1

Orwall is a great root app that can make sure all your internet communications on your android phone are reliably routed through Tor via Orbot. And it is presented as one of the must-have apps for privacy and security by for example the Mission Improbable article.

Orwall seems to suggest that you should route everything through Orbot. (e.g this screenshot which includes Twidere)

I know you should probably not log into gmail and other user-identifiable accounts (e.g. twitter) through tor if you also want to be "completely" anonymous through tor.

But from the point of view of just wanting to be less tracked and exploited by all the people and 3rd party organizations in the world, is it a good idea or useful to route e.g. the Google services, FB, Twitter through Orwall?

  • This is an opinion question. IMHO, No Problem as long as you don't mind waving a red flag in the face of the authorities. The Patriot Act allows them to retain the full content of encrypted communications without time limits. And one single slip, such as making a non-Tor connection from the same phone, or registering the phone with anyone (Tracfone or Verizon) then they definitely know who owns the phone. – SDsolar Nov 25 '17 at 3:41
  • Such patriotism <3 But isn't it still useful because whoever tracks my e.g. Twitter account sees that historically I have connected to Twitter from: 2 phones, 3 PCs, and multiple instances of Tor Browser - which at most only report that they were a mobile device or desktop device, but not which one at which location, or if it was a new yet unknown device. – Spectraljump Nov 27 '17 at 13:26
3

A difficult question to answer decisively.

The tl;dr is that if you are performing highly sensitive activies you should not be doing them on the same device as your normal day to day activies. This is a concept called Compartmentalization.

To pull the answer straight from my own documentation on the subject:

When you take your whole operating system and stick it behind transparent proxying, everything goes over Tor if it can. Everything that goes over Tor will, by default, use the same circuit. Your operating system updates, your email, your browsing, and fetching information about media you play will all share the same circuit. The exit node could connect all of these things together and ascribe them to a single entity. This means things intended to be anonymous could be linked to things directly linked to your identity, or between psuedonyms.

See also: the Whonix Stream Isolation Infographic.

Another problem is that a lot of software is trash, it doesn't handle updates or fetching of content and files in any sane way. Again, from my own writing:

Some applications, even some security applications still check for and download unsigned updates over plaintext. This is not safe in any scenario but becomes a more obvious problem on Tor.

Now, these applications aren't bad because of Tor. These applications are totally unfit for purpose on the internet at all (ISPs get hacked, routers get rooted, wifi gets cracked, etc) but it is far simpler for an attacker to gain a Man-in-the-Middle position through being an exit relay in a Tor circuit (or posing as a free VPN provider).

So generally, no. You don't want to just Tor everything.

The alternative (where everything is torified, isolated and audited to be free of leaks) is very difficult to setup and you should also consider lateral leaks of information (an application that you don't torify might leak information outside of Tor about applications you are torifying because they're running under the same operating system and can infer information from each other). So do you consider your local ISP or a potentially malicious exit relay operator a bigger threat? This depends on your situation, there is no definitive answer but Transparent Proxying everything will always be sub-optimal.

  • Nice answer. So then the only secure use for tor is to never use multiple apps on the same circuit at anywhere around the same time (but I can't open and maintain a new unique circuit for every request, and I certainly can't compartmentalize my regular phone stuff). So then why have the concept of a Tor Firewall (Orwall) in the first place? – Spectraljump Feb 10 '17 at 0:29
  • As far as I can see (since I can't have install Copperhead OS, + I want google store sometimes), my only options are: Tor, VPN, or nothing. (in addition to other stuff like XPrivacy) The trouble with VPN is that there are no Root VPN apps, so nothing's as reliable as OrWall (and drains battery). So I guess I will Tor everything (except bandwidth-intensive stuff) since it's probably not worse than nothing. Unless I want to torrify my browser only (Orfox), and have that be the only secure-ish thing. – Spectraljump Feb 10 '17 at 0:32
  • Man, we gotta tell Elon Musk or someone, to team up with John McAfee and make a proper open source and decently secure version of Android.... – Spectraljump Feb 10 '17 at 0:40
  • I'd trust neither of those people :P Yes, it's problematic. Android and iPhone are nightmares for anonymous or private usage, outside of specifically made apps. OrWall lets you pick if an app can connect to the internet at all and apps which are Tor aware can properly isolate themselves. There are other ways you could set it up but it'd be ugly and wouldn't work as a generic solution. – cacahuatl Feb 10 '17 at 1:40
1

A VPN is best for your case I imagine. All the programs beside your browser knows who you are and probably phones home. This just puts more load on Tor than nessasary. It could obscure how much data you are using browsing(to fight correlation), but the VPN would offer the same(The VPN is much less likely to turn over logs than Facebook and Google would to assist in correlation). And they could have access to Google and Facebook servers.

Google Services spys on the apps you use and it is possible it watches data and collects data that could be used to fingerprint your browser. If you want a secure phone ideally should use a Nexus 5X or 6P with Copperhead OS. If you can't get your hands on one of those Lineage OS with no Gapps could be effective. However, Android has many security flaws coming out all the time. Do not rely on this for anything confidential.

  • The 2 vpn clients I tried so far, keep my radio and connection active all the time and drain battery. And I don't think they can be as reliable as Orwall + Orbot since they don't require root. And I thought I would be helping out the Tor network by using it, because I'd be contributing to the signal to noise ratio (I would not stream netflix through tor). Also, you can use stuff like XPrivacy to deny apps access to ridiculous identification requests like your phonebook to something stupdily unrelated like for ex an alarm clock app, but yeah google services monitor all your apps. – Spectraljump Feb 7 '17 at 21:57
  • +1 especially for the second paragraph! – DJCrashdummy Feb 7 '17 at 23:47
  • No Signal without gapps :) It's all about threat models. – cacahuatl Feb 8 '17 at 23:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.