Skip to main content
6 votes
Accepted

Are .onion addresses leak-proof?

No, .onion's are not exempt from DNS leaks. Since it's possible for people to run local DNS gTLDs, DNS infrastructure will generally respect and dutifully perform lookups for invalid domain names. DNS ...
cacahuatl's user avatar
  • 11k
6 votes

Isn't it easy to de-anonymize users this way?

No, this approach will not work that simply. First of all, you've got your targeted user(s). Bob and Alice. You assume the role of Eve (a passive adversary, who can only observe). You know Bob is ...
cacahuatl's user avatar
  • 11k
4 votes

Does cross-browser fingreprinting work in Tor Browser?

All of those are already dealt with, with the exception of AudioContext which may get a similar treatment as canvas fingerprinting has. See ticket #13017. Update: Tor Browser 7.0 disabled ...
cacahuatl's user avatar
  • 11k
2 votes

How does de-anonymization work?

I think I can answer the first two paragraphs. I think because the entry guard node knows where a Tor user is from (compromising anonymity) and the exit node knows what that user is looking at (...
m894v5n74v539nm8's user avatar
2 votes

Can JavaScript get my real IP?

I'm no expert, but the most convincing answer I found is: no, JavaScript, as it is implemented in TBB, can't get your real IP. There is a lot of confusion about that in the Web. Just do a web search ...
anon's user avatar
  • 21
2 votes

How to best avoid having unencrypted information logged by an exit node, if encrypted connection is not an option?

You do not have a 'best option' here the way you describe it. However - playing it over tor makes sure your real IP stays hidden. The exit node does not get to know your IP, but as you say - the exit ...
IAmNoone's user avatar
  • 1,863
2 votes
Accepted

Can a HSDir see visited onion url's?

Yes, currently HSDirs can see the looked up .onion hostname. This does not include the full URL but just the .onion hostname. Proposal 224 (ticket #12424) will fix this issue. See also #8106. If you ...
Peter Gerber's user avatar
  • 1,342
2 votes

Whonix Workstation Country Code

Packets won't carry your local time information, application data will though. You probably want to make your timezone UTC since this is the most "generic" timezone and the easiest to calculate your ...
cacahuatl's user avatar
  • 11k
2 votes

Do vulnerabilities exist in Tor Browser Bundle

The article is mostly wrong headed, at least in how the article presents it. tl;dr - Tor Browser does a great job of making you anonymous against passive observers, it lacks against active ...
cacahuatl's user avatar
  • 11k
2 votes

Should use same ISP for Tor and Real life?

There is no direct problem in connecting to Tor from the connection that you also use to perform other activities, assuming that it is safe for you to use Tor in the first place (I.E. that it's not ...
cacahuatl's user avatar
  • 11k
2 votes

A server behind a physical Tor gateway to hide its location

Whonix is what you want. The Workstation VM can "see" only IP addresses on the Internal LAN, which are the same in every Whonix installation. User applications therefore have no knowledge of ...
IAmNoone's user avatar
  • 1,863
2 votes

Is this setup to send anonymous email secure?

When you go to the place with the open wifi, you should additionally check if the place is physically secure. This means no cameras, no people who could shoulder-surf etc. Furthermore if you connect ...
Jens Kubieziel's user avatar
  • 8,570
2 votes
Accepted

Clearing the state of rendezvous client provides privacy improvement?

Is there a risk the server can learn the connection between Alice and Bob without clearing the state of the rendezvous client? If so, then how much of this risk is? Yes. It could be possible for an ...
cacahuatl's user avatar
  • 11k
2 votes

How was YouTube able to deanonymize Tor?

Open up developer console on your browser, run this console.log(window.navigator.userLanguage || window.navigator.language) If it prints your preferred language, that means you're fine. Otherwise, ...
Thor-x86_128's user avatar
1 vote

Download large files over tor?

Tor will try to continue to use the same circuit for the duration of the connection. The exception being if some unexpected problem causes the connection to fail (e.g. your internet drops, the exit or ...
cacahuatl's user avatar
  • 11k
1 vote

Checking for DNS leak on TOR router

Android devices do ignore DHCP DNS server, remember. So - it looks like this? I've met this problem too. The only really working workaround is to forcibly route all dns requests to 8.8.8.8 and 8.8.4.4 ...
Alexey Vesnin's user avatar
  • 6,265
1 vote

Is this setup to send anonymous email secure?

Tor is your best bet. There are free email providers that you can access over Tor. By using their webmail client, over Tor, they will not know your real IP address - only the IP address of the last ...
nextlinemail's user avatar
1 vote

Is this setup to send anonymous email secure?

That sounds secure to me. When you sign up for an email service, make sure not to give any identifying information away. You'll find that a lot of email providers require you to give your phone number,...
Weston Reed's user avatar
1 vote

Does it matter when you connect to TOR?

Somehow it matters, but not fatal. Here are your two cases for a start: You have connected to Tor after using an authorized page. If your actions you do perform through Tor can be linked with your ...
Alexey Vesnin's user avatar
  • 6,265
1 vote

Double connection to Tor from one IP

No and no. Is there any security issues or deanonymise techniques when a user use Tor from his tablet and from his Notebook at same moment? You use Tor on 2 different machines. They are not ...
NeverMine17's user avatar
1 vote

Do vulnerabilities exist in Tor Browser Bundle

Interesting article. I don't know what the exact vulnerabilities are they talk about. But, yes, Tor Browser like any other software, has vulnerabilities. I'm not aware of any other browser that is ...
Peter Gerber's user avatar
  • 1,342
1 vote

Tracking users via google APIs?

2nd point: it's as simple as hell to give you one cookie/tracker to merge it. The tracking itself may be not a trivial task, but Tor Browser is a browser after all, so it can not defeat some ...
Alexey Vesnin's user avatar
  • 6,265
1 vote

Was I attacked or my identity found out?

It's a captcha glitch, quite a common one. It's OK - some sites are using overreaching protection, it does backfire like that even without using Tor. Tor Browser and Chrome by themselves are two ...
Alexey Vesnin's user avatar
  • 6,265
1 vote

Can I prevent Tor from building single-hop circuits?

No, you cannot stop Tor from building single-hop circuits. All Tor circuits start out at 1 hop in length. Clearly, to build a circuit any circuit needs to start from the first hop to then negotiate ...
cacahuatl's user avatar
  • 11k
1 vote

Isn't it easy to de-anonymize users this way?

You're missing the middle guard detection difficulty - that's the reason why the minimal and default circuit length is 3 hops, actually. Unless you're running tons of middle nodes and guards - which ...
Alexey Vesnin's user avatar
  • 6,265
1 vote
Accepted

What do you make of the news that researchers had found at least 110 Tor nodes that were spying in on network traffic or were honeypots?

What the researchers were doing was creating "honeypots", the relays weren't "honeypots". The snooping HSDir is something that's long been acknowledged as a weakness in the current rendezvous protocol....
cacahuatl's user avatar
  • 11k
1 vote

How do we find out the identities of online scammer(s) who used TOR?

No. Tor is anonymous network. Everyone who use it is anonymous. But you can prevent this attack from happening in the future. Quoting best answer from Is it possible to block Tor users?: Tor is much ...
NeverMine17's user avatar
1 vote

Can a website read out my MAC address using JavaScript even though I use Tor?

In general this is not possible. This question was previously discussed at StackOverflow (see MAC addresses in JavaScript). Only if you are able to use signed JavaScript it is possible to get more ...
Jens Kubieziel's user avatar
  • 8,570
1 vote

Can JavaScript get my real IP?

yes, the JS itself is capable of making an external requests in a several ways, like simple HTTP GET "some-javascript.php" with a js content type, incorporating the IP address of the HTTP request, to ...
Alexey Vesnin's user avatar
  • 6,265

Only top scored, non community-wiki answers of a minimum length are eligible