Hacker News Reader

Comment by andrewaylett | Hacker News Reader

I know there are good reasons why it's not fully secure, but I'd really like to be able to access `.onion` addresses in my regular browser over TOR and everything else directly as usual. In _this_ I'm not over-worried about the risk of deanonymisation as my aim is on one hand access to resources I don't have access to now and on the other hand legitimisation of TOR as something that anyone could reasonably use, even (or especially!) if they have "nothing to hide".

View on HN

You absolutely should use Tor for regular non-logged in browsing if you can bear the slowness. Exit bandwidth is limited, but I'd say being a needle in the haystack of people who actually need the privacy is a net benefit.

I'd just really advise against touching Tor with a regular browser. For starters, you shouldn't browse Tor without blocking JavaScript by default. Hogging the bandwidth needed for video is also where 'normal use' turns problematic for the people who actually rely on Tor for personal safety.

Tor Browser is painstakingly maintained to make it suitable for Tor. Even Brave's Tor mode is more fit for purpose than proxying Tor manually.

I'd also argue that it's better for the anonymity of all to use a browser prepared to avoid fingerprinting.

Seems like you are being the haystack instead of the needle in this case.

Well, that or he is a rare strand of hay in a stack made mostly of needles.

(I'm stretching the analogy to point out that you are correct that he is providing cover [the hay], but that most of the traffic currently is of the type that the surveilling entity is looking for [the needles]).

>"For starters, you shouldn't browse Tor without blocking JavaScript by default."

Could you say why this is recommended?

Because JS might be used to leverage technology that can give clues on your browser and connection, it's in general one less open hole to think about when trying to stay as anonymous as possible

Not only that, but JavaScript can get you owned, and any code loaded over a non-https connection could be rewritten in transfer. Remember: all Tor exit IPs are publicly known. Tor users are easy to target.

If you use .onion services for anything... interesting, you should also be aware that the first step an advanced attacker might do with a compromised site is to try and completely own all browsers visiting.

If you run JavaScript, you're just waiting for someone to poke a hole in whatever sandbox protections the Firefox base of Tor Browser can provide. Example: https://threatpost.com/tor-browser-update-critical-flaw/1458...

Interesting point. Thanks. I have a related question. I'm assuming Tor browsers don't include any javascript engine then? And also likely include some self-contained resolver library? Are there other things that differences between a standard browser and a Tor browser worth mentioning?

The Tor Browser enables JavaScript by default -- it would be impossible to use for most web browsing otherwise. In fact there is an argument to be made that you should not disable JavaScript because it makes your fingerprint more unique to the sites you visit (you're a Tor user with JavaScript disabled). It depends on whether you value your anonymity more than the risk of potentially being attacked by bad JavaScript.

Tor Browser is based on Firefox, and has a bunch of anti-fingerprinting measures built in to it which have been slowly upstreamed to Firefox (as well as ensuring the Firefox doesn't send anything without going through Tor -- something which historically has been hard to do as a Firefox user).

You can do this! There exist several tor2web proxies that allow you to do this. Simply go to tor_url.onion.ws in a regular browser.

Keep in mind that this only protects publishers, not those accessing the website.

More info: https://www.tor2web.org/

These proxies can appear useful, but I'm just going to drop by here to say that this a particularly bad idea to spread among non-technical people.

I've seen these proxies bleed into more problematic Tor use cases among vulnerable individuals. Defaults matter, and as technical people we should assume a bit of 'do no harm' moral responsibility for people who seek our advice.

Tor Browser is painstakingly maintained to be fit for its specific purpose. If you're not authorized to install Tor Browser on a device and to emit Tor traffic on the network you're using, you generally shouldn't access Tor there.

Anyone using Tor to access resources that might get them in trouble in the country they're in should look into proper operational security with Tor Project-provided infrastructure like bridges.[1] The special purpose Tails operating system can be used with bootable USB memory on common hardware like laptops without leaving a trace.[2]

1 - https://www.torproject.org/docs/bridges.html.en

2 - https://tails.boum.org/

These do not (yet) support version 3 of Tor which is the current version.

you can download the brave.com browser for desktop, which supports Tor. After creating a Tor tab I could view https://www.bbcnewsv2vjtpsuy.onion/ without issue

You should not use Brave Browser to access .onion websites. It makes you easier to target and identify and you stand out.

Tor Browser has millions of active daily users VS Brave Browser has only a very small amount.

Sometimes that's okay. Sometimes you don't care about privacy and just want to use a network system where people actually own their domain names instead of lease them on the whim of a corporation.

That is fantastic. I might finally make the switch over from firefox.

You can do this in Firefox. Open about:config and search "dotonion". Toggle it. The other arrangements are left up to you.

But this will need you to start the Tor deamon separately and configure the two I guess? Not as simple as just using Tor browser, or a Tor tab in Brave...

Hence "The other arrangements are left up to you." Also OP specified he wasn't concerned with deanonymization.

It's pretty straightforward.

1. Run the service.

2. Disable blocking onion in about:config.

3. In firefox set manual proxy and enable proxy dns for socks5.

Done :D

Takes all of two mins.

Even better you can start Firefox with the profile manager and have one profile configured for TOR and the other for normal browsing.

That said, it's generally better to run the official TOR Browser instead. It has security nerds working over every aspect of it to make it as anonymous as reasonably possible. Deanonymization is shockingly powerful in the age of big data.

Agreed. I just switch ff to proxy when I want to bypass isp blocks for tpb and so on really.

If you want to be anon, use tor.

Privacy Browser on Android does that - you can choose which sites are accessed over Tor and a lot more (searching with DDG via Tor, access Facebooks onion address).. Highly configurable..

https://f-droid.org/en/packages/com.stoutner.privacybrowser....

https://www.stoutner.com/privacy-browser/

Brave browser integrates Tor browsing, might be worth trying for you.

If you have installed tor on your local machine, you can use an add on like proxyswitch omega (firefox and chrome) to redirect all onion websites.

For a network wide approach, you will need to set up PAC and a network accessible tor proxy. The PAC would have a rule that redirects all .onion hosts to the network accessible tor proxy.

You can use a browser extension such as foxyproxy to specify proxy settings based on url patterns. Just tell it to use the SOCKS proxy of the Tor daemon for .onion addresses, and the I2P proxy for .i2p adresses for example.

You can use torsocks https://gitweb.torproject.org/torsocks.git

I think the Brave Browser has this capability. It at least will allow you to create Private + Tor windows.

I set this up at one point. I should try and find the config again....

This uses the linux specific TPROXY mechanism, if your desktop doesn't run linux you'll need to figure out the alternative.

In /etc/tor/torrc:

    DNSPort 127.191.0.1:53
    TransPort 9040
    TransProxyType TPROXY
    AutomapHostsOnResolve 1

Add iptables rules:

    iptables -t mangle -A PREROUTING -d 127.192.0.0/10 -j TPROXY --on-ip 127.0.0.1 --on-port 9040 -p tcp
    iptables -t mangle -A PREROUTING -d 127.192.0.0/10 -j TPROXY --on-ip 127.0.0.1 --on-port 9040 -p udp

Make sure you start tor with relevant capabilities (I use systemd, so here is my override snippet):

    [Service]
    AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_ADMIN

Split horizon dns to send .onion lookups via the tor daemon. e.g. my dnsmasq config contains

    server=/onion/127.191.0.1

Note that some programs might need some coercing. e.g. firefox needs network.dns.blockDotOnion set to false in about:config (see https://twitter.com/mrphs/status/708548201800982528)

The way to do that is just to use Tor Browser as your regular browser.

I do this. Most of my life is just copy-pasting from stack overflow, so speed isn't a problem.

No, because the Tor Browser sends all traffic through the tor network and exit nodes.

Why is that bad, per se?

In practice some sites drop Tor connections, and localisations come through wrong, but that doesn't seem to be why you said "no".

In my experience, the limiting factor is speed. Tor is not exactly the fastest protocol in the world, and while streaming video over Tor has gotten better over time, it's still not what I'd call ideal. For regular browsing, the loss of speed is inconvenient enough to annoy the average user, myself included.

I've used tor-browser and Brave's tor mode quite a bit. I've not really had problems with speed nor playing 480p video (if sites default to higher res it's sometimes a problem).

Captchas on some sites, for sure, sometimes a different route will fix it. Usually mainstream sites either block tor or work properly.

Hope you like solving CAPCHAs, because you're going to be doing a lot of that. And you can forget about searching with Google. Also you'll learn to hate Cloudflare as they straight up block you from so many websites.

And don't even think about trying to sign up for some free service like an email account or game account. Your account will be flagged before you finish thinking up your username.

> Also you'll learn to hate Cloudflare as they straight up block you from so many websites.

Well, it's the websites using Cloudflare, not Cloudflare doing it for fun. You're better served hating other Tor users for ruining nice things for you.

But you're lucky if a service even allows Tor. I straight up block it for some of my applications since it's 99.99% abuse.

"Use tor for everything" is a bad answer, because the question specifically said "I'd really like to be able to access [...] everything else directly as usual"

"Use tor for everything" might be good life advice, but it's not a good answer for "how do I avoid using tor for everything" :P

It actually reduces the security because exit nodes are likely to MITM you.

So install an extension to block non-HTTPS pages and you're golden

fwiw, Tor Browser comes with HTTPS Everywhere, though you need to click the add-on's icon and enable "Encrypt All Sites Eligible" to block non-HTTPS.

I know it is based on Firefox, do they keep updated with upstream?

Yes, they base Tor browser upon the latest Firefox ESR so it has the same security fixes as that...

Reply on news.ycombinator.com