So I am going to set up a Raspberry Pi Onion Router and I normally use the browser bundle would it be bad? More effective? Or just as effective as using just the browser bundle?


Tor over Tor is always worse, rule of thumb: mo' hops, mo' problems. Instead of using your RPi as a "Force Everything Through Tor" transproxy box, you should use it as an isolating proxy.

Your laptop/desktop connects to the Pi over Ethernet (this is important!). Then, your Pi connects to some wifi network with internet access and runs an instance of Tor. Your Pi provides its SOCKSPort and a ControlPort over the ethernet interface. You configure your Tor Browser to use an external Tor daemon instead of running its own by following this guide.

The reason it is critically important that you connect over Ethernet is that your Pi will receive your plain-text Tor traffic, for example if you connect to an http onion site you will send your requests to that onion in plain-text. If you did this over Wifi a reasonably competent, local adversary could decrypt the traffic and see exactly what you were doing on Tor because the connection between your laptop and the Pi is before any of Tors protection is applied. If you have to set it up using Wifi you should instead consider using OpenVPN or SSH to tunnel connections over Wifi to the Pi to stop local eavesdroppers. (yes, even WPA2 is trash by modern standards)

Please note that a Tor-over-Tor connection will always, without exception, be less safe than a normal Tor connection. There is always a possibility that your Tor connection would use the initial Tor connections guard as an exit, introduction point, rendezvous point, or in some other way interact with your own guard in such a way that it would be using a single relay for ingress and egress.

Never, ever use Tor-over-Tor. It is always less safe.

  • so my conclusion is (and please correct me if i'm wrong): as thumb rule... run Tor (just once) as close to your application as possible! -- and to make it applicable: using Tails would be the best cease and if you install several additional software and you are worried about (unknown) leaks, using Whonix (ideal on QubesOS) for isolating is the best way to go...?! – DJCrashdummy Aug 23 '16 at 9:18
  • 1
    Broadly speaking, yes. Strictly speaking, for isolation using a distinct, physical isolating proxy device (PORTAL or similar) would be the best option (better than Whonix and/or Qubes). Virtual machines have in the past, and will in the future, suffer vulnerabilities that allow subverting their barriers (e.g. XSA-182), problems that don't affect physical isolation as readily (less attack surface) but aren't always as readily practical. VMs do offer nice isolation from leaks of physical device identifiers too, maybe both? ;P Rabbit hole.. – cacahuatl Aug 23 '16 at 9:54

It is indifferent. There is the small chance (depending on the consensus weight associated to your relay, based on my experience this could happen roughy 0.01% of the times) that your TBB will use your relay as an intermediate relay (assuming that you don't allow exits), so the answer is that it is no big deal.

  • 1
    Can we see your calculation for "0.01%"? Because if I were an attacker I can think of a few ways to force a tor-over-tor user to do this, I'm not sure how you imagine that could ever be safe. – cacahuatl Jul 13 '16 at 16:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.