weasel - Peter Palfrader
  • Member for 8 years, 3 months
  • Last seen more than 2 years ago
How does Tor route DNS requests?
Accepted answer
58 votes

Tor clients do not, in general, directly do DNS requests. When you open a connection through the tor network you usually ask your client (on its socks ports) to connect you to a hostname and port, ...

View answer
For how long does a circuit stay alive?
Accepted answer
27 votes

The Tor FAQ also tries to answer this, but here's my attempt : Circuits get created on start-up and whenever Tor thinks it might need more in the future or right now. Once a circuits is actually ...

View answer
How to run Tor on Raspbian on the Raspberry Pi?
Accepted answer
23 votes

The issue The packages we build for deb.tpo are compiled for various Debian and Ubuntu architectures. These currently are amd64, i386 (x86-64 and x86), and two arm ports: armel and armhf. Arm CPUs ...

View answer
.onion Domains DNS lookup
Accepted answer
18 votes

It doesn't resolve them in the common sense - there is no DNS involved at all. It looks up their introduction point on the hidden service directories - see Is it possible to look up the public key ...

View answer
Is it possible to look up the public key for a .onion-address?
Accepted answer
17 votes

In theory, it should be just a matter of fetching /tor/rendezvous2/<hidden service identity> via HTTP from the hidden service directory responsible for that hidden service, as per the rend spec, ...

View answer
What specifically causes an Exit to get a Bad Exit flag?
Accepted answer
12 votes

Usually it implies that they are breaking stuff, either maliciously or through misconfiguration. The most common misconfiguration I have seen is using OpenDNS as a host's nameserver with what I think ...

View answer
When does a relay get the Named flag?
Accepted answer
9 votes

It used to be manually assigned by the authority operators, but a couple of years ago I wrote a set of scripts to vote on Named automatically. We have documented their behavior in dir-spec: Newer ...

View answer
Why does Tor use three hops, instead of two?
Accepted answer
9 votes

Maybe think of it as a defense in depth idea. If you only have two hops, and your adversary owns or watched your exit node, they immediately know which other node to compromise to get you. That ...

View answer
Freenet distributed hosting model: Could it be ported to Tor?
9 votes

Tor isn't a content-storage system. Tor is an anonymous communications system. As such, it facilitates communication, not storage. Even hidden services are about communication. They allow you to ...

View answer
When I click "New Identity", why do I sometimes end up with the same exit relay?
Accepted answer
9 votes

Nodes in circuits are chosen randomly. (Selection is weighted by a way-too-complex function of capacity, roles, etc, but it's still a random selection.) Sometimes, two random choices will actually ...

View answer
How to use Tor behind a http-only proxy?
Accepted answer
9 votes

If your proxy cannot do CONNECT, you lose. Sorry. Most proxies actually do connect - else how would you visit gmail or anything else doing https - but they only do it for https on port 443. If your ...

View answer
How to use Hidden Service Authentication?
Accepted answer
8 votes

According to the manual, there are two configuration options (i.e. things you put in your torrc): HidServAuth is what can be used on the client. It allows you to provide authentication cookies for ...

View answer
What is the difference between NTor and TAP?
Accepted answer
8 votes

TAP is the original Tor Authentication Protocol, the one described in the original Tor paper (html). A security proof was later done by Goldberg at PET2006 and I think this is where the name of the ...

View answer
How much does it cost to change Tor identity?
8 votes

Setting up circuits is very expensive. It involves several round trips, and it involves lots of public/private key operations for the servers. Continually creating new circuits at a high frequency ...

View answer
Why are there only 1000 exit relays?
8 votes

Having only a thousand exit relays does not harm your anonymity directly. If there were only a thousand users, then that would be a problem. But there aren't. There are many thousands of users, and ...

View answer
Can I mix country name and nickname in ExcludeNodes line?
8 votes

Yes, you can mix them. The example in the manpage even has that: ExcludeNodes SlowServer, ABCD1234CDEF5678ABCD1234CDEF5678ABCD1234, {cc}, 255.254.0.0/8

View answer
Why is a longer guard rotation period with fewer guards better than the other way around?
Accepted answer
8 votes

The short version is that when your adversary owns your first and your last hop you lose. Assume you have an adversary that controls a couple of nodes. You change your last hop all the time. If you ...

View answer
How to create a private exit node?
7 votes

Tor does not have a concept of exit nodes that only you can use. The routing protocol allows for it, but there is no support in Tor or its directory layer for what you ask.

View answer
Would Tor work if it became very large?
6 votes

Caveat: not a complete answer, but still a start: There probably is a limit, given Tor's current design. For instance, right now it's assumed that every relay can and does talk directly to every ...

View answer
What does Tor do with streams?
Accepted answer
6 votes

Tor puts many streams onto a single circuit. If possible, the same circuit is used for up to 10 minutes -- see For how long does a circuit stay alive? for some details. Accordingly, if you visit a ...

View answer
Are virtual servers like Tor Cloud less advisable?
Accepted answer
6 votes

Yes, in a sense they are less secure since it's probably trivial, given sufficient access, to copy the system. Real hardware requires physical access and is, perhaps, easier to detect: an extended ...

View answer
How can Tor use a one hop circuit to a directory server during initial bootstrap?
Accepted answer
6 votes

Tor ships with a list of directory authorities and some information about them. In particular, this information includes for each authority its IP address, onion port and onion key fingerprint. This ...

View answer
The ReachableAddresses version of FascistFirewall
Accepted answer
6 votes

I don't think there are any plans to deprecate FascistFirewall. At least the manpage does not say it is, unlike FirewallPorts. And yes, that's exactly the equivalent if you haven't also set ...

View answer
Can ReachableAddresses be on separate lines?
Accepted answer
6 votes

Yes, it can be multiple lines. The config option is a LINELIST type, just like ExitPolicy.

View answer
What are cannibalized circuits and how Tor make use of them?
Accepted answer
5 votes

Tor often builds circuits well in advance of actually needing them. This speeds up various operations since building circuits are quite expensive and time consuming. Circuits it has build are ...

View answer
Why was my relay given the Guard flag only for it to be removed an hour+ later?
5 votes

Each authority votes on what they think the proper flags are for your relay. Currently it seems 5 think angrykitteh should have the Guard flag, and 4 think it shouldn't yet. Depeding on which ...

View answer
How many preemptively built circuits?
Accepted answer
5 votes

It's complicated. There are many reasons Tor builds circuits preemtively: access hidden services, provide them, exit to any ports that you may want to use (based on recent behavior) and also ...

View answer
Is there an archive of deb.torproject.org?
Accepted answer
5 votes

No, there is no snapshot service for deb.tpo. archive.tpo has some old .debs but it is not updated regularly, and thus not current. All source versions can be found in git though - the are properly ...

View answer
Does those ExitPolicy make my relay a Tor non-exit relay?
Accepted answer
5 votes

The proper configuration line for a non-exit relay is ExitPolicy reject *:* Since that's what you're using, you should be fine.

View answer
Why aren't pluggable transports default?
Accepted answer
5 votes

To connect using Pluggable Transports as a client, you need to know about at least one bridge relay that offers this particular pluggable transport. This list of bridges is not public, because that ...

View answer