Comment by tete | Hacker News Reader

Comment by tete | Hacker News Reader

Parent Full thread

I actually switched to using Tor whenever I go on wild hunts about stuff that I find interesting. Basically that means whenever I visit Wikipedia, because I can waste hours there, going over the weirdest topics.

Usually I get drawn in by stuff like history and end up on things like Soviet Union, Nazi Germany, Japan in WW2, etc. or stuff like Ku Klux Klan, the "Islamic State". If there is some surveillance system it will probably be thinking I am into each and every kind of extremism. And since extreme groups like the Nazis have the wildest conspiracy theories that also is something I don't want to identified with.

Using Tor by using the Tor Browser is actually pretty nice and pretty fast, both to set up and when browsing. Years ago Tor used to be rather slow. That totally changed.

The are a few annoyances though.

Some websites seem to have weird rules such as "block Tor completely". Come on, your website can still be exploited. You will not really stop anyone that way.

Then there is the problem of websites usually requiring JavaScript for everything. The latter is weird, cause it's like people use "front end frameworks" for stuff where it doesn't really make sense and even slows down the page a lot. I am not saying JavaScript is evil, but I think people overuse them these days. Of course you might decide to enable JavaScript and unless you set the Tor Browser to highest security at least HTTPS sites will deliver and execute JavaScript.

Another major annoyance is CloudFlare. They require you to enter a CAPTCHA (which for some time didn't work), when accessing a website via Tor. The only way to disable it is for the website owner to completely disable security. I mean I get that they probably want to prevent some script kiddies from "hacking" unpatched Wordpress or so, but maybe this can be enhanced. Cause like I said above. The approach of filtering certain IPs isn't really enhancing actual security and nobody is going to DDOS you via Tor. ;)

You can download a copy of Wikipedia articles from https://dumps.wikimedia.org/. It's surprisingly small, around 15GB for all articles, and 50GB or so uncompressed.

Then just browse offline, and nobody can tell what articles you looked at.

Is there any way to get just the static html pages post 2008 when they just stopped doing them? That's 6 years out of date.

The Wikipedia on DVD link doesn't seem to work http://www.wikipediaondvd.com/.

And I am not sure what to do with the Database backup dumps if the only thing I want is some static HTML pages, how could I get some readable HTML out of them?

You can't get the html anymore. You can download the dump (latest one is enwiki-20151102-pages-articles.xml.bz2, around 11GB), and then generate the pages dynamically.

See https://en.wikipedia.org/wiki/Wikipedia:Database_download#St..., and the next section. There are a bunch of programs that can do various things, and if you're on a reasonably recent computer, you shouldn't have a problem dynamically loading anything. There's even a rockbox plugin, which I used for some time, on a slow mp3 player.

> nobody is going to DDOS you via Tor

Uhh, yes they will... and that is pretty much the exact reason for the captcha.

Is this true? Tor specifically disavows this:

https://www.torproject.org/docs/faq-abuse.html.en#DDoS

It's rather hard and inefficient to do that over Tor.

It's actually way easier to just use your regular botnet or pretty much every other approach.[1]

And then it's rather simple to prevent this with your ordinary approach. There are currently around 1000 exit nodes[2]. Compared to most DDOS attacks that is really small number of nodes. For various reasons (measures that are mostly there to make sure Tor can be used for regular browsing in a usable manner, even when there is people that want to download lots of large files) you will run into limitations rather quickly.

[1] https://www.torproject.org/docs/faq-abuse.html.en#DDoS

[2] https://metrics.torproject.org/relayflags.html?graph=relayfl...

More likely they will try to perform a Denial Of Service while appearing to be Distributed, so "DDOS" is technically accurate.

As tete says, it'd be rather inefficient to do a DDoS via Tor. I think that the reason for the captcha is more related with security, to avoid spammers or bots to getting through via Tor. Cloudflare explains the issue here: https://support.cloudflare.com/hc/en-us/articles/203306930-D...

Some of these points are partly why I chose to go with a commercial VPN regularly rather than Tor. There is also no change at all in my bandwidth with the VPN, and I can seamlessly use high bandwidth tools like Netflix, streaming audio/video, etc. Maybe Tor has improved lately to allow this kind of behavior easily also?

The problem with these VPNs is that they can log your traffic. Even if they say they don't, what's to stop them?

Moreover, VPNs are juicy targets for surveillance corps since so many do use them to conduct illegal or questionable activities. My personal strategy is to use Tor with a private obfuscating bridge rotated frequently between hosting providers.

Do you mean you use Tor with VPN together?

Not quite, I'm referring to https://www.torproject.org/docs/pluggable-transports.html

My favorites are obfs4 and StegoTorus, running on a private machine in some "cloud".

For certain kinds of streaming it might be nicer to use a VPN, even though, like others already pointed out it might still be used invade your privacy.

Not just that your provider might just log your actions, but VPNs are usually not trying to avoid various passive attacks, simply because VPNs are there to provide an encrypted connection, nothing more.

For ISPs (of the VPN) and others it's rather simple to look at where and how you enter and therefor an attack where people look at the (amount of) traffic that goes there, what the server on the VPN side requests. It's not impossible with Tor, but way, way harder.

In addition to VPNs usually being centralized and therefor easier to attack in such a manner your VPN also is likely to have fewer users than Tor, so it's way easier to look at it and draw conclusions.

Also VPNs tend to be better suited for (semi)targeted attacks.

Watching HTML5 video on Tor is fine, though I haven't tried a 2 hour movie in high resolution. The main challenge is that if you want to preserve many security benefits of Tor then you can't use Flash.

Tor's performance generally works well enough that I think most users could use it most of the time and make non-Tor usage a special case.

This is my normal mode of operation :) I use it on my phone, desktop, and laptop for pretty much everything.

How is it implemented on your phone? Does it cover all your phone's network usage?

Nope. Still an annoying process to stream YouTube, and it still chops. The general vibe of the Tor community is to not use up excess bandwidth unless you have to, because it chokes endpoints and gateways and leaves less room for others. I think a lot of gateways probably run some form of bandwidth limiter, but that's just speculation. It's considered extremely bad taste to do things such as high-volume P2P

I stream musicvideo on youtube via tor all day and if things are too slow I simply use the 'new circuit' button. It works very well.

Reply on news.ycombinator.com