6 votes

Isn't it easy to de-anonymize users this way?

No, this approach will not work that simply. First of all, you've got your targeted user(s). Bob and Alice. You assume the role of Eve (a passive adversary, who can only observe). You know Bob is ...
cacahuatl's user avatar
  • 10.9k
6 votes
Accepted

Are .onion addresses leak-proof?

No, .onion's are not exempt from DNS leaks. Since it's possible for people to run local DNS gTLDs, DNS infrastructure will generally respect and dutifully perform lookups for invalid domain names. DNS ...
cacahuatl's user avatar
  • 10.9k
4 votes

Does cross-browser fingreprinting work in Tor Browser?

All of those are already dealt with, with the exception of AudioContext which may get a similar treatment as canvas fingerprinting has. See ticket #13017. Update: Tor Browser 7.0 disabled ...
cacahuatl's user avatar
  • 10.9k
2 votes

How does de-anonymization work?

I think I can answer the first two paragraphs. I think because the entry guard node knows where a Tor user is from (compromising anonymity) and the exit node knows what that user is looking at (...
m894v5n74v539nm8's user avatar
2 votes

Can a USB drive's serial number or unique hardware be used to identify me?

Theoretically - YES, if it will be a way to make a hardware listing query like lsusb -v
Alexey Vesnin's user avatar
  • 6,023
2 votes

Can JavaScript get my real IP?

I'm no expert, but the most convincing answer I found is: no, JavaScript, as it is implemented in TBB, can't get your real IP. There is a lot of confusion about that in the Web. Just do a web search ...
anon's user avatar
  • 21
2 votes
Accepted

Can a HSDir see visited onion url's?

Yes, currently HSDirs can see the looked up .onion hostname. This does not include the full URL but just the .onion hostname. Proposal 224 (ticket #12424) will fix this issue. See also #8106. If you ...
Peter Gerber's user avatar
  • 1,342
2 votes

Whonix Workstation Country Code

Packets won't carry your local time information, application data will though. You probably want to make your timezone UTC since this is the most "generic" timezone and the easiest to calculate your ...
cacahuatl's user avatar
  • 10.9k
2 votes

Do vulnerabilities exist in Tor Browser Bundle

The article is mostly wrong headed, at least in how the article presents it. tl;dr - Tor Browser does a great job of making you anonymous against passive observers, it lacks against active ...
cacahuatl's user avatar
  • 10.9k
2 votes

Should use same ISP for Tor and Real life?

There is no direct problem in connecting to Tor from the connection that you also use to perform other activities, assuming that it is safe for you to use Tor in the first place (I.E. that it's not ...
cacahuatl's user avatar
  • 10.9k
2 votes

A server behind a physical Tor gateway to hide its location

Whonix is what you want. The Workstation VM can "see" only IP addresses on the Internal LAN, which are the same in every Whonix installation. User applications therefore have no knowledge of ...
IAmNoone's user avatar
  • 1,863
2 votes

How to best avoid having unencrypted information logged by an exit node, if encrypted connection is not an option?

You do not have a 'best option' here the way you describe it. However - playing it over tor makes sure your real IP stays hidden. The exit node does not get to know your IP, but as you say - the exit ...
IAmNoone's user avatar
  • 1,863
2 votes

Is this setup to send anonymous email secure?

When you go to the place with the open wifi, you should additionally check if the place is physically secure. This means no cameras, no people who could shoulder-surf etc. Furthermore if you connect ...
Jens Kubieziel's user avatar
  • 8,570
2 votes
Accepted

Clearing the state of rendezvous client provides privacy improvement?

Is there a risk the server can learn the connection between Alice and Bob without clearing the state of the rendezvous client? If so, then how much of this risk is? Yes. It could be possible for an ...
cacahuatl's user avatar
  • 10.9k
2 votes

How was YouTube able to deanonymize Tor?

Open up developer console on your browser, run this console.log(window.navigator.userLanguage || window.navigator.language) If it prints your preferred language, that means you're fine. Otherwise, ...
Thor-x86_128's user avatar
1 vote

Can a website read out my MAC address using JavaScript even though I use Tor?

In general this is not possible. This question was previously discussed at StackOverflow (see MAC addresses in JavaScript). Only if you are able to use signed JavaScript it is possible to get more ...
Jens Kubieziel's user avatar
  • 8,570
1 vote

Do vulnerabilities exist in Tor Browser Bundle

Interesting article. I don't know what the exact vulnerabilities are they talk about. But, yes, Tor Browser like any other software, has vulnerabilities. I'm not aware of any other browser that is ...
Peter Gerber's user avatar
  • 1,342
1 vote

Tracking users via google APIs?

2nd point: it's as simple as hell to give you one cookie/tracker to merge it. The tracking itself may be not a trivial task, but Tor Browser is a browser after all, so it can not defeat some ...
Alexey Vesnin's user avatar
  • 6,023
1 vote

Was I attacked or my identity found out?

It's a captcha glitch, quite a common one. It's OK - some sites are using overreaching protection, it does backfire like that even without using Tor. Tor Browser and Chrome by themselves are two ...
Alexey Vesnin's user avatar
  • 6,023
1 vote

Can I prevent Tor from building single-hop circuits?

No, you cannot stop Tor from building single-hop circuits. All Tor circuits start out at 1 hop in length. Clearly, to build a circuit any circuit needs to start from the first hop to then negotiate ...
cacahuatl's user avatar
  • 10.9k
1 vote

Isn't it easy to de-anonymize users this way?

You're missing the middle guard detection difficulty - that's the reason why the minimal and default circuit length is 3 hops, actually. Unless you're running tons of middle nodes and guards - which ...
Alexey Vesnin's user avatar
  • 6,023
1 vote
Accepted

What do you make of the news that researchers had found at least 110 Tor nodes that were spying in on network traffic or were honeypots?

What the researchers were doing was creating "honeypots", the relays weren't "honeypots". The snooping HSDir is something that's long been acknowledged as a weakness in the current rendezvous protocol....
cacahuatl's user avatar
  • 10.9k
1 vote

How do we find out the identities of online scammer(s) who used TOR?

No. Tor is anonymous network. Everyone who use it is anonymous. But you can prevent this attack from happening in the future. Quoting best answer from Is it possible to block Tor users?: Tor is much ...
NeverMine17's user avatar
1 vote

Can JavaScript get my real IP?

yes, the JS itself is capable of making an external requests in a several ways, like simple HTTP GET "some-javascript.php" with a js content type, incorporating the IP address of the HTTP request, to ...
Alexey Vesnin's user avatar
  • 6,023
1 vote

Can I permanently blow my anonimity on Tor?

Oh man! You need to sell everything you own now!!! :D All that happened is your accounts are logged with a known Tor exit node. Thus, you are identified as a Tor user now if logs are checked for any ...
michael g's user avatar
  • 121
1 vote

Can I permanently blow my anonimity on Tor?

It's probably not that big of a mistake, as long as you obtained a new Tor identity after you were done (e.g., quit the Tor browser bundle, then restarted it before using Tor for more anonymous ...
pseudon's user avatar
  • 121
1 vote

Can I use other applications connected to the Internet while using Tor?

Actually it can compromise you, if you're using a browser with WebRTC enabled, and the page you're opening has the same tracking code - via WebRTC some leaks are theoretically possible. That's ...
Alexey Vesnin's user avatar
  • 6,023
1 vote

Can I use other applications connected to the Internet while using Tor?

No Technically speaking, a Tor site won't know you opened that connection on clearnet and the clearnet site won't be able to tell whether you're using Tor (your ISP can, though). Also you won't have ...
Sebb's user avatar
  • 111

Only top scored, non community-wiki answers of a minimum length are eligible