Tor Now Comes In a Box 150
Daniel_Stuckey writes "Tor has been in the spotlight lately as a way to keep prying eyes away from your online activities. However, to your average internet user, the covert network of relays and whatchamacallits can come off as too complex and intimidating to bother with — even as people are increasingly concerned with their online privacy in light of the NSA scandal. So goes the thinking behind Safeplug, a new hardware adapter that basically puts Tor in a box. It takes 60 seconds and 50 bucks to plug the privacy box into your router, and you're good to go, the company claims. Like anonymous browsing for dummies. The adapter comes from hardware company Pogoplug, which announced its new product yesterday and hopes it will bring Tor to the mass market by offering more consumer-friendly access. 'We want to just take what is currently available today to a more technical crowd and democratize it, making it easier to use for an average user,' CEO Dan Putterman told GigaOM."
Make it easy? (Score:1, Troll)
Have you installed TOR on a winders box recently? It is not complicated and certainly does not need a geek to help you.
Re: Make it easy? (Score:4, Insightful)
The difference being that you have to install tor in every single device you are using, with this box you anonimize the whole traffic of your network, anyone using your WiFi is automatically routed through TOR.
Re: Make it easy? (Score:5, Insightful)
Does it sit between your gateway and your router, and transparently redirect all packets to the tor network?
Do you just plug it into a router port and point your devices at it as a proxy?
Where is the source code? If we're going to be paranoid enough to use Tor for everything, shouldn't we demand to audit the code for security holes and possible backdoors?
It just seems like a product without a niche. Most users have no desire to use Tor, and those that do are typically savvy enough to set it up themselves.
Re: (Score:1)
Re: (Score:3, Informative)
Because the information provided isn't sufficient to understand what the box actually does. Does it act as a DHCP provider? How would my devices know to use it? Since it sits inside the network, how would devices which want to use it know its there? Do I have to update proxy settings on browsers?
Re: (Score:1)
A router that connects to Tor, or a router that claims to connect to Tor? :)
Re: (Score:2)
It almost certainly just acts as a transparent proxy that intercepts connections and DNS requests and sends them through Tor - there's already support in the Tor client for doing this.
Re: Make it easy? (Score:4, Insightful)
Re: Make it easy? (Score:5, Interesting)
I mean how would you know if this doesn't just send all traffic to a pseudo TOR network setup by the NSA which captures everything you do?
AKA half of Tor, I'd imagine. The point of Tor has never been to evade detection by the NSA. It's to anonymize your internet traffic to prevent the destination service operator from knowing who/where you are. It's essentially a chain of "legitimate," marginally highly-available TCP proxies that anyone can use without having to create or rent a botnet. Hidden services are a nice side effect, or at least were until Silk Road's compromise spooked everyone.
That said, your point stands: there's not enough information about how this magic box works.
Re: Make it easy? (Score:4, Informative)
Re: (Score:1)
Sure - if you have malware, all bets are off. So don't use malware, then. "A page" never ever installed anything on my computer - the advantage of not using microsoft products.
Re: (Score:2)
Re: (Score:3)
You can use Whonix in virtualbox. It basically replicates this setup, where you have a gateway VM and a workstation VM. The workstation can only access the Internet through the gateway. So if the workstation is compromised it still can't leak your IP.
Re: (Score:2)
And what IP is going to be reported when the Tor gizmo on your same cable modem NAT hits the internet? Wait for it... your cable modem IP. Either that or 192.168.1.2, which I hear is a popular one.
Re: (Score:2)
Re: (Score:1)
Another case of the perfect being the enemy of the good. Technology does not have have to be perfect for it to be useful, furthermore there is always a cost/benefit tradeoff. Even locks that are easy to pick and windows easily broken are useful. I know that most of you have a condescending attitude towards users who are unconcerned about internet privacy. It may well their cost benefit tradeoff is far more reasonable than yours.
Re: (Score:1)
Re: (Score:2)
There's a much easier way to to leak your IP over Tor -- use UDP. Or anything other than TCP, for that matter.
Re: (Score:2)
Well that's hardly an unsolvable problem, just put another tor router box in series with the malware infested one.
Re: (Score:3)
Well that's hardly an unsolvable problem, just put another tor router box in series with the malware infested one.
Hey, that's a good question: do the stats on these things stack? I.e., if I put 3 of them in series, am I 3X as anonymous?
Re: (Score:1)
And you can use SelekTOR (google SelekTOR Exit Node) which makes it even easier.
Re: (Score:2)
No source.
Non-free.
No Mac version.
Nothing for mobile devices.
No thank you.
Re:Make it easy? (Score:4, Informative)
The TOR busts the FBI did earlier this year was malware infecting windows users using outdated versions of TOR (for windows).
A TOR AP makes very good sense, since you can easily change MAC adr. local IP etc. to something other than the normal network, making leaks very hard to use.
Re: (Score:1)
Clearly the benefit of a plug like this isn't at home. Bring down the price and size a notch and it will be ideal to hide at libraries, schools and other places that can't be traced back to you.
Suddenly there is a whole bunch of tor nodes in your town that you can connect to, all of them used for completely legal stuff.
Re: (Score:2)
Have you installed TOR on a winders box recently?
You don't even have to install it (for web browsing at least).
https://www.torproject.org/projects/torbrowser.html.en [torproject.org]
Comment removed (Score:5, Funny)
Re: (Score:2)
Indeed, "Safeplug" just makes me think of "PATRIOT" as one of these words that should make you scrutinize whoever says it.
Re: (Score:2, Funny)
Roll your own (Score:5, Interesting)
Wireless Tor AP built with a Raspberry Pi: http://learn.adafruit.com/onion-pi/overview [adafruit.com]
Re:Roll your own (Score:5, Informative)
Re:Roll your own (Score:5, Insightful)
Yeah but, when your non-technical friend asks you about using Tor, do you want to point them to Raspberry Pi and get a dirty look, point them to the browser plugin and forever be saddled with support questions, or point them to the $50 "just plug it in and forget about it" hardware and earn their gratefulness?
Re: (Score:2)
Re: (Score:1)
tinkering your own for nearly twice that money...
To be fair, the safeplug isn't a wireless access point, so the Pi version might be better in some cases.
Re: (Score:2)
the pi version just needs copying to sdcard... not that much tinkering.
of course you could just run it on a router you already have or a pc.
Re:Roll your own (Score:5, Informative)
Re: (Score:1)
how is this different than a browser plugin? (Score:2)
i like the idea of a $50 plug and play box for tor, but how is this different than using a browser plugin? a serious question, not being rhetorical.
Re: (Score:1)
Ease of use, flexibility with non-browser applications and devices (SSH, FTP, tablets, phones, etc.)
Re: (Score:1)
One difference would be that this works for every piece of software on every computer that you connect to the network after the box - not just one browser.
This can be good or bad. You may be doing something very secret on your secure, anonymous computer. Then an insecure app on your iPhone opens an unencrypted connection to some server and tells the tor exit node who you are.
Re: (Score:2)
Re: (Score:3)
No, in his scenario, the tor exit node is run by a government that is watching all the traffic come out. Then they see your iPhone connection come out with your name, phone number, GPS location, etc. and can match that to all the other streams of data coming through the same circuit.
Re: (Score:2)
i like the idea of a $50 plug and play box for tor, but how is this different than using a browser plugin? a serious question, not being rhetorical.
Well, for one thing the "tor in a box" won't be there if you connect to the internet anywhere other than your home network.
Why Pay the NSA to put a box on your connection? (Score:2)
Color me skeptical.
Put Tor in a box?? (Score:2, Funny)
It's untinkable that the Mighty Tor could be trust into a box such as tis.
Re: (Score:2)
Had to read it twice.
Good one.
Re: (Score:2)
Hehehehe, nice!
Is Tor being safe? (Score:1)
Re: (Score:2, Informative)
From Merriam Webster [merriam-webster.com]:
to make (something) available to all people : to make it possible for all people to understand (something)
Democratization is a common term that existed long before USA appropriated "democracy" as part of their call to arms, you brainwashed yank.
Re: (Score:2)
Hardly a buzzword. To democratize something is to make it available to all. From the Greek demos (people) + kratia (power).
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
democratize, democratise:
vb (Government, Politics & Diplomacy) (tr) to make democratic
Democratization (or democratisation) is the transition to a more democratic
political regime.
democratise:
verb (used with object), verb (used without object), democratized, democratizing. to make or become democratic.
democratize or democratise
verb
1. (transitive) to make democratic
You were right to be sceptical, it is an ambig
Re: (Score:2)
The meanings of words can change over time, and dictionary definitions are often behind the curve. Merriam-Webster's online dictionary gives as its third definition of democratic "relating to, appealing to, or available to the broad masses of the people". And for democratize they give the example sentence, "The magazine's goal is to democratize art".
If you'd like to know more about how words change over time, you should ask about the process in the discussion forum at Wordorigins.com [slashdot.org].
Re: (Score:2)
As long as there's putting power in the masses' hands, I have no objection to the term; for example, guiding the editorial policy of a periodical. However, a statement such as "twitter is democratizing the internet" I would consider to be a serious dilution of the earlier meaning of the term.
Slavery is d
Re: (Score:2)
(shrug) Well, that's how it goes with words. What you like or what I like is irrelevant. I went to the OED, the de facto arbiter of English word definitions, and they have for democratize "make (something) accessible to everyone", with the following example sentence, "mass production has not democratized fashion." This is using the word in the same way that the OP used the word. I think if it's in the OED we can be confident that the word is not "in a state of evolution", but is acceptable for use in th
Re: (Score:2)
While I wish I agreed with it, I completely disagree with your final sentence.
Re: (Score:2)
I'm sorry you disagree fatphil. Personally, I am not prepared to challenge the OED or MW in their assessments, but perhaps you are. People are using the word "democratize" in this fashion, like it or not. I know, I know. These things can be maddening. For instance, I do not like it when people use "literally" as an intensifier. It gets under my skin. Yet, that is what they are doing. I wish you luck in tilting at this particular windmill.
Re: (Score:2)
Aside - you'll be pleased to know that as of just 2 days ago I decided thenceforth to use "literarily" to mean "expressed as one would find in literature, namely exagerated or fictionalised". To contrast against "literally", clearly
Why would we trust Pogoplug? (Score:1)
Their other products phone home because they are really in the business of selling online services, not network hardware.
Re: (Score:1)
Their other products phone home because they are really in the business of selling online services, not network hardware.
I always just had issues with their name... does their network hardware go up and down all the time?
Re: (Score:2)
My take on the name was:
We have met the enemy... and he is US.....intelligence.
Why would you trust Pogoplug? (Score:1)
Yea, but this one doesn't phone home.Thanks to a "National Security Letter" it phones directly to the NSA. Not that it maters, since the NSA is closely monitoring all of the TOR portals anyway.
Security Theater, it's not just for airports anymore.
Re: (Score:2)
Their FAQ says the following about why safeplug is secure:
Oh, wait, it doesn't say anything. No description of the software, no developer access, "activation"? WTF is that? This is just another spy box, folks, just like your cellphone and your self-encrypting storage unit.
Sounds good (Score:4, Insightful)
But we're going to need a lot more tor nodes, particularly exit nodes
Re: (Score:2)
Re: (Score:2)
Do they broadcast BBC4 online? I haven't seen a new episode of Top Gear in months.
That alone would be enough to get me to use the software.
Re: (Score:1)
Re: (Score:2)
Awesome to the max, will give it a shot tonight!
Thanks for the intel.
Re: (Score:2)
Rather than exit nodes, we need a lot more dark net content.
Re: (Score:3)
You first.
Tor? Reallly? (Score:2)
Last I tried it, it necessarily slowed my Net connection down to essentially unusable because of an obvious lack of "exit nodes". Besides, all it does is add some very, very simple obfuscation to what you may be doing on the Net. It doesn't in any way provide any meaningful protection. The nature of TCP/IP precludes true anonymity. People pursuing anonymity through TCP/IP are the same kinds of people looking for perpetual motion machines.
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Overkill? (Score:5, Interesting)
.
Re: (Score:1)
I don't want anyone to know I watched Sharknado
Re: (Score:3)
Sorry Tim, we already know you what you watch, you paid with your credit card remember?
Re: (Score:2)
Netflix accounts aren't anonymous, they already know everything you watch.
Re: (Score:1)
Yes; you want to be able to hide the suspicious data inside the mundane. Makes it harder to figure out how to spend resources tracking you.
The only reasons this might be bad are for fear of overloading the network, and the latency.
Using Tor requires care (Score:5, Insightful)
Tor is not a magic bullet. Anything you send over Tor can be intercepted by an exit node. If you send any identifying information over Tor, all the onion routing in the world won't help you. You can easily do this accidentally, all it takes is for you to visit a page with a google or facebook script on it. You can't just plug into Tor and expect it to take care of everything for you.
The only way to use Tor securely is to partition your Tor activities from everything else you do. This is most easily accomplished with a separate computer, or a VM used only for anonymous activities. Remember, it only takes one slip up and you are identifiable. That's how they got Ulbricht, and they can get you too.
A box that you plug into and forget about is going to provide nothing but a false sense of security. Bad idea.
Re: (Score:2)
Exactly what I was going to post. If you don't take care of how you're using Tor, it will probably do more to flag you as "interesting" for the authorities to investigate further than protect your anonymity.
Not a Tor user, btw, if the NSA is listening. ;)
Re: (Score:3)
A box that you plug into and forget about is going to provide nothing but a false sense of security. Bad idea.
C'mon, half of the users are going to plug it into their router, then just go on using their WiFi connection, believing that they're now secure.
Why buy a box for this? (Score:3)
https://tails.boum.org/ [boum.org]
Re: (Score:1)
You can buy Adafruit's version already built.. (Score:1)
WoW-percussions (Score:1)
This will probably just wind up getting me banned from WoW for "suspicious activity".
Re: (Score:2)
Herbs, potions, strange foods to amplify strencth and intelligence, spells to turn people into sheep, you're already on the FDA's shit list, buddy!
Rather than let NSA to monitor the traffic... (Score:3)
It is so much better to let the exit node owners to monitor your traffic right? Ok fine, they can't trace it back to you, but do expect every malicious thing possible to be done on your traffic.
http://arstechnica.com/security/2007/09/security-expert-used-tor-to-collect-government-e-mail-passwords/ [arstechnica.com]
Tor in a box (Score:1)
And you in a jail cell, if you host an exit node on it. Remember kiddies, you are responsible for what comes out your pipe.
This seems dangerous (Score:2)
Re: (Score:2)
Yeah, fuck those Dems for making TOR so hard to install!
Oh, I mean, wait... What the fuck are you on about?
Re: (Score:2)
Yes, I speak English, the problem is that I do not understand all that bollox.
Re:Wow Black helecopter syndrom (Score:5, Interesting)
What am I doing that's so important to keep secret? I'm minding my own business, that's what. You should do it too.
The reason we should all be afraid of the authorities spying on us is because more often than not, they are the POS humans that are the greatest threat. Remember COINTELPRO? Remember the FBI infiltrating mosques? Remember the IRS harassing political groups? Remember people like Thomas Drake being prosecuted for blowing the whistle on massive amounts of public corruption and fraud?
In an authoritarian regime, anything you do that stands out will get you unwanted attention. If you don't believe we're authortarian today, there's no guarantee we won't be in the future. If we can't protect our privacy today, how will we protect it then? If you want to live a free life, you need privacy.
Re:Wow Black helecopter syndrom (Score:5, Insightful)
As importantly, if you only encrypt things that you want keep secret, then you might as well not keep them secret at all. Not only are you waving a flag and essentially waving a red flag attracting Their* attention that you are now doing something covert ("I am done surfing Amazon.com and now intending to visit a forbidden website!"), it also makes it easier for Them to correlate your obfuscated traffic with traffic with the traffic that hits a forbidden site ("Hmmm, Bob went on Tor at 08:24:42.342 and at 08:24:42.359 traffic from a TOR exit node hit TheNSASucks.Com...").
On the other hand, if you disguise all your activity online, it makes it much harder for Them to do this sort of pattern matching.
So if you are going to use TOR - or use other similar privacy-protecting technologies or techniques - it is best used ALL the time and not just when you are doing something that specifically you don't want the bad guys to know about.
And as the previous poster indicated, just because what you are doing now isn't considered wrong doesn't mean it won't be considered immoral or illegal in the future, or used out of context by others to your disadvantage. As organizations become larger and more bureaucratic, they become more detached from the harm - intentional or otherwise - they can inflict on individuals. And it is not only governments who can cause this harm; corporations gather as much information about us and - as has been frequently been shown over the past few years - are far more careless about how they secure that information. As the old proverb goes, 'an ounce of prevention is worth a pound of cure'; I'd rather try to keep as much of my life out of anyone else's hands rather than try to clean up the mess after that same information is being used against me.
* They, Their and Them are generic placeholders for whichever bad guys you think are watching you, be it the NSA, KGB, KKK or Santa Claus.
Re: (Score:2)
Re: (Score:2)
It might also behoove us to remember that much of this spying is done by *third-party contractors*. This means that it's not only the government with access to this information, hired hands as well. God only knows where the information might end up.
Re: (Score:1)