The Stack Overflow podcast is back! Listen to an interview with our new CEO.
16

Yes. There are two ways to recognize Tor users. The first way is through their IP address -- the list of Tor relays is public, so you can check whether the user is coming from a known Tor relay. It's actually a little bit trickier than that though, first because every Tor relay has an exit policy (so only some relays will allow users to reach your site), ...


4

"Why would I want to set this field?" Because you're a good relay operator and therefor you don't "know" your relays are "clean" with certainty [sufficiently advanced stupidity is indistinguishable from malice...] Even if you were arrogant enough to believe that they were "clean" [absence of evidence in not evidence of absence]: The more relays that are ...


3

Yes, sessions still work, and no, users won't be logged in all the same. Website sessions are stored client-side, so every client will have a unique session.


3

Try curl -v icanhazip.com and play with --connect-timeout --max-time --retry-max-time. +


3

Think about this instead from the perspective of the Tor Project. Say you're a dev and you notice that a bunch of nodes that appear to be operated by the same person, but they aren't grouped together in a family. It's possible this is an accident, but it should also throw up a red flag for you because it may be an intentional ploy to deanonymize users - so ...


3

Follow the guide in Tor wiki for 'Transparently Doing DNS and Routing for .onion Traffic' here: https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy substitute the Ip in the guide with your own local IP. I've been using it many times on Debian and ubuntu to route all traffic on the machine through tor, works great.


3

Check this Blog Torproject New Tor Denial of Service Attacks and Defenses


3

The list of Tor relays is public and can be accessed via different means. So you can basically check if the current connecting client is listed as relay or not. This gives you a first, good approximation. However someone can run a relay and use this computer for everyday web surfing which is not routed through Tor. In this case the above mentioned check ...


2

Should be fine. You're just affecting connections originating at your own machine. Whether it is safe to use drupal's autoupdater at all is something you have to ask yourself, of course.


2

Depends what you're doing. In practice, very little, especially if it is a low-traffic static web site. I've run low-traffic static sites on a Raspberry Pi before.


2

Based on mirimir's comment, To install Tor as a service, you can simply run: tor --service install


2

My company is looking to use Tor internally for our network, using our own directory authority server, and would like to know if it's possible and how to do it First of all, if your company have the ability to monitor all trafic, then your Tor network becomes useless, since it's going to be really easy to tell who is doing what. But if your company can't ...


1

So far it seems that all exit note-to-server connections are communicated in plaintext. They're communicated as they're sent, I.E. Tor doesn't add or remove any encryption that was already applied to the application traffic. If it was using HTTPS and was encrypted to the service before entering the Tor network, it will leave the Tor network still encrypted. ...


1

The short answer "you can't", the description is: after sending a termination signal - it's wise to let the network find another chains, so that's why there's a delay in order, and there's absolutely nothing wrong with it. To reduce the delay - it does not works all the times - you can set via ControlPort "DisableNetwork 1" and give Tor 5-10 seconds, then ...


1

Yes, it's sad that it's not in the logs, but it is buried deep in the protocol mechanics. A brief guess is coming out of the EnforceDistinctSubnets directive description. To fix the case when you have just a single address use a VPN with unlimited traffic and static IP address like this - as far as I remember they used to provide a static address with ...


1

No tweaks you've mentioned in your question are necessery - leave them as it is: DOS point of attack here is not the webserver, but the tor instance itself: tor has a single-core crypto. So you need a 2+ core dedicated box for it with maximum core speed, a CPU overclock+overcool can be used too, for now. Even with my patches(I'll release them a bit later) it ...


1

I believe tor-ramdisk or Torride to be what you are looking for.


1

If they're only looking at your network traffic then they would know you are using Tor. They wouldn't be able to know what your traffic contained or where it was sent to or received from but they could estimate how much traffic you've sent and received and when. This all depends on you owning the hardware and operating system that Tor Browser is running on....


1

Tor won't prohibit them from having their intentions, but it will disarm a lot of their tools and approaches : they will simply be unable to circumvert your traffic in many ways and using certain methods. The exceptions you're concerned about do not exist, but if in your locality will be more people using Tor - a Tor network will work for all of you a bit ...


1

you must migrate your whole DataDirectory - the one you've specified in your torrc. after that you're pointing your new-hosted Tor to the same directory and config - and that's it! You can change a filesystem path of the dir, of course - just don't forget to reflect it in your torrc before running tor.


1

Removing the reverse DNS doesn't matter because what the DNS used to be is sitting around in, for example the Rapid7 Sonar scans. They regularly scan the entire IPv4 address space's PTR records and publish the results. Your link to that server is baked into the internet and it will not go away. Yes you will be linked by your payment data and following money ...


1

No, it's not, because he can't decipher your Tor connections on firewall. However it does not prevents him from installing spyware on enpoint machines "to trace things down". But you can be safely ensured that there's NO trace possible on firewall logs alone: your browsing history from properly configured Tor can not be there.


1

in the directions on their site they tell you to click the link on this page (https://cloud.torproject.org/#get_started) to the correct AMI images (us-east-1-virginia)... this is a ubuntu with the tor config stuff already to go (Tor-Cloud-EC2--us-east-1-04-13-2013-20616 - ami-4a7c1a23) as far as your last question it is not so much on trust or encryption ...


1

Those are your entry guards. You can verify that by looking them up in Atlas. The processes all have the Tor PID because they're all Tor related :)


Only top voted, non community-wiki answers of a minimum length are eligible