In defense of Tor routers | Hacker News Reader

In defense of Tor routers

arstechnica.com

48 pointssimas19 comments

I, for one, have completely resigned myself to the idea that my employer, government and neighbors know all of the most shameful elements of my Internet usage. I haven't yet seen an approach to the privacy problem that delivers acceptably anonymous results for acceptably low effort, while simultaneously leaving my connection speed and latency relatively intact.

My experience with Tor was limited and was several years ago, but it felt like I'd returned to a 28k modem...except the entire Internet had begun to serve content on the implicit assumption that I at least had a few megabits of pipe. Do these routers actually offer a solid cornerstone of the kind of solution I've been waiting for?

It's really not that slow any more, it's actually quite usable for regular browsing and if you catch a slow route a reconnect usually fixes that.

I wonder how much of this is solvable through re-engineering applications to assume high latency - preferably also adding in a fairly heavy dash of decentralization at the same time.

Well a VPN would be a lazy way to limit it to just your govt. Now I need to figure out a way to have *.corp addresses not use VPN.

You should try out the network today. "Several years" ago was drastically different.

If you haven't used Tor in several years, you're not really qualified to comment on the current state of Tor.

I'm a babe in the woods, but I had no idea that I was broadcasting my list of installed system fonts and browser plugins.

But it seems to me that this kind of fingerprinting would be pretty easy to defeat if people new it was happening and wanted to defeat it. Something like panoticlick could give advic on fonts and plugins to add to lose yourself in the herd.

CSS media queries give away your font list (and screen dimensions). Tor Browser modified some internal code in Firefox to protect against this.

Panopticlick is nice but it's not that advanced.

(Much) more info: https://www.torproject.org/projects/torbrowser/design/

That's the point of Chameleon[1]. I've got it installed, and the issue is a lot of websites assume "oh, they don't have $plugin (e.g., Flash) installed", and don't fallback to something reasonable. So there are edge cases where you'd have to disable it. Otherwise, it's pretty effective.

[1] https://github.com/ghostwords/chameleon

Uninstall Flash and Java (or disable browser use) and disable your browser reporting plugins (a single option change in FF) and you're pretty anonymous. Block JavaScript for untrusted sites and you're even better. Disconnect and Adblock even better.

Both the original and this retort forget to consider that different users have different needs. Security is never going to be a 'one size fits all' kind of arrangement. Different users will find differing levels of utility in Tor routers.

> we’ve been vocal about the need for people to use privacy add-ons with their web browsers

This contradicts what I have read on the Tor Project site:

"Site-specific or filter-based addons such as AdBlock Plus, Request Policy, Ghostery, Priv3, and Sharemenot are to be avoided."[1]

[1] https://www.torproject.org/projects/torbrowser/design/#philo...

Because imperfect filtering can sometimes be worse than exposing yourself. Imperfect filtering can sometimes identify its users. That and filters will never be perfect.

Filter-based addons leak at a minimum 1 bit of identifying information -- that the addon is installed.

With something like RequestPolicy the specific policy in place likely uniquely identifies the user.

Maintaining anonymity with a modern web browser is virtually impossible.

Maintaining pseudonymity substantially less so, but you're probably identified as "user running tails version x"

But if you block JavaScript, a site can't detect whether certain third-party elements are loaded. So using RequestPolicy to also block third-party elements would then increase your anonymity, because it would prevent things like web bugs from leaking your browsing patterns outside of the first-party site. Right?

Or would CSS tricks allow a first-party site to conditionally load elements and reveal your RequestPolicy policy?

Sigh. :(

Why/how do browsers allow sites to query the list of installed addons? That seems like it should very much be opt-in behaviour, that an addon would need to explicitly inject functionality to be discovered.

It's not that the list of addons is known, but rather infered from the number and types of blocked elements.

Perhaps I'm missing something, but isn't the primary argument against Tor routers simply that it's a really bad idea to send all your traffic through Tor? You certainly don't want to be sending logins, banking data, etc., through some unknown exit node. I mean, presumably you can configure the router to only use the network for some traffic, but then what do you gain over using the Tor Browser bundle?

If banking isn't using https, get a new bank.

Reply on news.ycombinator.com