1

It's common knowledge that Wi-Fi, or other Internet connections, should be encrypted via a VPN to be secure, and to hide our real IP address from intermediary network observers. However, one can't trust one's VPN provider to be an exit point for all of one's Internet activity, because not all websites support HTTPS, and a VPN provider can observe any of your HTTP transactions. For example, I'm posting this question over HTTP now.

To solve this problem, I purchased my own VPS to run my own VPN. A good start, but there's still a problem.

In China, most of the VPN protocols are blocked. L2TP, OpenVPN, and SSH are recognized, and blocked, by the port or handshake they use, and additionally, some of them are very difficult to set up on a server. So I'd like to try a custom Tor Bridge, because it's very easy to set up, and the Obfsproxy project promises protection against DPI -- so it can't be blocked by Chinese ISPs.

My questions are,

  1. Does Tor really provide VPN security features similar to an OpenVPN connection?
  2. Is it possible to use one server to provide a Tor proxy, or do I need additional servers?
  3. Can I really trust Tor Obfsproxy Bridge? By that I mean, what is the encryption method? Which authentication method is used?

To me, it just looks like a proxy which anyone can use to execute a man-in-the-middle attack, as with PPTP VPNs.

Improve this question

1 Answer 1

Reset to default
3

TOR does not provide security, TOR only provides anonymity.

TOR will help you if your internet connection is being monitored. But your information will exit TOR unencrypted through an exit node. Exit nodes should not be trusted at all. Anyone can run an exit node. There was a security researcher who installed many exit nodes and intercepted a lot o confidential information from people who were using TOR for security like a VPN service. It is better to trust a VPN service than TOR.

Obfsproxy is used to change how TOR traffic looks like. Your network admin or your ISP might be blocking TOR traffic from your computer. You can use Obfsproxy client and server to make TOR traffic look like normal HTTP or Skype traffic and bypass such filters. Obfsproxy provides a new layer of encryption to hide the presence of TOR traffic inside but it has some limitations presented in this threat model: https://gitweb.torproject.org/obfsproxy.git/blob_plain/HEAD:/doc/obfs2/threat-model.txt. You don't need to trust a public Obfsproxy server/bridge because it only proxies your encrypted TOR traffic.

If you use your own Obfsproxy server, you can improve security by adding a shared secret parameter to the command line, so anyone who doesn’t have this secret key won’t be able to use your obfsproxy server or decrypt your traffic:

# screen obfsproxy --log-min-severity=info obfs2 --shared-secret="scretpsword" --dest=VPS_IP:443 server 0.0.0.0:80

$ screen obfsproxy --log-min-severity=info obfs2 --shared-secret="scretpsword" socks 127.0.0.1:9999

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .