Questions tagged [security]
Information about network security
487
questions
25
votes
5
answers
14k
views
Securely hosting a Tor hidden service/site
There are some detailed instructions for setting up a Tor site at torproject.org1. It seems that it would be most secure to use a dedicated machine for this task if possible. I've read elsewhere that ...
- 749
20
votes
8
answers
35k
views
Can Tor be used with applications other than Web browsers?
From what I can see Tor mainly handles your web browser's traffic, but is there a way to do all of your connections through it? Like email, Dropbox, Carbonite backup, Skype etc?
(Please explain ...
- 375
16
votes
2
answers
1k
views
Is Tor's security compromised if other services are connecting in the clear?
I am using the Tor Browser Bundle, so all my internet browsing traffic is routed via Tor. However if I have other services like Dropbox, another web browser, etc. running on my machine that aren't ...
- 962
15
votes
3
answers
3k
views
Can government agencies track what sites I'm visiting when using Tor?
Can agencies such as the NSA or GCHQ track what websites I'm visiting if I'm using the Tor Browser Bundle? What about hidden services?
- 962
15
votes
1
answer
2k
views
Is it safe to run an entry node server?
After some research, I found that there are mostly relay (middle) nodes, and less exit and entry nodes. But why? The connection from the client to the entry node is encrypted, so there should be no ...
- 285
14
votes
5
answers
3k
views
Aside from disabling Javascript in Firefox, how can I make Tor Browser Bundle more secure?
In a recent Tor security advisory, Roger Dingledine writes:
Consider disabling JavaScript (click the blue
"S" beside the green onion, and select "Forbid Scripts Globally").
Disabling ...
- 657
14
votes
1
answer
82k
views
How to properly start tor service
For months I've been using:
$ sudo systemctl start tor.service
but I just realized we can start tor by simply typing "tor" into a terminal. What's the proper/safest way to start and stop tor.service?...
- 141
13
votes
2
answers
660
views
Are there trustworthy third-party audits of the Tor source code?
Was the Tor source code trustworthily audited by a third party to check if it does not contain a back-door?
Are such audit results freely available?
13
votes
2
answers
345
views
Does Tor latency leak location information?
This might be a general question about any anonymizing service, but I'm new here and curious about, but not super familiar with, Tor.
Suppose there's a service that engages in some handshake with ...
- 233
13
votes
3
answers
2k
views
Are there any vulnerabilities in the process of onion routing?
In onion routing, messages are repeatedly encrypted and then sent through several network nodes called onion routers. Each onion router removes a layer of encryption to uncover routing instructions, ...
- 1,053
10
votes
1
answer
7k
views
HTML5 Canvas Security Flaw
What security flaw with the HTML5 canvas is Tor Browser Bundle protecting you from when it pops up a notification about the canvas.
- 203
10
votes
1
answer
745
views
How should I verify Tor downloads?
When I go to https://www.torproject.org/download/download.html to download the Tor Browser for Windows, how can I be sure that the package I'm downloading is genuine, and hasn't been tampered with?
...
- 369
10
votes
1
answer
402
views
How would a registration of the .onion gtld impact the Tor network?
The title pretty much says it all.
What effects would a gtld registration of .onion domain have on the Tor network, is this something to worry about? Or is it something to welcome and slap a web2tor ...
- 231
9
votes
4
answers
373
views
May I do security inspection on exit relays?
If I decide to run an exit relay may I run security inspection (Intrusion Prevention System, anti-spam, anti-malware etc.) on the traffic leaving the Tor network? Would this be considered legally and ...
9
votes
3
answers
567
views
Is it secure to set the contact information when building up a Tor relay?
When I am setting up a tor relay, one option is to determine the contact information as an email address. Is it secure considering information harvesting by NSA for instance or would be better to hide ...
- 103
8
votes
6
answers
1k
views
Releasing a controversial movie torrent using Tor Network for security
I live in a dictatorship and use the Tor Network to get around censorship. I read that Torrenting over Tor Network is not good because of high Internet usage and it slows everything down. For a short ...
- 81
8
votes
1
answer
3k
views
What is the difference between NTor and TAP?
Recently I read that Tor switched from TAP handshake requests to NTor handshake requests. This seems to improve the performance and doesn't put such a high load on relays (because of Mevade). However ...
- 8,561
8
votes
1
answer
9k
views
What encryption algorithms does Tor use?
I am building an application that will be connected over tor, using onion services. I just realized that the file generated by Tor that contains the private key of the hidden site is only RSA 1024bits....
- 215
8
votes
2
answers
1k
views
Why do Tor hidden service operators bother with SSL/TLS encryption?
Tor hidden services have an asymmetric key pair. That seems like it ought to do the job of authenticating the server and securing the connection to the client. When Tor clients reach out to normal ...
- 429
7
votes
5
answers
3k
views
Can technicians track my computer which has an image on it if I use Tor?
My laptop is imaged on a school network, which allows the technicians to remotely connect to it, locate it and track what I'm doing if I'm connected to their network, if I use Tor at home (or any ...
- 71
7
votes
2
answers
935
views
Can using Tor make you a suspect?
When you are browsing regular WWW through Tor last node's (exit node's) IP is known to the server, also exit node's ISP can observe the traffic.
So if somebody is browsing sites with illegal content (...
- 173
7
votes
3
answers
15k
views
How well-protected am I behind Tor?
I would like a general consensus, idea, or evidential proof of how protected I am from authorities behind Tor.
As it stands, am I how much more protected and less likely from getting traced behind ...
7
votes
2
answers
529
views
Can somebody force my Tor circuits to always start from his "guard node", to access my traffic?
The first node after "my browser" is always the same.
I am worried to see that even when asking for "new identity" or "new circuit", it restarts always by the same IP address in France. I have no ...
- 71
7
votes
2
answers
2k
views
How can I download Tor within China to get over the Great Firewall?
I am trying to download Tor within China to use as VPN. However, I cannot access the Tor download page using the mainstream internet inside of China. I am blocked by the Great Firewall, and recent ...
7
votes
1
answer
299
views
Who can see my bridge's ContactInfo?
I'm guessing that a bridge uploads its ContactInfo to the bridge authority, so there's a point of contact for the Tor project.
Is this information available to any other parties, i.e. users ...
- 467
7
votes
1
answer
572
views
Is (provider rotating) DNSCrypt inside Whonix superior privacy-wise to defaulting to Tor exit nodes' DNS?
I use Whonix.
I am interested in making clearnet traffic as private from third parties other than the sites I visit, as possible. This not only includes the NSA, but also third-party DNS providers ...
- 145
7
votes
1
answer
251
views
What is this warning in the Tor log?
My Tor log shows this entry. What does this mean?
Apr 04 16:08:07.000 [warn] Rejecting INTRODUCE1 on non-OR or non-edge circuit 7503.
- 465
6
votes
2
answers
1k
views
What would happen when multiple servers are having the same onion hostname?
I'm concern about uniqueness of the onion sites in terms of finding the right onion hostname and publishing it. How I can be guaranteed that my onion site will be the only one in Tor network with the ...
- 1,153
6
votes
2
answers
1k
views
How can I improve my SSL/TLS security?
I recently visited https://www.howsmyssl.com/ with TorBrowser Bundle 3.5 and the rating was alarming. In particular, the site informed me that the cipher SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA was ...
- 1,630
6
votes
2
answers
1k
views
When I use Tor, occasionally I get two different IP address simultaneously
When I use Tor circuit during last few months I use ip-check.info site to verify my IP address in addition to check.torproject.org site. What I have noticed is that occasionally I get two IP addresses ...
- 3,228
6
votes
2
answers
46k
views
How do I import bookmarks into Tor Browser?
How do I import bookmarks to Tor Browser? I did it before, but they are gone and now I cannot find the "import bookmarks" function I used last time.
- 61
6
votes
1
answer
547
views
How secure is downloading Tor from a PPA vs. from official website?
I use Tor browser on Ubuntu and every time it updates, I have to download and unpack the binaries again. This is a bit annoying, so I would prefer to use a PPA. I found this ppa by the webupd8team, ...
- 445
6
votes
3
answers
4k
views
Tor -> VPN or VPN -> Tor
I'm trying to decide which method is safer, Tor -> VPN or VPN -> Tor.
Lets suppose both exit nodes are compromised(Tor and VPN). They were set up by the government and it's goal is to spy on users.
...
- 63
6
votes
1
answer
1k
views
Does hosting a Tor hidden service also on clearnet DNS reduce privacy/security for the Tor user?
I am wondering about the anonymity and security differences in visiting an .onion site, from the user's perspective, between one that is ONLY a hidden service, and one that also points the same ...
user1006
6
votes
3
answers
989
views
Tor does not connect----The probable cause: The security system CYBEROAM
My college has installed a security system called Cyberoam. Now they have blocked many things including youtube, break, etc., as a counter measure, I tried to find a way to circumvent this security ...
6
votes
1
answer
1k
views
How much time they may take to track me down?
What I did:
I used Tor Browser Bundle and created a fictitious Facebook account. The Facebook was registered through a fake email, No personal information was given.
I uploaded the video and copied ...
- 61
6
votes
1
answer
246
views
How do I report a security issue to the Tor project?
I have found a security issue in Tor which allows for information leakage in certain scenarios. I went to report this to the Tor project, but found nothing more than a bug tracker, and no obvious ...
- 63
5
votes
5
answers
23k
views
Is using Tor on Windows dangerous?
One of my friends keeps telling me that it's useless to use Tor on Windows, as Windows is full of key-loggers, Trojans and other malware, and if they want to identify me it will be easy because of ...
- 175
5
votes
4
answers
2k
views
How safe are Tor users?
Given that Silk Road was just shut down, an article was published stating that:
Tor Can't Always Keep You Safe; Just Ask Silk Road ... careful traffic monitoring and a little math you can figure ...
- 153
5
votes
3
answers
372
views
How can I set up the most useful Tor node?
I've heard of Torservers and Noisetor. I've considered donating to them, but I want to avoid consolidating the Tor network in those two organizations, so I'd like to operate my own Tor node. (I also ...
- 369
5
votes
2
answers
2k
views
How to create a private exit node?
I would like to create an private exit node that only I have access, it will be set on my personal computer, then plan to create "exit node" to relatives who live USA and France so I can have a fully ...
- 51
5
votes
2
answers
845
views
Does Tor team have plans to implement post-quantum asymmetrical encryption schemes?
There is information that NSA is building quantum computer. Since it would make it possible to crack RSA using Shor's algorithm and we unlikely to know if they will successfully build it and start ...
- 51
5
votes
1
answer
156
views
Are virtual servers like Tor Cloud less advisable?
It's probably not difficult to extract Tor encryption keys from storage or memory on virtual hardware like EC2 instances. Similar issues likely exist for rented physical servers with management access....
- 467
5
votes
2
answers
2k
views
Is it posible to choose what entry node you want to use?
If I know of an entry node that I know the device running it is not malicious or being watched, do I have the ability to only use that as an entry point? And would this be potentially more secure than ...
- 385
5
votes
2
answers
5k
views
Use Tor browser as non-root Linux
If I want to use the Tor browser as a non root user is there a way to do it without having to completely logout of the root workspace and log back in as another user?
Basically have the browser run ...
- 183
5
votes
2
answers
148
views
Tor security if LE/ISP want me really bad
Let's say LE knows who I am ... they already know I am using Tor. Is there a way for them to create a surveillance from my ISP ? You will say Tor is encrypted except exit relay ... but common to the ...
- 51
5
votes
3
answers
10k
views
If I log into facebook with Tor, am I still protected?
I want to be able to log into social networking sites like FB. Do I have to make a new account or will Tor protect my identity still? I think I logged into FB and realized that I might not be ...
- 61
5
votes
1
answer
354
views
Which one is preferable :electrum or blockchain.info in the sense of anonymity?
What is better option, electrum or blockchain.info when using Tor, regarding anonymity?
I read here: http://www.coindesk.com/bitcoin-tor-anonymity-can-busted-2500-month/ that it's possible to ...
- 51
4
votes
6
answers
555
views
Has the Tor project considered using NTRU?
The Tor Project is switching to ECC, a set of algorithms promoted by the NSA. People like Bruce Schneier have mentioned concerns about both NSA's promotion of this algorithm, as well as the chosen ...
- 1,202
4
votes
3
answers
213
views
Is this a security flaw?
Now, this seems almost too obvious, so I assume I must be missing something, but I figure I should run it by the experts first to see.
Hypothetical scenario:
At 5:18pm, a user using the Tor network ...
- 41