Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

Information about network security

23
votes
5answers
8k views

Securely hosting a Tor hidden service/site

There are some detailed instructions for setting up a Tor site at torproject.org1. It seems that it would be most secure to use a dedicated machine for this task if possible. I've read elsewhere that ...
18
votes
7answers
24k views

Can Tor be used with applications other than Web browsers?

From what I can see Tor mainly handles your web browser's traffic, but is there a way to do all of your connections through it? Like email, Dropbox, Carbonite backup, Skype etc? (Please explain ...
15
votes
2answers
1k views

Is Tor's security compromised if other services are connecting in the clear?

I am using the Tor Browser Bundle, so all my internet browsing traffic is routed via Tor. However if I have other services like Dropbox, another web browser, etc. running on my machine that aren't ...
15
votes
3answers
2k views

Can government agencies track what sites I'm visiting when using Tor?

Can agencies such as the NSA or GCHQ track what websites I'm visiting if I'm using the Tor Browser Bundle? What about hidden services?
14
votes
1answer
904 views

Is it safe to run an entry node server?

After some research, I found that there are mostly relay (middle) nodes, and less exit and entry nodes. But why? The connection from the client to the entry node is encrypted, so there should be no ...
13
votes
5answers
3k views

Aside from disabling Javascript in Firefox, how can I make Tor Browser Bundle more secure?

In a recent Tor security advisory, Roger Dingledine writes: Consider disabling JavaScript (click the blue "S" beside the green onion, and select "Forbid Scripts Globally"). Disabling ...
13
votes
2answers
460 views

Are there trustworthy third-party audits of the Tor source code?

Was the Tor source code trustworthily audited by a third party to check if it does not contain a back-door? Are such audit results freely available?
13
votes
3answers
731 views

Are there any vulnerabilities in the process of onion routing?

In onion routing, messages are repeatedly encrypted and then sent through several network nodes called onion routers. Each onion router removes a layer of encryption to uncover routing instructions, ...
12
votes
2answers
181 views

Does Tor latency leak location information?

This might be a general question about any anonymizing service, but I'm new here and curious about, but not super familiar with, Tor. Suppose there's a service that engages in some handshake with ...
11
votes
1answer
496 views

How should I verify Tor downloads?

When I go to https://www.torproject.org/download/download.html to download the Tor Browser for Windows, how can I be sure that the package I'm downloading is genuine, and hasn't been tampered with? ...
11
votes
1answer
280 views

How would a registration of the .onion gtld impact the Tor network?

The title pretty much says it all. What effects would a gtld registration of .onion domain have on the Tor network, is this something to worry about? Or is it something to welcome and slap a web2tor ...
10
votes
3answers
358 views

Is it secure to set the contact information when building up a Tor relay?

When I am setting up a tor relay, one option is to determine the contact information as an email address. Is it secure considering information harvesting by NSA for instance or would be better to hide ...
10
votes
1answer
5k views

HTML5 Canvas Security Flaw

What security flaw with the HTML5 canvas is Tor Browser Bundle protecting you from when it pops up a notification about the canvas.
9
votes
4answers
323 views

May I do security inspection on exit relays?

If I decide to run an exit relay may I run security inspection (Intrusion Prevention System, anti-spam, anti-malware etc.) on the traffic leaving the Tor network? Would this be considered legally and ...
8
votes
6answers
692 views

Releasing a controversial movie torrent using Tor Network for security

I live in a dictatorship and use the Tor Network to get around censorship. I read that Torrenting over Tor Network is not good because of high Internet usage and it slows everything down. For a short ...
8
votes
2answers
711 views

Can using Tor make you a suspect?

When you are browsing regular WWW through Tor last node's (exit node's) IP is known to the server, also exit node's ISP can observe the traffic. So if somebody is browsing sites with illegal content (...
8
votes
1answer
2k views

What is the difference between NTor and TAP?

Recently I read that Tor switched from TAP handshake requests to NTor handshake requests. This seems to improve the performance and doesn't put such a high load on relays (because of Mevade). However ...
8
votes
1answer
194 views

Who can see my bridge's ContactInfo?

I'm guessing that a bridge uploads its ContactInfo to the bridge authority, so there's a point of contact for the Tor project. Is this information available to any other parties, i.e. users ...
7
votes
5answers
2k views

Can technicians track my computer which has an image on it if I use Tor?

My laptop is imaged on a school network, which allows the technicians to remotely connect to it, locate it and track what I'm doing if I'm connected to their network, if I use Tor at home (or any ...
7
votes
3answers
12k views

How well-protected am I behind Tor?

I would like a general consensus, idea, or evidential proof of how protected I am from authorities behind Tor. As it stands, am I how much more protected and less likely from getting traced behind ...
7
votes
1answer
4k views

What encryption algorithms does Tor use?

I am building an application that will be connected over tor, using onion services. I just realized that the file generated by Tor that contains the private key of the hidden site is only RSA 1024bits....
7
votes
3answers
3k views

Tor -> VPN or VPN -> Tor

I'm trying to decide which method is safer, Tor -> VPN or VPN -> Tor. Lets suppose both exit nodes are compromised(Tor and VPN). They were set up by the government and it's goal is to spy on users. ...
7
votes
2answers
237 views

Why do Tor hidden service operators bother with SSL/TLS encryption?

Tor hidden services have an asymmetric key pair. That seems like it ought to do the job of authenticating the server and securing the connection to the client. When Tor clients reach out to normal ...
7
votes
2answers
994 views

How can I download Tor within China to get over the Great Firewall?

I am trying to download Tor within China to use as VPN. However, I cannot access the Tor download page using the mainstream internet inside of China. I am blocked by the Great Firewall, and recent ...
7
votes
1answer
194 views

What is this warning in the Tor log?

My Tor log shows this entry. What does this mean? Apr 04 16:08:07.000 [warn] Rejecting INTRODUCE1 on non-OR or non-edge circuit 7503.
6
votes
2answers
1k views

How can I improve my SSL/TLS security?

I recently visited https://www.howsmyssl.com/ with TorBrowser Bundle 3.5 and the rating was alarming. In particular, the site informed me that the cipher SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA was ...
6
votes
1answer
21k views

How to properly start tor service

For months I've been using: $ sudo systemctl start tor.service but I just realized we can start tor by simply typing "tor" into a terminal. What's the proper/safest way to start and stop tor.service?...
6
votes
2answers
482 views

When I use Tor, occasionally I get two different IP address simultaneously

When I use Tor circuit during last few months I use ip-check.info site to verify my IP address in addition to check.torproject.org site. What I have noticed is that occasionally I get two IP addresses ...
6
votes
2answers
25k views

How do I import bookmarks into Tor Browser?

How do I import bookmarks to Tor Browser? I did it before, but they are gone and now I cannot find the "import bookmarks" function I used last time.
6
votes
1answer
405 views

How secure is downloading Tor from a PPA vs. from official website?

I use Tor browser on Ubuntu and every time it updates, I have to download and unpack the binaries again. This is a bit annoying, so I would prefer to use a PPA. I found this ppa by the webupd8team, ...
6
votes
2answers
340 views

Can somebody force my Tor circuits to always start from his “guard node”, to access my traffic?

The first node after "my browser" is always the same. I am worried to see that even when asking for "new identity" or "new circuit", it restarts always by the same IP address in France. I have no ...
6
votes
3answers
943 views

Tor does not connect----The probable cause: The security system CYBEROAM

My college has installed a security system called Cyberoam. Now they have blocked many things including youtube, break, etc., as a counter measure, I tried to find a way to circumvent this security ...
6
votes
1answer
1k views

How much time they may take to track me down?

What I did: I used Tor Browser Bundle and created a fictitious Facebook account. The Facebook was registered through a fake email, No personal information was given. I uploaded the video and copied ...
6
votes
1answer
198 views

How do I report a security issue to the Tor project?

I have found a security issue in Tor which allows for information leakage in certain scenarios. I went to report this to the Tor project, but found nothing more than a bug tracker, and no obvious ...
5
votes
4answers
2k views

How safe are Tor users?

Given that Silk Road was just shut down, an article was published stating that: Tor Can't Always Keep You Safe; Just Ask Silk Road ... careful traffic monitoring and a little math you can figure ...
5
votes
2answers
388 views

What would happen when multiple servers are having the same onion hostname?

I'm concern about uniqueness of the onion sites in terms of finding the right onion hostname and publishing it. How I can be guaranteed that my onion site will be the only one in Tor network with the ...
5
votes
3answers
287 views

How can I set up the most useful Tor node?

I've heard of Torservers and Noisetor. I've considered donating to them, but I want to avoid consolidating the Tor network in those two organizations, so I'd like to operate my own Tor node. (I also ...
5
votes
1answer
1k views

How to create a private exit node?

I would like to create an private exit node that only I have access, it will be set on my personal computer, then plan to create "exit node" to relatives who live USA and France so I can have a fully ...
5
votes
2answers
279 views

Does Tor team have plans to implement post-quantum asymmetrical encryption schemes?

There is information that NSA is building quantum computer. Since it would make it possible to crack RSA using Shor's algorithm and we unlikely to know if they will successfully build it and start ...
5
votes
1answer
150 views

Are virtual servers like Tor Cloud less advisable?

It's probably not difficult to extract Tor encryption keys from storage or memory on virtual hardware like EC2 instances. Similar issues likely exist for rented physical servers with management access....
5
votes
1answer
713 views

Does hosting a Tor hidden service also on clearnet DNS reduce privacy/security for the Tor user?

I am wondering about the anonymity and security differences in visiting an .onion site, from the user's perspective, between one that is ONLY a hidden service, and one that also points the same ...
5
votes
2answers
1k views

Is it posible to choose what entry node you want to use?

If I know of an entry node that I know the device running it is not malicious or being watched, do I have the ability to only use that as an entry point? And would this be potentially more secure than ...
5
votes
1answer
3k views

Use Tor browser as non-root Linux

If I want to use the Tor browser as a non root user is there a way to do it without having to completely logout of the root workspace and log back in as another user? Basically have the browser run ...
5
votes
2answers
113 views

Tor security if LE/ISP want me really bad

Let's say LE knows who I am ... they already know I am using Tor. Is there a way for them to create a surveillance from my ISP ? You will say Tor is encrypted except exit relay ... but common to the ...
5
votes
3answers
6k views

If I log into facebook with Tor, am I still protected?

I want to be able to log into social networking sites like FB. Do I have to make a new account or will Tor protect my identity still? I think I logged into FB and realized that I might not be ...
5
votes
1answer
814 views

socks server with “dynamic traffic routing” trought Tor / I2P depending on the extension .i2p .onion

To browse the web, I connect to ssh and make a tunnel to an http proxy (privoxy) who is configured to "route" the traffic depending on the extension, here is an extract of the privoxy config file : ...
5
votes
0answers
325 views

Is (provider rotating) DNSCrypt inside Whonix superior privacy-wise to defaulting to Tor exit nodes' DNS?

I use Whonix. I am interested in making clearnet traffic as private from third parties other than the sites I visit, as possible. This not only includes the NSA, but also third-party DNS providers ...
5
votes
1answer
295 views

Which one is preferable :electrum or blockchain.info in the sense of anonymity?

What is better option, electrum or blockchain.info when using Tor, regarding anonymity? I read here: http://www.coindesk.com/bitcoin-tor-anonymity-can-busted-2500-month/ that it's possible to ...
4
votes
6answers
469 views

Has the Tor project considered using NTRU?

The Tor Project is switching to ECC, a set of algorithms promoted by the NSA. People like Bruce Schneier have mentioned concerns about both NSA's promotion of this algorithm, as well as the chosen ...
4
votes
2answers
548 views

What is the preferred OS platform with respect to TBB in the sense of minimization of security risks?

Different OS platforms offer advantages and disadvantages in term of security as far as user is concerned. Some maybe open-source, others may not be. Some may have huge user base, others may have a ...