Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was thinking about how safe it really is to use Tor as a "local proxy" to grab information from webpages anonymously. Is it possible that the real IP address can be seen?

On the official Tor homepage they claim:

Tor does not protect all of your computer's Internet traffic when you run it. Tor only protects your applications that are properly configured to send their Internet traffic through Tor. To avoid problems with Tor configuration, we strongly recommend you use the Tor Browser Bundle. It is pre-configured to protect your privacy and anonymity on the web as long as you're browsing with the Tor Browser itself. Almost any other web browser configuration is likely to be unsafe to use with Tor.

The Tor Browser will block browser plugins such as Flash, RealPlayer, Quicktime, and others: they can be manipulated into revealing your IP address. Similarly, we do not recommend installing additional addons or plugins into the Tor Browser, as these may bypass Tor or otherwise harm your anonymity and privacy.

Is this something of concern for me when I run the script below (with Vidalia/Tor enabled)? Would my real IP be revealed if I ran the script on different webpages? The webpage in the code below (my-ip.heroku.com) is very simple and only returns my IP address. But how exposed would I be for example on webpages with browser plugins such as flash, realplayer, quicktime etc.?

import socket
import socks
import http.client

def connectTor():
    socks.setdefaultproxy(socks.PROXY_TYPE_SOCKS5 , "127.0.0.1", 9050, True)
    socket.socket = socks.socksocket

def main():
    connectTor()

    print("Connected to Tor")

    conn = http.client.HTTPConnection("my-ip.heroku.com")
    conn.request("GET", "/")
    response = conn.getresponse()
    print(response.read())

if __name__ == "__main__":
    main()
share|improve this question
    
First it would be a good idea to actually make sure your script makes its requests via Tor. Load up check.torproject.org instead of my-ip.heroku.com. –  Michael Hampton Aug 10 '13 at 23:06
    
Check out stem.torproject.org –  nitrl Aug 10 '13 at 23:36
1  
if unsure on your script, use proxychains –  that guy from over there Aug 12 '13 at 6:26

2 Answers 2

In this case, no it won't leak.

What you're doing in Python here is simply making an HTTP request via a proxy that happens to be Tor's local SOCKS proxy. The response of this request will basically be some text. Regardless of the actual content of this response, your Python "client" will not actually parse the response or user plugins to run certain contents. The HTTP request is passed through Tor and no subsequent requests will happen depending on the response.

So, plugins or not, JavaScript or not, it all won't affect your case. Also, when calling setdefaultproxy(), you're setting rdns to true which will prevent DNS leaks by performing the DNS lookups remotely.

The quote you posted is written in a slightly paranoid language. They obviously don not mean that 100% of the cases your IP will leak if you don't use Tor Browser Bundle. They just mean that it's far more likely that you'll miss something while using your own browser, like that DNS setting, not disabling plugins, and so on.

share|improve this answer

When worried about Tor leaks, there is a simple way to get a good baseline going:

  1. Get connected to the Internet.

  2. Get a mature Tor proxy (opt w/ HTTP cleaner like Privoxy) going and ensure it works by loading a page through it that shows location/IP.

  3. Set your firewall to redirect all traffic from your app (or whole system) to Tor proxy and vice versa.

Bam. Now, you get the benefits of Tor without designing an app specifically for it. Just make sure none of the data it sends out is identifying b/c the protection ends at the exit nodes.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.