8

Except for reading through all of the plugin's or the extension's source code, there is unfortunately no way to make sure it is safe. And some believed-to-be-safe extensions like AdBlock Plus will still reduce your anonymity somewhat compared to other Tor users, by creating a more unique network fingerprint ("this user is the one that doesn't download the ...


6

Based on the case reports they were able to trace the SR to him. That does not mean that he was initially found out because of a tor compromise. If such a compromise existed, they would have had to create a parallel construction to hide the fact the compromise existed, which would had been trival once they found their target. Yes, he may have gotten sloppy, ...


6

The short answer is no. Basically, Tor is susceptible to timing correlation attacks, where someone who is observing the connection going from your client (OP) to the Tor network and also the connection from the Tor network to your destination can tell with fairly high certainty that they are the same connection. Note that you would need to correlate data ...


6

No, this approach will not work that simply. First of all, you've got your targeted user(s). Bob and Alice. You assume the role of Eve (a passive adversary, who can only observe). You know Bob is talking to someone over Tor and you want to discover who. So you hoodwink a confused deputy (this is a polite way of saying "lie to a judge") to get Bob's internet ...


6

No, .onion's are not exempt from DNS leaks. Since it's possible for people to run local DNS gTLDs, DNS infrastructure will generally respect and dutifully perform lookups for invalid domain names. DNS itself is agnostic to the gTLD being valid or not, with a few exceptions (for example .invalid should always fail). There is an RFC covering .onion which ...


5

No, not with TBB. TBB is based on Firefox ESR which doesn't use OpenSSL but NSS to do SSL/TLS. Other software that uses a vulnerable Version of OpenSSL could be exploited by a malicious server.


5

Windows 10 has a keylogger embedded, thus all the words, codes, psws that user insert using keyboard could be sent to Windows Servers and to authorities per request. Does it mean we should use "on screen" keyboard or other alternative input (speech) while using Tor? Unfortunately, Windows 10 has camera-logger embedded as well as microphone-logger embedded ...


4

As I understand, when I have a private RSA key and I send this private key to a Tor host and he runs it, I should be able somehow to get his real IP address using this RSA key, isn't that right? No. The hidden service key is just used for signing stuff. It won't let you decrypt any special information. If the provider has the private key, it just means ...


4

Youtube does a lot of crazy stuff. It is not your normal HMTL5 video tag, there was actually some beta feature where you can try to ask google to send you only with Ogg+Theora, but then many of the videos show up as unavailable. If you look at the video tag itself http://w3schools.com/tags/tag_video.asp You will notice that the tag provides the dimentions, ...


4

All of those are already dealt with, with the exception of AudioContext which may get a similar treatment as canvas fingerprinting has. See ticket #13017. Update: Tor Browser 7.0 disabled AudioContext fingerprinting by setting the new dom.webaudio.enabled option to false as a stop-gap measure, so this vector is also no longer fingerprintable by default. ...


3

It's becoming more and more a necessity to use Tor on mobile devices, so yes it makes sense. Even though there are lots of privacy-anonymity risks with doing so, people could develop solutions over time as more people start using Tor on Android. You must be very careful and informed about how Android works, what is being sent to internet, etc. My best ...


3

@Jens's answer has a great description of current Tor. The Tor-Browser adds some additional defenses, namely: it enables HTTP pipelining, so that several requests can be sent on the same "batch" it reorders the packets in that batch and randomly sets its size


2

Short answer: Because a VPN account degrades your anonymity to pseudonymity. Long answer: All your VPN traffic is tied to a single VPN account. If one "anonymous" post (or page view) can be linked to another "anonymous" post (or page view) as coming from the same user... the anonymity is no more, even if your IP is still unknown. Instead of telling the VPN ...


2

First of all: As far as i know, if you do not compromise the Entry-Relay (Guard), you can not locate the client. So being said, the third case does not result in client de-anonymization. For the other two cases, in which you have compromised the entry-relay, you will be able to locate the client. To be a little more specific: Before there were Entry-Guard ...


2

An attacker has several methods to find out that you're using Tor. If you use plain Tor without bridges or other circumvention technology than the IP addresses are known to the world. An attacker just compares the IP addresses you're connecting to with those known Tor IP addresses. If you're connecting to one of those there is a good chance that you're ...


2

What you say is true. This attack exists. If all the nodes are controlled by an attacker such an attack works. However Tor is designed to make it somewhat hard for one attacker to control all the nodes and really target and individual users. It also explains why your client chooses and keeps an entry guard. Entry guards, entry points, so the first hops is ...


2

Theoretically - YES, if it will be a way to make a hardware listing query like lsusb -v


2

I think I can answer the first two paragraphs. I think because the entry guard node knows where a Tor user is from (compromising anonymity) and the exit node knows what that user is looking at (compromising privacy) and thus, it give the clearer overall picture to the attacker if they have control of these two points. I don't think its as useful to analyze ...


2

You do not have a 'best option' here the way you describe it. However - playing it over tor makes sure your real IP stays hidden. The exit node does not get to know your IP, but as you say - the exit node, and/or VPN provider - can log the traffic itself. It would be a better if the role-playing game had secure connection enabled. The same issue is there ...


2

The article is mostly wrong headed, at least in how the article presents it. tl;dr - Tor Browser does a great job of making you anonymous against passive observers, it lacks against active exploitation. You should use Tor Browser but also look to isolate and/or sandbox Tor Browser. Tor Browser doesn't currently have any publicly known vulnerabilities, that ...


2

Packets won't carry your local time information, application data will though. You probably want to make your timezone UTC since this is the most "generic" timezone and the easiest to calculate your own local time from (since timezones are measured as offsets from UTC). Random timezones are probably counter productive, because some timezones will have ...


2

Yes, currently HSDirs can see the looked up .onion hostname. This does not include the full URL but just the .onion hostname. Proposal 224 (ticket #12424) will fix this issue. See also #8106. If you want to make the page accessible to your friends only the HiddenServiceAuthorizeClient option might be something that could interest you.


2

Whonix is what you want. The Workstation VM can "see" only IP addresses on the Internal LAN, which are the same in every Whonix installation. User applications therefore have no knowledge of the user's "real" IP address, nor do they have access to any information about the physical hardware. In order to obtain such information, an application ...


2

There is no direct problem in connecting to Tor from the connection that you also use to perform other activities, assuming that it is safe for you to use Tor in the first place (I.E. that it's not illegal for you to use Tor in the first place). Infact the more people who can openly use Tor, the safer that it will be to use Tor since it's use will lose ...


2

When you go to the place with the open wifi, you should additionally check if the place is physically secure. This means no cameras, no people who could shoulder-surf etc. Furthermore if you connect with your own hardware to that WIfi, keep in mind that you leave some information (MAC address etc.). So using other hardware might be a good thing. VPN is not ...


2

Is there a risk the server can learn the connection between Alice and Bob without clearing the state of the rendezvous client? If so, then how much of this risk is? Yes. It could be possible for an onion service to create an oracle that would allow it to link Alice and Bob if they're simply using Stream Isolation copared to if their connections were re-made ...


1

Serving your site through a Tor hidden service will indeed prevent the general public to learn your identity through technological means. But as you said that you would operate legally, I would worry as much, if not more, about the threat posed by conventional private investigators. Because they won't even care about how is served your site, they will hunt ...


Only top voted, non community-wiki answers of a minimum length are eligible