Hacker News Reader

Comment by jeroenhd | Hacker News Reader

Tunneling all traffic through Tor can be risky, especially if you're using exit nodes to access clearweb applications. The traffic patterns of your tunnel will be significantly different from most Tor traffic (browsers, exclusively) which can help pinpoint your phone if the authorities are wiretapping your connection. Allegedly, the various law enforcement agencies around the world operate a significant amount of exit nodes and if they can pinpoint a particular traffic pattern, they may be able to trace it back home.

I would be more selective with my traffic. Use Tor Browser for browser traffic, but keep sending Signal/Session/whatever through normal means. That makes your phone stand out less. Consider using a decent VPN like Mullvad, that should provide enough plausible deniability not to stand out.

View on HN

The routes of Tor traffic are dynamically changed, so a node can just pinpoint the pattern during a small period of time. So compared to a VPN which may monitor you constantly, Tor should be preferred.

If you think your traffic is not being monitored over Tor, then you have thought incorrectly. It can be monitored at the exit node no problem, and is likely monitored _more_ closely than other endpoints.

Your only hope is either not using exit nodes (and only using hidden services), or encrypting all of your traffic _and_ making sure different apps/services use different Tor circuits. This does not happen by default, meaning all of your traffic is mixed together. It doesn't matter that it migrates routes every so often.

Exit nodes don't know where the traffic is coming from, until, of course, you accidentally access your personal domain name over HTTPS just by visiting it, which leaks through SNI. Hope you don't host your own services!

>If you think your traffic is not being monitored over Tor, then you have thought incorrectly.

Tor exit nodes can only monitor traffic for a very short period of time, you create a new circuit and pick an entirely new path through the network very often.

>This does not happen by default, meaning all of your traffic is mixed together. It doesn't matter that it migrates routes every so often.

Absolutely true, a solution to this is to use Whonix or Tails which automatically stream isolates all pre-installed programs, therefore correlation by circuit sharing is impossible. Unfortunately that does not work on a phone, but in the end, using Tor for this is no worse than a VPN.

>Exit nodes don't know where the traffic is coming from, until, of course, you accidentally access your personal domain name over HTTPS

This seems like a straw man. There's not many options to Tor. A VPN will know where you're coming from by default.

> you create a new circuit and pick an entirely new path through the network very often

It is every 10 minutes: https://support.torproject.org/about/change-paths/

> This seems like a straw man. There's not many options to Tor.

It wasn't intended to be a straw man, it was intended to highlight the complexity of hiding your identity online. Tor is indeed one of the best mixnets out there, but it is _not_ a panacea, and if used incorrectly can actually make your privacy _worse_.

The Tor Project itself has official guidelines on how to use Tor safely when you do need it: Tails or Tor Browser. Recommendations that stray from this, from an engineer not familiar with Tor, can actually be _harmful_.

Tunneling all traffic through Tor is beyond risky. It's absolutely wrong.

Not only applications can leak all sort of data in cleartext, but your traffic is visible to exit nodes, and some are malicious.

Reply on news.ycombinator.com