2

I was thinking about how safe it really is to use Tor as a "local proxy" to grab information from webpages anonymously. Is it possible that the real IP address can be seen?

On the official Tor homepage they claim:

Tor does not protect all of your computer's Internet traffic when you run it. Tor only protects your applications that are properly configured to send their Internet traffic through Tor. To avoid problems with Tor configuration, we strongly recommend you use the Tor Browser Bundle. It is pre-configured to protect your privacy and anonymity on the web as long as you're browsing with the Tor Browser itself. Almost any other web browser configuration is likely to be unsafe to use with Tor.

The Tor Browser will block browser plugins such as Flash, RealPlayer, Quicktime, and others: they can be manipulated into revealing your IP address. Similarly, we do not recommend installing additional addons or plugins into the Tor Browser, as these may bypass Tor or otherwise harm your anonymity and privacy.

Is this something of concern for me when I run the script below (with Vidalia/Tor enabled)? Would my real IP be revealed if I ran the script on different webpages? The webpage in the code below (my-ip.heroku.com) is very simple and only returns my IP address. But how exposed would I be for example on webpages with browser plugins such as flash, realplayer, quicktime etc.?

import socket
import socks
import http.client

def connectTor():
    socks.setdefaultproxy(socks.PROXY_TYPE_SOCKS5 , "127.0.0.1", 9050, True)
    socket.socket = socks.socksocket

def main():
    connectTor()

    print("Connected to Tor")

    conn = http.client.HTTPConnection("my-ip.heroku.com")
    conn.request("GET", "/")
    response = conn.getresponse()
    print(response.read())

if __name__ == "__main__":
    main()
5

In this case, no it won't leak.

What you're doing in Python here is simply making an HTTP request via a proxy that happens to be Tor's local SOCKS proxy. The response of this request will basically be some text. Regardless of the actual content of this response, your Python "client" will not actually parse the response or user plugins to run certain contents. The HTTP request is passed through Tor and no subsequent requests will happen depending on the response.

So, plugins or not, JavaScript or not, it all won't affect your case. Also, when calling setdefaultproxy(), you're setting rdns to true which will prevent DNS leaks by performing the DNS lookups remotely.

The quote you posted is written in a slightly paranoid language. They obviously don not mean that 100% of the cases your IP will leak if you don't use Tor Browser Bundle. They just mean that it's far more likely that you'll miss something while using your own browser, like that DNS setting, not disabling plugins, and so on.

  • 1
    "They just mean that it's far more likely that you'll miss something while using your own browser, like that DNS setting, not disabling plugins" -- Absolutely! Firefox can be configured to not leak DNS requests, but Chrome cannot and will bypass Tor do do its lookups. Similarly, Adobe Flash (in Firefox) will bypass your proxy for traffic and DNS requests. And god knows what every piece of Javascript you encounter will leak. The Tor people encourage you to use TBB because the stock setup they ship is comfortably secure-- the browser is configured properly and leaky plugins are disabled. – Ivan Jul 27 '16 at 13:24
1

With that particular code the DNS requests will be sent before connecting with socks, so your IP address will be revealed. To solve this you should modify your code like this:

import socks  
import socket

socks.setdefaultproxy(socks.PROXY_TYPE_SOCKS5,'127.0.0.1', 9050, True)  
socket.socket = socks.socksocket  

def getaddrinfo(*args):  
       return [(socket.AF_INET, socket.SOCK_STREAM, 6, '', (args[0], args[1]))]  

socket.getaddrinfo = getaddrinfo  

import http.client  

def main():  
      connectTor()  

...  

The trick is to redefine the DNS queries to pass through TOR before importing httplib. With your previous code try to connect to an onion site and you will get a DNS error because normal DNS can't resolve onion hosts.

0

When worried about Tor leaks, there is a simple way to get a good baseline going:

  1. Get connected to the Internet.

  2. Get a mature Tor proxy (opt w/ HTTP cleaner like Privoxy) going and ensure it works by loading a page through it that shows location/IP.

  3. Set your firewall to redirect all traffic from your app (or whole system) to Tor proxy and vice versa.

Bam. Now, you get the benefits of Tor without designing an app specifically for it. Just make sure none of the data it sends out is identifying b/c the protection ends at the exit nodes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.