Questions tagged [security]

Information about network security

Filter by
Sorted by
Tagged with
27 votes
5 answers
13k views

Securely hosting a Tor hidden service/site

There are some detailed instructions for setting up a Tor site at torproject.org1. It seems that it would be most secure to use a dedicated machine for this task if possible. I've read elsewhere that ...
user avatar
21 votes
8 answers
33k views

Can Tor be used with applications other than Web browsers?

From what I can see Tor mainly handles your web browser's traffic, but is there a way to do all of your connections through it? Like email, Dropbox, Carbonite backup, Skype etc? (Please explain ...
user avatar
  • 385
16 votes
3 answers
3k views

Can government agencies track what sites I'm visiting when using Tor?

Can agencies such as the NSA or GCHQ track what websites I'm visiting if I'm using the Tor Browser Bundle? What about hidden services?
user avatar
16 votes
2 answers
1k views

Is Tor's security compromised if other services are connecting in the clear?

I am using the Tor Browser Bundle, so all my internet browsing traffic is routed via Tor. However if I have other services like Dropbox, another web browser, etc. running on my machine that aren't ...
user avatar
16 votes
1 answer
1k views

Is it safe to run an entry node server?

After some research, I found that there are mostly relay (middle) nodes, and less exit and entry nodes. But why? The connection from the client to the entry node is encrypted, so there should be no ...
user avatar
15 votes
5 answers
3k views

Aside from disabling Javascript in Firefox, how can I make Tor Browser Bundle more secure?

In a recent Tor security advisory, Roger Dingledine writes: Consider disabling JavaScript (click the blue "S" beside the green onion, and select "Forbid Scripts Globally"). Disabling ...
user avatar
  • 677
14 votes
1 answer
70k views

How to properly start tor service

For months I've been using: $ sudo systemctl start tor.service but I just realized we can start tor by simply typing "tor" into a terminal. What's the proper/safest way to start and stop tor.service?...
user avatar
  • 141
14 votes
2 answers
622 views

Are there trustworthy third-party audits of the Tor source code?

Was the Tor source code trustworthily audited by a third party to check if it does not contain a back-door? Are such audit results freely available?
user avatar
14 votes
3 answers
1k views

Are there any vulnerabilities in the process of onion routing?

In onion routing, messages are repeatedly encrypted and then sent through several network nodes called onion routers. Each onion router removes a layer of encryption to uncover routing instructions, ...
user avatar
  • 1,093
13 votes
2 answers
300 views

Does Tor latency leak location information?

This might be a general question about any anonymizing service, but I'm new here and curious about, but not super familiar with, Tor. Suppose there's a service that engages in some handshake with ...
user avatar
  • 233
11 votes
1 answer
690 views

How should I verify Tor downloads?

When I go to https://www.torproject.org/download/download.html to download the Tor Browser for Windows, how can I be sure that the package I'm downloading is genuine, and hasn't been tampered with? ...
user avatar
  • 379
11 votes
1 answer
386 views

How would a registration of the .onion gtld impact the Tor network?

The title pretty much says it all. What effects would a gtld registration of .onion domain have on the Tor network, is this something to worry about? Or is it something to welcome and slap a web2tor ...
user avatar
  • 241
10 votes
3 answers
459 views

Is it secure to set the contact information when building up a Tor relay?

When I am setting up a tor relay, one option is to determine the contact information as an email address. Is it secure considering information harvesting by NSA for instance or would be better to hide ...
user avatar
10 votes
1 answer
7k views

HTML5 Canvas Security Flaw

What security flaw with the HTML5 canvas is Tor Browser Bundle protecting you from when it pops up a notification about the canvas.
user avatar
9 votes
4 answers
356 views

May I do security inspection on exit relays?

If I decide to run an exit relay may I run security inspection (Intrusion Prevention System, anti-spam, anti-malware etc.) on the traffic leaving the Tor network? Would this be considered legally and ...
user avatar
8 votes
6 answers
1k views

Releasing a controversial movie torrent using Tor Network for security

I live in a dictatorship and use the Tor Network to get around censorship. I read that Torrenting over Tor Network is not good because of high Internet usage and it slows everything down. For a short ...
user avatar
8 votes
2 answers
861 views

Can using Tor make you a suspect?

When you are browsing regular WWW through Tor last node's (exit node's) IP is known to the server, also exit node's ISP can observe the traffic. So if somebody is browsing sites with illegal content (...
user avatar
  • 183
8 votes
1 answer
3k views

What is the difference between NTor and TAP?

Recently I read that Tor switched from TAP handshake requests to NTor handshake requests. This seems to improve the performance and doesn't put such a high load on relays (because of Mevade). However ...
user avatar
  • 8,663
8 votes
1 answer
8k views

What encryption algorithms does Tor use?

I am building an application that will be connected over tor, using onion services. I just realized that the file generated by Tor that contains the private key of the hidden site is only RSA 1024bits....
user avatar
8 votes
1 answer
280 views

Who can see my bridge's ContactInfo?

I'm guessing that a bridge uploads its ContactInfo to the bridge authority, so there's a point of contact for the Tor project. Is this information available to any other parties, i.e. users ...
user avatar
  • 477
7 votes
5 answers
3k views

Can technicians track my computer which has an image on it if I use Tor?

My laptop is imaged on a school network, which allows the technicians to remotely connect to it, locate it and track what I'm doing if I'm connected to their network, if I use Tor at home (or any ...
user avatar
  • 71
7 votes
3 answers
14k views

How well-protected am I behind Tor?

I would like a general consensus, idea, or evidential proof of how protected I am from authorities behind Tor. As it stands, am I how much more protected and less likely from getting traced behind ...
user avatar
7 votes
2 answers
477 views

Can somebody force my Tor circuits to always start from his "guard node", to access my traffic?

The first node after "my browser" is always the same. I am worried to see that even when asking for "new identity" or "new circuit", it restarts always by the same IP address in France. I have no ...
user avatar
7 votes
3 answers
4k views

Tor -> VPN or VPN -> Tor

I'm trying to decide which method is safer, Tor -> VPN or VPN -> Tor. Lets suppose both exit nodes are compromised(Tor and VPN). They were set up by the government and it's goal is to spy on users. ...
user avatar
7 votes
2 answers
936 views

Why do Tor hidden service operators bother with SSL/TLS encryption?

Tor hidden services have an asymmetric key pair. That seems like it ought to do the job of authenticating the server and securing the connection to the client. When Tor clients reach out to normal ...
user avatar
  • 419
7 votes
2 answers
2k views

How can I download Tor within China to get over the Great Firewall?

I am trying to download Tor within China to use as VPN. However, I cannot access the Tor download page using the mainstream internet inside of China. I am blocked by the Great Firewall, and recent ...
user avatar
7 votes
1 answer
543 views

Is (provider rotating) DNSCrypt inside Whonix superior privacy-wise to defaulting to Tor exit nodes' DNS?

I use Whonix. I am interested in making clearnet traffic as private from third parties other than the sites I visit, as possible. This not only includes the NSA, but also third-party DNS providers ...
user avatar
  • 145
7 votes
1 answer
232 views

What is this warning in the Tor log?

My Tor log shows this entry. What does this mean? Apr 04 16:08:07.000 [warn] Rejecting INTRODUCE1 on non-OR or non-edge circuit 7503.
user avatar
  • 465
6 votes
2 answers
901 views

What would happen when multiple servers are having the same onion hostname?

I'm concern about uniqueness of the onion sites in terms of finding the right onion hostname and publishing it. How I can be guaranteed that my onion site will be the only one in Tor network with the ...
user avatar
  • 1,115
6 votes
2 answers
1k views

How can I improve my SSL/TLS security?

I recently visited https://www.howsmyssl.com/ with TorBrowser Bundle 3.5 and the rating was alarming. In particular, the site informed me that the cipher SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA was ...
user avatar
  • 1,664
6 votes
2 answers
896 views

When I use Tor, occasionally I get two different IP address simultaneously

When I use Tor circuit during last few months I use ip-check.info site to verify my IP address in addition to check.torproject.org site. What I have noticed is that occasionally I get two IP addresses ...
user avatar
  • 3,236
6 votes
2 answers
46k views

How do I import bookmarks into Tor Browser?

How do I import bookmarks to Tor Browser? I did it before, but they are gone and now I cannot find the "import bookmarks" function I used last time.
user avatar
6 votes
1 answer
527 views

How secure is downloading Tor from a PPA vs. from official website?

I use Tor browser on Ubuntu and every time it updates, I have to download and unpack the binaries again. This is a bit annoying, so I would prefer to use a PPA. I found this ppa by the webupd8team, ...
user avatar
  • 455
6 votes
1 answer
1k views

Does hosting a Tor hidden service also on clearnet DNS reduce privacy/security for the Tor user?

I am wondering about the anonymity and security differences in visiting an .onion site, from the user's perspective, between one that is ONLY a hidden service, and one that also points the same ...
user avatar
6 votes
3 answers
987 views

Tor does not connect----The probable cause: The security system CYBEROAM

My college has installed a security system called Cyberoam. Now they have blocked many things including youtube, break, etc., as a counter measure, I tried to find a way to circumvent this security ...
user avatar
6 votes
1 answer
1k views

How much time they may take to track me down?

What I did: I used Tor Browser Bundle and created a fictitious Facebook account. The Facebook was registered through a fake email, No personal information was given. I uploaded the video and copied ...
user avatar
6 votes
1 answer
234 views

How do I report a security issue to the Tor project?

I have found a security issue in Tor which allows for information leakage in certain scenarios. I went to report this to the Tor project, but found nothing more than a bug tracker, and no obvious ...
user avatar
5 votes
4 answers
2k views

How safe are Tor users?

Given that Silk Road was just shut down, an article was published stating that: Tor Can't Always Keep You Safe; Just Ask Silk Road ... careful traffic monitoring and a little math you can figure ...
user avatar
5 votes
4 answers
22k views

Is using Tor on Windows dangerous?

One of my friends keeps telling me that it's useless to use Tor on Windows, as Windows is full of key-loggers, Trojans and other malware, and if they want to identify me it will be easy because of ...
user avatar
  • 175
5 votes
3 answers
351 views

How can I set up the most useful Tor node?

I've heard of Torservers and Noisetor. I've considered donating to them, but I want to avoid consolidating the Tor network in those two organizations, so I'd like to operate my own Tor node. (I also ...
user avatar
  • 379
5 votes
2 answers
2k views

How to create a private exit node?

I would like to create an private exit node that only I have access, it will be set on my personal computer, then plan to create "exit node" to relatives who live USA and France so I can have a fully ...
user avatar
  • 51
5 votes
2 answers
597 views

Does Tor team have plans to implement post-quantum asymmetrical encryption schemes?

There is information that NSA is building quantum computer. Since it would make it possible to crack RSA using Shor's algorithm and we unlikely to know if they will successfully build it and start ...
user avatar
5 votes
1 answer
156 views

Are virtual servers like Tor Cloud less advisable?

It's probably not difficult to extract Tor encryption keys from storage or memory on virtual hardware like EC2 instances. Similar issues likely exist for rented physical servers with management access....
user avatar
  • 477
5 votes
2 answers
2k views

Is it posible to choose what entry node you want to use?

If I know of an entry node that I know the device running it is not malicious or being watched, do I have the ability to only use that as an entry point? And would this be potentially more secure than ...
user avatar
5 votes
2 answers
5k views

Use Tor browser as non-root Linux

If I want to use the Tor browser as a non root user is there a way to do it without having to completely logout of the root workspace and log back in as another user? Basically have the browser run ...
user avatar
5 votes
2 answers
140 views

Tor security if LE/ISP want me really bad

Let's say LE knows who I am ... they already know I am using Tor. Is there a way for them to create a surveillance from my ISP ? You will say Tor is encrypted except exit relay ... but common to the ...
user avatar
  • 51
5 votes
3 answers
9k views

If I log into facebook with Tor, am I still protected?

I want to be able to log into social networking sites like FB. Do I have to make a new account or will Tor protect my identity still? I think I logged into FB and realized that I might not be ...
user avatar
5 votes
1 answer
1k views

socks server with "dynamic traffic routing" trought Tor / I2P depending on the extension .i2p .onion

To browse the web, I connect to ssh and make a tunnel to an http proxy (privoxy) who is configured to "route" the traffic depending on the extension, here is an extract of the privoxy config file : ...
user avatar
  • 151
5 votes
1 answer
345 views

Which one is preferable :electrum or blockchain.info in the sense of anonymity?

What is better option, electrum or blockchain.info when using Tor, regarding anonymity? I read here: http://www.coindesk.com/bitcoin-tor-anonymity-can-busted-2500-month/ that it's possible to ...
user avatar
4 votes
6 answers
544 views

Has the Tor project considered using NTRU?

The Tor Project is switching to ECC, a set of algorithms promoted by the NSA. People like Bruce Schneier have mentioned concerns about both NSA's promotion of this algorithm, as well as the chosen ...
user avatar
  • 1,182

1
2 3 4 5
10