Tor Browser 6.0 is released

Re:Tor Browser 6.0 is released by auganov on Tuesday May 31, 2016 @07:47AM (#11805972)

Tor is not enough to ensure even mediocre privacy. Just proxying everything through Tor would give people a very false sense of security (and break UDP amongst others).

There are VMs that do that but still wouldn't recommend that to someone that doesn't understand tor and networking. Even inside such a VM you'd still use Torbrowser.

It combines Tor and app-level security/privacy measures in an accessible way.

[ Parent | on HN ]

Re:Tor Browser 6.0 is released by vox_mollis on Tuesday May 31, 2016 @10:44AM (#11806787)

Tor is not enough to ensure even mediocre privacy.

I'm curious why you believe this, outside a few watering hole attacks, and the (now-patched) CMU attack. Given a known-good entry guard, where is Tor broken?

[ Parent | on HN ]

Re:Tor Browser 6.0 is released by schoen on Tuesday May 31, 2016 @12:59PM (#11807816)

The parent commenter is referring to application-layer attacks, which is why the Tor Project deprecated things like TorButton in favor of a dedicated Tor Browser, and why they discourage things like having a router that sends all traffic over Tor by default (because random applications will reveal trackable identifiers!).

https://www.usenix.org/legacy/event/leet11/tech/full_papers/...

https://www.torproject.org/projects/torbrowser/design/

There's probably a more specific statement from the Tor Project that I'm forgetting at the moment that sets forth the idea that you should only use Tor with Tor-aware client software (that controls what privacy leakages may occur at the application layer).

[ Parent | on HN ]

Re:Tor Browser 6.0 is released by auganov on Tuesday May 31, 2016 @12:57PM (#11807793)

Not broken. Exit nodes. One has to assume all unencrypted TCP traffic will be recorded and potentially modified (MTIMed).

Consider we have that system wide tor proxy instead of the torbrowser bundle. Now exit node operators get all your TCP traffic. It's fine if one knows what they're doing[0], but if that was the default way for the average user to get on Tor? A privacy and security disaster IMO. Not only would we not provide mediocre privacy, we'd actually endanger people.

[0] and you've got proper stream isolation, which I'm not sure how possible it is system-wide with unmodified software

[ Parent | on HN ]

Re:Tor Browser 6.0 is released by jontas on Tuesday May 31, 2016 @01:00PM (#11807828)

Tor itself is not broken, but all it does is anonymize your traffic and therefore does not protected against exposure that comes form other sources. It does not prevent against things like browser fingerprinting (and other fingerprinting methods, see other comments in this thread), vulnerabilities caused by various content types (Flash/JS/Java) and a host of other issues an inexperienced user would not be aware of.

[ Parent | on HN ]

Re:Tor Browser 6.0 is released by ashitlerferad on Tuesday May 31, 2016 @11:15AM (#11806991)

I suggest you look into the fact that browsers now cater to web app capabilities before they cater to user privacy.

[ Parent | on HN ]