The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Hot answers tagged

137

A good option is to harden your Content Security Policy. It allows you to fine-tune which resources the browser will load/run, and is supported by most browsers. Consider the following header: Content-Security-Policy: default-src 'none'; img-src 'self'; style-src 'self'; This tells the browser to disable scripts, frames, connections and any other objects/...


112

Tor is used to circumvent censorship! No, not directly. Tor is about anonymity, not about availability. Tor alone does not help its users access blocked content. Tor helps by making it hard to link clients with site visits, so that people can publish or read content without being identified. It's used to avoid being caught in relation to banned content, not ...


109

In order to block Tor all that has to be done is have the current list of Tor nodes which can be found at the following link: http://torstatus.blutmagie.de/ip_list_all.php/Tor_ip_list_ALL.csv and then block them bidirectionally via the Routers or Firewalls. That said there will be numerous ways around such efforts, people can still use VPN's to connect ...


106

As a very long time Tor user, the most surprising part of the NSA documents for me was how little progress they have made against Tor. Despite its known weaknesses, it's still the best thing we have, provided it's used properly and you make no mistakes. Since you want security of "the greatest degree technically feasible", I'm going to assume that your ...


81

You can use a list of Tor (uplink) nodes, add this to the outgoing firewall, setup a task to update this once a day and you'll be good. But Tor can also be used over a HTTP(S) proxy, so you will have to detect proxies as well. I am not sure if this is going to help you secure anything. As long as there is a connection to the internet, it would be possible ...


65

Any software you install on your system can compromise the system and thus affect security and privacy. This can be done either willingly or because of bugs in the software. And this is doubly true for software which runs with elevated privileges, like Antivirus usually do. And while Antivirus might like to protect you they often have critical bugs which ...


64

Shallot is an older program, there are newer alternatives available now: Scallion - uses GPU hashing, needs .NET or Mono: http://github.com/lachesis/scallion Eschalot - uses wordlist search, needs Unix or Linux: http://blacksunhq56imku.onion Eschalot can find longer human-readable names like seedneedgoldcf6m.onion, hostbathdarkviph.onion, etc. The ...


57

Tor uses a routing method called Onion routing. Much like an onion, each message (the core of the onion) is covered with layers of encryption. image attribution Your message is encrypted several times before it leaves your device. Node A can only decrypt (peel) the layer A, under which it would see the address of the next node. After the packet reaches the ...


57

First: Don't use work computers for personal use, people! Many network policies forbid personal use. Our policy states that personal use is not forbidden but is monitored. If you don't want to be monitored you need to use equipment you control. TL;DR: If you don't want your parents to know you smoke, don't smoke in front of your parents. Work Equipment ...


53

TL;DR Tor provides anonymous web browsing but does not provide security. VPN Services provides security (sort of) and anonymity, but the anonymity might be more in question depending on the service. Since you're depending on them not logging pieces of information that may or may not be able to be traced back to you. VPNs Traditional A traditional ...


53

I believe your major concern should be that: using anonymous proxy in the network Is a bad assumption. I would straight away ask: In which network? Yorick already touched this point but I'll be more blatant. HIPAA is mostly about privacy of the data in your production system and therefore in the network that is used to connect to the production ...


47

They might do it already, there is a known technique to dedicate malicious and powerful nodes to the network to be able to take control of some of the traffic. Tor does not advertise itself to be able to protect against adversaries that have control over a fair part of the internet. While there are techniques to check the validity of the nodes if you have ...


43

Perhaps it's worth mentioning that the impact of resizing your browser on your privacy heavily depends on what window size you set. Maximizing Tor browser on a screen with a standard resolution like 1280x1024 or 1080p is not too bad - lost of people have screens like that, and you probably won't end up being the only one with that resolution. The adversary ...


42

The article you link says that the FBI obtained "the MAC address" for the user computers. MAC addresses are specific to each ethernet hardware, and they don't travel beyond the first hop -- meaning that they are visible to your home router, possibly the one provided by the ISP, but not beyond. If that specific piece of information is true, then this means ...


41

2013 calling I think this question deserves a new answer after what we know now. Given the financial sources of the Tor project and what we learned about the NSA inserting backdoors (e.g. see here) casts a shadow on the trustworthiness of the project. From the annual report for last year (linked above): However, keep in mind that the US government claims ...


38

In Tor, the user (you) chooses a random path through several nodes for its data. The first node in the path knows your IP address, but not what you send or where. The last node ("exit node") knows the target server address and sees the data (unless SSL is used, of course), but not your IP address. Every node in the path knows only the addresses of the ...


38

If you are in a crowd and you wear a mask, but nobody else in the crowd does, then you tend to attract attention... If you want to remain anonymous, then you must use only tools which do not single you out as a potential miscreant, i.e. tools that everybody uses. A good example is when you pay in cash: this is a mostly traceless payment system, and yet ...


37

Tor will be actually quite hard to block because of tor bridges: Bridge relays (or "bridges" for short) are Tor relays that aren't listed in the main Tor directory. Since there is no complete public list of them, even if your ISP is filtering connections to all the known Tor relays, they probably won't be able to block all the bridges. To ban Tor ...


35

It is an information leak on the Silk Road server. It appears somebody located a debug or info screen on the Silk Road server that dumped configuration and environment variables. Some possibilities: The output of Apache's mod_status (example) Output of phpinfo() (example) A custom debug page that is part of the Silk Road application It could have been ...


34

No, it won't. The thing is that when you use HTTPs over TOR you: you use the public key of the server to encipher your message (so nobody except the server will be able to read your message). then you pass the HTTPs message (which, remember, is encrypted with the public key of the server) to a TOR node, this TOR node to another, and another and... ...


33

Preface: I consider this question to be a false dichotomy and an inversion of the burden of proof. One of the core tenets of building secure systems is that you minimise the attack surface, and resist additional components and features wherever possible to keep in line with this. As such, if one cannot identify a strong reason to include a component in the ...


32

Tor provides privacy only under the assumption that at least one node in the randomly selected chain is not attacker-controlled (since we are talking about traffic analysis, simply eavesdropping on traffic entering and exiting this node, without trying to decrypt it, counts as "control"). This is probabilistic. If the attacker controls, say, 50% of all nodes,...


32

Generally speaking No. Assuming: You follow Tor's best practices Tor does not protect all of your computer's Internet traffic when you run it. Tor only protects your applications that are properly configured to send their Internet traffic through Tor. To avoid problems with Tor configuration, we strongly recommend you use the Tor Browser. so if it's ...


31

TOR, VPN, bots, proxies, you name it.. The source IP is not "spoofed" per se... it's the real deal. If someone really spoofed a source IP, they couldn't establish a TCP connection or receive any replies. The source IP spoofing method is more useful over UDP when launching an amplification attack to a victim/spoofed IP.


29

The article you posted states how they did it. But the author doesn't seem to be knowledgeable on the subject and it got lost in the article. They didn't crack Tor and more so found a way to collect analytics that didn't go through Tor's network. First the FBI confiscated the servers running the child porn ring on Tor known as Playpen. After seizing the ...


24

In one line: they have a list of all the exit nodes (something like that). more detailed: I have seen this post demonstrates how to detect a Tor connection in php function IsTorExitPoint(){ if (gethostbyname(ReverseIPOctets($_SERVER['REMOTE_ADDR']).".".$_SERVER['SERVER_PORT'].".".ReverseIPOctets($_SERVER['SERVER_ADDR']).".ip-port.exitlist.torproject....


21

Yes you can run them side by side and not corrupt the security. This is because your Tor browser will send everything through a Tor proxy (including DNS requests) and your normal browser won't. Do mind that: If the NSA really would like to know what you are doing then they will find a way, bug your house, target your computer with malware, ... .


21

Ah, trust, that fickle thing... Tor provides anonymity for the download part. A download is: to obtain a sequence of bytes. What you do with these bytes is then completely up to you. Some sequences of bytes encode executable instructions that a computer will be eager to run. Executable files, scripts... fall in that category. If the file you download ...


20

I think it's important here not to overstate the capabilities of the various Three Letter Agencies with regards to identifying Tor users. The very first slide notes that they "...will never be able to de-anonymize all Tor users all the time". This means that the fundamentals of Tor are sound. The slide then goes on to note that "...with manual analysis we ...


Only top voted, non community-wiki answers of a minimum length are eligible