How Tor Works

http://www.alexkyte.me/2016/09/how-tor-works.html

by LForLambda • 10 years ago

171 31 10 years ago

Cool blogpost. People that enjoyed this might also like to take a look at "The Architecture of Open Source Applications" http://aosabook.org/en/index.html.

Also, a few months back I annotated the original Tor whitepaper here http://fermatslibrary.com/s/tor-the-second-generation-onion-...

vthallam• 10 years ago

The annotations on the paper look informative, thanks for sharing!

deltaprotocol2• 10 years ago

When I see articles about security related topics I immediately expect them to be served over HTTPS and get frustrated when they are not.

It makes me think if HN should perhaps make a stand and either display some sort of lock icon next to secure links or make it harder for insecure links to show in the front page. Where is the right place to discuss this?

kbart• 10 years ago

Why do you need https for text only page? Sure, somebody could do deep packet inspection, but they would not find anything they couldn't find going to the domain (that won't be hidden by https anyway) directly.

EDIT: previously incorrectly stated 'url' instead of 'domain'.

niftich2• 10 years ago

For integrity, ie. tamper-resistance and knowing if MitM tampering was done.

deltaprotocol2• 10 years ago

I don't know what is on a page until I visit it, so to make a stand myself in favor of a less insecure internet, I use HTTPS Everywhere in strict mode, which blocks HTTP. I have found that mostly I can live with it, and wish for the community (HN audience is a good part of it) to keep pushing (through a bit of pressure perhaps) towards an HTTPS only internet.

sasas• 10 years ago

Javascript inserted that injects fake flash/ms/java update... fake redirect to a login page to capture credentials... the list goes on.

jahnu• 10 years ago

But URLs are encrypted as it's the TCP connection that's encrypted, isn't it?!

yoo1I• 10 years ago

that won't be hidden by https anyway

The only thing that's not hidden are the domain names in the certificate that the server presents.

The rest of the URL is encrypted, along with all data and headers.

nbraud3• 10 years ago

There are several reasons you want this, relating to security, privacy and “politics” (in the wider sense).

Regarding security, using HTTPS (along with the right measures on externally-hosted content) guarantees (to some extend) that what the users gets is what you meant to publish: an hostile network cannot replace the content with misinformation and cannot inject JS -- to exploit the client or not (as was done with the “Great Cannon” [0] which took down Github).

Privacy-wise, a number of countries routinely spy on their communication infrastructure, and revealing “I visited this website” is far more problematic than “I visited this Tor-related post on this website, and left this comment”.

The last reason for systematic HTTPS is “political”: if we go towards a situation where HTTPS is systematically employed, HTTP-only website will be subjected to increasing amounts of social pressure as adoption rates grow: deploying HTTPS (and preferably best-practices) on your “text-only” website pushes other websites (that might “need” it more) to deploy it too.

[0] https://citizenlab.org/2015/04/chinas-great-cannon/

mirimir• 10 years ago

It would also be useful to point out limitations and vulnerabilities. Tor browser has no protection against malware that hits the Internet directly, bypassing Tor circuits. But Tor Project does not prominently warn users about that on its website. While Tor Project does acknowledge Tor's vulnerability to global adversaries, there's also no prominent warning about that. If you run Tor in a terminal, you see "This is experimental software. Do not rely on it for strong anonymity." But how many users will ever see that warning?

beardog4• 10 years ago

Even worse is that javascript is default enabled, making the security as strong as the Firefox sandbox.

nbraud3• 10 years ago

That's FUD and untrue.

The first thing you see in Tor Browser is a tab explaining that you got properly connected to Tor, but that Tor in itself is not a complete solution to online privacy and suggests you follow a link to an informative document written by the Tor Project.

0xmohit• 10 years ago

Another 3 part series:

http://jordan-wright.com/blog/2015/02/28/how-tor-works-part-...

http://jordan-wright.com/blog/2015/05/09/how-tor-works-part-...

http://jordan-wright.com/blog/2015/05/14/how-tor-works-part-...

jwcrux• 10 years ago

Hey there! I'm the author of this series - happy to answer any questions.

Edit: I've also had some posts about Tor that did not fall exactly under this series format but should be helpful: http://jordan-wright.com/blog/tags/tor/

known• 10 years ago

Remember that Tor anonymizes the origin of your traffic, and it encrypts everything inside the Tor network, but it can't encrypt your traffic between the Tor network and its final destination. If you are communicating sensitive information, you should use as much care as you would on the normal scary Internet — use HTTPS or other end-to-end encryption and authentication.

https://www.torproject.org/projects/torbrowser.html.en

kefka• 10 years ago

I've also written up a comprehensive IoT infrastructure using Tor, Node-Red, MQTT, and sensor/actuator nodes as you choose.

It's all documented here: https://hackaday.io/project/12985-multisite-homeofficehacker...

How Tor Works

Related Stories