(untitled)

What are the recommended ways of using Tor when using it for normal websites and onions without compromising your safety or anonymity? What I have learned: >Use Tails >Disable JS >Don't enlarge Tor's window >Don't use any personal information anywhere >Don't log in with existing accounts on the clearnet >Don't write anything, you can be identified by your way of typing Anything else?

Be aware that third-party trackers can build a profile of you across different websites if you visit them during the same session.

>>9058 The new Tor Browser Bundle makes resizing not as dangerous anymore. It will set the window.innerWidth and window.innerHeight to a reasonable default value. For me it's 1800x900. I'm on a 1920x1080 monitor.

The most important thing you omitted was to always encrypt your traffic independently of Tor using TLS. Otherwise the Tor exit node operator(s) can read your traffic.

>>9065 As I understand, aren't websites with HTTPS already running TLS? and onion sites are using some other kind of encryption

>>9066 Exit nodes don't apply to onion sites and yes, only use HTTPS sites is what >>9065 means in laymans terms.

>>9058 1. Tails' Tor browser is different from vanilla Tor browser, hence the different fingerprint, mostly because it has uBlock Origin instead of NoScript. Tails does not prevent you from possible leaks because Tor routing software and browser itself run on same OS. 2. Most people do not disable JS, you will be more unique this way 3. a. How do you prevent accidental window enlarging? b. Most people use it in full or half-screen because 1000x1000 is damn small c. Tails has no means of preserving window size if your screen resolution is somehow lower in any dimension, many notebooks have 720-1080 pixels height, with task bar and top portion of browser window it cuts window height tremendously, and there is a way to determine view port height through media queries: https://arthuredelstein.github.io/tordemos/media-query-fingerprint.html 4. Obviously, applies to normal Internet too 5. Unless you are in China and need to access faceborg for some reason 6. You mean, by the way of sentence construction, grammar and typos? Yes, there are very accurate ways of determining person's first language and dialect by the way he/she uses English grammar. Here's an example: https://archive.gameswithwords.org/WhichEnglish/ >>9065 So what, do Tor exit node operators care if I access some gophers? Gophers are un-encrypted. It is possible to see what contents of website person is accessing over https by analyzing traffic pattern, there is no obfuscation in https, obviously it applies to public contents only as those could be compared, for example: lainchan boards.

>>9068 >2. Most people do not disable JS, you will be more unique this way Ain't there the issue of being able to deanonymize Tor users through JS? Why would you keep it going if it's an anonymity issue

I disregard all of those things. You can use Tor without going full paranoia and it will still be a positive thing compared to just browsing the clearnet directly.

>>9070 Most people use it for circumventing firewalls and govt censorship, for their normal people purposes: access a torrent site or porn, they don't care about anonymity such situation. It is possible to deanonymize a non-isolated browser giving an attacker the real IP, real OS and hardware fingerprints, but in case of isolated network routing like on Whonix - assign a unique identity to such person when javascript malicious code manages to escape the browser only finding itself in a virtual machine or hardware not specific to this person's daily activities.

>>9068 >So what, do Tor exit node operators care if I access some gophers? Gophers are un-encrypted. It is possible to see what contents of website person is accessing over https by analyzing traffic pattern, there is no obfuscation in https, obviously it applies to public contents only as those could be compared, for example: lainchan boards. not the lain you're replying to but i think the general idea is that you probably aren't too concerned with exit node operators knowing what pages you're accessing (obviously there is some profiling that can be done with this knowledge, but I don't think it's the crux of the https argument), but if you ever have to log in to anything or provide any other identifiable information, you obviously don't want the exit node operator stealing your info. >mostly because it has uBlock Origin instead of NoScript. Tails's tor browser has NoScript, it's just not in the menu bar or configured to deny everything by default. >>9070 >Ain't there the issue of being able to deanonymize Tor users through JS? Why would you keep it going if it's an anonymity issue Yes, along with all the other spooky things associated with Javascript, e.g. browser exploits, drive-by malware, etc. Unfortunately, some sites don't work without it, some sites think you're a bot without it. If your use case requires these sites, you'll have to enable it for them. Risk associated with running Javascript also depends on your setup. Maybe your machine or network's entire traffic is routed through Tor, in which case you don't really need to worry about deanonymization in the form of malicious JS exploiting the browser and subverting the proxy settings to get your real IP, since it will still be routed through Tor. Maybe your setup also involves a VM that gets reset to a clean snapshot after each use so that even if someone uses JS or some other means to exploit your machine and backdoor it, it doesn't matter because it only poisons that one session.

>>9068 >Most people do not disable JS source? even if true, I think it's worth it to prevent exploits >>9073 >just not in the menu bar or configured to deny everything by default It behaves the same way as normal Tor Browser, if you increase security level it will deny everything

>>9058 I don't use Tor for any illegal activities and so my threat model isn't necessarily governmental entities. I use the Tor Browser with JavaScript disabled in about:config and lately I've stopped even temporarily allowing cookies for some websites in about:preferences. There was a bug in NoScript which allowed JavaScript to execute is one reason to do this. I do use a maximized window, because I want to and it's my understanding you need JavaScript to get at this information anyway. I make posts such as this one over Tor, without worry, and I may change my writing style if I want to be more certain it won't be connected with any other posts. If one were to use Tor for potentially illegal activities, it should be merely one layer of the security. Using Tor with Tails on a machine that can't be connected to you from an Internet access point that hasn't personally identified you in a location you're not known to be in at a time when you're ostensibly doing something else would be a good way to do it. I use several websites that don't bother with encryption and I've never had my connection interfered with from what I've been able to notice. It's my understanding you're truly better off trusting complete strangers than an ISP you pay, as some of those are known to intercept and heavily modify traffic. I also voluntarily cut my contact with several types of websites. I avoid URLs from any of the large surveillance conglomerates and Cloudflare is the biggest issue, since it does interfere with more than one website I use, meaning the traffic could perhaps be correlated. If you don't want to enable JavaScript just to use a website, and you shouldn't, get better at reading the source and also learn to use tricks like disabling all of the CSS in the view option. Even malicious CSS is becoming an issue on the modern World Wide Web. >>9071 I agree. It's a good thing to use Tor for casual Internet traffic, as that makes it all more legitimate and less prone to guilt by association. It's also easier to avoid the paranoia by simply not using websites which are trying to harm you to start with, such as Lainchan.

What about exploring onions, it's inevitable to come across things of a legally questionable nature, and I'd rather not get in any trouble because of that, I'd still like to go on and see whats happening there

>>9154 >it's my understanding you need JavaScript to get at this information CSS is enough. https://blog.torproject.org/new-release-tor-browser-90/comment/284634#comment-284634

>>9165 I just saw how horribly I worded this, what I meant: I want to go exploring .onions' to find what kind of communities have formed there, forums, imageboards, file sharing sites, etc. I know that in searching for places like these I will eventually come across places that are of a legally questionable nature and would like to keep myself from getting in trouble when I do. But I would like to continue searching and find what kind of communities have formed, I feel the internet as we have it today is far too corporate, creativity and expression are being sanitized by large websites that hold monopolies e.g Youtube, so I believe that .onion sites would be where you could find something similar to the internet in it's earlier years, new, everyone figuring things out, expressing themselves more freely and no single template on how everything should be if you want it to be successful.

>>9166 Your link is broken, but you can just scroll to the bottom of this page to see what you intended: https://blog.torproject.org/new-release-tor-browser-90 I was wondering about this and had the suspicion CSS could be used for it. I already knew CSS allowed loading arbitrary resources based on certain actions which could be used for tracking. The World Wide Web is such a stain of soykaf. I'm not looking forward to this letterboxing when I update the Tor Browser.

https://www.hackerfactor.com/blog/index.php?/archives/761-Exploiting-the-TOR-Browser.html Tor Browser can expose OS through width of the scrollbar (JS only): The TOR-Browser on MacOS 10.11 uses a default thickness of 15 pixels. The TOR-Browser on Windows 7/8/10 uses scrollbars that are 17 pixels thick. The TOR-Browser on Linux uses scrollbars that are 10-16 pixels thick. The thickness depends on the Linux variant and desktop platform, like Gnome or KDE. The variability on Linux makes each platform distinct. Linux Mint with Gtk-3.0 defaults to 10 pixels thick, Ubuntu 16.04 with Gnome uses 13 pixels thick, etc. BTW, is there a script to lock down window size on Linux window managers? You resize the window accidentally and now you have a unique fingerprint.

>>9179 >lock down window size It should reset to the starting dimensions if you hit New Identity. If you just resized a few pixels, you don't need to bother with that because of the new letterboxing thing.

>>9058 you forgot VirtualBox its like a vpn don't use qubes OS if you want to keep you old OS anyways i'm going to a onion chan troll dsp. https://www.youtube.com/channel/UCIY6_ctX52o7hhMvJYDudbg/about?view_as=subscriber

>>9181 that my YouTube channel https://www.youtube.com/channel/UCIY6_ctX52o7hhMvJYDudbg/about?view_as=subscriber

>>9180 Main protection should be against accidental downsizing or making full screen window. There also should be a preset of determined screen resolutions, for example: viewport size for 1080p full screen on Windows 10 with taskbar on the bottom, and so on. Many of JS things can be altered and spoofed as well, at least their fake values can fool the machines used at online casinos and banks where fraud is taken very seriously, I guess for anonymity against manual inspection of these parameters there needs to be a more plausible way of executing javascript and it's fingerprinting techniques.

>>9181 >>9182 What the fuarrrk are you on about?

>>9179 Isn't it old news? I think they fixed the scrollbar problem too in the last big patch (9.x)

All that I've learned from Tor security is that Tor is pretty safe, the reason why people get caught doing naughty naughty things on it is due to bad opsec, so all you need is good opsec and you'll be secure from practically anything and everything.

>>9062 Well 1800x900 isn't a legit standard size so I'm guessing they would just assume 1920x1080 if they were canvassing you anyway

>>9715 Not with the new Tor update

>>9716 Im talking about standardization of monitor resolution. Where on earth are you going to find a 1800x900 screen? If you are running over tor its safe to say you are using the tor browser, which letterboxes so its easy to extrapolate and get the full resolution because the one appearing isn't even available readily and most people fullscreen their browsers.

>>9717 You're missing the point : People don't necessarily control their environment. Some people might need to use torbrowser on the go on machines they don't own. Desktop environment updates, or changing your theme might also modify the environment in ways that aren't obvious. Most people have soykaf opsec. Most people don't use tails. Yeah, it's safe to assume someone is actually using the next standard resolution up if they show up as 1800x900, but the point is to make sure you don't douze yourself in dayglo by being *the only guy* using 1901x1077 and *some other combination of parameters*.

>>9058 >Don't write anything, you can be identified by your way of typing I am obsessed about this but I use the internet to express myself so I learned to live with the worry.

Wouldn't any of the points above just potentially deanonymize you for only your current circuit, barring any greater modification not mentioned? With this in mind, unless the deanonymization process were automated or inexpensive, it's my conclusion the payoff wouldn't be worth the effort to identify any rando Tor user unless they were to visit a domain of particular interest to the whatever entity attempting to deanonymize.

>>9721 Congratulations, by paraphrasing the classic boomer dad argument of " why do you care, no one is going to be looking for your stuff specifically anyway " you've described the exact thing the whole thing was made to circumvent : deanonymization of users who are at risk of harm from their government or some local political entity. Test your own torbrowser setup against panopticlick, and then try keeping a straight face implying the process can't be automated or made inexpensive.

>>9722 >panopticlick Not on Tor, but that site breaks when I try to test it, it doesn't load the fingerprinting results. I would have to unblock the whole site by changing my umatrix rules, but that wouldn't make a lot of sense.

>>9724 Gets told about panopticlick. Refuses to turn umatrix off for 30 seconds. Never change, interwebz. And because there's bound to be one of those people reading this thread : for the love of lain, don't fuarrrk around with the default config of torbrowser. That's how people doxx themselves.

>>9726 Not that's not how they get "doxed". Go watch "How Tor Users got caught" from Defcon 22. For most users doing legal things or 'not-so-hot' illegal things (like downloading anime) the default Tor config is your best bet at blending into the mass of other tor users using the same config. Stop talking like you're a leet haxor expert if you don't even know others threat models. Dropping words like "interwebz" isn't gonna fool us.

>>9072 Is there a precedent or a specific reason to why people use Tor to browse imageboards? Porn sites? Is it purely a privacy concern or is there something else? >>9726 >Gets told about panopticlick. >Refuses to turn umatrix off for 30 seconds. I don't turn umatrix off on any website so why would I on a site that's supposed to test how much info it can get?

>>9728 The more people who use Tor for everyday activities, the more effective Tor becomes for everyone. That's why Tor browser is set to defaults that are more convenient than 'safe'. Dingledine himself encourages people to use Tor for casual purposes. I use Tor for everything, 100% of the time, both to increase Tor's overall anonymizing powwr for everyone, and because I just enjoy resisting 'surveillance culture' slimeballs.

>>9729 >I use Tor for everything I tried but It´s just too slow, and of course you can't watch videos there at decent speed

>>9729 I post somewhat personal/identifying stuff sometimes, and it's not something I can negotiate. Will Tor give me trouble that would make using a normal, secured browser better?

>>9727 Hey look at me I'm the only tor user doing things A, B and C that uses *some specific configuration of torbrowser*. This can't possibly be information that could help the state actor I'm trying to protect myself from. A video from 2014 about people who really should have known better having garbage opsec and the .onion they visited being owned doesn't change anything about what I said. >>9728 Same as >>9729 >>9730 It's a bit hit and miss at times, but I stayed on my first impression of tor for a very long time, until I realized last year that it had become perfectly serviceable give or take the odd crappy path. By far the biggest problem with using tor is when google and cloudflare get in the way with their fuarrrking captchas rigged to fail. When they don't, smooth sailing.

>>9732 lmao so why do you think people never change the default settings and use whole operating systems designed to make sure they all look exactly alike?

>>9733 Reread the post you quoted.

>>9722 Chill dude. That's not what I was saying at all, but I'll admit maybe I should have been clearer. Doing what OP described 100% of the time is near unreasonable, at least for what I think is most of us ie not activists or journalists at risk of getting attacked by a government. The goal should be to use Tor as much as possible. I don't think you're a bad Tor user if you enable a couple pieces of JS to make a site usable, don't use Tails, reply to a post on lainchan while using it, or heck even on rare occasion log into a personal account. It's not advised, sure, but it's more important to use Tor in the first place. You did mention you shouldn't do these things if you don't want to be subject to state oppression, but simply using Tor in the first place helps the anonymity of those in the most danger from state oppression, even if you use it poorly. Its adding noise to the signal that the malicious actors are trying to capture. One should stay vigilant and do their best to follow these rules, and if the Tor user does that they're effectively on a clean slate once they have a new circuit. And yes, I realize there is a mass dragnet and information doesn't die and world governments as a whole will inevitably transition to overt tyranny - and probably very soon, but I also realize that Tor is not made to defeat that for everybody, only the people that need it most. It is ov my opinion as well that information loses its significance as it ages, and operational costs are considered in whether to pursue deanonymizing all the captured data state actors get from their own PRISM pipelines. There's a lot to be paranoid about, but if I'm going so far to say these factors are irrelevant I would have stopped using the internet in any form already.

>>9736 >The goal should be to use Tor as much as possible. I don't think you're a bad Tor user if you enable a couple pieces of JS to make a site usable, don't use Tails, reply to a post on lainchan while using it, or heck even on rare occasion log into a personal account. It's not advised, sure, but it's more important to use Tor in the first place. This. Security is based on a threat model. If you are not at risk using tor can be a privacy improvement for you , or activism in providing mask and plausible deniability for others who need it. Obviously , if you threat model includes life threatening or life altering conflict with your government consider Risk Avoidance (Not doing it) or doing exactly what the tor project says to do. If you use tor with JS enabled you could be vulnerable to FBI exploit etc, or fingerprinted. But, a browser fingerprint by itself doesn't provide attribution to a legal identity and is far better privacy than simply not using tor. Use of a VPN or even nothing is still subject to browser fingerprinting . Browser Fingerprinting is also very limiting compared to ISP Business Records from Real IP , or Synconrized Cookies associated with your very real attributable accounts with businesses.

>>9734 yup, it's the same post the second time through.

>>9738 sarcasm (noun) : remarks that mean the opposite of what they say, made to criticize someone or something in a way that is amusing to others but annoying to the person criticized

I have a recommendation. If you run into a site that blocks you with Cloudflare, blocks Tor, or you just don't trust their JS if needed to view, you can use the Wayback Machine, Startpage's anonymous view, or one of these sites listed here to get around it: https://www.alltechbuzz.net/best-internet-archive-wayback-machine-alternatives-2018/

>>9749 Oh, well damn. Going through the article I linked it seems that the only useful site mentioned is archive.is. My bad for not vetting properly. Note to self: set password for posts.

>>9750 Here, I happen to have a better list: https://alternativeto.net/software/wayback-machine/ https://archive.today/ https://archive.is/ https://archive.li https://archive.vn https://archive.md https://archive.ph https://archive.fo/ http://archivecaslytosk.onion/ https://archive-it.org/ http://www.peeep.us/ https://www.webcitation.org/ https://megalodon.jp/ http://www.freezepage.com/ https://via.hypothes.is/ https://webcache.googleusercontent.com/ https://perma.cc/ https://unv.is/ https://gigablast.com/ http://timetravel.mementoweb.org/ https://archive.st/

>>9737 Ideally youd be using tor browser so your fingerprint would be useless if you werent installing ransom add ons like it explicitly says not to

Should I really not install any addons other than the defaults? I just want umatrix. Is there a way to change the white backdrop to the website container to black?

>>9878 When you install umatrix - and other blockers - you're essentially adding 2 newer stamps on torbrowser's fingerprint : You're running more soykaf than the default install, and they can figure that out easily. You're now part of a few % of torbrowser users. It's possible to create a shadow profile based on what content you're blocking, and on which pages you're blocking it. You're now *at best* part of a few % of that already very small % of total torbrowsers users. Now you just need to fuarrrk up once and they can tie that up to your maintream profile.

>>10245 honestly why are scripts even allowed to know what addons you're using? why the fuarrrk are they allowed to get this information?

I have to use gsuite services on almost a daily basis, what should i do?

>>10258 Dont use them.

>>10258 use them on a seperate(clearnet, unmodified) browser and clear cookies every time you close it.

>>10251 because web developers are fuarrrking idiots. That said, I believe you can turn off or spoof addon enumeration in firefox, and I believe this is what the Tor browser does by default. You should never have JS turned on with Tor anyway, it's a gaping security hole. >>10245 >It's possible to create a shadow profile based on what content you're blocking, and on which pages you're blocking it. This is much harder to block, and this is the real reason why it's not good to add any content blocking/modifying addons to the Tor Browser.

See I've read that Tor still leaves enough data behind after ending a session on your computer that anyone with access to it can get it and figure out what you've been doing, which is why you should be using Tails, but Tails' browser has ublock installed into it, so that destroys the no addons rule. It's a no win situation is it?

>>10374 Just remove ublock? Disk encryption is always a good idea too.

>>10374 >See I've read that Tor still leaves enough data behind after ending a session on your computer that anyone with access to it can get it and figure out what you've been doing, For instance? Imo that could only be due to operator error. Tails just makes operator error harder.

>>10388 >>See I've read that Tor still leaves enough data behind after ending a session on your computer that anyone with access to it can get it and figure out what you've been doing, For instance? Imo that could only be due to operator error. Tails just makes operator error harder. (Correction.)

I wish there was a cyber/lainesque community on Tor to hang out on. Well, I might just hop on the ol IRC at some point. Just wonder if the people there are friendly or a bunch of elitists as I often find on IRC channels.

>>10396 What benefit do you see in something like that, if you find people in IRC channels oft being elitists, something like Tor would breed even further elitism.

If you really want the straight dope on Tor, just hang out on the official irc channel on OFTC. Dingledine, the guy who wrote it, is frequently present, has a good attitude, and answers questions posed in good faith. They seem to try to keep the sanctimonious noob-trolling to a minimum, unlike a lot of other dev-heavy irc channels.

>>10396 I've tried a few times, but it always falls out, to be honest a forums with actual discussion is better.

Is it safe to connect to tor directly? Does my internet provider know I use tor? I assume yes. What if I use tor while being at China? Should I prefer chain proxy to tor for preventing goverment identify me as unit that uses tor?

>>10438 You ISP would know if they have some kind of DPI https://en.wikipedia.org/wiki/Deep_packet_inspection Also, you can read here about "best practice" of government eavesdropping and doxxing on TOR users [spoiler]https://www.zdnet.com/article/hackers-breach-fsb-contractor-expose-tor-deanonymization-project/[\spoiler]

>>10450 tl;dr it

>>10438 >Is it safe to connect to tor directly? Yes, you are increasing the anonymity set of all network users in your country and make it more popular, unless Tor is somehow blocked in your jurisdiction >Does my internet provider know I use tor? Yes when you connect to public guard nodes No if you connect to semi-public bridges Yes when an ISP has some sort of DPI No when you use obfs4 and meek bridges >What if I use tor while being at China? You should use shadowsocks as external layer or obfs4 bridge. >Should I prefer chain proxy to tor for preventing government identify me as unit that uses tor? Depending on your jurisdiction and threat model. If Tor is not censored yet, more proliferate usage of it would show the regulators and ISP admins that it's not used for buying drugs by criminals, even your grandma in fact may use it to check amazon listings before buying a present to avoid unwanted advertisements.

>>10375 Then you're making yourself even more unique. From largest group to smallest: Tor users, Tails users, Tails users with uBlock removed. >>10453 I thought the only bridges that work in China are meek/Azure, no?

>>10454 What does Tails add to Tor besides uBlock?

>>10454 Public obfs4 bridges are blocked in China. However, they can't do DPI on obfs4 (the pluggable transport) itself. You can connect to an obfs4 bridge if it isn't public. I once recommended a Chinese user on a web forum to use Tor with the meek-azure bridge, and he told me that it didn't work all of the time.

Shouldn't compromised end nodes not be an issue as long as you remain within the tor network?

>safest security settings >don't enlarge window It isn't really that hard.

>>10864 Recent versions will not increase the browsing area when you enlarge them, so having it in full screen is fine.

>>9058 >>Use Tails not really necessary if you use disk encryption (as you should anyway) and trust your OS to not make automatic connections >>Don't enlarge Tor's window see >>10866 >>Don't write anything, you can be identified by your way of typing if you have JS disabled, there is no way individual key presses could be sent, HTML doesn't work that way I guess paying attention to your writing style is still a good piece of advice though

>>10867 I remember hearing some time back that there were HTML exploits that could compromise anonymity.

>>10869 HTML is a standard, only specific implementations can have exploits. None of them have ever allowed for registering individual keystrokes though.

>>10867 I know people have made css3 keyloggers, they're not effective I would imagine.

>>10869 You're referring to the <tags> causing unique fingerprint. Like say Internet explorer does tags differently.

I thought the tor browser was only for windows and mac?

>>10875 it isn't. it runs anywhere firefox runs.

>>10875 That's pretty funny considering that it's advised not to use tor with windows.

>>10873 Yeah I think that was it, so basically just keeping Javascript fully disabled is enough to keep your Anonymity, excluding any user error that would deanonymize you.

Question: if you use tor or torsocks and a proxy to redirect to port 80, can you access .onion links? What about the nameserver?

>>10904 SOCKS5 has a feature for proxying DNS lookups, but you still have to make sure your software is using it. For example, CURL has a command line option --socks5-hostname that makes it use the provided proxy for DNS. Onion links will work with the TOR proxy only if you use that option (normal DNS lookups will also deanonymize you if you if you don't use it). torsocks wrapper seems to take care of DNS for you.

>>10904 >>10905 these days my preferred method for preventing dns leaks is to just put the program in a network namespace that only has a single tun device corresponding to the tor/vpn internal gateway. afaik this makes even those sketchy webrtc leaks impossible because the browser doesn't even know that the physical interface exists.

Help me learn how to use NoScript properly. With it enabled, I'm able to see who replied to each post and click on their post number in order to quick reply. But with JS disabled and having having lainchan.org enabled in NoScript I don't get those features back. Same that goes with sites like YouTube and Reddit. I enable the scripts that don't look like it would be trackers and the site still doesn't work as it should.

>>10927 Let me get into more detail, so what I'm seeing can be more reproducible. In our latest lainzine (https://lainzine.org/all-releases/lainzine05/security-consulting-and-the-future.pdf) on TOR's safer security level I can see everything here just fine, but on safest with noscript allowing lainzine script to run I still can't see what's on this page. I'm I getting the purpose of NoScript wrong? If this is the case I don't think I can use this browser for day to day browsing.

>>10927 >>10928 "Safest" now disables JavaScript completely. There were a few bugs where JavaScript could be forced to run even with NoScript set to block everything, and the Tor developers finally had enough. You should be able to switch javascript.enabled back to true in about:config.

>>10930 I thought about doing it, but is this common practice for most people to do? I don't want to greatly compromise my privacy. Should NoScript be enough to cover me?

>>10931 I believe most people use the lowest security setting, simply because it's the default. As for the JavaScript bugs, I don't know how practical those attacks really are. I should also mention that changing javascript.enabled may cause you to stand out from other "Safest" users, because most/all of them will have JavaScript completely disabled. This requires that the attacker somehow discovers that you can run scripts, but again, I don't know how the attacks work. It might be easiest to toggle your security settings depending on what site you're visiting. (And for YouTube, just use Invidio.us)

>>10932 You're right, until I find a better solution I'll change my settings per site

>>10933 Perhaps you should try torsocks+firefox+onion browser button+noscript+ublock(or some other ad tracking blocker)+https everywhere. This is what I'm currently using and it's pretty cash. I've setup noscript to disable js on all websites by default, I only enable it for websites which I deem trustworthy (lainchan for example). If I need to use youtube and for some reason I can't just view the video via torsocks mpv video-url, I open up tor, set the settings on standart/moderate and check the video. I make sure to reset my tor session though if I want to continue using tor for some reason and set back the privacy settings to "strict".

>>>10934 That sounds like a lot lol I'll look into it

>>10935 It really isnt't, it's essentially firefox with some addons. The only thing which you have to install separately is torsocks.

>>10934 >Perhaps you should duct-tape together a bad imitation of Tor Browser that will have a completely different fingerprint from everyone else and missing Tor Project's security patches.

>>10938 What's your actual critique of the setup, I've suggested? If you want more security you can change some of the predatory "features" firefox has in the about:config. I use firefox-esr because it's more convenient, I try to harden the privacy whenever I can. If you have some suggestions, I'd like to hear them.

>>10939 I'm going to open my emergency supply of good faith and give you a response. >actual critique The way you set up your browser causes it to look different from the standard Tor Browser to anyone watching your traffic. This is the "fingerprint". Your browser is also missing the Tor Project's security patches, which include new code, not just changes in about:config. Tor Browser already uses Firefox ESR as its base. >more convenient You do more work and gain nothing. How is your way more convenient? >suggestions Just use Tor Browser.

>>10940 Fair enough, I still believe that firefox-esr has somewhat more friendlier defaults for browsing. >You do more work and gain nothing. How is your way more convenient? For example cookies aren't cleared automatically when I exit firefox or my browsing history isn't completely wiped (there are some websites which I need to keep cookies and history for). If I were to tweak tor in such a way I'm tweaking firefox currently, I feel like I'd just make tor more handicapped.

>>10941 There's plugins for firefox to manage cookies, and their lifespan. Really useful in the same way noscript is.

>>10942 I don't know which plugin you're referring to. So far I've been managing cookies from the settings page i.e. save cookies for certain websites and delete everything else.

Why doesn't Tor Browser come with uBlock/uMatrix?

>>11072 Ad blockers? I assume because it blocks all js requests by default when you set it on "strict".

>>10939 >>10933 >>10934 Use Tor Browser (standard fingerprint) within Whonix (browser-based exploits can't discover your real IP address or read / touch anything on your host system, keystroke anonymization, torification of non-web applications)

>>11079 Why not Tails over Whonix?

>>11080 Whonix seems better for the particular lainon’s use case as a non-amnesiac system. But Tails is good too and also a much better choice than the torsocks jerry rig. It’s just more of a pain to dual boot and set up persistence. For a very detailed comparison see https://www.whonix.org/wiki/Comparison_with_Others I think that the Whonix architecture (VM separation instead of Tor enforcing firewall) is probably less likely to lead to deanonymization *if* your host is secure. But that is a giant, giant if, and the whole point of tails is that it lowers the host attack surface mostly to bootkits and firmware.

>11073 >all js requests by default But not tracking pixels etc.

Tails not safe. Is anything? https://www.engadget.com/facebook-fbi-hacking-tool-targeted-child-abuser-171753372.html

>>11176 Would likely get patched by the team.

>>11176 Not a Tor software/network flaw. Not a Tails flaw. Probably a flaw in one of those over-engineered networking-capable video players like VLC. The video was sent via Dropbox (not Facebook's internal chat where Facebook's servers transcode everything into jay peg quality. Would be suspicious to receive a a video over third party service like Dropbox when there's built-in function for that on Facebook) He opened the file on Internet-connected computer It happened 3 years ago >Buster Hernandez l 0 l >otherwise he would send the nude photos he already had to her friends and family (in reality, he didn’t have any nude photos) ok this is epic

>>11176 Qubes with Whonix might be a better choice than Tails. Less convenient, though.

>>11182 >Not a Tails flaw. You can argue that the video player being able to make direct connections without Tor is a Tails flaw.

I recently saw a very cool article about deanonymizing tor circuits from earlier this year. It was written by a guy who runs the hidden service for the Internet Archive. He lists out a very interesting new hidden service attack that the noticed and reverse engineers it. http://archive.is/Wm8lW The interesting thing about this attack is that I don't really understand what could be done to mitigate this kind of malicious deanonymization approach on any of the current mixnet proposals that are out there. I've talked to a couple people about it but I think that it is pretty good evidence that the system is in major need of an overhaul if attacks like this start cropping up everywhere.

>>11211 Can you post the real link? Thanks.

>>11232 Abolish fire hydrants, traffic lights, cars, buses and bicycles. It's time for a revolution. https://www.hackerfactor.com/blog/index.php?/archives/868-Deanonymizing-Tor-Circuits.html

>>11209 No. Tails allows you to download external things. Thats like saying Linux has a security flaw because a new linux compatible program has a security flaw.

>>11232 Is there some reason why you trust the isolated archive.is rendering less than a random site? The way it grabs the original sites resources and renders them in a completely neutral sandboxed way is actually much safer than going to a normal website. I fully believe your not wanting to click the link is borne out of an illogical skepticism or unfamiliarity with the site. If I'm mistaken and you have some nuanced critique of how archive.is functions, I would love to hear it.

>>11234 Yes, it is a Tails flaw. Tails enforces Tor through firewall rules, which are not supposed to be circumventable any Torified application. This shows that the isolation between Tor and non-Tor domains isn't good enough on Tails if some codec exploit can break it. For starters, non-Tor domain (e.g. Unsafe Browser for captive portals) needs to be on a completely separate tty and X session.

>>11238 Basically if your Tails desktop Linux session gets owned, you can be de-anonymized. This is not the case with Whonix.

>>11239 Here it's good to remind that the protected system should be as isolated as possible. As example, get rid of all bluetooth and wifi hardware, which could trivially provide detailed location. As well as make sure that the MAC address is clean, etc. Of course these problems cna be slightl reduced by running in VM. But if they're serious, they probably can deal with that too.

>>11235 >why you trust the isolated archive.is rendering less than a random site I do not have trust any of them. I have javascript disabled and can't see page contents because of cloudflare captcha placeholder, cloudflare and apparently, site's owner decided to discriminate against people with disabled javascript accessing their servers over Tor and public proxies. Normally, when a direct non-archived link is posted I'd first see a downgraded version of the original page and at least be able to read text, and in rare case of original being deleted, I'd look up various web page archives myself. You posted a shortened archive.today link that doesn't give any indication what page it actually serves, ironically you claim the article is written by an Internet Archive volunteer, and you didn't bother to make Internet Archive caption which does show original page address in it's URL. There is a way to include source page URL in archive.today link, go to "page history" or something like that, and post it properly next time. Best regards, Iwakura Lain Present Day, Present Time! AHAHAHAHAHA!

If I run of the safer setting of tor does this mean that trackers on the site are operating? Some sites that I know respect my privacy are operational only with javascript. Since in my about:config js is disabled no amount of fiddling with noscript is going to change it. how protected am I using safer over safest

>>11334 If you're the only autist who visits these sites with javascript disabled by default, they probably can track you very easily.

>>11337 So I should enable javascript in the about:config? I thought that wasn't common practice

1. Don't be a fool 2. Use Tor Browser as it comes, don't modify about:config, install add-ons or do any other stupid soykaf. 3. Run safest security settings for tasks that work on it, only enable javashit when it is absolutely necessary 4. Don't enlarge window 5. Learn how Tor works and why certain people get de-anonymized

>>11339 >4. Don't enlarge window This is not necessary anymore, TBB uses letterboxing since version 9 https://blog.torproject.org/new-release-tor-browser-90

>>11345 Still necessary when you enlarge videos from memory? Or does letterboxing take care of it?

>>11346 Good point. It might be something to look out for. I couldn't find anything about it right now

I've heard that Heads is a good alternative to Tails? Can any other lainons comment on this?

>>11398 Last release is from years ago, wouldn't recommend.

>>9059 Can't you use some extension like a tab container to avoid that ?

>>10245 >>10335 Is this why, in extensions.enabledAddons, I have ubufox@ubuntu.com despite I'm not on ubuntu and it's not in about:addons? Can websites read anything out of about:config (with or without javascript)? For example, I enabled the separate search box, so my browser.uiCustomization.state is different. Is it safe to install addons as long as they don't change your traffic?

Because Tor Browser allows JS by default, disabling it can be an important factor in fingerprinting you. Not saying I'm pro JS, just be aware that it isn't necessarily black/white on whether disabling it is superior.

>>9058 https://restoreprivacy.com/tor/

>>11447 It's not black and white but it's very close to it nonetheless. The amount of evil JavaScript can do is unbeliavable. >>11446 Question is, how clever are you about it? What causes the traffic in the first place? Try reading up on what the Tor Project is trying to do to prevent deanonymization and fingerprintability. At any given point, it's very hard to know what is fingerprintable or not. Some time ago, even if you were using the stock version of Tor Browser, having an unusual amount of cores assigned to your browser was a problem (https://trac.torproject.org/projects/tor/ticket/21675). You'd think that having something simple as Tree Style Tab wouldn't matter at all, but surprisingly it does, especially if you have letterboxing turned off. I'll show you an example using the bookmarks bar, the one on the left that you open with ctrl+b, but TST has pretty much the same behavior. A while ago (before letterboxing), simply changing the top bar density made you more fingerprintable, and so did toolbars. Letterboxing is there to protect you from this; it allows you to customize the browser without much risk. Now, when it comes to disabling JS or not; sure, disabled JS is fingerprintable, but JS is the very thing that opens doors to many different attack vectors. A small amount of entropy is much better than an unpredictable one.

If everyone enlarged their window then that would be the norm. Shit, if even more than a hundred people who used Tor enlarged their window, that is enough. I can't possibly imagine anyone in an intelligence agency looking at someone using an enlarged Tor browser and going "we GOT the fuarrrker"

>>11447 >Because Tor Browser allows JS by default, disabling it can be an important factor in fingerprinting you. Tor Browser allows JS by default because otherwise websites break and normal people nope.jpg their way out 5 seconds after installing it. Engaging normal people and making Tor '"mainstream" has been the project's top priority for a few years now. https://fosdem.org/2020/schedule/event/tor/

>>11476 >I can't possibly imagine anyone in an intelligence agency looking at someone using an enlarged Tor browser and going "we GOT the fuarrrker" Take some esoteric as fuarrrk resolution, something like 4200x690. If you browse the internet with this resolution, even if you use Tor Browser, everyone knows that it's "that guy with 4200x690 res". You can do anything; create accounts wherever you want, soykafpost whatever you want, just do dumb soykaf 'n stuff and they will always know that it's you. You mess up one day - do something illegal, questionable or just something that 'gets you out there' - and they'll know that it was you. They won't need much to get you - if you logged into one of your accounts without Tor, if you got unlucky and routed your traffic through compromised nodes, if you did something that was traceable or something that could be otherwise connected to your real location or personality, you're fuarrrked. >Waddup dude, you're arrested because you downloaded some pizza. >But how'd you get me? >The guy who downloaded the pizza (from our honeypots lol) had a weird as fuarrrk resolution, 4200x690 or something like that. One day he made an account on some soykafty social network and used it for a while. And then he forgot to use Tor once, dumb fuarrrk, so we got his IP. And since he always had this weird ass resolution, we just assumed that it was him (you know, not many people have 4200x690), the guy who downloaded the pizza. Then we told his ISP to give us his location and we ended up here. Whatever, the party van is waiting outside. Clearly, this is just a made up story so don't quote me on that. But the point exists; someone out there, although we don't know exactly who, looks like nobody else.

>>11477 Yep, that's why they allow it. I don't disagree. I'm saying that deviating from the default by *disabling* it is a statistically deviant behavior that can be an integral part of fingerprinting you, just like having a nondefault window size, or nondefault user agent.

>>11480 Having JS enabled already gives you a unique fingerprint. 2 guys without js are still harder than your among millions with js. Of course ideally you use addons to create a fake fingerprint.

>>11480 >>11481 When it comes to addons, unless Tor itself decides to use them (or publish patches which accomplish something similar), you are dealing with a double-edged sword. If you use an addon that changes your fingerprint every time you visit a site, good for you, but what happens if you're the only person using it? What happens if you're the only person spoofing one particular value while everyone else defaults to something else? There's your fingerprint. One way Tor is trying to achieve anonymity is by making everyone look the same - either everyone uses the same value or everyone spoofs (i.e. randomizes) it. In most cases, going against the flow of the project (even if you think that it does you good) is counter-intuitive and somewhat unpredictable. And when it comes to JS - it doesn't matter. As >>11474 said, JS opens doors to many different attack vectors. If you disable it, cool, your fingerprint changes a little. On the other hand, if you enable it, a lot more entropy can be generated in the long run. Now here's the thing about "JS being turned by default; disabling is blah blah blah." Tor has two ways to go about things - the 'default' approach and the 'bucket' approach. The default approach is simple - everyone either defaults to one value or everyone defaults to randomizing that value. But in many cases there is a better way to go about it, the 'bucket' way. This is how, for example, letterboxing works - instead of forcing everyone to use the same resolution, they put different groups of people into buckets. This is the default behavior; I know it because I have a high-res monitor and a low-res laptop and the same version of Tor Browser defaults to different resolutions on both of them. So even if the browsers are basically the same, their fingerprint is not. With all this in mind, you end up with two buckets: a JS-enabled bucket and a JS-disabled bucket. And because Tor endorses disabling JS, trying to track people based on whether they are in the first bucket or the second one is madness. Of course, this bucketing approach has a huge downside to it - the combination of buckets is a fingerprint by itself. For example, with 3 different possible resolutions and 3 different security levels, you have 3*3 buckets - in other words, there would be 9 possible 'default' versions of the browser, 9 different fingerprints. Even if the stock version of Tor browser uses only 1 security level, you still have 3 different possible resolutions. This would mean that the 'stock' version of the browser has 3 different fingerprints. The main problem is that we don't know all the ways of tracking someone; it's not just 9 buckets - it's an unknown amount of buckets. But you can be positive that with JS enabled, the amount of these buckets is much higher than with JS disabled. At the end of the day, one of Tor Browser's main efforts is to lower the amount of such buckets by putting people into a small amount of them, to keep the entropy at the lowest reasonable maximum, to lower your uniqueness. Disabled JS is just an illusion of lower entropy - it's actually unpredictable (unless you can come up with every single way of tracking/attacking someone through JS). It could be a minor thing, it could be a huge thing. And JS isn't even the only way of tracking someone... Anyway, I'd take the Socrates way here: I know that I know nothing. Also, I'm sorry if I made the fingerprinting problem too complicated by trying to explain it with 'buckets'. If you want to dive deeper into the subject, read the attached pdf.

>>11488 >But you can be positive that with JS enabled, the amount of these buckets is much higher than with JS disabled. >Disabled JS is just an illusion of lower entropy - it's actually unpredictable Can you explain? It seems like a contradiction.

>>11488 re: randomizing/spoofing values, i've seen an argument that since resisting fingerprinting and niche privacy tools are so deeply at odds its better to just have a fingerprint that's constantly changing rather than compromising on the privacy tools to stick out less. sure, at any given time you might be one in a million, but that doesn't mean much if every site you visit sees you as a different person, and it changes every time you establish a new circuit. i guess you could probably be tracked as "the guy whose browser keeps changing" but that's kind of hard to search for at scale. specifically with tor browser i still think it's probably better to stick with a common config, but that's only because virtually everyone is using some minor variation of that and presumably the risks are higher. your daily driver browser on the other hand is practically one in a million straight out of the box, with no config tweaks or addons, just by virtue of how webgl/canvas work.

>>11490 Yeah, my bad. The second statement was meant to be "Enabled JS".

>>11492 >your daily driver browser on the other hand is practically one in a million straight out of the box, with no config tweaks or addons, just by virtue of how webgl/canvas work. Jokes on you, Tor browser is my daily driver browser. Anyway, to prove the point, I went to Panopticlick and took 3 tests: stock Firefox, Tor browser on the standard security level (i.e. stock, with JS), Tor browser on the safest level (i.e. no JS). My WebGL fingerprint is just about completely unique on stock Firefox, but that is understandable because my setup isn't very common (also, I took the test twice which kinda skewed the results). >Vendor: X.Org >Renderer: Radeon RX 580 Series (POLARIS10, DRM 3.35.0, 5.4.48-gentoo, LLVM 10.0.0)

Is it even possible to have js enabled only for certain websites on Tor? Tor uses NoScript for blocking js so it should be possible but I'm not sure how, I haven't seen anything about it on Tor's website.

>>11488 you're very correct that default configs on such addons don't do spoofing well. Saw absolutely obscure values in defaults where you have to ask if its intentional that they use decade dead values to mark you. That said there is a very simple solution - collect fingerprints yourself and reuse that data for authentic spoofing. Last point is attributes can be correlated. Especially using multiple tools ends in spoofing correlated attributes separate which can create otherwise impossible combinations and thus mark you.

>>11468 >How to more safely use tor >use a VPN! Dropped. And theres a good article by a guy that writes opsec articles on why Eldo Kim stood out when he used Tor to call in a bomb threat, that entire article is fearmongering paranoia designed to promote VPNs

>>11502 Right click page, select noscript, set permissions like you would with noscript on a normal browser. It doesn't work as well but it works.

Has cloudflare moved back to reCaptcha or are some sites just overriding it? hCaptcha is generally solvable on tor while reCaptcha never works.

ditch tor and use i2p. restoreprivacy.com/tor

>>11683 that article is filled with absolute soykaf claims and misrepresentations. Its just an attempt to sell VPNs to people who don't know any better.

>>11683 While there's a good amount of garbage in that link, I do agree that Tor is no longer sufficient and people need to migrate to I2P. I've been meaning to look for into Nym but haven't had time to do enough reading.

>>11687 Whats your reasoning for tor no longer being sufficient? Do you think its compromised or too vulnerable to traffic analysis by nation states?

in almost every case, people who say Tor is insufficient are speaking from ignorance.

If tor was insufficient we'd be hearing Snowden yelling about it from the rafters by now.

>>11691 >>11694 >>11710 https://arxiv.org/pdf/1808.07285v1.pdf Last I had checked, there wasn't any response from the Tor Project about this vuln. An email on the mailing list went completely unanswered. They've also stated multiple times that Tor is not designed to stand up against a global passive adversary. We need I2P, we need mixnets.

>>11712 That study suggests that the use of obfuscated pluggable transports in bridges is enough to significantly throw it off. It is concerning that the Tor project hasn't responded to the study though however theres nothing stopping you from using a TOR bridge that has IAT turned on with obfs4.

>>11718 Is obfs4 with IAT the default? What percentage of people are using it?

>>11727 pretty much anyone who uses Tor in China uses obfsproxy

>>11712 Still no response according to my cursory research. >>11718 Most people don't use those though. The unsafe default combined with their lack of a response is a huge red flag. >>11727 The default is plain Tor protocol

>>11729 >Most people don't use those though. Most people don't need it.

>>11730 According to the paper, and Tor project's lack of response --- they actually do.

>>11730 > Users of an anonymous overlay network don't actually need to be anonymous. wat

We need to seriously consider alternatives if Tor has this massive fuarrrking hole. You know who can pull off global-scale deep learning? The fuarrrking government. And those fuarrrks don't mind scalping lil guys like us.

>>11732 if every tor user was doing something that they actually needed to be anonymous for, they would fall under active surveillance just for using tor(which by the way, is exactly the threat model obfsproxy is designed for). Most traffic on the tor network is completely innocuous and exists as "cover traffic". All of mine does, I use it for normal internet browsing. Not saying that Tor gives you perfect or even good anonymity, but I've been assuming that flow correlation this good is possible and probably in active use for years. It is one component of many for a good anonymity setup.

>>11734 You just contradicted yourself... >if every tor user was doing something that they actually needed to be anonymous for >Most traffic on the tor network is completely innocuous and exists as "cover traffic". >they would fall under active surveillance just for using tor Everybody falls under active surveillance because everybody is using tor. It doesn't matter what the nature of your traffic is, you're being scooped up. Everybody needs anonymity because it is there to protect the individuals who are doing something "special".

What's stopping you guys from going over to ircs://irc.oftc.net:6697 in your irc client and asking Dingledine directly about your concerns? Last I checked he was often around and happy to answer questions. That might be better than spreading FUD about Tor. Unless that's your job, of course.

>>11736 You're paranoid for a tor thread lol. FUD about Tor benefits nobody: the police, the sekret agents, the gobbermant, the criminals, the casuals, the reporters, the channers, etc. Dingledine is suspect, he works for the government, and always has. Do you know what a honey pot is?

>>11737 >you're paranoid >don't trust people who might provide comment on this vulnerability, they might work for the gubbermint!

>>11735 >Everybody falls under active surveillance because everybody is using tor. This is exactly the *opposite* of what I said. The point is that it is not worth it for three letter agencies to use active surveillance on people using Tor for purely innocuous traffic. That take a lot of resources that even they don't have. >It doesn't matter what the nature of your traffic is, you're being scooped up. by passive surveillance, sure. >Everybody needs anonymity because it is there to protect the individuals who are doing something "special". everybody needs to use anonymity-protecting networks, sure.

>>11736 Their response essentially boils down to "Tor wasn't designed to thwart global passive adversaries". Their suggestion is if this is part of your threat model is to use something else. Like I2P or mixnets. So maybe we can quit squabbling and start trying to make those the norm, instead.

>>11742 Flow correlation attacks have been around for years, and never worked well for global passive adversaries, at least not for NSA The Snowden leaks showed that. This paper uses the same basic idea of tracking packet timings and sizes at guard nodes and exit nodes. The only new thing is the claim that their AI makes it much more efficient. But there are several good ways to thwart it, regardless: circuit padding, packet padding are now options in Tor; flow obfuscation like obfs4; use bridges; change guard node; above all else, just use onion service destinations and flow correlation is useless. And most Tor users don't have global passive adversaries as part of their threat model, anyway.

What the hell are IAT and MOAT and why Tor project's manuals for layman are such garbage? Am I supposed to choose between quirky code comments written in slang and funny clip art for toddlers that barely describes the basics?

>>11756 I find Tor Project's instructions to be exceptionally clear and easy to follow, but if you need more help there's always the irc channel. Btw, nick "arpa" is Dingledine, the guy who wrote Tor.

>>11756 IAT is intended to be implemented on bridges and relays, if you can't figure it out from the docs you probably shouldn't be running one. The user explanation for how to use MOAT is extremely clear http://dgvdmophvhunawds.onion/bridges/index.html Everything else is as simple as possible for end users.

>>11743 Until padding and obs4 are the *defaults* this is still a vulnerability for all Tor users. Onion sites are still subject to traffic analysis, since it's a problem that exists *at the network layer*. Doesn't matter that the site only exists in the overlay network, it ultimately needs to send data over the wire, which is where the analysis is happening. Room 641A shows how prevalent this kind of mass monitoring is. Considering that the NSA engages in parallel construction with tons of other three letter agencies, and has info sharing agreements in place with the various ##-Eyes, I'd say that it *is* part of their threat model. Again, we're here spinning our wheels on a flawed model instead of trying to use a better designed protocol. So, again. Suggestions for alternatives? I2P? Nym? Loopix? Loki?

>>11757 Why would such crucial information be obfuscated in the chatroom darknet where one has to fish out "that guy" to ask for what should be written on their main webpage? If someone asked this before me, how do I look it up it on IRC, do they publish their logs on the web, are those logs crawled by search engines? >>11761 I type in "MOAT Tor" into duck duck go search engine and get nothing relevant. The Tor Project's documentation for preschoolers page you linked does not explain how this MOAT works, as in what network computers does my client software connects to and how anonymous/private that is. Merely downloading tor-browser-installer from Linux distribution repos or connecting to non-obfuscated bridges can put you in jail in some countries, so I have to be absolutely sure this things works as I deem it suitable for my situation. There is a fair description of IAT which stands for Inter-Arrival Timing, albeit too techie here: https://www.fortinet.com/blog/threat-research/dissecting-tor-bridges-pluggable-transport-part-2 >you probably shouldn't be running one There is no way to choose highest IAT setting for bridge I have to connect as an end user. I want iat-mode=2. Your statement reads like "you should not use https because you're not an experienced web admin". >>11770 Use all of them, you raise anonymity set by participating in.

Honestly I've heard a lot about parallel construction but never seen an actual example of it. >>11779 >Again, we're here spinning our wheels on a flawed model instead of trying to use a better designed protocol. So, again. Suggestions for alternatives? I2P? Nym? Loopix? Loki? dunno about the others, but I2P has some really serious flaws as well, mostly related to its use of a DHT for keeping track of nodes. They have all kinds of mitigations but they could be thwarted by a big botnet. DHT-based systems are just not very good for anonymity. Freenet, when used in F2F mode, is probably the closest to a good anonymity network that exists today, and that is because it is relatively limited.

>>11779 >Your statement reads like "you should not use https because you're not an experienced web admin". No it reads like "you shouldn't be managing apache if you can't understand the documentation", IAT is designed to be set up on the bridge side. If you are incapable of understanding the more techie documents than you have zero business running a fuarrrking node on a security network.

>>11781 >Honestly I've heard a lot about parallel construction but never seen an actual example of it. Because you're not looking. https://theintercept.com/2019/10/10/fbi-nsa-mass-surveillance-abuse/

>>11797 I have been looking. I've never heard of a darknet vendor getting caught except with seriously sloppy OPSEC. While it may be true that three letter agencies would catch the OPSEC breaches first and then get a warrant, that doesn't change the fact that there's no indication they routinely break Tor to do so. They wouldn't need to, most people do dumb soykaf like use the same username in a clearnet forum. Easy as pie to crawl for stuff like that.

>>11779 >Use all of them, you raise anonymity set by participating in. If there are flaws in the designs, then we should seek to avoid them and instead direct users to the least flawed. It's security software, just like any other. You don't recommend people use WEP still, right?

>>11815 Using "all the tools" including the bad ones is purely bad OPSEC. The weak link in the chain is what will get you got.

>>11817 I heard an idea about this that may not necessarily make this so. It was called sekreta. https://gitlab.com/sekreta/sekreta The idea was to use multiple networks with secret sharing, such that you would need to compromise all of them. https://gitlab.com/sekreta/sekreta/-/blob/master/doc/README.md

It seems likely tor browser exploits are withheld, and that the predictability becomes the weak point (such as deep learning time correlation). It increasingly becomes a good idea to mix it up and use different configurations with tor.

>>11819 I don't think this actually corrects the flaws in tor, leaving you vulnerable. It seems like good security, but you're assuming it'll all work together effectively without leaking. I'm dubious of this, you can't layer security to remove a weak link.

>>11815 WEP is an industry standard and it's not me or any end user who decides what standards new hardware supports. Industry moved onto WPA2, ISPs installed pre-configured access points -> everyone uses WPA2.

>>11770 >Suggestions for alternatives? I2P? Nym? Loopix? Loki? i2p has left a little bit of a bad taste in my mouth after the whole i2p/kovri drama happened. lack of defense against sybil attacks does leave a bit to be desired too. nym looks to be an implementation of loopix. ania piotrowska is on the nym dev team, along with harry halpin. definitely piques my interest. she's the one that talked at usenix about loopix: https://youtu.be/R-yEqLX_UvI i want to read more about loki's llarp, but i found this quote pretty early on: > This project does not attempt to solve traffic shape correlation or active nation state sponsored network attacks. The former is an inherit property of low latency computer networks that I personally do not think is possible to properly fully "solve". The latter is a threat that lies outside the scope of what the current toolset that is available to me at the moment provides. i'm leaning toward nym, but that could change

>>11881 That claim by Loki shows the developers' ignorance. Garlic routing with false packets and variable (through time) packet sizes would do a lot to reduce exposure to traffic analysis, and also impair nation actors.

>>11868 Afaik we really should be focusing on WPA3 at the moment.

>>11899 Who "we"? Who "we"? You, me, that lad over there, who else huh? Drop this redditspeak, please. Nobody should be "focusing" on this bureaucratic corporatist garbage """standard""". Plug a wire and use software encryption, proprietary soup of hardware encryptions never works.

>>11881 The one advantage I see is that Loki appears to have a lot more currently functional software available where Nym is lagging behind. https://nitter.net/sebx2a/status/1291744069434191872 "Just finished the first successful test run of a @nymproject TCP/SOCKS5 hidden service implementation I started as a side project. It's still very primitive and crashes often, but it's getting there." >>11903 Yeah, everybody just needs to connect their phone with Cat6. Sure, bud. Sorry, but this is a garbage take with no basis in reality. The cat is out of the bag with regards to wireless, so now all there is to do is to try to make it suck less. People don't want to use tethered devices. Hell, people can't be bothered to use wired peripherals at a fixed location like a desk.

Tor malware really fuarrrking is like kicking dead whales down the beach because you won't notice it's there, and you won't notice if you're using a NSA controlled exit, you'll just be sending data over to the NSA. If you visited cp sites for whatever reason (not judging, maybe just curiosity) you should really wipe your system and reinstall.

>>11882 I do find it concerning how many of these projects are unwilling to even consider things that while won't solve the problem will at least make it significantly more difficult for these known attacks to be carried out. Thinks like IAT for tor have such a miniscule performance impact while increasing the difficulty of attacks

>>11905 NSA is able to break the encryption between the onion service and me?

>>11907 Probably not as the encryption is still mathematically sound, while its possible they have discovered some way to break it if they have you have far bigger things to worry about. Concern is that the NSA have anonymity breaking attacks that while they can't read the contents of your packets they can tell which server you are talking to and if that server is compromised they will be able to see the contents of your packets the old fashioned way. Tor isn't meant to protect from them breaking encryption (as normal HTTPS should be mathematically unbreakable) its only meant to protect against anonymity breaking.

>>11908 In a communication where end to end encryption is being used(like OTR for example) and both sides are using TOR and SSL tor connect to the service(xmpp for example), they have any chance?

>>11909 With the current public understand of mathematics, no, as far as we know modern encryption standards are not breakable in a remotely timely manner (may take past the heat death of the universe) on classical computers. However they are likely breakable with quantum computing which as far as we know is not advanced enough to do this yet or if the NSA or similar have successfully managed to pull off placing a mathematical backdoor into a standard such as they attempted with Dual_EC_DRBG. The odds of either of those two attacks being possible are extremely slim and it is far more likely that they would access encrypted communications the old fashioned way by compromising the server (or you) and just reading them in their decrypted forms, assume this is happening with big tech services (facebook, google, etc) and be cautious on other sites although it is unlikely other sites have been compromised in this way unless you have drawn the attention of law enforcement. If in doubt don't communicate something you wouldn't want anyone to see over a computer network that can be traced back to you and use defence in depth for anonymity (e.g. don't connect to tor to do things you want to be secret from an access point traceable to you).

>>11910 Nice explanation, thanks for this, In the case they own the service the communication will still safe because of the end2end encryption (assuming the other end dont got compromised too, right?

>>11907 >>11910 Part of the issue is, they will always withhold exploits. Part of the issue is tor project and Mozilla are still in U.S. jurisdiction. Why? It's not possible for them to not be influenced. They don't need to decrypt, they only need control over the hidden service and browser exploits. I only see 2 reasons why tor is still allowed to exist: foreign interference and honeypots. Maybe I'm just paranoid.

>>11912 What about using TOR in applications which is not a browser?

>>11911 Really depends on how the E2E encryption (i assume by E2E encryption you are referring to messaging programs and the like) is being implemented, if it is being done inside the browser/app then you cannot be sure that the server hasn't slipped an updated version of the code that captures your encryption keys (you can avoid this with apps if its properly audited and verified on your machine) while if you are manually encrypting yourself on a trusted platform then you reasonably trust it isn't breakable. Of course if you or the person you are communicating with has been compromised then they can just grab the decrypted message or keys from your device. If its just standard HTTPS then it has to be decrypted on the target server and if the target server is compromised then no amount of third party tools will stop the feds being able to read it if the server is compromised. But again the main goal of tor is anonymity as compromised servers is an unsolvable problem by third party software. >>11913 If the other anon is right and tor is deliberately broken then theres a high chance the underlying tech is broken too, theres been some known exploits directly linked to the browser though.

>>11770 >Until padding and obs4 are the *defaults* this is still a vulnerability for all Tor users. Circuit padding is default. You're prompted to use obfuscation every time you start Tor browser. >Onion sites are still subject to traffic analysis The claim was improved flow correlation. You can't use flow correlation unless you already know both ends of of the circuit. Most onions sites, and all good ones, are unknown. There is no better public anonymity/security scheme in the world than Tor. When one appears I'll switch to it. Why are you so adament about people not using Tor? Hmm?

>>11918 Well, I could have put that better. By "both ends of the circuit" I mean most of the guard (entance) nodes, and all of the exit nodes, which are a published list. A nation state might have some chance of correlating traffic if they can monitor all of them simultaneously. But with unknown onion sites, even in the best case of alreading knowing the caller's IP address, the nation state would have to monitor every other IP address in the world, which just isn't feasible.

>>11918 >You're prompted to use obfuscation every time you start Tor browser. It does? Mine just takes me straight into a regular non obfuscated circuit.

>>11918 I've never seen this prompt. Know any steps to reproduce it? Sounds like something you'd only see if you were specifying a bridge of your own. I just tried using a bridge provided by the directory after solving the captcha and couldn't even get it to connect after that. It looks like circuit padding has been the default since version 0.4.1.5 which was released in August 2019, so that's nice. However, there are still a bunch of nodes (over 1,000 according to Tor's metrics) running 0.3.5, so that is like kicking dead whales down the beach. My understanding of it is that all nodes in the circuit must support padding for it to work. People are actively developing better anonymity frameworks right now. Many have already been named in this thread. Why are you so adamant about using a flawed system?

>>11921 >any steps to reproduce it? start a recent version of Tor Browser for the first time.

>>11907 https://freedom-to-tinker.com/2015/10/14/how-is-nsa-breaking-so-much-crypto/

What is the opnion of lainons on this? >https://restoreprivacy.com/tor/

>>12063 FUD article that is trying to sell VPNs. Includes extreme misrepresentations (e.g. the harvard guy who would have been caught if he was the only one using any service from his location) and flat out lying that the tor project reccomends VPNs. Tor isn't perfect and has its issues (scroll up to see discussions of them) but that article is wrong.

Does anyone use a middlebox? It is a very basic install. * Install OpenBSD on spare desktop * Setup networking (w/ 2 x network cards) * Setup Clock, openntpd * Install Tor * Configure PF * Run your homelan over Tor * Profit

>>12067 yes but EZ -mode with openWRT on SBC

>>12068 cool! I use GL.iNET minirouter when traveling. It works great with Tor and hyperboria.

>>12067 What makes this different to whonix? The ability to use different OS's instead of just the distro attacheded to whonix?

>>12070 I guess, different use cases. You can do transparent proxy or use socks5, then you can do sudo ufw default deny outgoing, and allow to socksport tor-box, use torsocks or built-in socks.

>>12070 its not all on the same hardware a odds game u play. u can get better odds by having multi architecture networks

>>12068 what kind of SBC is best for tor+openwrt?

>>9062 how?

>>12075 depends if you want Ethernet ports or wireless for WAN+LAN port I use a nanopi R2S if you need decent wireless you want a SBC that has USB3 or decent wireless on the board R2S support is in OpenWRT master, not yet in stable release. Otherwise look here: https://openwrt.org/toh/views/toh_available_16128

>>12076 Automatically when you maximize the window. It's called letterboxing and rounds it down to the nearest 100x100 or something. It's not as big of a possible anonymity set as the default window size, but it's better than what you would get from maximizing without it.

What kind of problems you get by using TBB as normal browser aside of captcha and IP-block?

>>12092 sometimes I can't browse content from the region Im interested

>>12082 I wonder how many people actually use default window size to make it a valid anonymity set and what kind of population samples do it more frequently. I'd say a user of paranoid places like nanochan would leave it on 1000x1000 while a more casual darknet market user or journalist accessing facebook would maximize the window for convenience. >>12097 It would be great if there was a dialog/GUI option to manually select exit nodes. That would be great. otherwise, for persistent pseudonymous identity (like a forum handle or whatever place with host being too bitchy with geoblocks and useless spooks like degfault cloudflare) it's not bad to chain a VPN after Tor exit.

>>12129 torrc ExitNodes

>>12129 You can manually set your exit nodes, they strongly recommend against it but tor is designed to be extremely customisable to the point that you can manually set nodes in torrc. Using it for pseudoidentity isn't as good an idea as you think though as all you're doing is changing your identity to the site from "tor user" to "tor user who only uses this one exit node" thanks to all exit nodes being public knowledge. Unless you are 100% confident your VPN can't be traced back to you then its the same for the VPN idea too.

>>12138 I think Mullvad will let you sign up using cash via mail and a throwaway email to get your id number. As long as you never connect to it from an IP traceable to you, they would have no means of identifying you. Assuming you use adequate opsec. So Mullvad after Tor would seem to fit that idea.

>>12129 >manually select exit nodes. That would be great for persistent pseudonymous identity Don't fuarrrk with your Tor config, just use proxychains to add a socks5/https proxy after the Tor exit.

>>12143 It's not a big deal at all, torrc is there to be used. Just try to use your brain.

>>12147 >It's not a big deal at all, torrc is there to be used. Just try to use your brain. If you were using your brain you'd realize that setting a fixed exit node undermines the anonymity Tor is trying to give you.

>>12148 "Manually set exit nodes" covers a lot of ground. You can set numerous acceptable exit nodes. Or you can just ban certain exit nodes that you don't trust. You don't have have to set a single exit node. You should learn more about the subject before offering advise.

>>12149 From the context of the original question it is perfectly valid for him to assume that he meant setting a single exit node which really is a bad idea. The discussion was not about filtering out known bad exits.

>>12151 well I don't like this arguing it's silly but the origin of the subject came from regional content, selecting a single countrycode should already imply several options, it also doesn't make much sense to keep this setting persistent when you are momentarily bypassing regional restrictions.

>>12152 >well I don't like this arguing it's silly The problem is you didn't bother to read the post you responded to properly and you're not actually trying to help anyway. You just want to show off your 1337 knowledge of Tor's config system and insult people in the process.

How can I transfer Tor browser settings to Firefox? The prefs.js file doesn't include everything.

>>12242 You can't. Use this for firefox: https://github.com/ghacksuserjs/ghacks-user.js

>>12186 Sorry for hurting feels fren.

How to clear RAM and other temp files that could contain information about your session on GNU+Linux after closing your Tor Browser/encrypted files?

>>12278 write script and run it

>>12280 This is not the spoonfeeding I was hoping for

>>12278 Use Tails.

>>12278 The only real way to be sure is to use Tails, you can use fancy scripts but if you use any other OS you risk leaving things behind in ways you don't expect and ways you do expect.

>>12281 rm -r /path/to/.tor/ lmao

>>12282 >>12283 Surely you mean heads, but I was just curious to the workabouts of trailing >>12284 >being this conspicious

>>12292 https://heads.dyne.org/

>>12293 What makes heads better than tails?

>>12297 >What makes heads better than tails? It's unmaintained so more delicious bugs in every byte.

>>12278 Try bleachbit.

I don't like tails, it makes my fan spin too loudly, it's gnome with systemd, it feels backdurred and honeypotted, if any project would be a target it's this one.

>>12304 Isnt tails by applebuam?

>>12305 >Isnt tails by applebuam? He's a journalist he doesn't have any technical skills.

There are some valid criticisms above. They aren't really finding the strengths to tackle the underlying issues, the movement doesn't appear to be analyzing the issues. The system is corrupted, this lack of democracy isn't functioning properly, so they resort to being as loud as they can. What else is there to be done if there is no resolution?

>>12298 This. Their repo hasn't been updated in a year and a half. >>12304 Then fire up a disposable VM in Qubes. >>12305 As far as I'm aware, the majority of Tails devs are pseudonymous. >>12308 Well, that's just easily disprovable bullshit. https://github.com/torproject/tor/commits?author=ioerror https://github.com/ioerror

>>>9058 Just out of curiosity, what's up with this >Don't enlarge tor's window What's the background on that?

>>12358 Resolution sizes, especially for laptops, are meaningful datapoints in deanonymization attempts. Part of the many things one can fingerprint in a browser using JS.

>>12358 https://arthuredelstein.github.io/tordemos/media-query-fingerprint.html

>>12359 >>12360 It's not just the size of the window, or even the display itself. Different desktop environments and configurations will have different sizes, making it an effective means of fingerprinting. This also means different taskbar configurations, scrollbar width variance between OSes, etc. There's a lot that can make a maximized window unique. Hence why the recommendation of keeping the default window size, and the efforts to include letterboxing in the event that people choose to maximize anyway.

>>12313 Use an alternative anonymity network such as I2P, alternatively become a trusted contributor to the tor network and propose making the changes such as making obfuscation with timing delays the default to make it harder for state actors to run analysis.

>>12365 Garlic Routing is the practice of bundling messages to tharwt timing attacks.

Having a hard time understanding something. If you're using Tor to connect to non .onion versions of sites, then you're at risk of running through an exposed end node that would show everything down to the guard node, worst case scenario guard node is exposed and would compromise your anonymity. But that issue is not possible if you're on an .onion site, because you're not decrypting the encryption tor uses?

>>12729 >that would show everything down to the guard node Only the relay knows the guard node. >guard node is exposed and would compromise your anonymity Even if the guard node is exposed, that doesn't show who is connecting to it. >because you're not decrypting the encryption tor uses Traffic always has to be decrypted at the end for the server to read your request. The danger of non-onion sites is if they don't have TLS, the exit node can also read your traffic. In this way there's no difference between onion and non-onion with TLS.

>>12730 This. The traffic always has to be decrypted at some point so the intended audience (whether an onion destination server or a non-onion destination server here) can understand it. If it's non-onion and non-TLS (that's a protocol for https encryption), then it may be plaintext between the exit node and the destination server, which is usually bad for anything private. lainchan.org has no onion address, but I'm connected with TLS 1.2 via the Tor network, so if only the exit node were compromised, it would know a person contacted lainchan at this time, with a message approximately x size, but it would only know the relay node and the destination (assuming the TLS encryption is secure from the adversary). The TLS encryption is performed in the browser and at the server. If the server isn't using TLS, it may expect plaintext, so exit node could read it easily. Correct me if I am wrong.

>>12730 >Even if the guard node is exposed, that doesn't show who is connecting to it. I thought once the guard node is exposed it would show who was connected to it? So .onion addresses are essentially always TLS?

There is a project going on allowing https onion sites, yet as mentioned, the connection is already encrypted, so I really don't know what the actual benefit is. Other than it giving people "impression of secure services."

>>12734 >So .onion addresses are essentially always TLS? Yes, hidden services are end to end encrypted by design. >>12744 A small number of hidden services already use HTTPS (e.g. protonmail), I think the idea is for hidden services with a clearnet presence to verify that they're the same company by using the trust provided by the certificate authority.

>>12745 >I think the idea is for hidden services with a clearnet presence to verify that they're the same company by using the trust provided by the certificate authority. This is a really good point I hadn't thought of before. Next time I'm operating a site on both clearnet and Tor, I'll keep this in mind.

>>9165 >>9168 Noone is going to sue you for accidentally visiting a website where ilegal activities happen. And if they do you can give them the explanation you just gave and you'll be fine.

>>12745 Facebook

>>12744 See: https://blog.torproject.org/tor-brower-onion-services-challenges-opportunities https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/21321

VPN RAID KRP seizes data from security company F-Secure's VPN service at Germany's request - court overturns seizure and orders destruction Two courts assessed whether or not KRP had the right to seize data. The courts agreed. data protection 21.10. 13: 55Updated 21.10. 14:06 F-Secure is headquartered in Helsinki Kimmo Brandt / AOP The Helsinki Court of Appeal has ruled that the data seizure of the data security company F-Secure by KRP is illegal. The seizure targeted the security company's Freedome service, which is tasked with guaranteeing the customer's privacy in telecommunications. KRP seized a request for legal assistance from the Bundeskriminalamt (BKA) of the German Central Criminal Police in January 2019. The BKA investigated the serious crime and estimated that the data held by F-Secure could identify the suspect. On 15 January 2019, KRP seized log data held by F-Secure concerning data from one IP address received from Germany. The seizure targeted F-Secure's Freedome service log data. Freedome is the company’s paid VPN service designed to provide privacy to the customer. Using a VPN, a customer can encrypt their own IP address from the recipient of the message and from outsiders. An IP address is a series of numbers that can be used to identify a user, but an IP address alone is usually not enough. In order to reveal the identity of the user behind the IP address, the information of the service providers must be accessed. Confidential Message or Customer Information? F-secure demanded in the district court that the seizure be overturned and the seized data destroyed. According to the company, the data seized in the seizure was confidential communications in accordance with the Constitution, which may only be seized on the basis of Chapter 10 of the Coercive Measures Act. Such seizure shall be limited to a message from or intended for the suspect. According to KRP's interpretation, it was entitled to seize the data, as they were not covered by the protection of confidential communications but customer and subscriber data. On this basis, the KRP would have been able to seize the data without the coercive measures defined in Chapter 10 of the Coercive Measures Act. On the Traficom F-Secure line The district court found that the data seized by KRP consisted of data momentarily stored for F-Secure, including the service user's IP address, the device ID of the device used, the session session ID, the start and end time of the connection, and the amount of data collected. Tapio Keihänen, an F-Secure expert heard in court, said that due to Freedome's fee, the validity period of the user's license is checked every time a VPN connection is opened. This information will be kept for three days. More data is saved when the user uses a VPN. This data is retained for 90 days. The seizure of KRP targeted the latter data, which contains data amounts and timestamps. By combining them, it is possible to find out the object of the communication, but for example, according to Keihänen, it is not possible to find out the websites visited by the user. Erika Leinonen, a lawyer at the Finnish Transport and Communications Agency, Traficom, testified that a memorandum on the nature of the information collected by the Freedome service was dated at the agency on 17 January 2019. A similar matter had previously been discussed with the tax authorities. The memorandum concluded that the IP address was transmission information within the meaning of the law and not only Customer information. Two courts overturned the seizure In its May 2019 decision, the District Court ruled that the information seized by KRP is brokerage data, not customer data. Obtaining them would therefore require the use of coercive measures in accordance with Chapter 10 of the Coercive Measures Act. The District Court also ruled that the Freedome service cannot be considered a communications object. F-secure is therefore not a party to the communication but an intermediary, so KRP cannot use coercive measures under Chapter 10 either. The District Court found that KRP had no right to seize the data and ordered the seizure to be annulled and the data destroyed. KRP appealed against the decision to the Helsinki Court of Appeal, which issued its decision today. The Court of Appeal upheld the district court's decision. F-Secure was not asked to give an interview on the subject, but the company said that it would comment on the matter later by e-mail.

Tor browser update -tor browser launcher no longer working. -tor browser randomly crashes. -tor browser grinding CPU and slow af. -tor browser tabs randomly crashing frequently. Anyone else find the same happening to them? I looked for forums discussing it without finding any.

>>12773 Tried sending crash logs through official channels and see what the reason might be?

>>12771 That's why we've got better options.