2

Ok, keep in mind that even though I'm fairly technically savvy, most of what I read on Tor related sites pretty much goes over my head. But even so; here's my question.

Normally on my laptop I use the regular Tor browser while connected to my home wi-fi network. Now let's say I use my android, which has a data plan, and I use it as a hotspot while tethering to connect my laptop to the net. If I use Orbot on my phone, but not use Tor on my laptop, is that just as effective? Or is it more important that I have Tor on my laptop? Perhaps i should do both; use Tor on my laptop AND use Orbot on my phone?

Also, what if I use my Raspberry Pi to connect to my Android's hotspot? Is that just as safe as though I was using the tor browser? Assuming that my phone is using Orbot?

Improve this question

1 Answer 1

Reset to default
1

tl;dr - You should, wherever possible, use tor on the local system. Especially when the "local" network is potentially hostile (which is almost always with wireless). If you can run Tor Browser on the laptop and just use the phone as a hotspot, prefer that option! And avoid running Tor-over-Tor, allow the laptop to connect directly to the internet through the hotspot and run Tor Browser as normal.

"Personal" Wireless (WEP, WPA-PSK, and WPA2-PSK) does not provide forward-secrecy. This means a local adversary who takes the time to log all of your packets and manages to capture the WPA2 4-way handshake will be able to (with effort dependent on the strength of your passphase) break your WPA2 PSK/PMK (Pre-shared Master Key, derived from the passphase) and once they have this they can derive the PTK (Pairwise Transient Key, or session key which is used to encrypt your traffic) for all previous and future WPA2 sessions for which they have also captured the 4-way handshake, assuming the same PSK/PMK. This is because the PTK is derived from values visible to an observer during the 4-way handshake with the exception of the PSK/PMK, which is the only unknown value.

Note that the traffic that they would be able to capture and decrypt in that case would be the traffic before any of Tor's protection is applied. They will see exactly what content you are sending and where, it will not be anonymized. It may be encrypted at the application layer (e.g. https, ssh, or other tls protected transports) but that may still constitute a catastrophic failure for your anonymity.

A tor circuit is protected with authenticated, end-to-end, forward-secret encryption so as a client you should always prefer to have your apps be as close as possible to your tor client to gain the most out of the protections provided by this property.

Also you should never ever entrust WEP, WPA-PSK or WPA2-PSK as anything but a weak means of access control, the cryptography just isn't up to scratch.

Improve this answer
3
  • i lend out some of your statements to give something like an answer or at least advices to this question... maybe you can give a real (and better) answer, that i can delete "my answer".
    – DJCrashdummy
    Commented Jun 21, 2016 at 7:55
  • Thanks! I know I waited almost two months to respond to this answer, but this just occurred to me; Since the phone I'd be using has GPS in it, is it likely someone can trace exactly where the traffic is coming from if the phone is not using Orbot?
    – jspencer
    Commented Aug 10, 2016 at 10:33
  • 1
    The GPS is a function of the phone, if the application using Tor both is allowed access to GPS and reports it back to somewhere (and doesn't just use it locally) then it's entirely possible. This would be problematic no matter how you used Tor (locally or tethered), the problem is the app and can't be fixed without removing it. See tor.stackexchange.com/questions/10427/…
    – cacahuatl
    Commented Aug 11, 2016 at 14:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .