Ask Slashdot: Alternatives To Tor Browser Bundle For Windows? 201
SonnyJim writes "I frequently use Tor for my anonymous browsing needs, via the Tor Firefox bundle for Windows. I noticed that there are many other applications out there that use Tor as a proxy as well (Janus VM, ChrisPC, etc.) Are any of them more secure than the original Tor bundles, or am I just wasting my time trying these other applications? Is there anything more secure than Tor, as far as anonymous browsing goes?"
Tor (Score:5, Insightful)
Nevermind also that half of the TOR network end nodes are monitored and sniff your traffic and can modify your browsing session in various ways. Just imagine the fun when you happen to use an end node that serves you a drive-by download exploit instead of the page you requested.
Re:Tor (Score:4, Interesting)
You have some good points, though some of those concerns are easily addressed in your privoxy config. I use tor regularly BTW, and am impressed with its performance compared to a few years ago. I don't drink the kool-aid, but between privoxy and tor you can certainly avoid being tracked by all but the most devoted bad guys. However, if someone competent is targeting you specifically you're screwed no matter what you use, unless you're an uberhacker with access to some heavy hardware.
Re: (Score:3)
I don't drink the kool-aid, but between privoxy and tor you can certainly avoid being tracked by all but the most devoted bad guys. However, if someone competent is targeting you specifically you're screwed no matter what you use, unless you're an uberhacker with access to some heavy hardware.
Didn't you know? Is "the good guys" doing the most tracking these days.
lolll..and as a rule you're paying them to watch you.
Re: (Score:2)
Re: (Score:3, Interesting)
what he means is the old good guys are our new bad guys. and good guy doesn't exist anymore, only you vs. them.
Re: (Score:2)
Kids, play nice or you're both going to have a timeout.
Re: (Score:2)
...for different definitions of "good"...
Re: (Score:3)
Re: (Score:2)
Might, perhaps, have been best to leave out the adjective "bad", which implies the existence of "good" and so leads those of us who are foolish enough to take someone literally into hypothesizing the existence of an anode in their cathode-only universe.
Why would you want to accommodate foolishness and make it more comfortable? It doesn't lead to fewer fools.
Re: (Score:2)
In a Time of Universal Confusion, telling things clearly is a Revolutionary Act
Re: (Score:2)
In a Time of Universal Confusion, telling things clearly is a Revolutionary Act
lollll...unless, of course, you're a politician - in which case telling things clearly would be a betrayal of your species.
Re: (Score:3)
Nevermind also that half of the TOR network end nodes are monitored and sniff your traffic and can modify your browsing session in various ways. Just imagine the fun when you happen to use an end node that serves you a drive-by download exploit instead of the page you requested.
At least it will arrive securely and anonymously - and isn't that what it's really all about? ;-)
Re:Tor (Score:4, Informative)
I personally find it funny when people use Tor and then leave behind [...]same MAC address, don't change DNS servers [...]
Proof that you know less about this than you think you do. MAC addresses become irrelevant after the first network layer hop or an application layer gateway like TOR. Also TOR acts as a socks 5 proxy and will resolve names for you, again the the DNS settings are irrelevant.
Re: (Score:2)
Re: (Score:3)
DNS resolving depends on settings.
TorButton - included in the bundle - configures Firefox to use Tor for DNS (using the SOCKS proxy).
Re: (Score:2)
By using TOR directly your browser may be giving away clues to your identify. By using privoxy some identity stuff may get filtered but instead you may be leaking information by DNS (especially if you are on an untrusted network). Torifying UDP is IMHO a PITA.
Re: (Score:2)
By using TOR directly your browser may be giving away clues to your identify. By using privoxy some identity stuff may get filtered but instead you may be leaking information by DNS (especially if you are on an untrusted network). Torifying UDP is IMHO a PITA.
The solution is to configure your browser to not provide such information in the first place, even when you're not using Tor. Those few cookies etc. you may need to use certain sites can be limited to a handful of specific sites and made quite temporary in nature.
I never saw any good reason why HTTP Referrers and user-agent headers were ever included in the HTTP spec in the first place. The first is extraneous information and the second is contrary to a Web based on open standards (and tends to help malic
Re: (Score:3)
"I never saw any good reason why HTTP Referrers and user-agent headers were ever included in the HTTP spec in the first place. The first is extraneous information and the second is contrary to a Web based on open standards (and tends to help malicious sites know which exploits to use)."
The referrer is useful for a number of reasons. Beyond the obvious one (statistical information), this is helpful for setting up mechanisms to help prevent people hot-linking to images (or other content) on your site. For peo
Re: (Score:2)
The referrer is the wrong way to fix hot-linking. You're attempting to maintain costs by using the user's browser. Instead, you should use your web server. Something like the JPG is only available if the HTML page it is on has been recently requested by the same IP. (I'm basically making a fox guarding the hen house argument.)
And the user-agent header is the wrong way to fix content issues. The best way would be to supply all of the content to the other browser and let the user decide what format they want
Re: (Score:2)
Your referrer solution: This solution would overload web servers quickly, as every object request would require a log file parsing. It would also suffer from the problem that the image may be loaded from a different server than the HTML file. Thus, your solution is fraught with difficulty in both efficiency of hardware use as well as implementation. Also, its stupid.
Your user-agent solution: So you're saying that my smart phone, which is on a slower network connection, with a lower usage quota should receiv
Re: (Score:2)
Re: (Score:2)
As someone who's worked for years as a web developer: Knowing what browser people are using is 100% needed.
Mostly, you use it as a priority list as far as what browser bugs you're fixing, it's not as serious now, but I know there's many web developers waiting for IE6 usage to drop below .1% so they can safely ignore it.
Now, using content headers to "guess" which version of a page to serve up is wrong (you can easily use mobile stylesheets for that) but we're nowhere near that kind of real world application.
Re: (Score:3)
To be honest, I have never really understood that mindset. It only comes into play when you wish to flood the page with all sorts of, glamor. And I mean that word in the sense of distracting effects, sounds and movement. It's only needed for making a big show of it, and IMHO, rather few sites benefit from such things. If your business is selling programs for inserting all kinds of special effects, then your page would likely benefit from using such. But if your site is for disseminating information, then al
Browser ID and the short attention web (Score:2)
Your point is well-constructed... but it also shows that you have a bias towards content over presentation.
The fact that it's all one long paragraph, is missing occasional letters, and may have small grammatical errors is absolutely irrelevant to the point that you are making. You used concrete examples and came to a logical conclusion.
But the rest of the world is biased toward presentation over content. It's sad, sure... but it's been that way since the Eternal September [catb.org], and it's not going to change. In f
Re:Tor (Score:4, Insightful)
Except, of course, if you're running wireless. Then MAC addresses are recorded by various data gatherers and used, among other things, for that Google location guesser thing.
Of course, it's OK if you never speak wireless in the clear and always use an encryption protocol which will never be found insecure in the future.
Re: (Score:3)
Re: (Score:2)
Re: (Score:3)
Are you telling me that if I tell you 00:50:ba:* you can identify where I bought my NIC [dlink.com]? And you can tie it to my credit card? You must be a spook in full collusion with D-Link (for the credit card and inventory records), in which case the mac address reveal is probably the l
Re: (Score:2)
The odds that anything like your credit card number would be associated with your MAC address, in any place that it could, as a practical matter, be found, is vanishingly small.
Re: (Score:2)
Re: (Score:2)
It's a NIC. Do you really think someone who's so concerned about privacy is going to give a crap about the $12/$35 it'll cost to replace an under warranty wired/wireless NIC _if_ it dies?
Besides the fact that MAC addresses are not globally unique, regardless that they should be in theory, and the only thing that can track them is the subnet you actually connect to, which isn't discoverable to the TOR exit node......
This conversation is stupid. MAC addresses are not a privacy issue, unless you're connected
Re:Tor (Score:5, Informative)
Use TorButton [mozilla.org] then (the Windows bundle includes it IIRC). AFAIK it solves most of the problems you mentioned. If you are using Firefox 4 then you need the alpha version from here [torproject.org].
Add to that BetterPrivacy [mozilla.org], and you should be much harder to track.
Don't use Torbutton on your everyday Firefox (Score:2, Interesting)
Torbutton as an addon is a step backwards from Tor Browser Bundle. It was discontinued for a reason. You're not smarter about Torbutton than the developer of Torbutton, and here's what he says: [torproject.org]
Re:Tor (Score:5, Funny)
I personally find it funny when people use Tor and then leave behind the same cookies, the same user-agent, LSO and Flash cookies, same system configuration, same screen size, same fonts, same installation and versions of plugins, same MAC address, don't change DNS servers and countless amount of other things that make it very easy to identify your other activity or what you're doing.
I solved this problem simply by finding out what your user-agent, LSO and Flash cookies, system configuration, screen size, fonts, plugins, MAC address, and default DNS servers were. Now whenever I'm on Tor I pretend to be x*yy*x - so I'm golden.
Re: (Score:3, Interesting)
But mostly you can identify tor-users which are not having all plugins switched off, by a java applet which acts as a beacon* , also if you have switched it off in your Firefox, it get's reactivated by every juscheded update ;)
But I also want to point the attention to the lately added
local web storage in the current generation of browsers, like Opera and doing a picture search in opera and just check the link of the thumb nail you will be interested So the question is how long will it take till it get's abu
Re: (Score:2)
I personally find it funny when people use Tor and then leave behind the same cookies, the same user-agent, LSO and Flash cookies, same system configuration, same screen size, same fonts, same installation and versions of plugins, same MAC address, don't change DNS servers and countless amount of other things that make it very easy to identify your other activity or what you're doing.
If someone is trying to block web browsing by installing a cruddy blocker or whatever, but are not smart enough to block tor connections (think, hotel, restaurant, etc) then tor is a massively overcomplicated proxying solution.
Re: (Score:2)
It's called the tor "browser bundle" for a reason. You never use your default browser under Tor.
Yeah, end node sniffing must be addressed through https-everywhere or a vpn of course.
Re:Tor (Score:4, Informative)
Easy to fix when you use user agent switcher, ghostery, better privacy, noscript, google sharing, cloned mac addresses and torbutton.
Check out http://www.decloak.net to see how anonymous you are.
It's hard to beat Tor for anonymous public web browsing, but i2p [i2p2.de] is already a better darknet.
Re: (Score:2)
Nevermind also that half of the TOR network end nodes are monitored and sniff your traffic and can modify your browsing session in various ways. Just imagine the fun when you happen to use an end node that serves you a drive-by download exploit instead of the page you requested.
http://www.ipredator.se/ [ipredator.se]
Problem solved. Also a heck of a lot faster. You just have to pay for it, which I think is a four-letter word on Slashdot
Re: (Score:2)
I'm not an expert though so don't take my word for gospel, but AFAIK that's how it
OperaTOR (Score:1)
The best TOR bundle, includes portability, non-root / admin user required, and no cookies etc. between sessions.
All settings are defaulted safe for Tor.
Re: (Score:2, Informative)
Does it have functionality similar to Firefox with TorButton [torproject.org] ? Otherwise I assume it offers weaker privacy.
Btw, according to this link [archetwist.com] OperaTor is not maintained anymore, and it was replaced by YAPO [archetwist.com] which does not support Tor.
Re: (Score:1)
Damn... on your first point, no it's stronger because it includes Polipo and Privoxy, which route DNS requests over Tor...
However, despite me using it religiously for years now, you are correct that it's now been deprecated? Why? I don't have to skills to maintain it, and it's something I am sure lots of people have used as their first step to anonymity... it should be maintained. :-(
VPN? (Score:2)
Re: (Score:3)
VPN is only one hop between you and any server, so they know both who you are (especially if it's paid), what IPs you connect to and any unencrypted traffic.
If you trust them more than your ISP, sure, but I think it's far from anonymous, even when compared to Tor.
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
It is simpeler to run TOR on both ends and use VPN between the client and the hidden service (OpenVPN in TCP mode should work). That way the traffic should never leave the tor network.
I don't get Tor (Score:3, Interesting)
Can someone explain to me why someone who is monitoring sufficient backbones and running sufficient Tor nodes himself can't just watch a packet stream being bounced between Tor nodes?
Then there are people using Tor really dumbly [inria.fr] such that you don't even need a three-letter acronym to work out who it is.
Re:I don't get Tor (Score:4, Informative)
Can someone explain to me why someone who is monitoring sufficient backbones and running sufficient Tor nodes himself can't just watch a packet stream being bounced between Tor nodes?
This is one of many known attacks on Tor, and is the reason why as many people as possible should be running Tor relays, entry nodes, and exit nodes. This is also why Tor circuits are periodically changed by the client. In general, though, it is possible for someone who can monitor a large enough fraction of the Tor network to break the anonymity of the system, even if they cannot control the nodes themselves.
Re: (Score:3)
I'd thought about running a Tor entry/exit node, but I really don't want to get dinged for someone else looking at kiddie porn and using me as an exit point. The authorities won't know the difference, and might not even care.
Re:I don't get Tor (Score:4, Informative)
I recall a raid in Germany [wordpress.com]. Depending on police behaviour and accessibility of records, in some countries that can be as harmful as a conviction (e.g. if you're working in a job with vulnerable people).
Re: (Score:3)
To date, not a single case has been bought against anyone running a tor exit node.
Re: (Score:2)
You just went full retard. Never go full retard.
Re: (Score:2)
Re: (Score:2)
Can someone explain to me why someone who is monitoring sufficient backbones and running sufficient Tor nodes himself can't just watch a packet stream being bounced between Tor nodes?
I've asked the same question about Freenet.
The network depends on users volunteering to route and store high-risk traffic. The files may be in fragments and encrypted. But if your client application, node or supernode is exposed, the consequences may be - unpleasant.
That is not a problem for the three-letter agency, foreign or domestic that can build depth by running tens of thosands of nodes and supernodes, if it chooses.
Re: (Score:2)
"The network depends on users volunteering to route and store high-risk traffic. The files may be in fragments and encrypted. But if your client application, node or supernode is exposed, the consequences may be - unpleasant."
If you are in the U.S., these assumptions are quite incorrect, in at least a couple of ways.
You are volunteering to take on anonymous traffic, not "high-risk" traffic. There is a very big difference. In effect, you are serving as a "common carrier", and you enjoy the same legal protections as any ISP. In other words, you are only carrying traffic, you are not looking at it in any way, or even accessing it, much less altering it, yourself. You are only a relay. You have nothing to do with the actual conte
Re: (Score:2)
You are volunteering to take on anonymous traffic, not "high-risk" traffic. There is a very big difference. In effect, you are serving as a "common carrier", and you enjoy the same legal protections as any ISP. In other words, you are only carrying traffic, you are not looking at it in any way, or even accessing it, much less altering it, yourself. You are only a relay. You have nothing to do with the actual content, so you cannot be held liable for that content.
That statement is very much open to debate [slashdot.org]. I would further argue that westlake's legal budget is significantly lower than TIme Warner, AOL or Comcast's.
Re: (Score:2)
But to the best of my knowledge, it is not open to debate. And I would argue further that I was talking about the law, not the distorted way the law has sometimes been enforced. Regardless of your budget, if the law is applied u
Re: (Score:2)
Re: (Score:2)
From your link:
... In this paper, we show that linkability allows us to trace 193% of additional streams...
193 percent?
Really?
Re: (Score:2)
A better alternative.. (Score:1)
Just stop trolling :-)
LiveCDs - TAILS v0.7.1, Liberté Linux (Score:4, Informative)
First, don't bet your life on this technology or OpenSSH or other tech.
Second, rather than run TOR on an everyday personal or work computer (Windows or Mac or Linux) with sensitive data and identifiable traits, I'd recommend booting a LiveCD: TAILS (v0.7.1 is the latest) and Liberté Linux:
http://tails.boum.org/ [boum.org]
http://dee.su/liberte [dee.su]
or get Knoppix and harden it:
http://knoppix.com/ [knoppix.com]
Change your MAC and connect at a coffee shop (if paranoid-- on the other side of town, and wear sunglasses in case of surveillance), not from home. Or connect to someone else's open WiFi, or get the key with Backtrack. Less secure is running a LiveCD in a VM (virtualbox or vmware). Another less secure option is running a hardened Linux, or at least running the Bastille script.
What am I missing? The main trouble with the LiveCD/DVDs is the NIC driver/module, but Knoppix is good for that.
integral-fellow
Re: (Score:2)
Then encrypt your bootable drive (it is possible to make bootable encrypted drives).
Re: (Score:2)
Re: (Score:2)
The United States Constitution guarantees us the right to be secure in our persons, property, and papers. These days, of course, "papers" includes digital files.
Censorship on Slashdot is most unbecoming. I am being very polite. If I were not so polite, I would use other words.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
What is the actual purpose of using TOR? (Score:4, Insightful)
I understand that what I'm going to ask is almost a logical fallacy in Slashdot, but I'm going to ask anyway.
Why exactly are you making things complicated for yourself and using Tor in the first place? A person as paranoid as you would use only properly secured banking connections and reputable services anyway, so the chance of any identity theft whatsoever is minuscule. I really can't think of any credible motivation for completely endorsing anonymity except the fear of being caught surfing something explicitly illegal. However, the amount of replies in this thread and their tone suggest, that you can't all be 3rd world revolutionists or Chinese students circumventing the Great Firewall.
Is this just a matter of principle, or do you actually have something to hide? If it's the principle, what are you hoping to accomplish and why? If you're into snuff or whatever, I really don't care, but at least one anonymous reply confirming this would be amusing.
This is not a troll. I'm genuinely interested. Technical answers about repercussions I may have not understood, are not only accepted, but appreciated.
Re: (Score:3)
From what I gather (remember this info is all secondhand) some people in former first-world countries (USA anyone?) use TOR, Privoxy, livecds, etc. to research the sort of things that might throw up a flag.
Re:What is the actual purpose of using TOR? (Score:4, Insightful)
"I really can't think of any credible motivation for completely endorsing anonymity except the fear of being caught surfing something explicitly illegal. "
History has clearly shown that the right to free and anonymous speech is essential to maintaining a free society. That fact alone is sufficient motivation to do it. If you don't practice and enforce your rights, you are likely to lose them. Your attitude is exactly why this is true.
Re: (Score:3)
Anonymous free speech is a by-product of public free speech and is useless if the society doesn't allow public free speech from a known individual. The uncited source is useless if the government doesn't allow the brave individual to include their reference in a public, non-anonymous article. Without someone, anyone standing up to vouch for a story, publicly, anonymous free speech is easily dismissed, easily forgotten, easily covered up.
What good would the Deep Throat informant have done if Bob Woodward an
Re: (Score:3)
"Anonymous free speech is a by-product of public free speech and is useless if the society doesn't allow public free speech from a known individual."
I am quite sure that the authors of the "Federalist Papers" and "Antifederalist Papers" would very strongly disagree with you, Patrick Henry notwithstanding. Thomas Paine is probably a better example, and he was not exactly a friend of the existing government. But here is the most telling point: the very people who were writing the Federalist Papers were our Founding Fathers... they just did not dare do it publicly under their own names. To do so would have called unwanted and perhaps disastrous attention t
Re: (Score:2)
"Anonymous speech will do nothing to ensure a free society - you need to be prepared to stand up and be counted and not hide behind a fuzzy layer of anonymity... I agree with the OP... Why would you want to be anonymous?"
That's GP, not OP, but regardless:
I refuse to go over the last 300-400 years of history to illustrate why this is important. There are so many reasons... but rather than just blow you off (which am half-tempted to do), I will instead point you at the following article: https://www.eff.org/issues/anonymity [eff.org]
If you aren't satisfied with that, just google "anonymity 'supreme court'" and read what you find.
Re: (Score:2)
When, at the signing of the Declaration of Independence, John Hancock said that the revolutionaries must be unanimous and that "We must all hang together on this," Benjamin Franklin replied "We must indeed all hang together, or most assuredly, we shall all hang separately."
I think it is pretty clear that he was right on that point. And
Re: (Score:2)
Re: (Score:2)
No problem, I wasn't insulted in any way. I stated the comment as a logical fallacy precisely because I knew, that this was going to be said, and that I also consider it the "correct" answer.
What my actual point tried to be, and what some people here already responded to, was that most of the people here using tor don't really have anything to hide and don't seem to have any use for Tor, yet they worry about these things and make their life more complicated for no apparent reason. I see that as paranoia get
Re: (Score:2)
And the assertions by some that "half" of the Tor exit nodes are monitored is ridi
Re: (Score:2)
> Is this just a matter of principle, or do you actually have something to hide?
Yeah, this: http://en.wikipedia.org/wiki/2011_Chinese_protests [wikipedia.org]
In many parts of the world, basic civil freedoms are not possible without anonymous communications. Given events in North Africa, surveillance combined with brutal repression (see Bahrain, Syria, Yemen, Ivory Coast) is now an expected outcome of trying to organize political discourse in many places.
Re: (Score:2)
Re: (Score:2)
well, one thing is for searching stuff that might be illegal to even look information about in your country. because if someone gets to know that, they can try to blackmail you, you have to bribe them or officials or just end up in a chinese jail. and it's useful if you're in a sect and looking for a way out.
another reason is that it makes it harder to track who you are, say if you're looking to download something from a site you know to have an admin who looks at the logs about who's ip it is. this is part
Re: (Score:2)
Various thoughts here:
You may be looking for non-illegal content, but worried that you may come across something illegal in the course of the search.
Re: (Score:2)
Example: in most of Europe, it is illegal to express any doubt at all as to the historical truth of the Holocaust. I don't mean denial, but even questioning the number of victims, or how they were selected can get you sent to jail.
Sorry, but that is total and utter fucking bullshit.
Re: (Score:2)
While I can't speak for the other users of Tor, I have found it extremely useful and even vital for computer security in the location I am now: Sudan.
Let me explain: I'm working for the UN, and have brought my own laptop. I'm buying "wireless broadband" from a local ISP, who is anything but broad... but thats a different matter. Since I like keeping my computer safe, I need to download the latest patches for Flash and Java and so on and so forth... which is where the problem arises. You see... the US is cur
Re: (Score:2)
Re: (Score:2)
TL;DR in my country, religious zealots and enforced morality codes forbid University students from accessing pornographic and other controversial materials even in their own dorm rooms. Can you guess which modernized first nation I live in?
Vatican City?
XeroBank Browser? (Score:2)
How about https://xerobank.com/download/index.html [xerobank.com] ? However, its Firefox is outdated. Supposedly, they are making a new one?
Simple (Score:2)
Yeah, don't fucking use Windows.
i2p (Score:2)
I was trying out iMule and saw that it uses a network layer called i2p that supports any application that can run using a proxy. You might want to give it a try.
i2p is available at http://www.i2p2.de/ [i2p2.de]
Here's a description of i2p from the introduction:
-----
"I2P is a scalable, self organizing, resilient packet switched anonymous network layer, upon which any number of different anonymity or security conscious applications can operate. Each of these applications may make their own anonymity, latency, and throug
Better than Tor... (Score:2)
OperaTor (Score:2)
I can't believe no one has said anything about OperaTor yet. Mostly because it's the only one I was aware of before this article
Is it because OperaTor doesn't appear to be in development anymore (as in dead).
Re: (Score:2)
virtual machine, dude. My virtual machine doesn't come to slashdot . . .
Re: (Score:2)
Did you mean I2P??? http://www.i2p2.de/ [i2p2.de]
It too can be compromised by MIM. Otherwise, yes, I think it is superior to TOR. Downside is, not enough people use it to make it worthwhile.
Re: (Score:2)
It's just another VPN proxy setup. THEY know who you are.
Re: (Score:2)
Re: (Score:2)
$10 Bikini (Ed hardy,polo)
I know you're not very bright, even for a bot - but I think you're barking up the wrong tree. You might want to go back to the Viagra stuff. Or maybe Rhogaine.