Hacker News Reader

So the way to fix this is to get involved and write some software instead of commenting in a forum as if software is a static problem. Why not open a bug report? Maybe we can prevent password reuse by the browser taking a hash of the password being entered in a form and comparing it against other password hashes locally?

These issues are trivial compared to the bigger issue at play: the right to read and to write without exception.

That is what is at stake here.

Exits sniffing passwords for plain-text forums is a minor concern compared to the bigger issues at play. I'd like to point out that it's trivial to test for this too...(create some plaintext accounts on forums, post there, then run a honeypot server with your own email address and see if you get a login, do this automatically for each exit) However the time commitment isn't so trivial: If you wrote such a program it would be appreciated, please yell loudly about it on the tor-talk list if you do! Tor works by and large by people following some basic principles, like "if you think it should be done, do it".

You could also see the issues with plaintext passwords on HTTP sites and password reuse as a problem of user education. If you're not up for writing software, why not open a bug and suggest some wireframed ideas for how a UI could look to prevent password reuse? There is a whole bunch of ways to contribute.

There are literally 100's of problems like this Mozilla or Tor could get help with... get involved instead of ahead of time saying "This can almost guarantee that this will do waaaay more harm than good." I hope to see your responsible posting of these concerns to a bug tracker. A lot of what gets done in FOSS projects like Tor really is just a bunch of people who've decided "hey, if I don't do this, who will?".

As for doing more harm than good: I can't possibly see how this does more harm than NSA domestic surveillance.

So the way to fix this is to get involved and write some software instead of commenting in a forum as if software is a static problem. Why not open a bug report? Maybe we can prevent password reuse by the browser taking a hash of the password being entered in a form and comparing it against other password hashes locally?

The lack of a proposed solution does not make the identification of a problem worthless. Writing code is as much part of the process of solving problems with software as identifying those problems is. When a problem is largely a social one, rather than a technical one, identifying the problem and making people aware of its existence is often the bigger part of the process.

Tor guarantees anonymity. It succeeds at that. There is no technical problem. There is no code to write. This could lead you to think there's a problem with scope, that maybe Tor should guarantee security too. Unfortunately, the design of Tor is not compatible with that goal: if your plain text data goes through an exit node, then by definition, that exit node gets to see what the data is. A bug report titled "Tor does not provide secure communication" would get closed faster than you can say "won't fix". And rightfully so.

There is, however, a social problem, as stated by the OP: many people actually expect security. This is a problem that can only be solved by educating as many people as possible that this is the wrong expectation to have, which is what the OP is contributing to by making this post. This is very much in the spirit of "if you think it should be done, do it".

>Tor guarantees anonymity.

No it does not, it is always best to use a seperate browser for tor because your browser & OS fingerprint is significant

https://panopticlick.eff.org/index.php?action=log&js=yes

And that is ignoring the fact that most people will continue to login to the HN and facebook accounts.

> Tor guarantees anonymity. It succeeds at that.

Doesn't it fail at anonymity if the entire internet is being monitored?

I fails to see how HTTPS Everywhere + a nag whenever a form is detected on a HTTP page doesn't make this a complete non-issue. OP is not giving Mozilla any credit.

If OP has ever used Tor, he would know that the performance hit is so huge, that no-one in there right mind is going to leave it on by default, if that's even an option. In OPs myopic view, he's missing the fact the the added benefit built in anonymity to all FF Users far outweighs this hypothetical security risk.

Maybe we can prevent password reuse by the browser taking a hash of the password being entered in a form and comparing it against other password hashes locally?

Won't work. People have too many accounts to be able to remember unique passwords. A large percentage of mundane users won't understand these things and will just be nagged all the time that they cannot log into their accounts with this new Firething.

We could warn "this is the same as site X which is HTTP". If it's a throw away, that is fine. If it's not, that might matter.

When you enter your password into an input on a page served over HTTP, it is already game over.

Not if you use a throwaway, crappy password, that you do not care gets compromised.

Your proposal, as it stands, doesn't warn the user until /after/ they've typed a non-throwaway password into a site served over http.

You'd need to warn them before they even start typing a password in on an http page.

You could do that. As you type into any <input type="password"> the browser would buffer the text and not send it through to the DOM immediately. When you hit enter, leave the field, submit the form, etc then it'd get sent through to the DOM where it'd be available to (potentially malicious) javascript. While the password is in the buffer the browser could check for "non-throwaway password + http" and block it if need be.

This does require the browser to know which passwords are which, though, at which point it might as well be entering them for you (and only being willing to do that over https).

Ideally yes, but almost no sites send passwords as they are typed. The only likely situation where that would be a problem is if the site itself is compromised, in which case nothing can save you.

Not just a site compromise; a path compromise (malicious exit node, shady ISP, or fake WiFi access point) can inject Javascript in an unencrypted page. CA-signed SSL with cert pinning prevents MITM injection.

What percentage of internet users do you think know what "HTTP" means?

Good point. I would guess 40%.

Really? I would guess substantially less than 1%.

Google did some videos asking the general public what browser they use (before they released Chrome). It might be informative for you.

Then force unique passwords without requiring the users to remember them, something which is both easier for users and more secure.

Perhaps the browser should present a warning dialog anytime you connect to a site over TOR, without using SSL?

You are still making a connection through an unknown third party host, which kind a negates the encryption on the last part of the journey.

The thing is that I doubt anyone is actually running a malicious server that would login to your honeypot as soon as it gets your credentials, at least I would let the username/password list collect for couple of months before checking it and even then I wouldn't blindly hit everything.

But the thing is that thous TOR exit points (just like Proxies) can inject all kinds of JS on the sites they display and while some people run NoScript or similar browser extensions most do not.

And giving out your username/password combinations for scriptkiddies and criminals and allowing them to run any JS on sites you visit does hell of a lot more short term damage than any government surveillance, losing all of your possessions in an identity theft or just getting phony bills is way worse for your average consumer than having their Facebook chat logged.

Tor is a good tool when used properly, but slapping it on to everything isn't what the tool was made for.

> Maybe we can prevent password reuse by the browser taking a hash of the password being entered in a form and comparing it against other password hashes locally?

I always thought that one possible way around this would be for websites to generate the passwords for their users, essentially forcing them to use some sort of password storage (either in the browser, or LastPass, or whatever-you-want). So one would register with just an email address/username and then be shown a generated password à la O5O1zn8H3zEGNjf1Ly8v to store in the browser’s password manager.

Of course, this only works if people only ever use the service from devices they own and I have absolutely no idea how common internet café/public library users are nowadays.

Is that similar to using something like OpenID, where you sign into the authentication service, then one by one authorize the identity to log you into services?

It seems like a more modular approach than using Facebook or Google to sign into third party sites, but similarly secure in terms of exposing passwords.

I don’t think it has much to do with OpenID – my suggestion still keeps the classical username/password tuple as credentials, but simply disallows the user to choose the password freely.

One extension, of course, would be for websites to somehow signal to browser ‘Hey, please store this password/username for this website’, but I’m not sure whether that's necessary.

Also, plenty of bad services out there that restrict passwords in lots of different terrible ways.

>So the way to fix this is to get involved and write some software instead of commenting in a forum as if software is a static problem. Why not open a bug report?

It cuts both ways. I don't understand why you meta-comment, instead of going fixing those things yourself.

It's a little bit different on that side. Telling others to go fix things, if you succeed, is better than (just) doing it yourself. I can donate money to charity, but let's say my budget (and in other scenarios equate budget to time, or skill, or whatever) is £100/month, if I donate that and tell others to donate, then maybe I can have a £1000/month impact.

Whereas if I'm just telling people "this is no good, it needs fixing" then not only am I not helping, I'm not persuading other people to help either.

I see that as merely double standard.

The main premise is wrong too: "if I'm just telling people "this is no good, it needs fixing" then not only am I not helping, I'm not persuading other people to help either.".

Lots of things that are no good NEED to be pointed out. Project members don't magically see all of them.

Either because they don't have that particular use case themselves, or because they haven't thought it that way, or they think it's not important but the users think otherwise, or they have invested too much in some design that they cannot admit it's flawed, etc.

Pointing things out helps making those flaws visible, helps start a discussion, makes the opinion of potential or actual users known, etc etc.

Telling people to go and help is very secondary to that. I don't think many people ever got motivated because of some second-hand meta-comment from someone not even involved in the project.

You're absolutely right - when I commented I was thinking purely in terms of "you shouldn't tell others to get involved, you should be getting involved yourself", I didn't stop to think about the pros or cons of the original comment.

As for doing more harm than good: I can't possibly see how this does more harm than NSA domestic surveillance.

How about false sense of security? Zero improvement in security plus baseless confidence that you are now secure sounds like a step backwards to me! It's already suspected that NSA has been working around Tor for years now. Wasn't there an article recently stating that the NSA (or was in the CIA...?) control 2/3 of Tor exit nodes?

Lastpass does something like that - it warsn about identical passwords, though of course it actually has the plaintext, but a hash would work fine as well.

It's not more dangerous than connecting through a regular proxy, or through a Wifi network at some coffee shop or hotel. And how trustworthy is your ISP exactly?

For example, while I visited the US it happened at 2 motels I stayed at for their network to insert ads in the web pages I was visiting. So they where not only snooping my traffic, but going further into altering it. Also, go to any conference or gathering of people, create an open Wifi hotspot (like, with your phone) and then enjoy all the cookies and passwords flowing through, from all the clueless people that connect to it.

Truth of the matter is, websites should be secure by default. Those that aren't represent a huge security risk. Fortunately many of the big ones are (e.g. GMail, Twitter, Facebook, etc...)

Also see:

[1] http://en.wikipedia.org/wiki/Firesheep

[2] http://faceniff.ponury.net/

(I know nothing about this.)

I interpreted tjoff's argument to be that the average Tor exit node is more malicious than any of the other average ways for proxies to be dangerous. In other words, yes coffee shops could be dangerous, but they are most often safe, whereas if you're getting routed through a bunch of exit nodes over a period of time (is that even how it works?) you stand a much greater chance of running into malice.

Would love to hear someone address that claim as I understood it.

If you care about your security (or as a service provider, the security of your users) and if you can't establish a chain of trust, then you can't call a solution secure.

If the connection is encrypted, then you have to trust the certificate authority, the browser and the service provider. If the connection is unencrypted, then in addition to the above, you have to trust that nobody is listening on that connection and that's a really tough pill to swallow, even if nothing bad happened to you in the past (just like with car accidents, it needs to happen only once to mess up your life).

If you don't think bad things happen all the time in the wild, see this story of Ashton Kutcher's Twitter account being hacked while attending TED: http://www.huffingtonpost.com/2011/03/02/ashton-kutcher-twit...

There is different _probability_ of having malicious network sniffer with different service providers. I would bet my left testicle that the probability with tor is higher than average ISP. If you want to speak about security _theory_, then please state so. Usually in these kind of discussions people speak about practical security, which means trusting different people different amounts, and trading theoretical security with trust.

"It's not more dangerous than connecting through a regular proxy, or through a Wifi network at some coffee shop or hotel. And how trustworthy is your ISP exactly?"

Totally false claim. I would bet my ass that there is higher probability to have your traffic sniffed by tor exit nodes than by regular ISP's. At least for short-term malicious purposes, like email snooping and credit cards.

(For more long-term malicious purporses, NSA etc., you can't be really sure.)

"I would bet my ass that there is higher probability to have your traffic sniffed by tor exit nodes than by regular ISP's"

Totally false claim. The biggest nodes on the tor network is run by established tor enthusiasts, and the largest portion of traffic is routed through them. Social pressure makes those people unlikely to put the node in jeopardy by sniffing exit traffic.

However, there is not much that would deter a coffee shop employee against sniffing the wi-fi, or for that matter, making them care to secure the router against would-be-attackers.

As such, I would be that there is a higher probability to have your traffic sniffed when visiting the local coffee shop, than by a tor exit nodes.

I think you are massively over estimating the power of this "social pressure", especially when up against the obligations of NSLs and the like.

So only support TOR for TLS-managed connections and .onion sites.

As for TLS, something like http://convergence.io/ would be a nice thing to add by default.

You can actually put up the "this is dangerous" sign for pretty much any invention out there. I understand that you are not advocating "this should not be done" but like any other feature one needs to be vigilant with Tor.

Are you saying that tor exit nodes are generally malicious? I mean, I understand the precautions involved in routing the data like that, and that there's the possibility, but is it really that rampant?

Regardless of the real situation, it is to be assumed.

My understanding is that its the vast majority.

Tor is a very attractive target for such behaviour. It takes very little effort to set up a Tor exit node and to start passively sniffing traffic. It would surprise me more to find out that this behaviour wasn't rampant.

Also, try and use your online banking through Tor. You might be using HTTPS, but watch as your account is frozen when they detect you accessing it from multiple different countries in a short period of time.

Tor is unsafe to use unless you understand how it works and use it selectively and carefully. Selectively and carefully is not a way I would describe the average persons browsing technique.

One possible way to implement ‘buried deep down’ would be with a command-line option (--enable-tor) that requires input on the console to continue launching the browser. Something like the following:

  $ iceweasel --enable-tor
  The option --enable-tor will route _all_ traffic generated by Iceweasel through
  possibly-malicious TOR exit nodes. Please read http://example.com/TOR for more
  information on how TOR works and then type "Enable TOR" to continue launching
  Iceweasel with TOR enabled.
  Awaiting Input: <user types Enable TOR + Enter>
  <Iceweasel starts>

Sure, people could build scripts with expect or so, but I would assume this to deter most unknowing users from enabling TOR accidentally (idea stolen from apt-get’s ‘Yes, do as I say!’).

People will enable this and think they are safe while they are suddenly routing all their cleartext through an untrusted third party (that is, very often, malicious).

So wouldn't the fix for this be to have the browser warn/refuse to send cleartext over Tor?

The way to fix this is to throw up a giant warning (al la untrusted SSL cert) when using the Tor mode and accessing a site that does not support HTTPS.

Probably, if FF implements a 'native Tor button.' The other possibility would be, to only support hidden services natively for .onion URLs. ( And use standard TCP/IP for everything else.)

This sounds like a great default behavior.

Tor inbuilt into firefox would be really good.

It would push for more secure practices, and would complement Mozillas current efforts with Persona. Site that do not use https, Persona, OpenID, google/facebook/microsoft/what-ever-authentication-system is a problem, but better served by some form of detection mechanism. incognito mode could simply try detect the common exceptional cases, and then provide a user warning. As such, user would report the warning to the forum/wp admin, and the web would improve as an result.

Second, the tor exist node are not more risky than using local ISP, coffee shops, or a business/school network. Who is more likely to secure the network routes against malicious attacks: a underpaid janitor, restaurant worker, teacher, or a several year established tor enthusiast? Most tor traffic flow through the biggest and most established nodes, and those has a lot to loose from sniffing the network. Can the same be said about the person behind the counter at the local coffee shop?

>That said, Tor inbuilt into firefox would be awesome. I just can't imagine it doing more good than harm.

try this: https://www.torproject.org/projects/torbrowser.html.en

Probably the best way would be to only route HTTPS traffic (with certificate pinning & checking) through tor. Plain HTTP traffic would go through your regular ISP.

That avoids the "password collection"/MITM attack?

It would be better to have it not route at all if unencrypted and the Tor feature is turned on. The idea is anonymity. Having it suddenly use your real-world IP because it sees you aren't using TLS breaks this.

Here is a nag box implementation that actually works:

To continue, please type the following phrase in the text box:

I UNDERSTAND THAT ENABLING THIS FEATURE WILL CAUSE HACKERS TO STEAL ALL MY MONEY

Type the phrase: _______________________________________________________

[Ok] [Cancel]

Page 1: [...information about the feature...] [Ok][Cancel]

Page 2: Which of the following are true? [multiple choice answers about the feature]

User friendly? More like user hostile... But that is what is needed.

Would it be possible to make it so it just won't connect to a website unless it's encrypted or a .onion domain? You could get past it by going through said warnings and nagging, so users who know what they are doing wouldn't be troubled.