. i just wasn't born with the entire body of future tech knowledge minutae pre-installed at birth. i do have other modules pre-installed, though. tech stuff is something that takes me a little more time, even as a non-casual. I went to about:config ( i know that part ) and put this in search and nothing came up.

>>9231 this looks like javascript. where would i put this for persistence?

>people itt can't navigate into about:config this is the new low for lainchan, shamefur dispray

>>9232 in your profile directory, in a file named user.js Im not the guy who suggested this. I don't know where the profile dir is for TBB. Or whrther its a good idea to change these values. For Firefox on Linux the profile dir is: ~/.mozilla/firefox/abcd3fgh1.default/

>>9023 > If Tor itself is compromised (IMO it isn't) then it doesn't matter if you use Tails or not This is technically true, but at the application level Tor Browser Bundle is more likely to get compromised (more targets, larger attack surface) than Tails. >>8437 >If you're planning to do something illegal over Tor, why wouldn't you venture out somewhere without cameras at night, connect to some old wi-fi, and use Tor to do whatever you're doing through that? If you're doing this you need to randomize your MAC address. I'm pretty sure Tails does this for you or is easily configurable to do so.

There are only 6000 Tor relays and less than 1000 exit nodes. Just look at this: https://metrics.torproject.org/bubbles.html#contact-exits-only Who the fuarrrk are most of these people? Not to mention, look at the map of the NSA's fiber taps from well over 6 years ago; they were fuarrrking everywhere then and you know it's not any better now. Tor's great, I use it, it protects me from the adtech botnet, sites tracking me, my ISP tracking me, gives some cover to people who need it more than I do, gives access to dark web sites, and it probably does hide a good portion of my soykaf from the glowfriends at the cost of bumping me up a few spots in their list just for using Tor. But it would be foolish to blindly trust it alone to always hide all your traffic now and forever from everyone, and not just because of traffic correlation attacks: the biggest attack on Tor users that we know of was a Firefox 0day. Some stuff to keep an eye out for are mixnets like Katzenpost that have bandwidth and latency overhead to avoid a passive adversary for certain applications. But even then, you have to trust their code, their build (is it reproducible?), and your machine.

One more Tor angle people forget about, it's called "website fingerprinting" (https://arxiv.org/pdf/1801.02265.pdf) Basically, use of most websites, encrypted or no, will have a traffic fingerprint based on the size of their content, loading order, dependencies, return traffic, etc. If someone wants to know who's accessing ied-diy.club over Tor or VPN, they can theoretically query their traffic database for the fingerprint to narrow down the targets. Obvi this doesn't tell them *why* you were there or exactly what you were doing, but it is information.

the fuarrrk? You should always be connecting to tor over a vpn anyways

>>9248 No. Not a all. You are putting your security in the hands of the VPN provider. https://trac.torproject.org/projects/tor/wiki/doc/TorPlusVPN >This can be a fine idea, assuming your VPN/SSH provider's network is in fact sufficiently safer than your own network. >[if] your VPN/SSH was actually following through on their promises (they won't watch, they won't remember, and they will somehow magically make it so nobody else is watching either), then you'll be better off.

Regarding the recent operation that shutdown a cheese pizza hidden service: 1-) How the server was found: "41. On or about September 1, 2017, law enforcement reviewed the source code of Welcome To Video's homepage, which could be viewed by right-clicking on the website and selecting 'View Page Source.' 42. In reviewing the source code, law enforcement discovered that Welcome To Video failed to conceal one of its IP addresses, 121.185.153.64. 43. On or about October 24, 2017, law enforcement again observed that the Welcome To Video homepage failed to conceal another one of its IP addresses, 121.185.153.45. 44. These two IP addresses resolved to a telecommunications provider in South Korea and were registered to an account serviced at the defendant's residence." 2-) How the operator was found: "47. On or about February 23,2018, an undercover agent sent 0.03 BTC, worth at that time approximately $287.79, to a BTC address that was provided by Welcome To Video. On or about February 24, 2018, the defendant then transferred these funds to Defendant's BTC Address 49. Defendant's BTC Address 1 was stored in an account ending in 209A at BTC Exchange 1. The signature card at BTC Exchange 1 revealed that this wallet was in the name of the defendant, and listed his cell phone number and his email account ("Defendant's Email Account") 50. On or about December 19, 2016, BTC Exchange I emailed Defendant's Email Account 1 a receipt for a BTC transaction involving the account ending in 209A cashing out BTC to a bank account ending in 0477. 51. The bank account ending in 0477 was held in the name of the defendant. 52. The defendant controlled at least four email accounts, all of which he repeatedly accessed from the IP address of 121.185.153.64, which was the IP address associated with Welcome To Video." Yet again, cybercriminals were caught by having careless OPSEC and failing to properly protect their hidden services, not due to an exploit on Tor.

I was listening to tor creater Digledine's Defcon 25 talk about new onion services and came across an interesting quote @ time 13:53 "I actually know the people that run 2/3s of tor relays by vol-- capacity." NO ONE should have that knowledge. That means two things: not a lot of people control 2/3s of the relays, anonyminity is compromised or compromisable. Or the guy said some bullshit and/or this sleep deprived hikikimori lain is blowing things out of proportion.

>>8232 >funded by US govt You mean like the internet?

>>9244 This is why you use the Tor Browser: https://blog.torproject.org/browser-fingerprinting-introduction-and-challenges-ahead. Attempts are being made to minimize browser fingerprinting by making all Tor Browser fingerprints exactly the same. Also see the `privacy.resistFingerprinting` about:config flag in Firefox, which was merged _from_ TBB. In short: > In March 2007, the changelog for the Tor button indicated the inclusion of Javascript hooking to mask timezone for Date Object. > In the end, the approach chosen by Tor developers is simple: all Tor users should have the exact same fingerprint. > Comparing with the one from Firefox, we can see notable differences. First, no mater on which OS Tor Browser is running, you will always have the following user-agent: Mozilla/5.0 (Windows NT 6.1; rv:60.0) Gecko/20100101 Firefox/60.0 > As Windows is the most widespread OS on the planet, TBB masks the underlying OS by claiming it is running on a Windows machine. Firefox 60 refers to the ESR version on which TBB is based on. > Other visible changes include the platform, the timezone, and the screen resolution.

>>9278 That's browser fingerprinting, not website fingerprinting, which is completely agnostic to the Tor client you're using.

https://blog.torproject.org/pride-and-privacy cyberhumped and gay

>>9308 Everyone has to jump on the politics bandwagon these days don’t they.

I guess you real men won't be using Tor any more, right? Bye.

>>9277 The US goverment created the TCP/IP network layer that is used today on the modern web. You can thank the british for making the HTTP protocol that this very website is using. Giving the united states full credit for modern internet would be dishonest.

>>9311 Eyeroll. Yeah, yeah, they helped. That's not the point, though—he's saying that the very basis of all modern communications has been built on infrastructure laid down by state security agencies. It's not really a time that makes sense to angle for credit.

>>9311 HTTP/WWW are completely superflous to the operation of the internet and it would be better off without them. Anyone who thinks they're a vital or fundamental component of the internet is dumb as a load of rocks.

>>9313 >Eyeroll Don’t do that

>>9314 based, I like it.

>>8232 Using only Tor is probably useless. To be really secure you should probably use all the countermeasures, a dedicated machine, etc. Unless you are a whistleblower or doing illegal activities, at some point you will have to deal with the fact you got only so many hours in a day and you just want to get things done. With Tor or even unusual browsers ou have to solve captchas almost everywhere. Soon enough Google might start forcing tough captchas on everyone not using Chrome, what do? I'm starting to think there is no point in any of this for the average user because if you're not doing every single thing required to keep yourself secure you are not secure at all. Lately I'm wondering if I should go back to Chrome and just forget about privacy, 'cause trying to use Searx, DDG and Startpage made me understand this battle is lost. As long as people are unwilling to actually give money to these projects there will be no change, and people love free services too much for this to ever happen. >I'm wondering if it's better to just use a VPN. VPNs are just another 3rd party you have to trust. I don't want to be debbie downer and maybe it's my fault for not doing things right, but I'm so tired of unbreaking sites, bothering about programs, security, tracking, cookies and other stuff when I have things to do that I want to spend my time on. And the constant awareness of corporate monopoly and general paranoia about Google knowing everything about my life is adding another layer of stress to my life. Not to mention there is no end to the rabbit hole and the line between security and conspiracy theory is blurred.

>>9479 >I'm starting to think there is no point in any of this for the average user because if you're not doing every single thing required to keep yourself secure you are not secure at all. this is just not true. Some security/anonymity is way better than no security/anonymity. Frankly, I'm starting to get tired of it too, but I want to just stop using corporate bullshit altogether. I've been migrating that way for a long time. I just don't use any site that requires me to spend 20 minutes updating umatrix rules to unbreak it, and if I have to use it for some financial reason I fire up a different firefox instance.