14

Normally the Tor service should be started/stopped with either: sudo systemctl start/stop tor.service Or: sudo service tor start/stop Personally I've always used the service command because it is simpler. I'm guessing things get a little more complicated when you run multiple Tor instances, but I have no experience with that. Running Tor in a terminal runs ...


13

"...Windows is full of key-loggers, Trojans and..." is a bit overblown. In general, the chances of a Windows box being infected with malware are higher than a Linux box. Mainly because Windows is a very popular target. Since Windows is closed source, as opposed to Linux which is open source, you (the user/consumer) can not tell what key-logging, screen-...


9

Using the HTML Canvas a malicious website can perform various tests to learn a large array of information, in relation to graphics, which can be used to fingerprint users. Tor Project design docs (under 4.6, section 2. HTML5 Canvas Image Extraction) After plugins and plugin-provided information, we believe that the HTML5 Canvas is the single largest ...


9

There's one important fact that makes such an attack extremely difficult. A connection between a Tor client and a Tor hidden service is actually composed of two entirely separate circuits that both connect to a rendezvous point. One circuit is set up by the client, the other by the server. Therefore, the client doesn't know which relays the data uses on ...


8

When running an exit node, it is highly recommended to make it as clear as possible that it is an exit node. This helps the operator deal with DMCA notifications and abuse reports and the like. Further more, it is impossible for any relay, exit or non-exit, to hide the fact that they are a relay. The list of all relays and their flags is publicly available....


7

Tor does not have a concept of exit nodes that only you can use. The routing protocol allows for it, but there is no support in Tor or its directory layer for what you ask.


6

Interesting discussion points thus far. Use VMs as discussed. I prefer VMware because of the networking, cloning, console access, replication, etc. No need for an OSS hypervisor discussion. These VMs need to be online, replicating, and failing over with zero issues and for use by any person who is involved in the enterprise. Your VMs are on ...


6

As highlighted on the Tor Project's homepage, Tor's objective is: Anonymity Online. Protect your privacy. Defend yourself against network surveillance and traffic analysis. To that end there are many developers, journalists, hackers, cryptographers, activists, government agents and more constantly evaluating Tor's effectiveness from both theoretical and ...


6

I would say advantages of ECC are: Performance—see Curve25519 performance on linked page More analysis—this is debatable, but I would say ECC is better understood in the crypto community than lattices. Spotty history of NTRU, which had to be revised several times, IIRC, based on cryptanalytic attacks. I think there might also be patent issues around NTRU, ...


6

Do the following steps one by one: Click on the Bookmarks icon (the clipboard icon not the star icon) next to the location bar Select Show all Bookmarks Click on Import and Backup menu in the new window Select Restore Click on Choose file from the submenu, and select the file where you previously exported your bookmarks to. You are done.


6

Your "source" at the "CIA" (i.e. your "friend" with the tinfoil hat (i.e. you)) is wrong. It was created by the US Naval Research Lab, some of whom are still active within the community. It's not secret information. This is noted in the Tor Project's FAQ and even in the US Naval Research Lab's Wikipedia entry.


6

Any captcha system can be broken by paying people. The captcha has been attacked in the past by a nationstate adversary. The captcha isn't critical to the security of Tor, it does present problems for censorship circumvention. Breaking it would net you a subset of the bridges on bridgedb, it is partitioned so that a break on any one of the distribution ...


5

Yes. Tor acts as a filter in a way, encrypting and pumping into the tor network any communications sent through its proxy port of 127.0.0.1:9150. Any browser using this port correctly will have its connection torified, and check.torproject.org will show a green onion if the browser is configured correctly. Warning: Tor will only torify connections sent to ...


5

Answer: Tails. https://tails.boum.org/ Even though Tails is without doubt the most secure OS you can get for Tor, it may not be suitable for you in every senario. One reason is because it is a live system, not an installed system. If you want an installed system, most larger Linux distributions is probably also safe (e.g. Debian, Fedora). The exception is ...


5

One possible solution is to disable the offending cipher by visiting about:config and setting the ciphers you don't want to false. Something like: security.ssl3.rsa_fips_des_ede3_sha false You could also improve your security by allowing TLS1.1 and 1.2 which are disabled by default in Firefox: security.tls.version.max 3 See my blog post ...


5

If you use Tails, then if they've installed software, it won't run while you use Tails. If you download Tails using a different computer, they won't know you downloaded it at all. You can also use a live OS like Ubuntu and keep the Tor Browser Bundle on a USB disk. As long as you avoid the OS that the tracking program is installed on, you're okay. As for ...


5

Making a movie available via BitTorrent is fine. But using Tor, either for seeding or recommended for downloading, is unwise. It's hard to properly configure torrent clients to use Tor without leaking, so recommending that people download via Tor would put them at risk. And even if torrent clients are properly configured, they would be stealing bandwidth ...


5

As far as I see it, the package file brings its own version of the Tor Browser Bundle. So if you want to make sure that someone didn't change anything you'd have to check the integrity for yourself. If you don't do this the maintainer can inject arbitrary code into his TBB version. A better way would be to download the TBB archive directly from torproject....


5

You can tell that they use Tor, but not what they do on Tor. Not from sniffing the network alone. If you own the machines they use, you could install software on it that tells you what they do, regardless of Tor. This is not something I would recommend you do without telling your kids/employees! At the end of the day, Tor was designed against you.


5

What encryption algorithms does Tor use? See the following sections of the Tor Protocol Specification: 0.2 Security parameters 0.3 Ciphers Isn't RSA 1024 considered weak? 1024 hasn't been broken (yet... ), and you'd find moving to anything bigger makes things generally slower. There's a useful discussion in this old thread. With regards to rolling ...


5

This setup may, or may not, be completely anonymous, depending on a whole bunch of factors, some extremely subtle. Adding a VPN to Tor basically never improves anonymity, though. Exactly how someone would trace you back to your real IP is in many cases more about how you use Tor, than Tor itself.


4

As I understand, when I have a private RSA key and I send this private key to a Tor host and he runs it, I should be able somehow to get his real IP address using this RSA key, isn't that right? No. The hidden service key is just used for signing stuff. It won't let you decrypt any special information. If the provider has the private key, it just means ...


4

This is from the Tor FAQ at https://www.torproject.org/docs/faq#KeyManagement . There is much more, but I think this snippet, especially the last bit, is what you're looking for: How do clients know what the relays are, and how do they know that they have the right keys for them? Each relay has a long-term public signing key called the "...


4

(not a full answer, but relevant) ICANN published the study Name Collision in the DNS (PDF, 3.3 MB): A study of the likelihood and potential consequences of collision between new public gTLD labels and existing private uses of the same strings


4

It's definitively considered a bad practice, for a number of reasons: Possible legal repercussions (personally I doubt this holds up, unless you actively target for and process personally identifiable information). The obvious privacy/ethical questions raised. Tor does not like it and will penalize you if caught modifying exit data. HOWEVER Possible legal ...


4

Since mirimir already mentioned running tor and webserver on seperate computers, I will mention that Whonix is a great Debian-based GNU/Linux build for anonymity of users and servers. Also, having a LUKS (or like whole disk encryption Free And Open Sourced software) encrypted server will be a good idea (unless you use predecessors of DDR3, which is ...


4

It's particularly not surprising to see different exit IPs for different protocols. This previous question of mine discusses this partially. Essentially each connection to the net looks for a circuit that supports that protocol. If there's an circuit already waiting with that port open (and it's less than 10 minutes old) then Tor will re-use that. If not ...


Only top voted, non community-wiki answers of a minimum length are eligible