Anonabox: a Tor hardware router

https://www.kickstarter.com/projects/augustgermar/anonabox-a-tor-hardware-router

by chermanowicz • 12 years ago

56 41 12 years ago

kickstarter.com

dang• 12 years ago

Url changed from http://www.wired.com/2014/10/tiny-box-can-anonymize-everythi..., which points to this.

josu3• 12 years ago

This has already been done:

http://www.technologyreview.com/news/521676/online-anonymity...

You can buy the product here [1] for $49. As far as I can tell, the only difference is that one is opensource while the other doesn't seem to be.

[1] https://pogoplug.com/safeplug

selectout2• 12 years ago

This is mentioned in the article including a couple points about the size (safeplug is twice the size so less convenient for taking with you) as well as the security flaws found in September.

josu3• 12 years ago

The article he is referring to is this one: http://www.wired.com/2014/10/tiny-box-can-anonymize-everythi...

The kickstarter page makes no mention to other similar products, which to me seems pretty dishonest. Nobody uses the "Risks and challenges" section correctly.

joshwayne• 12 years ago

I think Anonabox will have more success than Safeplug because it's open source. Selling a black box to the privacy conscious never sounded like a good idea.

josu3• 12 years ago

Yeah, it seems that they are marketing to different groups of people.

acabal2• 12 years ago

That's a huge and critical difference. Open source down to the hardware is the only way you can be sure that what you're getting is actually Tor and not Tor + secret backdoor. (Though I suppose you still have to trust the hardware manufacturer, but the buck does have to stop somewhere.)

sbierwagen2• 12 years ago

Note that Tor is still being actively funded by US law enforcement (http://pando.com/2014/07/16/tor-spooks/) and that Tor's security has been repeatedly broken by US law enforcement in order to take down sites illegal under US law. (http://www.wired.com/2014/09/fbi-silk-road-hacking-question/)

It is debatable if Tor provides any more security than just using someone else's open wifi point. Great for evading bans on online forums, worthless against the DEA.

greenyoda• 12 years ago

Not sure why the above post is being downvoted. I read the Pando article, and it seems to be a comprehensive and well-researched piece that documented:

- How Tor was created by the U.S. government (Naval Research Lab) for the purpose of providing anonymity to intelligence agencies. It is now also widely used by law enforcement agencies to maintain anonymity in criminal investigations.

- How the project was funded primarily by intelligence agencies.

- How the NSA, which can monitor a large fraction of internet traffic, can unmask Tor users by correlating traffic directed at Tor entry points with traffic observed at Tor exit points. Snowden's leaks revealed that the NSA was working on breaking Tor anonymity and believed its efforts were "pretty much guaranteed to succeed".

atmosx8• 12 years ago

The above comments is downvoted IMHO because of: It is debatable if Tor provides any more security than just using someone else's open wifi point.

That's absolutely not true and if the author doesn't understand why, then he doesn't have a clue about what he is talking about.

rsync2• 12 years ago

On the one hand, I frequently (and loudly) point out to people that Tor is US Govt funded, etc. - I think it's important that everyone be aware of that.

OTOH, I am not sure this is a bad thing, at least in terms of the "legality of Tor" ... it's often discussed whether simply using Tor will, at some point, be legally questionable and I think there is a built-in legal defense here: How can merely using Tor ever be illegal if it is currently funded by the government ?

atmosx8• 12 years ago

Yeap at some point in time ARPANET was a military project too. So where drones, small GPS devices (iPhones?!) and google glass-like equipment :-)

dublinben• 12 years ago

As a user and proponent of Tor, I think products like this are a bad idea. Buying a box that promises "reliable anonymity" without understanding all the behavioral changes necessary to support that is dangerous.

Educating users all over the world on how to resist censorship and protect their anonymity is important. Buying a piece of hardware doesn't achieve that.

pfg2• 12 years ago

Pointing out that just using Tor without changing your behavior might not be enough is definitely important. Using a separate piece of hardware that's dedicated just to routing all your traffic through Tor still has a lot of security benefits, since it limits the target surface just to Tor (and the OS stack required to run Tor), as opposed to your browser, OS or any other software you might use that could potentially leak your true identity.

atmosx8• 12 years ago

What benefits does it have (except anonymity)?

opendais5• 12 years ago

No, it doesn't.

You are sorely, severely mistaken and misguided (just like the people creating this Tor product).

since it limits the target surface just to Tor (and the OS stack required to run Tor) as opposed to your browser, OS or any other software you might use that could potentially leak your true identity.

That is completely 100% false. The attack surface of the browser remains along with the attack surface of the OS. All this does is mask your IP address/network origins.

Tor is no more effective at "reducing the attack surface" of your OS & Browser as a VPN.

atmosx8• 12 years ago

I'm 100% that most of the people who use tor through these devices, use it because it's cool. They will try login to their Gmail account and their Facebook page or watch Netflix through it. Some might use it for torrents. That's about it...

I don't believe that it will be used to anonymise their internet profiles. They probably need just some sort of authority circumvention.

opendais5• 12 years ago

That is what I'm afraid of. Popularizing Tor in this manner is actively harmful to the Tor network and doesn't provide any real benefits. Tor operates its network on a limited budget.

The people this is marketed too should use a VPN if they want to circumvent local network policies.

https://blog.torproject.org/blog/bittorrent-over-tor-isnt-go...

The attack is actually worse than that: apparently in some cases uTorrent, BitSpirit, and libTorrent simply write your IP address directly into the information they send to the tracker and/or to other peers. Tor is doing its job: Tor is _anonymously_ sending your IP address to the tracker or peer. Nobody knows where you're sending your IP address from. But that probably isn't what you wanted your Bittorrent client to send.
So what's the fix? There are two answers here. The first answer is "don't run Bittorrent over Tor". We've been saying for years not to run Bittorrent over Tor, because the Tor network can't handle the load; perhaps these attacks will convince more people to listen. The second answer is that if you want your Bittorrent client to actually provide privacy when using a proxy, you need to get the application and protocol developers to fix their applications and protocols. Tor can't keep you safe if your applications leak your identity.

mrbill• 12 years ago

Also see the PORTAL travel router: https://github.com/grugq/portal

It uses the GL-Inet travel router. They already run OpenWRT by default and have both LAN and WAN ports. Eliminates the problems of Kickstarter.

I may do this tonight, as I have a few of them at home (they're great for "need a wifi bridge", "need a repeater", "friend needs a replacement router" type tasks).

http://www.amazon.com/Gl-iNet-Router-Openwrt-Mobile-Control/...

adultSwim• 12 years ago

Does anyone know if the following is a good idea:

Run two SSIDs on a router: one regular internet, the other TOR only. TOR would be running on the router itself.

Are routers too underpowered to run TOR?

PORTAL looks good. Not sure why it has to have a separate 3g modem/wireless card. Any good reason to avoid ethernet? Reason to have this as a separate box?

atmosx8• 12 years ago

Hello,

I won't comment on the configuration because I don't know what you'd like to achieve.

A router could run a tor node if the traffic is limited. If the traffic up/down increases (e.g. 50 Mbits up/down) then it can't handle on-the-fly encryption/decryption.

However, you could install/run a tor node (private) on digital ocean for 5 USD/month and route all your traffic through the VPS.

You could use Tor Browser or custom running on your Desktop. The configuration depends on how often you use tor and for what reason.

rsync2• 12 years ago

What hardware is that ? Is that custom designed for their project, or are they using an existing travel router whose form factor I have never seen before ?

I am always interested in the smallest possible non-wireless device with two ethernet ports ... all of the dual ethernet tp-link devices have wireless capability, so they are disqualified.

Related: this, and every device like it, should be a plug ... even at the expense of compactness...

atmosx8• 12 years ago

Hm, Carambola (without the WiFi module)?

noyesno• 12 years ago

Though they claim to have designed the hardware themselves, it looks very much like the NEXX mini-router:

  http://www.atupapa.com/17043400030en.html
  http://www.nexx.com.cn/index.php/home/detail?pid=199

atmosx8• 12 years ago

Apparently the product was a huge success. I don't understand it's use case. Seriously I don't:

* Is it hard to buy an RPi and set-it-up for a home Tor node? * To buy a VPS and setup a Tor-node then route all the traffic through it?! * Run tor-browser on your desktop when/if you need Tor?

A use how has avg Joe's internet's workflow through Tor, protects himself from whom? Rogue internet caffe access points?!

Anyway it seems neat but to me is pointless.

vertex-four2• 12 years ago

I don't understand it's use case.

If there's a chance that the Government or some other entity will come after you for whatever you're doing on Tor, and you don't want there to be any way that your machines (clients or servers) could leak their public IP address, you could put them behind this.

opendais5• 12 years ago

They can deanonymize you at the NSA's scale. They can deanonymize you with browser exploits at the FBI's scale.

If you are going to be actively targeted using Tor is not sufficient.

Tor is an effective defense against passive, generalized surveillance. It isn't effective against FBI/NSA-level resources because they will just drop 0 days in your path until you get hit by one.

acabal2• 12 years ago

* Is it hard to buy an RPi and set-it-up for a home Tor node? * To buy a VPS and setup a Tor-node then route all the traffic through it?! * Run tor-browser on your desktop when/if you need Tor?

Well... yeah, it is hard. It's undeniably much, much harder than buying a box and plugging it in, even if you're the kind of person who thinks configuring a VPS safely for Tor, then flawlessly configuring local network routing is an easy task. Hell I'm certified nerd and I'd still be scared to (flawlessly) do that. Not to mention a box is cheaper than a monthly VPS.

Tor browser is slightly easier but still crappy, because as the Kickstarter says it's just your browser and less tech-savvy people might wrongly equate "my browser" with "all of my computer's internet activity".

This project is a fantastic idea.

Xeoncross2• 12 years ago

My problem with this is that I only want 10% of my traffic filtered over tor. This is useless to most people that want to stream movies or need some of their traffic over a regular network.

I guess that you use the wired connection for Tor, wifi from the router for everything else? Then you still have to enable/disable the network card you want to use at the time.

The current tor browser is perfect. I just switch back and forth between it and my regular browsers as needed.

corysama• 12 years ago

If you are using Tor for a serious reason, you should have separate machines for Tor vs non-Tor activity. There was recently a high profile case (silk road?) where a user forgot to switch browser modes once before logging in to an monitored account to post a quick comment. It only takes once.

Xeoncross2• 12 years ago

Good point, better safe than sorry, but in my case (and probably a large number of Tor users - I don't use Tor for "serious" reasons. Mostly to support privacy.

fuzzywalrus• 12 years ago

I'm pretty sure a VPN would achieve the level of security that most users looking for a "Tor" router would want, as Tor is a bit overkill, and silly if you're willing to commit to the behavior changes to make it effective.

Perhaps someone should partner with a popular VPN like PrivateInternetAccess or another major VPN, as it'd allow people to continue using the services they know and love, and keep some of the prying eyes away from their unencrypted traffic.

Anonabox: a Tor hardware router

Related Stories