Sometimes I'm working in a small office. Colleagues asked me to try Tor and I thought about setting up SOCKSListenAddress thus allowing them to use my onion client. Can this harm my anonymity in any way and makes it maybe more sense that everyone install their own client?
asked Sep 29, 2013 at 22:36
-
1If nothing else, your coworkers could simply go on a public forum and post "I'm using Tor and my actual IP is X from company Y's network". That's an extreme example, but the point that more people using it equals a bigger attack surface is still valid.– user5Sep 29, 2013 at 23:32
Add a comment
|
2 Answers
It should be fine.
Tor, starting with the 0.2.3.x branch, has a feature called stream isolation.
This means that clients in different classes never share the same circuit. It can be configured with the various Isolate* options for a SocksPort.
By default, the IsolateClientAddr option is enabled. Accordingly, different hosts using your Tor instance as their Onion Proxy should never use the same circuits.
Further references: proposal171: separate-streams.
answered Oct 2, 2013 at 11:35
Even though Peter's answer mentioned stream isolation, I believe, you shouldn't do this. Those other client machines might be compromised and may try to attack your Tor client. I am not saying your colleagues do this on purpose, rather it's likely that one of their machines is compromised without them knowing.
Connecting things were is no strong advantage from such connections isn't wise from a security perspective.
Also if they are using your system as a Tor proxy, I doubt they are aware browser fingerprinting and tracking related threats and using Tor Browser re-configured to use your machine. It would make much more sense if they all used their own Tor Browser Bundle (or similar Tor focused project such as Tails etc.).
Not to forget the firewall aspect. When they can access your Tor instance, you necessarily have a listening port open and need a firewall to protect you from connection from the internet. The company firewall (simple NAT router will do) might do this, but what if it's a notebook and you use it for a journey using a foreign WiFi, with no firewall to protect you? Then either the whole internet or (depending on configuration) machines in that LAN can attack you. Also other things such as IPv6 tunnels may weaken firewalling. When providing services for others, you need quite some knowledge to safely do it.
There is also another subtle aspect when using multiple Tor clients versus a single Tor client. The amount of entry guards chosen by Tor. An ISP level adversary may be able to guess the number of individual Tor clients from that connection, due to different sets of entry guards. If that is of concern to you, a single Tor client might be better.
Companies can benefit from Tor, but it needs someone knowing the basics of Tor and proper briefing.
