Hacker News Reader

Comment by encryptluks2 | Hacker News Reader

I'm surprised that they haven't bundled Arti, their Rust-based tor client implementation. I will say I am thankful for Tor Browser, but any JavaScript-enabled browser seems like the wrong choice for privacy and security.

View on HN

1) Arti is basically a prototype at this point, including it already would be reckless, 2) Arti is a client for the Tor protocol, and including it in the browser wouldn't have any impact if JavaScript ships enabled/disabled by default in Tor Browser, 3) if you really want to, you can easily change the "Security Level" in Tor Browser to disable JavaScript for all websites by default.

As an alternative for the last point, turn the Security Level to "Safest" or however it's worded, then use the included NoScript addon to enable it for just sites that just won't work without JavaScript. You get functional web + JS disabled in most places where you can.

I've basically come to the same conclusion having attempted to use a lot of Tor Browser's default config in Firefox. Most of it is a good idea, but trying to be untrackable while JavaScript is turned on seems futile. Every single browser's APIs are leaky as hell. No matter how many things are turned off or obfuscated, there's always a few unique-ish details that are exposed that create a fingerprint.

There was one point where my anti-fingerprinting tactics did appear to fool Panopticlick, but that apparently didn't last long. Fingerprinting and anti-fingerprinting are a cat and mouse game, and much worse so than just ad-blocking because there's more at stake than just being annoyed by banners. There's also way too many websites doing everything, and I mean everything with JS. Fricking blog sites half the time display nothing more than a motionless loading spinner if you don't have JS turned on. And if you turn JS on well good luck because lots of things want to use <canvas> to render things that don't even strictly need it, and you're really not going to casually enable canvas for certain things? Even the list of fonts is a decent metric for fingerprinting, yet that's rarely taken seriously because even privacy experts seem to believe that every website needs to display its own fonts for "brand identity."

Though I would stay away from Tor anyway, if I were to use it, JS would have to be turned off entirely.

My default browser is Librewolf with JavaScript turned off. If a page fails to load correctly, I reopen it in Firefox private browsing mode (or, if it still fails, Chrome incognito mode). If it’s a site I expect to come back to in future, I bookmark it in Firefox and assign it its own container using the Multi-Account Containers extension.

Arti isn't ready for production use yet. Its a long ways away from being usable in TBB or as a full drop in for tor itself.

I think in a years time that will change.

Security is always a compromise between competing concerns. A browser that cannot browse a significant chunk of the internet doesn't get used and helps nobody.

I installed the Tor Browser to access the Z Library a few days ago. I guess I shouldn't complain, but the downloads are very slow (I'm not sure if the problem is in my end).

In general connecting over Tor or I2p is slow.

Tor works by proxying through (at least) 3 PCs before hitting the open web. The problem is that you’re trying to download big files which is not a use case for tor.

It’s specifically for browsing the web anonymously.

Was it always 7? I seem to remember it being like 3-4?

https://i.imgur.com/h1vlxNh.png

Connecting to hidden services it's 6 hops, reaching out to the internet it's 3 hops.

For a circuit to clearnet it's 3. Guard --> Middle --> Exit. For a onion service it's 6 and the connection is a bit more complicated [0]. The speed varies from very fast to unbearable depending on your circuit and how bad the ddos is at that moment. [1] You can try to create a new and hopefully faster circuit by clicking on the onion symbol on the left in the address bar.

[0] https://github.com/mikeperry-tor/vanguards/blob/master/READM...

[1] https://status.torproject.org/issues/2022-06-09-network-ddos...

My mistake, updated my comment

In your defense I also wasn't sure for a minute and had to look it up. Could also have been three hops to the intro point from the onion service.

When I first starting using Tor in the mid aughts, I was using it to download movies and music. I remember talking with a security friend and he was like, "Bruh, what are you doing? That's not what Tor is for." and then launched into a 20 min rant about why I was misusing Tor and affecting other people using the service by what I was doing.

It was a good lesson and helped me realize what Tor should really be used for.

It's likely that downloading music and movies is actually helpful for those using TOR to "avoid death" - because it provides more cover and traffic.

Check Library Genesis (on the open web) before resorting to z-lib, as that's where z_lib got most of their content in the first place.

Arti doesn't even support hidden services yet.

Reply on news.ycombinator.com