1
  1. Do Tor users have any particular concerns, as opposed to general web users? E.g., the owner of an entry node might decide to send malicious code back to all Tor users, or the owners of an exit node might decide to infect all Tor users who visit a site that their government does not want them to see. Infection would be for the purpose of piercing anonymity, rather than for financial gain.
  2. Why doesn't China, or any other government or entity e.g., set up nodes to infect dissidents?
  • "Why doesn't China, e.g., set up nodes to infect dissidents?" How do you know it doesn't? – user66 Oct 29 '14 at 8:42
  • Users who are new to Tor and who want to get the most out of the technology, before doing anything requiring real anonymity, may consider reading the entire Torproject.org site, signing up for the mailing list, adding the blog to an RSS reader, and then using the TorBrowser for a few months until it becomes more familiar. – raisins47 Nov 10 '14 at 12:54
  • I've removed the original part 2 of your question as it's off topic here. Consider asking it at one of the other SE sites (though I suspect it would be counted as "subjective" anywhere). Thanks for using Tor.SE, and good luck getting a good answer to the rest of your question! – Sam Whited Nov 10 '14 at 14:13
4

There are a couple of things you should do.

Keep your browser secure. Use Tor Browser and if websites allow it, disable JavaScript. This makes your browser way more secure, but also makes attacks on your anonymity harder.

Try to avoid Downloads completely. Seriously, you shouldn't download any files. Even a PDF or a word document can pose a serious risk to your security and anonymity.

If you think your computer might be infected (virus scanners don't detect everything only what they know - really only that) then you should really consider using Tails, not a virus scanner. This will protect both your anonymity and your system.

There is no virus scanner which is made for Tor, just because that's not how virus scanners work. They just have a big database of known viruses that they look for, but it's a quite inefficient tool in the sense that it already needs to know about a certain malware to be able to protect against it, so it's rather easy for an attacker to bypass it, even with really low skills.

In general you want to be more cautious. You should actually always be suspicious about bad SSL certificates from websites and verify signatures if you really have to download something over Tor (like Tor itself), but then again you may want to avoid that as it poses a serious threat, just like every downloaded file.

About China: They and other countries actually seem to at least consider that. However, if you can get a working version of Tor, a bridge and the public key(s) with which new releases are signed to dissidents then the right usage of both can make it incredibly hard to attack. Once you have the public key (and you only need to get that once) then you can verify every future release of Tor or anything else you might download. Of course this doesn't prevent security holes that might be there in the Tor Browser. That's why disabling JavaScript can increase security. A lot of attacks require enabled JavaScript, but when you Download files and you don't trust the source or can't verify that anybody messed with the Tor Browser you downloaded then you are vulnerable.

But like I said. It's as easy as getting that right public key just once and you can detect every attack. Should the signature be invalid (not be linked to the public key for example) then you know you have to download Tor from somewhere else.

2

There are some tips that a Tor user should pay attention to :

Use the Tor Browser

Tor does not protect all of your computer's Internet traffic when you run it. Tor only protects your applications that are properly configured to send their Internet traffic through Tor. To avoid problems with Tor configuration, we strongly recommend you use the Tor Browser. It is pre-configured to protect your privacy and anonymity on the web as long as you're browsing with the Tor Browser itself. Almost any other web browser configuration is likely to be unsafe to use with Tor.

Don't torrent over Tor

Torrent file-sharing applications have been observed to ignore proxy settings and make direct connections even when they are told to use Tor. Even if your torrent application connects only through Tor, you will often send out your real IP address in the tracker GET request, because that's how torrents work. Not only do you deanonymize your torrent traffic and your other simultaneous Tor web traffic this way, you also slow down the entire Tor network for everyone else.

Don't enable or install browser plugins

The Tor Browser will block browser plugins such as Flash, RealPlayer, Quicktime, and others: they can be manipulated into revealing your IP address. Similarly, we do not recommend installing additional addons or plugins into the Tor Browser, as these may bypass Tor or otherwise harm your anonymity and privacy. The lack of plugins means that Youtube videos are blocked by default, but Youtube does provide an experimental opt-in feature (enable it here) that works for some videos.

Use HTTPS versions of websites

Tor will encrypt your traffic to and within the Tor network, but the encryption of your traffic to the final destination website depends upon on that website. To help ensure private encryption to websites, the Tor Browser includes HTTPS Everywhere to force the use of HTTPS encryption with major websites that support it. However, you should still watch the browser URL bar to ensure that websites you provide sensitive information to display a blue or green URL bar button, include https:// in the URL, and display the proper expected name for the website. Also see EFF's interactive page explaining how Tor and HTTPS relate.

Don't open documents downloaded through Tor while online

The Tor Browser will warn you before automatically opening documents that are handled by external applications. DO NOT IGNORE THIS WARNING. You should be very careful when downloading documents via Tor (especially DOC and PDF files) as these documents can contain Internet resources that will be downloaded outside of Tor by the application that opens them. This will reveal your non-Tor IP address. If you must work with DOC and/or PDF files, we strongly recommend either using a disconnected computer, downloading the free VirtualBox and using it with a virtual machine image with networking disabled, or using Tails. Under no circumstances is it safe to use BitTorrent and Tor together, however.

Use bridges and/or find company

Tor tries to prevent attackers from learning what destination websites you connect to. However, by default, it does not prevent somebody watching your Internet traffic from learning that you're using Tor. If this matters to you, you can reduce this risk by configuring Tor to use a Tor bridge relay rather than connecting directly to the public Tor network. Ultimately the best protection is a social approach: the more Tor users there are near you and the more diverse their interests, the less dangerous it will be that you are one of them. Convince other people to use Tor, too!

I have some personal advice:

Do not download things from websites which do not support HTTPS. Some Tor exit nodes are traps,when you download things from websites which do not support HTTPS,these nodes will put malicious code into things that you are downloading,than your computer will be infested.

Please open a file name torrc (you can find it by using windows search) by using notepad,then add:

ExcludeNodes {cn},{hk},{mo},{sg},{th},{pk},{by},{ru},{ir},{vn},{ph},{my},{cu},{br},{kz},{kw},{lk},{ci},{tk},{tw},{kp},{sy}
ExcludeExitNodes {cn},{hk},{mo},{sg},{th},{pk},{by},{ru},{ir},{vn},{ph},{my},{cu},{br},{kz},{kw},{lk},{ci},{tk},{tw},{kp},{sy}
StrictNodes 1

then you can avoid most trap nodes. I don't know your country,maybe you should add your country in the exclude list,just for safe.

You can change your PC's OS into GNU/Linux (like Debian), then you will not need to worry about computer virus.

  • "but Youtube does provide an experimental opt-in feature (enable it here) that works for some videos." Almost all youtube vids are HTML5 now. – Chinup Oct 29 '14 at 13:08
  • "Do not download things from websites which do not support HTTPS." Oh, I like that advice - very good. Btw, I also do use the free PDF-XChange Viewer, because 1) it's probably safer than Adobe. 2) I always like to avoid software from any megacorporation (such as Adobe). – Chinup Oct 29 '14 at 13:12
  • "Use bridges" The last time that I looked, that requires a gmail account - I hate lying/spying google and I'm certainly not going to give my phone number to them in order to get a gmail account. (I do realize that G.A. is quoting the torproject website and that's not necessarily his own advice.) – Chinup Oct 29 '14 at 13:17
  • Well,obfs3 bridges do not require any mail account,so does meek,you may have a try. – Ghost Assassin Oct 29 '14 at 15:37
0

E.g., the owner of an entry node might decide to send malicious code back to all Tor users

All return traffic is encrypted to the original requester. Tor uses an Onion routing scheme, so the original entry node could misbehave and send you bad traffic, but you'd know that it didn't come from the correct place (or correlate with a request you made) and ignore it.

or the owners of an exit node might decide to infect all Tor users who visit a site that their government does not want them to see. Infection would be for the purpose of piercing anonymity, rather than for financial gain.

This has been observed in the wild and is why you should use TLS when visiting sites over Tor (only go to sites that use "HTTPS").

  1. Why doesn't China, or any other government or entity e.g., set up nodes to infect dissidents?

They almost certainly do. Again, use TLS (and if you can, check the hash or signature of binaries out of band).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.