Anonabox: a Tor hardware router
kickstarter.com
kickstarter.com
Educating users all over the world on how to resist censorship and protect their anonymity is important. Buying a piece of hardware doesn't achieve that.
You are sorely, severely mistaken and misguided (just like the people creating this Tor product).
> since it limits the target surface just to Tor (and the OS stack required to run Tor) as opposed to your browser, OS or any other software you might use that could potentially leak your true identity.
That is completely 100% false. The attack surface of the browser remains along with the attack surface of the OS. All this does is mask your IP address/network origins.
Tor is no more effective at "reducing the attack surface" of your OS & Browser as a VPN.
Case in point, when the FBI busted users of child porn sites in 2013, they used a Zero-day in Firefox [1] to leak the users IP addresses. This would not have worked for users with a device like this. They could've tried to gather evidence through other means using this exploit, but that's definitely harder than simply opening a network connection and would only work in cases where the exploit could access anything that would identify the user.
(Obviously I'm not unhappy about child porn users getting busted, but I thought it would serve as a good example.)
[1]: https://www.mozilla.org/security/announce/2013/mfsa2013-53.h...
I don't believe that it will be used to anonymise their internet profiles. They probably need just some sort of authority circumvention.
The people this is marketed too should use a VPN if they want to circumvent local network policies.
https://blog.torproject.org/blog/bittorrent-over-tor-isnt-go...
> The attack is actually worse than that: apparently in some cases uTorrent, BitSpirit, and libTorrent simply write your IP address directly into the information they send to the tracker and/or to other peers. Tor is doing its job: Tor is _anonymously_ sending your IP address to the tracker or peer. Nobody knows where you're sending your IP address from. But that probably isn't what you wanted your Bittorrent client to send.
> So what's the fix? There are two answers here. The first answer is "don't run Bittorrent over Tor". We've been saying for years not to run Bittorrent over Tor, because the Tor network can't handle the load; perhaps these attacks will convince more people to listen. The second answer is that if you want your Bittorrent client to actually provide privacy when using a proxy, you need to get the application and protocol developers to fix their applications and protocols. Tor can't keep you safe if your applications leak your identity.
http://www.flashrouters.com/routers/vpn-types/privateinterne...
The problem is they are all overpriced 'cause of manuals steps to flash an existing piece of hardware.
Really, what I want to see is more open hardware routers so we can automate the build process to setup a VPN on them.
It is debatable if Tor provides any more security than just using someone else's open wifi point. Great for evading bans on online forums, worthless against the DEA.
- How Tor was created by the U.S. government (Naval Research Lab) for the purpose of providing anonymity to intelligence agencies. It is now also widely used by law enforcement agencies to maintain anonymity in criminal investigations.
- How the project was funded primarily by intelligence agencies.
- How the NSA, which can monitor a large fraction of internet traffic, can unmask Tor users by correlating traffic directed at Tor entry points with traffic observed at Tor exit points. Snowden's leaks revealed that the NSA was working on breaking Tor anonymity and believed its efforts were "pretty much guaranteed to succeed".
That's absolutely not true and if the author doesn't understand why, then he doesn't have a clue about what he is talking about.
Additionally, the list of exit nodes is open and public, (https://www.torproject.org/projects/tordnsel.html.en) so any given server can tell if you're using Tor.
Comparing Tor to your neighbor's open wifi was an example of how poor Tor's anonymity is, rather than how good your neighbor's connection is.
Tor anonymises extremely well both client and server. All other stuff in between should be used through SSL and with caution (after all SSL is kinda broken and the NSA can perform MiTM attack or steal and sign certificates from major authorities).
If you 'leak' metadata using JS or by logging to services e.g. to Facebook (the dumbest use of TOR I've ever seen), then obviously state-level authorities are not your concern. Otherwise you wouldn't real had public profiles on social networks anyway.
Comparing the neighbours Open WiFi to TOR is very naive, even if the NSA is after you. The Open WiFi will a give 1km radius of your CURRENT position on-the-fly. On the other hand to analyse metadata sniffed from an exit-node will probably take hours if not weeks and still would be a (mostly) wild guess over where you where at the time of the attack.
OTOH, I am not sure this is a bad thing, at least in terms of the "legality of Tor" ... it's often discussed whether simply using Tor will, at some point, be legally questionable and I think there is a built-in legal defense here: How can merely using Tor ever be illegal if it is currently funded by the government ?
I guess that you use the wired connection for Tor, wifi from the router for everything else? Then you still have to enable/disable the network card you want to use at the time.
The current tor browser is perfect. I just switch back and forth between it and my regular browsers as needed.
It uses the GL-Inet travel router. They already run OpenWRT by default and have both LAN and WAN ports. Eliminates the problems of Kickstarter.
I may do this tonight, as I have a few of them at home (they're great for "need a wifi bridge", "need a repeater", "friend needs a replacement router" type tasks).
http://www.amazon.com/Gl-iNet-Router-Openwrt-Mobile-Control/...
Perhaps someone should partner with a popular VPN like PrivateInternetAccess or another major VPN, as it'd allow people to continue using the services they know and love, and keep some of the prying eyes away from their unencrypted traffic.
http://www.technologyreview.com/news/521676/online-anonymity...
You can buy the product here [1] for $49. As far as I can tell, the only difference is that one is opensource while the other doesn't seem to be.
The kickstarter page makes no mention to other similar products, which to me seems pretty dishonest. Nobody uses the "Risks and challenges" section correctly.
I am always interested in the smallest possible non-wireless device with two ethernet ports ... all of the dual ethernet tp-link devices have wireless capability, so they are disqualified.
Related: this, and every device like it, should be a plug ... even at the expense of compactness...
http://www.atupapa.com/17043400030en.html
http://www.nexx.com.cn/index.php/home/detail?pid=199Run two SSIDs on a router: one regular internet, the other TOR only. TOR would be running on the router itself.
Are routers too underpowered to run TOR?
PORTAL looks good. Not sure why it has to have a separate 3g modem/wireless card. Any good reason to avoid ethernet? Reason to have this as a separate box?
I won't comment on the configuration because I don't know what you'd like to achieve.
A router could run a tor node if the traffic is limited. If the traffic up/down increases (e.g. 50 Mbits up/down) then it can't handle on-the-fly encryption/decryption.
However, you could install/run a tor node (private) on digital ocean for 5 USD/month and route all your traffic through the VPS.
You could use Tor Browser or custom running on your Desktop. The configuration depends on how often you use tor and for what reason.
* Is it hard to buy an RPi and set-it-up for a home Tor node? * To buy a VPS and setup a Tor-node then route all the traffic through it?! * Run tor-browser on your desktop when/if you need Tor?
A use how has avg Joe's internet's workflow through Tor, protects himself from whom? Rogue internet caffe access points?!
Anyway it seems neat but to me is pointless.
If there's a chance that the Government or some other entity will come after you for whatever you're doing on Tor, and you don't want there to be any way that your machines (clients or servers) could leak their public IP address, you could put them behind this.
If you are going to be actively targeted using Tor is not sufficient.
Tor is an effective defense against passive, generalized surveillance. It isn't effective against FBI/NSA-level resources because they will just drop 0 days in your path until you get hit by one.
This wouldn't be able to handle anything more than a consumer grade internet connection at relatively low speeds. "By our fourth round of prototypes we had created a model with 64mb memory and a 580mhz CPU. This not only runs the software well, it flies! At last happy with the board, we designed a simple, minimalist case in plain white to house it. The end result is our current model. We decided to name it the anonabox."
Running CPU intensive processes (e.g. encryption) on a high throughput connection (e.g. web server) isn't going to work unless its only used by you and your 5 friends.
Well... yeah, it is hard. It's undeniably much, much harder than buying a box and plugging it in, even if you're the kind of person who thinks configuring a VPS safely for Tor, then flawlessly configuring local network routing is an easy task. Hell I'm certified nerd and I'd still be scared to (flawlessly) do that. Not to mention a box is cheaper than a monthly VPS.
Tor browser is slightly easier but still crappy, because as the Kickstarter says it's just your browser and less tech-savvy people might wrongly equate "my browser" with "all of my computer's internet activity".
This project is a fantastic idea.