3

I've been considering proxying all web traffic on my network transparently through Tor and dividing up my bandwidth to share with the rest of the Tor network.

Practically speaking, what are some of the reasons why one shouldn't do this? Obviously bandwidth is a concern, but apart from this, are there security concerns?

I'm particularly concerned about running Tor network-wide and seeing greater security threats open up as a result of it.

  • Where have you picked up this wisdom? I don't see any obvious reason why this is a bad thing, beside the not to be underestimated bandwidth issue. Personally, I don't think surfing the Web through Tor all of the time is a fun experience. Furthermore you might still be traceable through all sorts of scripts, applets and things like that. Making your connection available to others is a different story and might be problematic, depending upon the jurisdiction your under. – Karol Babioch Mar 19 '14 at 23:07
  • Depending on where you live, it could be a legal problem. When someone uses your TOR relay to commit criminal activity, you might be the first suspect. Whether or not it could be enough to get you convicted as an accomplice is a question for a lawyer, but such a lawsuit would be annoying in any case. The risk of this happening is quite low when you run just a relay, but would be higher when you run an exit node. – Philipp Mar 21 '14 at 15:24
1

This is a question of threat modelling. Which adversary are you most concerned about? Tor has the advantage of obscuring the origins of the traffic, which makes it difficult for your ISP, as well as the destinations of your traffic to track you. The adversary you should be worried about is the exit nodes. Since anyone can run an exit node, it's lucrative to sniff unencrypted traffic for information, such as passwords, credentials or other personal information. Furthermore, a really clever exit node could use your credentials transparently—after all the connection appears to be coming from the exit node—for example to spam (in the case of forums, or other communication) or spread malware (in the case of say an uncencrypted FTP connection.)

As long as you can guarantee that all network traffic you are generating has strong encryption and trust (such as ssh fingerprints, which would not be known the first time you're connecting) it would be secure enough to route all your traffic through Tor.

  • I'm mainly concerned with anonymity, but exit nodes are definitely something I'm concerned with vis-a-vis malware, tampering, and credential stealing. – Naftuli Kay Mar 20 '14 at 5:58
0

As nitro2k01 says, you should always assume that your exit nodes are sniffed. Perhaps it would be useful to configure your network to only direct SSL connections through TOR?

If you're mostly concerned with anonymity, then you might be worried about correlation attacks. The exit node can see all your traffic, and so if it sees you browse to something identifying (gmail.com, for example) and then to something sensitive, it may be able to correlate the two. It's kinda unlikely IMHO but it depends on your threat model.

Reading your question again, though, I wonder - are you planning to run exit nodes, relay nodes, or just the 'normal' use?

If you're planning on relay nodes, they are pretty safe. Bridges are too. Exit nodes open you up to some legal hassles (and you'd be blocked from all services that block tor exit nodes), but I don't think there are any credible security threats from running it properly configured.

0

Keep in mind that any non-HTTPS web traffic running through TOR passes the exit-node in clear-text. The same problem applies to your ISP, but you know your ISP and you know they are bound to certain laws regarding privacy and confidentiality. But you don't know who your exit node is and what agenda they could be following. For that reason you should be very careful when you use TOR to access websites via unencrypted HTTP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.