Comment by csandreasen | Hacker News Reader

Comment by csandreasen | Hacker News Reader

Parent Full thread

I'm sure most of HN knows this already, but I've run in to enough people that used Tor but weren't aware of these that I'll post anyway. Some things to keep in mind if you're going to use Tor:

- The exit nodes can see all traffic being routed through them[1]. Be wary of using Tor for regular web surfing - the exit node can not only monitor any unencrypted traffic, but can also inject browser exploits, attempt to strip SSL[2], etc.

- HTTPS Everywhere is only enabled for sites that the EFF has whitelisted[3]. Even if a site supports SSL, don't expect HTTPS Everywhere to automatically send you to the encrypted version - always doublecheck.

- NoScript is not enabled by default in the Tor Browser Bundle[4]. Don't expect it to protect you from malicious Javascript exploits out of the box.

If you absolutely must use Tor for something, the safest way to do so is to connect to Tor, make whatever connections you need to make (and only those connections), then immediately get off.

[1] https://www.torproject.org/docs/faq#CanExitNodesEavesdrop

[2] http://www.thoughtcrime.org/software/sslstrip/ (it's long, but the video is worth watching)

[3] https://www.eff.org/https-everywhere/faq#automatic-https

[4] https://www.torproject.org/docs/faq#TBBJavaScriptEnabled

There's a new feature in this week's release of HTTPS Everywhere (4.0.2): HTTP nowhere. You can now block all non-HTTPS requests.

I'm using 4.0.2 but I don't see this option anywhere.

Click the icon to pop up the menu, select the 'Block all HTTP requests' option.

What about the use case of using Tor in order to expand the network for those that really need to use Tor?

I will take your advice to heed if I'm ever in a truly sensitive situation, but I use Tor out of solidarity. Do you think that's unwise?

I was referring to using the Tor Browser Bundle or any other client to access the internet over Tor, which has different security implications than running an exit node or relay.

That said, feel free to use it for whatever you want - just be aware of the tradeoffs/risks. You can't just turn on Tor and assume that you're instantly more anonymous and secure - to achieve that, people need to completely change their browsing habits. Surfing the web through Tor without taking extra precautions is essentially saying "I don't trust the web site I'm visiting or any node between it and me, but I will implicitly trust this random group of volunteer exit node operators who have assured me that they have no malicious intent."

in terms of privacy and avoiding everyday tracking of what i read, say, and search for...i actually do trust this random group of mostly volunteer exit node operators more than i trust major internet companies or my ISP...especially where SSL is supported. i live in the united states.

No. I think thats very wise and I've heard it recommended by some smart people. I think the OP is overreacting a bit.

There is HTTPS-Finder that auto creates the rules for HTTPS-Everywhere

https://github.com/kevinjacobs/HTTPS-Finder/tree/master/dist

Do you mean that Tor adds risk over 'normal' web use, or that Tor is not as secure as people think?

The only added risk I see is that an exit node arguably could be more likely to attack the user than an ISP, but I think the difference is that attack in different ways. Most ISP's attack confidentiality as part of their business, though probably they don't insert browser exploits.

If you are a bad actor, you can run a Tor exit node and do whatever you like with other people's traffic passing by. This is similar to what you could do if you hosted a public wifi hotspot. While ISPs are in power to do such evils to their customers, it wouldn't be a sustainable business model to for example fish for credentials in their customer traffic. For an exit node administrator, this is entirely possible. Tor project monitors for bad exit nodes, but traffic eavesdropping for example is something they can't detect.

It's a trade-off. If your ISP chooses to, they can monitor non-HTTPS traffic while knowing exactly who you are.

Whereas a Tor exit is more likely to snoop, theoretically they should have no idea who you are (as long as you don't send any identifying information in plaintext).

I think the most important thing is that we should try and make the implications of both clear to as many people as possible.

FYI, even when NoScript is operating in blacklist mode rather than whitelist mode, it still offers a bunch of protections. The Tor Browser Bundle ships with the NoScript extension enabled but configured to operate in blacklist mode.

I've always wondered whether it would not be possible to split the outward packet in, say, 2 and recombine it at its final destination.

Reply on news.ycombinator.com