Skip to main content
Share Your Experience: Take the 2024 Developer Survey
15 votes

How to properly start tor service

Normally the Tor service should be started/stopped with either: sudo systemctl start/stop tor.service Or: sudo service tor start/stop Personally I've always used the service command because it is ...
SuperSluether's user avatar
9 votes
Accepted

Does Tor latency leak location information?

There's one important fact that makes such an attack extremely difficult. A connection between a Tor client and a Tor hidden service is actually composed of two entirely separate circuits that both ...
Ben N's user avatar
  • 429
6 votes

TOR Anonymity Query

Your "source" at the "CIA" (i.e. your "friend" with the tinfoil hat (i.e. you)) is wrong. It was created by the US Naval Research Lab, some of whom are still active within the community. It's not ...
cacahuatl's user avatar
  • 11k
6 votes

Security of Tor bridges and Captcha

Any captcha system can be broken by paying people. The captcha has been attacked in the past by a nationstate adversary. The captcha isn't critical to the security of Tor, it does present problems ...
cacahuatl's user avatar
  • 11k
5 votes
Accepted

Is Tor completely anonymous?

This setup may, or may not, be completely anonymous, depending on a whole bunch of factors, some extremely subtle. Adding a VPN to Tor basically never improves anonymity, though. Exactly how someone ...
womble's user avatar
  • 562
4 votes
Accepted

Why does Tails use an insecure memory wiping process

Tails uses sdmem from the secure-delete package to overwrite RAM on shutdown, see https://tails.boum.org/contribute/design/memory_erasure/ for details. According to that page, "memory is only ...
Pintar's user avatar
  • 56
4 votes

Is a server's response to a Tor browser query encrypted by the Tor nodes when it transits the Tor circuit in the reverse direction?

If a Tor browser makes a request of a server on the Internet, it will be encrypted several times by the Tor browser before it leaves the client. Correct. Once for each Tor relay, which is a ...
Richard Horrocks's user avatar
4 votes
Accepted

Why do Tor hidden service operators bother with SSL/TLS encryption?

It has it's uses, of course! At least: Integrity you know, that your server is responsible for cipher strength, and a potential malicious node in a chain will have some trouble-time due to that fact ...
Alexey Vesnin's user avatar
  • 6,225
4 votes
Accepted

Is it safe to use Tor with Malwarebytes Anti-Exploit?

Alright this was going to be a comment but no one has really addressed this and it's a pet peeve of mine, so... Generally speaking anti-virus protects you from known threats, they provide signature ...
cacahuatl's user avatar
  • 11k
4 votes

Routing Bittorrent through a Tor relay...

my thinking is that having all this Tor relay traffic co-mingling with the BitTorrent traffic would make any sort of traffic analysis of my Internet much more complicated. Not in any meaningful way, ...
cacahuatl's user avatar
  • 11k
4 votes
Accepted

Has my Facebook Account been hacked when using Tor?

You probably logged into your Facebook account over Tor. Facebook sees you exiting the Tor network in Portugal, or what it thinks is Portugal and so it flagged up your own login attempt as suspicious....
cacahuatl's user avatar
  • 11k
3 votes

Security implications of running tails in Virtual machine

This one irks me, especially when the "VMs are magic" crowd provide answers like: If you are using your own computer, it is probably safe. As the documentation states there are limitations. The "...
cacahuatl's user avatar
  • 11k
3 votes

Does tails work with Mini free Laptops

From looking at the pictures on their website, Minifree laptops appear to be old, re-branded Lenovo T400 and X200 Thinkpads. If we ignore the fact that they're selling old, presumably ex-business ...
Richard Horrocks's user avatar
3 votes

What would happen when multiple servers are having the same onion hostname?

It depends on the exponent, if the people will use the same exponent - yes, they will have an identical keys. And - as far as I know - as soon you publish your HS descriptor, no descriptor with the ...
Alexey Vesnin's user avatar
  • 6,225
3 votes

Serious TCP Bug in Linux Systems?

What we can do to protect ourselves as VPN/Tor users? Note that the attack itself is targeted at the service, not the client (I.E. tor relay, not the tor client) so there isn't much you can do. If ...
cacahuatl's user avatar
  • 11k
3 votes
Accepted

Tails and OnionShare

The threats are completely different. Tor Browser has a much larger attack surface (it has far more features and functionality that could go wrong) and it's not written in an memory safe language (if ...
cacahuatl's user avatar
  • 11k
3 votes

Extra security for private forum posts

No, Tor would not help. What you are suggesting is 100% impossible.
cacahuatl's user avatar
  • 11k
3 votes

Does facebook's hidden service url mean that collisions are feasible?

No, and yes. Facebook, hidden services, and https certs had talked on this. Facebook in fact brute forced only the first 40 bits and then made a backronym. Their hidden service name is "...
nobody's user avatar
  • 725
3 votes

Is Tor network traceable

Tor connections are in general secure. However for a global adversary it would be possible to trace a Tor connection back to a user. It is not known whether such a global adversary exists or if ...
bn4t's user avatar
  • 446
3 votes
Accepted

How did the FBI find the IP address of the Freedom Hosting servers?

According to this FAQ from the EFF, Freedom Host had a publicly visible IP address that allowed the FBI to physically seize their server: In December 2014, the FBI received a tip from a foreign law ...
sfmiller940's user avatar
3 votes
Accepted

Should I first stop all local servers running on localhost before starting Tor?

Unless you edit your tor configuration (your torrc file) to add an onion service, tor won't run any onion services and no one will be able to connect to any of your local servers, so you're safe. Even ...
Steve's user avatar
  • 3,142
3 votes
Accepted

Why doesn't Tor browser block HTTP by default?

It's not enabled by default because it would block a significant fraction of the Internet for users. Blocking HTTP-only traffic will likely come in the future once Tor Browser is using a version of ...
Steve's user avatar
  • 3,142
2 votes

How to easily verify certificates on .onion versions of clearnet sites?

[waves] Facebook-over-Tor-geek here. It's a toughie, the cleanest thing is to use the same SSL certificate in your clearnet and onion sites, but this only will work if you can use EV certificates on ...
Alec Muffett's user avatar
2 votes

When logging into Facebook with Tor: "Your computer needs to be cleaned"

Edit: It's possible to use any TCP-based application that supports SOCKS proxying through Tor. That doesn't mean you should. It's not possible to use a different browser with Tor. The Tor Browser is ...
Richard Horrocks's user avatar
2 votes

Latest scandals about Tor

No technology is 100% secure, and the FBI and Carnegie Mellon University are not 100% capable. A smart Tor user who configures and uses Tor properly can remain anonymous. The FBI and other parties are ...
GruentleBarrk's user avatar
2 votes

Possibility with malicious endnode, SSL Strip?

Tor only protects the traffic up to the exit node. If there is some man in the middle at the exit node or after the exit node then he can intercept and modify the traffic. Since https is end-to-end ...
Steffen Ullrich's user avatar
2 votes

Adding a blacklist for known scam sites?

Replace "onion site" with "clearnet site" - your description of the threats and attack vectors could equally apply to both. The same personal security practices and behaviours should therefore be ...
Richard Horrocks's user avatar
2 votes

Anonymity on TOR : DisconnectMe versus DuckDuckGo

The answer is "Whichever you prefer". You should not blindly trust in privacy policies and promises of not recording IPs. These promises are what is known as "Privacy-by-Policy", that is to say: they ...
cacahuatl's user avatar
  • 11k
2 votes

What are the differences between security levels?

If you hover over the names of the various security levels on the Privacy and Security Settings it should provide a brief synopsis of the various things that they each do. For a more detailed view ...
cacahuatl's user avatar
  • 11k

Only top scored, non community-wiki answers of a minimum length are eligible