Hacker News Reader

Comment by zionic | Hacker News Reader

Can you imagine if Mozilla went with the nuclear option and replaced "private" tabs with Tor tabs? Going further, what if every Tor tab (by default, letting you opt out) acted as a node on the network and donated some minuscule bandwidth? I can see some tech heads being against such a thing, but your average user would have no idea 0.5Mb/sec (or some % of a speed tested value) is being used while their private tab is open and the number of users/nodes would skyrocket. Imagine the ever Tor tab potentially being an exit node!

View on HN

The Tor FAQ addresses this at

https://2019.www.torproject.org/docs/faq.html.en#EverybodyAR...

Some other problems:

* Possibly Sybil attacks get worse or harder to detect, because attackers can convincing simulate being a bunch of regular users with a browser

* Possibly mitigating malicious nodes gets harder, because people can create lots of super-ephemeral nodes that fail to forward traffic, but there's no way to notice this in time to protect other users

* Users could be very angry about relaying exit traffic without expecting it, especially if they got in legal trouble as a result (when EFF ran a campaign to encourage people to run Tor nodes, we discouraged people from running exit nodes in their homes)

I must admit I am perplexed by the last line in the story: "Donate today, and Mozilla will match every dollar of your donation."

I personally do not think that Mozilla is doing enough to protect its users and is partially to blame for where we are. They seem to be piling more and more features on that users don't want.

> Can you imagine if Mozilla went with the nuclear option and replaced "private" tabs with Tor tabs?

That's one thing I really like about Brave. There's an option for a private Tor session.

Sending traffic over Tor and using the Tor browser are different things: The former is just a proxy, the latter an anonymity tool. Is Brave doing the former or the latter?

I'm confused as to what you are trying to say. When you use the Tor browser, it sends all your traffic over the Tor network. That's how it keeps you anonymous. Perhaps you are thinking of hidden services.

Tor Browser does more than just proxying. See my response above.

i run security at Brave and here's the answer from Taylor, our lead Tor dev:

Using the Tor network is one part of internet anonymity, serving to conceal where you are. But using the Tor network does no good if the application helpfully adds X-My-Actual-IP-Address: 123.45.67.8 to every HTTP request, and browsers tend to do a lot of things like that which we have to play whack-a-mole with. What we implement in Brave is somewhere between (a) naively just setting a SOCKS proxy, like you can do in vanilla Firefox or Chromium, and (b) mimicking everything about the Tor Browser and following the Tor Browser Design Document to the letter (https://2019.www.torproject.org/projects/torbrowser/design/). So, while you are right that there's more to Tor and that we're not the Tor Browser (and that's why we are careful to say 'private windows with Tor' and not 'Tor windows', per agreement with the Tor Project about branding), there's also more to what Brave does than just setting a SOCKS proxy like in Firefox or Chromium and leaving it at that.

It is great to hear that Brave is indeed doing more than just proxy.

It has a great UX already and with VPN0 announced a month or so back, Brave is really pushing the envelope and do seem to have the right mindset.

Also, thanks a lot for responding.

>Can you imagine if Mozilla went with the nuclear option and replaced "private" tabs with Tor tabs?

Considering they don't even have a built-in PGP implementation in Firefox, which would make so much sense, I honestly can't imagine what you described. Tor is a relatively complex technology that requires knowledgeable use on user's part. (I.e. you're not supposed to resize windows, the browsers can't do certain things, it gets chewed up by Cloudflare and so on.)

For many people, half a megabit is more than their Internet uplink speed, and many are on capped/metered connections as well.

I haven't checked, but I imagine there's a "Metered connection mode" that limits things like auto-updates and perhaps loads lower resolution images. That could also disable bandwidth donation. You could also set the bandwidth to scale based on a speed test instead of a flat rate.

Sure, a lot more people would try it if Firefox made it easy. However, they might also stop using it pretty quickly if it's inconvenient.

Here's a similar experience I had: for a while I would open any news link shared on Hacker News in Incognito mode, but at this point it gets blocked so often there's not much point.

And leading to wide swaths of users being banned from tons of sites that use one of the many publicly-available tor banlists for some reason they have zero understanding of.

Or make banning tor unpalatable.

> but your average user would have no idea 0.5Mb/sec (or some % of a speed tested value) is being used

This is quite wrong

FWIW I'm not. I believe the "some % of a speed tested value" covers that scenario though. It's not a hard problem.

Reply on news.ycombinator.com