Tor Browser 4.0 is released

https://blog.torproject.org/blog/tor-browser-40-released

by conductor • 12 years ago

319 102 12 years ago

blog.torproject.org

nemesisj• 12 years ago

The Tor project is really important, and I'm really glad the EFF supports it. It's come a long way in the last 10 years too. For about a year I ran a fairly high traffic couple of exit nodes (circa 2004) and it was a really scary experience - constant legal threats, phone calls from people screaming that we'd hacked their servers in the middle of the night, and several conversations with the lawyers of big media companies. People who run exit nodes have some serious stones. It was finally too much, despite the crew at the EFF being really helpful when we called asking if they might help us navigate some of the more intimidating legal waters.

All this to say, I'm really impressed at the lengths the project has gone (and continues to go) to make Tor safer, more accessible, and easier to use for nontechnical folks. I just downloaded and installed this, and it worked, and worked well. A far cry from the earlier days. Cheers to Tor and the people working on it, running exit nodes, bridge nodes, and offering legal support to those that need it.

s_q_b4• 12 years ago

I run one. I tell anyone who complains that's legal, explain Tor, and send them the form letter, and then never respond again. Three years running, and I've never been sued or otherwise affected.

GFischer• 12 years ago

Thank you for running a node. I'm very grateful.

click170• 12 years ago

For those wondering which form letter parent is referring to.

https://trac.torproject.org/projects/tor/wiki/doc/TorAbuseTe...

https://blog.torproject.org/blog/tips-running-exit-node-mini...

DINKDINK3• 12 years ago

What stops someone from masking their own behavior by falsely attributing it to a TOR user. That is, someone runs a TOR exit relay and whenever a complaint comes in for an action actually executed by the relay host, falsely attributing it to a TOR user.

imaginenore• 12 years ago

What happens when somebody tries to do something really bad from your IP? Like hacking government sites, offering child porn, etc?

blacksmith_tb• 12 years ago

Though their TOS seems to forbid running an exit node, I run a fairly big relay on one of my Digital Ocean droplets - even the $5 instances have a ton of bandwidth which can be donated, if you aren't using it all for other projects.

KnightHawk3• 12 years ago

They haven't shut you down from all the DMCA requests?

tacoman3• 12 years ago

I use Tor every day for random ordinary things, like looking up recipes or researching banal purchases. The responsiveness of the Tor network has improved dramatically in the last year.

It seems that the biggest threat to the Tor network right now, are web sites that treat Tor users differently. For example, Cloudflare is currently serving captchas to Tor users. It's an automated response based on reports of abuse from the exit node IP at some point in the past.

Some individual sites have been doing this for a while to tackle abuse problems, but for a service that handles as much internet traffic as Cloudflare does, this is not a good sign for Tor.

https://blog.torproject.org/blog/call-arms-helping-internet-...

dmix• 12 years ago

Ugh yeah Cloudflare will make TOR unusable for casual use the more popular it gets.

ensignavenger• 12 years ago

Any thoughts on how cloudflare and others should go about things differently? They certainly have a compelling motivation for their actions.

hippich• 12 years ago

Is there a way to run a node which does not route exit traffic at all? if so - I still think it is great to help grow network.

IgorPartola• 12 years ago

Yes, it's called a relay, and it's very easy to configure. If you do this, your exposure would be minimal, while providing a huge benefit to the Tor network. See https://www.eff.org/torchallenge/what-is-tor.html

okbake• 12 years ago

As already mentioned, you can run a relay. You can also only allow exits out of certain ports. So if you only wanted people to use your exit node for IRC, you can specify that in your exit rules.

mrinterweb4• 12 years ago

This may be stupid, but I am slightly concerned about visiting anything related to Tor or security because of my fearful suspicion that the NSA will flag me for closer observation. That said, me frequenting a site called "Hacker" News probably sets off some red flags somewhere anyway.

scrollaway• 12 years ago

You're on their list for that comment alone.

The TLDR of the situation is that you shouldn't worry about what the NSA flags you as. They flagged everyone. Just assume you're on their list because you probably are anyway.

kissickas• 12 years ago

The Snowden releases have done exactly that - in a perverse way, they make me take many more risks online. "Everything I do is already being tracked, so I might as well search for that new Daesh (IS) video."

justcommenting2• 12 years ago

No--Everyone is on the NSA's list, that is unjust, and I would encourage you to join others to work for justice by increasing the cost of suspicion-less surveillance through mutual aid and solidarity, like using the Tor Browser Bundle.

walterbell2• 12 years ago

Professional surveillance usually outwits amateur thought self-policing. May as well enjoy freedom of thought instead. With more anonymous traffic, all parties are incented to raise their game.

Does HN support Tor?

Edit: read City and the City by China Mieville?

privong• 12 years ago

Does HN support Tor?

What do you mean by "support"? You can access HN through tor, though sometimes it is blocked (perhaps depending on which exit node you happen to be routed through).

mrinterweb4• 12 years ago

I wasn't making the assertion that HN supports Tor. I was just joking that some dumb flag bot in NSA's network likely flags all users visiting sites with words such as "hacker".

I feel that fear of big brother is a limitation on citizens personal freedom since people will be more guarded about what they say, inquire about, and behave. No shifty behavior. The constable may be watching.

krapp2• 12 years ago

That said, me frequenting a site called "Hacker" News probably sets off some red flags somewhere anyway.

Probably less the name of the site as the confluence of money, power, technical expertise and occasionally violent anti-government rhetoric. Honestly, I find it surprising how many people seem to feel perfectly safe here while avoiding Facebook, Google, etc.

mrinterweb4• 12 years ago

I think it was this article that makes me think that the NSA targets users inquiring about Tor: http://motherboard.vice.com/read/how-the-nsa-targets-tor-use...

PavlovsCat2• 12 years ago

I look at it this way: a future for humanity where everybody is cowering before "big brother" is not worth calling that. So, why would I prepare for a case that is so bad that any nuances in it are essentially meaningless? Instead, I would rather be counted as someone who bit back at the very least, no matter in how small and futile a way. If the revolution comes, that will be my Persilschein, and if it doesn't, I'd rather be taken away sooner than later. You might say, I'm not as worried about "evil" people with power not liking me because they project their own sickness, I'm rather worried about good, powerless people not liking me for IMHO correct reasons.

sroerick4• 12 years ago

Cheers. Thanks for your bravery.

I've likened it to that scene in V for Vendetta. They can only take what you give them.

chatmasta• 12 years ago

I went to a privacy conference in Europe this summer, featuring a former NSA official. The organizers explicitly asked me if I wanted to "be on the list," so of course I said yes.

To my dismay, the TSA did not attempt to search me at my home airport. Perhaps the data had not propagated to screeening yet. Regardless, it seems harder than I initially thought to get onto one of these NSA lists.

frostmatthew• 12 years ago

I am slightly concerned about visiting anything related to Tor or security because of my fearful suspicion that the NSA will flag me for closer observation.

This is exactly what's wrong with the whole situation.

mrinterweb4• 12 years ago

I wholeheartedly agree.

sroerick4• 12 years ago

Don't be a coward.

Read whatever you want to.

For all the hullabaloo about censored books, surveilled reading is just as much of a threat to the formation of free ideas as censorship, if not more so.

DINKDINK3• 12 years ago

Easier to be a hero if you're an American citizen but the FBI and NSA has a history of extorting people with tenuous citizenship:

http://www.amazon.com/The-Terror-Factory-Manufactured-Terror...

higherpurpose• 12 years ago

You're right. That is stupid. That's exactly what NSA wants. For us to not even bother to try to use more privacy-friendly tools because "they may be watching us". Guess what. They are already watching us. All of us. Do you really think you have to be on a "Tor list" for the to spy on you?

They have alerts on everything. If you say something they may not like online, you're probably already on a list. Tor or not.

panarky• 12 years ago

The best way to fight this is to make the list of suspicious people so long that it's intractable to pay attention to any of us.

nathanm412• 12 years ago

I feel that since I truly don't do anything that the NSA could be interested in, if I do something that puts me on their list for higher monitoring, I'm just wasting resources that they could be spending on looking for people who might be communicating with another Snowden. If I download and play with Tor, I'm really helping out people who are trying to exercise their rights. If the NSA 'list' includes everybody, then the list doesn't really have much value to them.

junto• 12 years ago

I think you have the wrong end of the stick. The NSA are making it their business to remove people who aren't interesting from the list of EVERYONE!

vdnkh• 12 years ago

I feel that since I truly don't do anything that the NSA could be interested in

How can you confidently say that you know what the NSA is interested in?

caio19822• 12 years ago

Can someone running an exit node in Brazil comment on how difficult it is (if it is at all) to do so given crazy local cable companies and the country's legal system? Any troubles so far? Worth the risk?

rcamera• 12 years ago

I didn't have the guts to deal with all the possible legal problems that an exit relay could spawn, and no lawyers I could find could help me with that question.

I suggest you run a non-exit relay instead, like I did for almost a year (at home). About to put it up again, after 3 months offline, now that I got better hardware to do it. Didn't have any trouble from my ISP, which was Tim, but I think that the biggest reason for that is that they are new in the business and they are trying to make things as painless as possible. It was a heavy traffic relay, I was limiting it to 4gb per day up/down bandwidth, which is quite alot, and never heard any complaints from Tim.

caio19822• 12 years ago

Thanks!

duckingtest2• 12 years ago

Tor Browser is an abomination. I don't know of any other software with lower ratio of real security to expected security (by the average user). See the Freedom Hosting story [0] for an example why. This time it was about pedophiles, but this danger holds for everyone, from users of silkroad clones to opposition in totalitarian countries.

Tor Browser is making tor more accessible to average computer user in the same way selling minefields cheaply makes real estate more accessible to average human.

The only reasonable way of using tor for even remotely illegal purposes is by using whonix, or roughly equivalent schemes (eg. a tor-only router + tails).

[0] http://nakedsecurity.sophos.com/2013/08/05/freedom-hosting-a...

tete• 12 years ago

Keep in mind however that using a LiveCD means that you will lose your guard nodes, which may make it easier for an attacker to deanonymize you over time.

Also Tor Browser is usually better than using Tor + another browser.

Explanation about attacks: https://blog.torproject.org/blog/improving-tors-anonymity-ch...

wyager2• 12 years ago

The vulnerability you mention either only affected or was only used against older Windows boxes (I can't remember which).

The security of the TBB is generally limited by the security of Firefox, which is not awful.

duckingtest2• 12 years ago

Security of firefox is beyond awful [0]. The same is true of all currently used browsers - almost certainly each has several unpatched remote code execution holes. The overwhelming majority of professional bug finding people are either working for the government(s) or selling bugs/exploits to them. These bugs aren't getting reported to the vendor. The occasional ones that are, are either reported by hobbyists, or professionals for marketing purposes.

You're the perfect example why tor browser is so bad.

was only used against older Windows boxes

It was only used against windows systems, but it was a firefox exploit.

[0] http://www.cvedetails.com/vulnerability-list/vendor_id-452/p...

tacoman3• 12 years ago

I would tend to agree with this overall. I'm a daily user of Tor for random browsing, but I use it on what is essentially a throw-away tablet using a Tor-only router.

e.g.

https://rednerd.com/2014/10/16/tor-transparent-proxy-on-a-gl...

https://rednerd.com/2013/12/07/portal-for-debian/

Using the TBB gives me the feeling of painting a giant target on my back.

Teapot• 12 years ago

The NSA and other agencies around the world already has you targeted. Tor makes you safer. Tor makes you aware of risks. This is also good since you are now better suited to defend yourself accordingly.

munchhausen• 12 years ago

Uh...you use some pretty strong language there. Can you provide technical information that will help me understand why is the Tor Browser an abomination?

Apart from the obvious (Firefox vulnerabilities, dangers of running Javascript or other plugins, etc.) weaknesses, I mean.

arj• 12 years ago

The ability to update easily is a very nice addition

Cakez0r• 12 years ago

And a nice attack vector

csandreasen2• 12 years ago

I'm sure most of HN knows this already, but I've run in to enough people that used Tor but weren't aware of these that I'll post anyway. Some things to keep in mind if you're going to use Tor:

- The exit nodes can see all traffic being routed through them[1]. Be wary of using Tor for regular web surfing - the exit node can not only monitor any unencrypted traffic, but can also inject browser exploits, attempt to strip SSL[2], etc.

- HTTPS Everywhere is only enabled for sites that the EFF has whitelisted[3]. Even if a site supports SSL, don't expect HTTPS Everywhere to automatically send you to the encrypted version - always doublecheck.

- NoScript is not enabled by default in the Tor Browser Bundle[4]. Don't expect it to protect you from malicious Javascript exploits out of the box.

If you absolutely must use Tor for something, the safest way to do so is to connect to Tor, make whatever connections you need to make (and only those connections), then immediately get off.

[1] https://www.torproject.org/docs/faq#CanExitNodesEavesdrop

[2] http://www.thoughtcrime.org/software/sslstrip/ (it's long, but the video is worth watching)

[3] https://www.eff.org/https-everywhere/faq#automatic-https

[4] https://www.torproject.org/docs/faq#TBBJavaScriptEnabled

sroerick4• 12 years ago

What about the use case of using Tor in order to expand the network for those that really need to use Tor?

I will take your advice to heed if I'm ever in a truly sensitive situation, but I use Tor out of solidarity. Do you think that's unwise?

csandreasen2• 12 years ago

I was referring to using the Tor Browser Bundle or any other client to access the internet over Tor, which has different security implications than running an exit node or relay.

That said, feel free to use it for whatever you want - just be aware of the tradeoffs/risks. You can't just turn on Tor and assume that you're instantly more anonymous and secure - to achieve that, people need to completely change their browsing habits. Surfing the web through Tor without taking extra precautions is essentially saying "I don't trust the web site I'm visiting or any node between it and me, but I will implicitly trust this random group of volunteer exit node operators who have assured me that they have no malicious intent."

rando289• 12 years ago

No. I think thats very wise and I've heard it recommended by some smart people. I think the OP is overreacting a bit.

hackuser• 12 years ago

Do you mean that Tor adds risk over 'normal' web use, or that Tor is not as secure as people think?

The only added risk I see is that an exit node arguably could be more likely to attack the user than an ISP, but I think the difference is that attack in different ways. Most ISP's attack confidentiality as part of their business, though probably they don't insert browser exploits.

stephen_g• 12 years ago

It's a trade-off. If your ISP chooses to, they can monitor non-HTTPS traffic while knowing exactly who you are.

Whereas a Tor exit is more likely to snoop, theoretically they should have no idea who you are (as long as you don't send any identifying information in plaintext).

I think the most important thing is that we should try and make the implications of both clear to as many people as possible.

Maakuth• 12 years ago

If you are a bad actor, you can run a Tor exit node and do whatever you like with other people's traffic passing by. This is similar to what you could do if you hosted a public wifi hotspot. While ISPs are in power to do such evils to their customers, it wouldn't be a sustainable business model to for example fish for credentials in their customer traffic. For an exit node administrator, this is entirely possible. Tor project monitors for bad exit nodes, but traffic eavesdropping for example is something they can't detect.

Aissen• 12 years ago

There's a new feature in this week's release of HTTPS Everywhere (4.0.2): HTTP nowhere. You can now block all non-HTTPS requests.

sp332• 12 years ago

I'm using 4.0.2 but I don't see this option anywhere.

antman• 12 years ago

There is HTTPS-Finder that auto creates the rules for HTTPS-Everywhere

https://github.com/kevinjacobs/HTTPS-Finder/tree/master/dist

wtallis• 12 years ago

FYI, even when NoScript is operating in blacklist mode rather than whitelist mode, it still offers a bunch of protections. The Tor Browser Bundle ships with the NoScript extension enabled but configured to operate in blacklist mode.

UhUhUhUh2• 12 years ago

I've always wondered whether it would not be possible to split the outward packet in, say, 2 and recombine it at its final destination.

geekam• 12 years ago

Question: What are the benefits one gets to run a Tor exit or relay node? Is it plain humanitarian deed or is there anything for profit as well, even a minor one.

devicenull2• 12 years ago

You get to respond to a continuous stream of DMCA and abuse complaints!

middleclick• 12 years ago

I don't know how true this is? I have talked to someone who runs one of the bigger exit nodes and he said that he used to get barely one or two abuse complaints in months.

zo1• 12 years ago

At some point, someone linked to a site that let people donate or bounty-out for people to run Tor exit nodes, or relays. Can't remember the details, or the url, though. I've been looking for it...

IceyEC• 12 years ago

after a certain point, the torproject sends you a tshirt[1]

[1] https://www.torproject.org/getinvolved/tshirt.html

WhitneyLand• 12 years ago

Really nice to hear about out-of-the-box uncensored web browsing in China. It's probably only temporary in the ongoing cat and mouse game, but still good to have the win.

netheril962• 12 years ago

Maybe there are not many Chinese here on ycombinator, but Tor is mainly used by us to bypass the Great Firewall. And I do not mean to read articles or profess opinions that are antithetical to Chinese government, but simply to access many useful resources. Many tech blogs are blocked, for example, because they are hosted on blogspot.com

For me, at least, I don't really care about security, but usability and stability.

TazeTSchnitzel• 12 years ago

Would you get in trouble with the government if they knew you circumvented the firewall?

gedrap• 12 years ago

They already know and don't seem to mind a lot. They just disable all VPN traffic, etc during sort of special political periods e.g. Tienanmen square events anniversary.

netheril962• 12 years ago

There are always some people who try to circumvent their censorship, and it is not worthy of their time trying to block every one of them, as long as the majority of people are properly confined.

Well, that is my speculation. I never get into any trouble for breaching the firewall.

edwinyzh• 12 years ago

I'm not sure if I was doing anything, but it failed to connect to the Tor network (both direct and bridged mode) in my country - China...

dobbsbob• 12 years ago

Try connecting to an obfsproxy3 bridge https://www.torproject.org/projects/obfsproxy.html.en

Can get bridges here: https://bridges.torproject.org/bridges?transport=obfs3

guipsp• 12 years ago

I really like the style guide of MEEK.

https://trac.torproject.org/projects/tor/wiki/doc/meek#Style...

Tor Browser 4.0 is released

Related Stories