2,631 karma · joined March 20, 2017
https://via.hypothes.is/https://blog.torproject.org/sunsetti...
https://web.archive.org/web/https://blog.torproject.org/suns...
> Bonus points for installing and running Tor without elevated privileges.
Try https://github.com/TheTorProject/GetTorBrowser then use meek-amazon as a pluggable transport to get it working if your network censors Tor traffic.
Please see this comment by Sarah, https://github.com/ricochet-im/ricochet/issues/555#issuecomm...
```
Hi, I don't speak for @special, but I think some context might be useful.
There is currently a bunch of (official|unofficial) work going on in the wider ecosystem - most of it related to factoring out the base library[1] to go to make it more useful as well as porting the main client to go[2].
There are also a few experiments regarding running on mobile[3] and using ricochet and these other libraries for other things besides traditional IM[4].
Most of this wider work has been updated within the last couple of weeks, ricochet is still actively being worked on & used - just not in the most visible places right now.
Some of the features you have pointed to are sitting waiting for someone to come along and design/write them. For most there is a lot of UX work that needs to be done in order for these features (layered crypto, hidden service auth, multiple profiles etc.) to be secure & useable.
In many cases, adding them to the new Go code might be preferable in terms of ease of implementation. That is partly why work is being put into the libraries there, to make new changes to ricochet as easy and as useful as possible. These libraries are also in development right now, and it may take a little while before everything comes together.
So the best thing people can do right now if they want to move these things along is to contribute to the discussions on the feature threads if they have ideas about how those features could work & to submit code/pull requests to the various code bases.
```
A VPN gives you little protection against browser fingerprinting, which may alone leak enough information about you to identify you. Also privacy-by-policy is in no way near privacy-by-design. If you want privacy, use the Tor Browser.
For iOS there's Onion Browser by Mike Tigas, but it's definitely NOT as privacy resistant as a Tor Browser. For Android there's Orfox and official Tor Browser builds for Android are coming this year.
Just FUD.
> Tor also relies on exit nodes to exist, yet it's considered very dangerous to run one.
It's dangerous in some places to run an exit, not everywhere.
Tor isn't that bad actually for browsing, while i2p needs more love regarding speed.
> difficult to configure correctly,
For Tor: You just download the Tor Browser. Already pre-configured.
> and make you more conspicuous to most three-letter agencies.
Good argument for actually using them.
With Qubes you can have a Whonix-ws VM have all its traffic go through Tor, and have another VM with all its traffic through some VPN to use with streaming.
You need to know that the Tor Browser disables a lot of stuff that Firefox has to lower the attack surface, and you can lock it down further using the Security Settings in the Torbutton.
Also you should look into a Whonix+Qubes OS setup, just because there's a sandbox doesn't mean you can't get hacked.
For speed: It's not really that bad for general browsing.
It's not as bad as you're making it seem.
That's why I said: "Then use meek-amazon as a pluggable transport which should work." meek-amazon makes your traffic look like you're talking to:
> url=https://d2cly7j4zqgua7.cloudfront.net/ front=a0.awsstatic.com
With the snowflake pluggable transport (only available with Linux and Mac alphas for now) the traffic looks like WebRTC.
You can read more about them here:
Never seen on my end for quiet some time, maybe worth a bug report: https://bugzilla.mozilla.org
Did you try out the Firefox Nightly with WebRender enabled?
Did you actually read the release notes? Quoting:
> Enhanced WebExtensions API including better support for decentralized protocols and the ability to dynamically register content scripts.
https://blog.mozilla.org/addons/2018/01/26/extensions-firefo...
I never really understood this argument, you gave up Firefox since you could no longer have your XUL/XPCOM extensions in favor of serious browsers who have less WebExt APIs than Firefox and don't have those same extensions?
It's just a "he".
> Some of the comments then seem odd
If you're referring to the "Currently this document is private, but eventually some or all of it should be public." comment, then there's really nothing suspicious about it, he doesn't want to publicly release the roadmap until later on.
That's why bridges and pluggable transports exist and let you obfuscate your Tor traffic to look like something else, see: https://tb-manual.torproject.org/en-US/circumvention.html
> That's not to say that I think Tor isn't great nor that it shouldn't be used. My complaint is that it gets represented to general non-technical crowds as solving more problems than it actually does.
Well they do provide warnings https://www.torproject.org/download/download.html.en#warning among them is the one which is related to the Harvard teen "Use bridges and/or find company: Tor tries to prevent attackers from learning what destination websites you connect to. However, by default, it does not prevent somebody watching your Internet traffic from learning that you're using Tor. If this matters to you, you can reduce this risk by configuring Tor to use a Tor bridge relay rather than connecting directly to the public Tor network. Ultimately the best protection is a social approach: the more Tor users there are near you and the more diverse their interests, the less dangerous it will be that you are one of them. Convince other people to use Tor, too! "
> The Harvard kid who was the only Tor user on Harvard’s network at the time that he sent his bomb threat.
> The Freedom Hosting and Silk Road hacks (problems with the web apps that were hosted as Tor hidden services, not with Tor itself).
> Exit node sniffing (an issue with people using plaintext protocols on the internet; people are just as vulnerable when using airport wifi, though perhaps they’re less likely to have an attacker on their network than to be using a malicious exit node).
As you can see those are problems that Tor can't solve. Micah wasn't talking about some inherent flaws in Tor's design.
> If your threat model includes state actors, then Tor's current shortcomings are non-trivial and should be treated as such.
Doesn't change the fact that Tor is the best low-latency anonymity system currently and using it is better than not.
If they weren't open about what they did with that funding, and the funding came directly from the NSA? Sure! That would've left everyone pretty doubtful. But since their funding comes from things like the NSF, OTF, ... and they're pretty open about the deliverables that each sponsor seeks[1] (for e.g. [2]), then there's really no reason to be doubtful.
[1] : https://trac.torproject.org/projects/tor/wiki/org/sponsors
[2] : https://trac.torproject.org/projects/tor/wiki/org/sponsors/S...