> I see this questioned regularly, and yeah it is generally a good idea. If you have a VPN provider that you trust to not keep logs, it can be a very good addition for your security setup.
Therein lies the problem. You can't trust VPN providers.
IMHO Even thought the provider would log it is still better than not using one in a lot of cases. If whoever can see my VPN address, he would otherwise see my real address directly.
In that way he has to find a way to get the VPN provider to give out my real address. What might be possible with a lot, but for sure not with all of them.
Also think countries, my country does barely have any contracts with other countries for crimes like this. So they would have to use a complicated way to actually force them to give out my data.
In most situations we are already way over the realistic damage done in forms of costs to catch the individual.
Yeah, GP is right in that you can't trust VPNs (for example, PIA is probably a massive honeypot for all we know.) However, if you're using a VPN outside of the jurisdiction of the "Fourteen Eyes", you've substantially increased the effort required for anyone outside of that VPN to monitor you.
> for example, PIA is probably a massive honeypot for all we know.
Why the 'probably'? Of course, no VPN-provider should be trusted at face value, but do you know of any sources that claim that Private Internet Access is in fact an elaborate honeypot?
I was just thinking that PIA would be the perfect candidate for a honeypot, especially since it's under USA jurisdiction. Does the "probably" make it sound like I'm making a claim? I can change it if you'd like.
I would have to agree with extra88, saying "for all we know PIA could be a honeypot" or "PIA would be the perfect honeypot" is every different from saying "PIA is probably a honeypot".
Looking at the argument though, even if it is a honeypot blowing it is a one-shot deal. The users are never going to trust PIA nor any other VPN that makes similar claims ever again. That means that they probably wouldn't spring the honeypot, if it is one, for anything but the biggest fish.
He did say "for all we know"; albeit that followed "probably a honeypot" rather than preceded it.
Frankly, I think you're all splitting hairs. Most of us understood the point he was making even if the phrasing of that sentence didn't flow as well as you may have liked.
This is not an attack on someone's use of language; merely a polite request to clarify a piece of ambiguous phrasing. If there are indeed sources that claim that PIA is acting as a honeypot, then that would be very interesting to know.
Yes, "PIA is probably a massive honeypot" is equivalent to "more likely than not, PIA is a massive honeypot." I don't think you mean that since you followed it with "for all we know."
Not any public sources, but I've personally seen a copy of the database and know that PIA was using a ridiculously vulnerable version of Kayako Fusion at the time.
Tbh, even if PIA is a giant honeypot, if you use public wifi and pay with a gift card you purchased with cash...it doesn't really matter in any substantial way unless they are willing to put boots on the ground to find you.
If they are willing to do that, even TOR isn't real protection due to the fact it can and will be breached in the event of an active attack by malicious nodes on both ends of the circuit.
A VPN you can buy relatively anonymously [e.g. disposable gift cards bought with cash] and use with common sense [e.g. Not via your home LAN] are an effective privacy tool.
However, 99% of people aren't going to go through that level of effort which makes them nearly useless for privacy purposes.
Yes but we've established the concern is someone knowing who you are, not what you are doing.
A MitM at the local wifi shop is going to know you are and what you are doing.
A MitM at a VPN you paid for with a gift card you paid with cash is just going to know which wifi shop you were at. If you never go back, odds are they can't figure out which customer you were.
"my country does barely have any contracts with other countries for crimes like this. So they would have to use a complicated way to actually force them to give out my data."
As far as you know. And that's exactly where the problem lies. You are trusting your adversaries to be honest about who they cooperate with, which is a great way to get screwed over, because your adversaries are adversaries.
So no, it still wouldn't necessarily be "better than not using one". The tradeoff is far more complex than that.
Cryptostorm are a decent VPN as they claim no logs are kept, however even if this is not accurate, their payment/token system allows you to access the service without linking it to you via a payment mechanism. To further cloud things you can pay with Bitcoin.
Yes, Cryptostorm is good for identity compartmentalization, and it's run by people who are passionate about privacy. That still doesn't mean their servers can't be compromised, or they can't suddenly decide to log everything one day. Their passion might even make them a target.
(I was able to find some information leaks in their forums, which I reported responsibly, but a malicious actor could have used to exploit an outdated module.)
Despite my less-than-chilly feelings about the service operator, I certainly wouldn't recommend anyone else trust them. An SSH tunnel over Tor (or even better, something like PORTAL) to protect against malicious exit nodes, where the endpoint is a VPS you rent with bitcoin not connected to your real identity, is preferable.
Cryptostorm (I love these guys) refuse to answer how they are in legal compliance with Canadian laws, which require VPN's to keep logs (they're Canadian fyi).
Best case scenario: They're an illegal operation who's defying local laws.
>> Therein lies the problem. You can't trust VPN providers.
Your link is borderline nonsense.
The only real evidence they give about not using VPN's is when hidemyass proxy gave up some Anon's in 2011. However, it very clearly states in the hidemyass TOS that their service is not to be used in illegal activity, which is exactly what the hackers who they gave up were doing. They only gave up the information after receiving a court order, even though they had seen the hackers in chats saying they used their service, at which point they did nothing until the government stepped in.
The only real evidence they give about not using VPN's is when hidemyass proxy gave up some Anon's in 2011.
Yeah, and you have no evidence that I don't have a nice bridge to sell you, so will you buy it?
Trusting by default and requiring evidence to distrust is a poor way to protect your privacy. VPNs - unlike Tor, for example - have no protection against logging by the operators, so why would one trust them? Because they pinky swear they won't log?
>> Trusting by default and requiring evidence to distrust is a poor way to protect your privacy.
Which is pretty much the default for anything you use on your computer.
- You ever install a software program?
- You ever click on a link in your email?
- You ever go to a site that contains malware that installs itself covertly on your PC?
- You ever open a JPG file?
- Use a cloud service?
- Save your pictures to Flickr?
- Ever use social media of any kind?
- Use any Google product or service?
- Use any Microsoft product or service.
The world is FILLED with UNVERIFIABLE information, the fact that people seem to put so much mistrust in a VPN provider when there's thousands of other ways and means to get to your data is well. . .absurd. Talking like you suddenly need some high level of verification that a VPN doesn't log your information when there's literally thousands of other ways to get at that information is completely myopic.
Just like your example with TOR, which recently has been shown to be not only insecure, but readily hackable, yet you seem to trust that far more blindly.
While there's no absolute security, I don't blindly trust random links and JPGs. JavaScript code running in Chromium and IE is actually "tethered" by two sandboxes, exactly because we don't trust it. Can some evade it? Sure. Is it the same as just trusting a statement in a site? No.
As for Google and Microsoft, I don't trust them. I give them my info with the expectation that it'll be shared with governments and other companies. I use their services despite that.
VPNs, on the other hand, are built in order to protect your privacy, so the same reasoning can't be applied.
As Tor, and beyond the fact that you didn't even bother to understand the links you posted (the first it's not even about any flaw in Tor), sure, it can be hacked if one manages to control 3000 nodes or have NSA-like capabilities in breaking crypto keys ($1 billion dollar custom-made chips, from your link!).
But a VPN doesn't even need to be hacked - though they can, and probably with less difficulty than Tor - all the operators need to do is set "log = True" in their configuration files. There is not even a semblance of a protection. It's just pinky swearing.
1. Not even about Tor, rather about Tor Browser, which is a modified Firefox and is optional to use (and 100% unrelated to Tor as a protocol or daemon). Complaints about this can be directed to Mozilla.
2. Pando loves to fear-monger about Tor and draw 'conclusions' without actually supporting them. Notice how they represent a blog post stating "incapacitated" (ie. affecting availability) as "exposed" (ie. affecting confidentiality)? Notice how Pando nowhere actually describes how a lot of 'fake' nodes could supposedly compromise users?
That's because they are not making a technical argument, and they don't understand the internals of Tor. They are just publishing a hit piece that sounds vaguely to the untrained ear like it might have some technical merit, without ever actually proving the assertion they're making. And their implied argument is wrong.
3. Ah, an actual issue with Tor. But look at the operative phrase: "The problem boils down to this – around 90% of Tor users are still using older software which can be hacked." It's an issue that has long been resolved, and was an implementation error rather than a fundamental issue with Tor.
--
You're really not the first to try and claim that Tor is "broken" by pointing at a bunch of articles like this. The reality is that none of it actually means that Tor is broken, and the one attack on Tor that does exist (and that is very expensive to pull off) isn't even clearly described in any of these articles.
If you're going to argue about the technical merit and security of different proxying techniques (because that's what they all effectively are), then at least inform yourself to a point where you actually understand how they work internally. Right now, you just look ignorant.
I think icebrained nicely covered the other few points, aside from "installing a software program" and "cloud services" - in which case, I'd recommend you look into package/executable signing, how it provides some guarantee of consistency, and how you can use it to avoid dodgy software builds. This kind of thing is also exactly why many people avoid proprietary software and 'cloud services', by the way.
While the advice is okay, the title is a huge turn off. There is no such thing as the Darknet. Please stop referring to the TOR network this way. It is harmful to the community and encourages journalists to write about TOR in a negative way!
I have a negative view of the Tor network, actually the name I use is indeed Darknet (or Deep Web).
My take is that it is valuable to use Tor to (try at least) to escape companies tracking and government spying.
But to visit any website only available on Tor network is not worth any effort on my part, as I have no doubt (currently) that it is all about illegal porn or illegal drugs and sinister scams.
Anyone care to give some counter argument to why this Tor Network deserves a positive light?
"s I have no doubt (currently) that it is all about illegal porn or illegal drugs and sinister scams."
You have come to your conclusion based upon nothing more than feeling, because if you had done any searching at all you would understand the answer to your question.
Everyone has heard the metaphor about leading a horse to water. In this case, it's more like the horse refuses to even be lead to the water but wants someone to go get a bucket of water and bring it to them. No one should or is gonna do it for you, especially since you have demonstrated a clearly exemplary amount of laziness in both effort and thought...
tldr
Tor sites != illegality
tor != darknet/deep web (eg, the darknet/deep web is much broader than just tor...)
To me, deep web means any website not indexed by major search engines... most of the deep web is accessible using a standard browser if you can find a link to it (many times, those links can be found by using the search engine of that website because most of their pages are not indexed for whatever reason)
So you are saying that there is a Darknet, only that it is different from Tor network, which use is solely to maintain someone anonymous and all the benefits it brings?
That contradicts the comment I replied to, that is why I framed my question that way. I assumed I should consider Tor Network and Darknet one and only (as it is the top voted comment on HN, it gave me the credibility credentials to trust it with no second thought).
Advocates for Tor say it supports freedom of expression, including in countries where the Internet is censored, by protecting the privacy and anonymity of users. The mathematical underpinnings of Tor lead it to be characterized as acting "like a piece of infrastructure, and governments naturally fall into paying for infrastructure they want to use".[139]
The project was originally developed on behalf of the U.S. intelligence community and continues to receive U.S. government funding, and has been criticized as "more resembl[ing] a spook project than a tool designed by a culture that values accountability or transparency".[20] As of 2012, 80% of The Tor Project's $2M annual budget came from the United States government, with the U.S. State Department, the Broadcasting Board of Governors, and the National Science Foundation as major contributors,[140] "to aid democracy advocates in authoritarian states".
Ok, I read that, but that and the other useful reply to my comment is that Tor is useful to communicate in anonimity, as I noticed when I said was valuable to escaping government spying.
But what confused me is that the top voted comment says that "There is no such thing as the Darknet. Please stop referring to the TOR network this way". This phrasing says two things to me, Darknet does not exist, all that exists is Tor network.
So I implied that visiting sites only visible through Tor was visiting sites of the so-called Darknet. And I assumed that what I called Darknet, actually is the Tor network, than all my prejudice against the Darknet should be aimed at Tor network, thus my question.
Now it looks the top voted comment is actually misleading. There IS Darknet, only it is not the same at Tor.
I've always taken darknet to mean a network physically separate from the Internet, like a wireless mesh or something along those lines. However it's definitely changed in usage to mean any network that's not part of the public internet, even if it's layered on top of it, freenet, tor, ipfs even.
i mostly agree. and even spend some actual thought on it. the point is there are good guides for tor, those work perfectly well for people with basic IT understanding.
I tried to target my keywords to people who miss that understanding. People coming directly from YouTube having no idea what it is all about. Those search for the darkweb.
Nation state agencies just go to upstream providers and grab traffic metadata there, your VPS/VPN not keeping logs won't help against a targeted investigation. Even just downloading Tor or Tails gets your IP "task queued" according to Snowden leaks.
You would want to both obtain and use Tor nowhere near your meatspace identity, pref with different hardware than you usually use, and leave your phone at home if protection from tracking is your highest priority.
Most countries can barely force any other country to give out consumer data from local companies. If you do not live in a five eyes state we can safely assume that nobody will target you that way for Tor browsing.
Then I believe we agree on this. I think many people would do well to include some overkill, in cases like this, to adjust for the risk of underestimating the difficulty 'killing' the problem.
To be fair, Qubes is arguably not really ready to be put into the hands of a casual computer user without specific threats yet. But for those who can handle it it seems like the most accessible option I've heard of for keeping the underlying system safe and preventing unmasking.
Accessing Tor "safely" is something over and above accessing the normal internet safely. Advice like "don't open PDFs" isn't very helpful. Nor is "don't use javascript" or "don't log into social media." Such inactions don't help you access anything safely, they help you not access things in the first place.
(1) Use a secure OS. Unless you are security guru, that should be some flavour of linux. A liveUSB of Tails is pretty idiot proof. It worked for Snowden.
(2) Don't run any web browser, tor or otherwise, under any sort of elevated privilege (ie not while admin).
(3) Understand how to verify a website's certificates. You can indeed log into social media safely via tor (ie your password won't be harvested by the exit node) if you know how to verify the website.
(4) Don't take anonymity casually. Understand why you are using Tor, what you are protecting, who your adversary is, and develop relevant procedures. Don't rely on easy checklists you find at Tor-for-Dummies.com.
> Use a secure OS... A liveUSB of Tails is pretty idiot proof.
That implies Tails is very secure. Why is that? Is it because it has never been hacked before or has Tails been shown to be virtually hacker-proof? As someone non-technical I might be misunderstanding something. If so, can you clarify that?
Tails is intended to be run on a USB drive. This means you can take nearly any computer, boot to usb, and have a operating system designed for security running in the computer's RAM. Many claim that this does not leave a trace of your activity in the computer itself.
It also comes with tor browser, electrum bitcoin wallet, and some GPG utilities preinstalled.
Microsoft backported a lot of the logging and tracking to Windows 7 and 8 as well. Not all of it, but enough to consider any computer running fully updated Windows to be user-privacy compromised.
Why does MSFT gets away with this. This is so evil. MSFT appearently spends a lot of money on paid commenters and lobbyism in general. Thanks god that XBoxOne, WinPhone are real flops - most aren't that stupid, for end users MSFT & Win are a burned brand names.
Go to any store, anywhere. What computers are they selling? Maybe Chromebooks, which are showing to be wildly popular. But they also get returned a lot. Why? Because the user expects X software to run on Y computer, and do not even know what an operating system is because we idled in complacency on Microsofts desktop monopoly for twenty years. Take note of how Walmart sells Ipads but not Macbooks.
The only alternative to Windows is ChromeOS. Which is not an alternative for even half of Widows' use cases, since there is no native application support and its app-store restricted. Half of Windows appeal is the lack of application lockdown to a store, albeit MS has tried their hardest with their Windows Store to stop that.
OSX is not an alternative, Apple Stores are fairly few and far between, and the cost of a Mac is prohibitive, and it would have the exact same software incompatibility problems as Windows. And modern OSX is code signing applications and is, for consumers, even more restrictive and draconian than Windows is - do you want your potential software users on iOS or OSX? I certainly do not, because that gives Apple absolute power to stop my software at their whim, or never approve it in the first place.
Ubuntu (or any desktop Linux) is also not an alternative, because, simply, its not there on the shelf next to Windows or ChromeOS. If Macs are inaccessible due to price and location, Ubuntu does not even exist - and it literally does not, given its market segment size. If Canonical wanted serious desktop adoption they would have to throw ludicrous money getting Ubuntu computers in front of potential users to purchase.
So of course MS gets away with this. Nobody is trying to stop them. And I doubt Xbone is a flop - it has sold 15 million units, half of the PS4 but still well on track to outsell the original Xbox in its lifetime, which only moved 24 million units in 5 years. I am insanely against consoles as a platform and pray they die finally and give consumers their hardware back, but that seems like a distant dream as well.
Lots of things leak information in ways that aren't considered and infection. Tools used to administer corporate infrastructure, for instance. Windows 10 might fit in that category too.
If anyone is interested, we (www.secfirst.org) just launched an Android open source app called Umbrella, which has lessons like this, along with a ton of other digital and physical security stuff. Everything from secure email to dealing with kidnap:
Actually it doesn't if you are using the lessons and checklists etc. It only applies if you want to use the feature that allows you to input your location and then pull updated physical security country data feeds from the UN and Centre for Disease Control.
Yep, we are in the process of sorting out it's inclusion. Hopefully should be there within 1 or 2 weeks. If you prefer a direct download version .apk then drop me a mail. You can find the code yourself at https://github.com/securityfirst/Umbrella_android. The code audit is on our blog.
We are hoping to do this in 2016, we currently looking for a non-profit funder to be able to develop it. We decided on Android first as it is dominant on cheap devices etc in the developing world.
This article has several mistakes and typos. I find it actually hard to enjoy reading it, and it also seems very superficial. Am I the only one to feel this way?
Thank you for this feedback. I usually dont write, it is just a topic where i felt that could need some noob friendly coverage and just started writing. If i even proceed i will look into someone that proof reads my blabber. It is also not my first language.
> The SOCKS server does not interpret the network traffic between client and server in any way, and is often used because clients are behind a firewall and are not permitted to establish TCP connections to servers outside the firewall unless they do it through the SOCKS server.
This is a very poor answer and, while I'm pretty sure that you're just trolling, Tor is important enough that your 'claim' really needs to be rebutted.
Consider a service like SecureDrop. Armed with SecureDrop, journalists and dissidents/whistleblowers can communicate in a more secure way.
Or, consider a publication like Propublica. They set up a hidden service so that they could talk about censorship in China...and hopefully allow Chinese citizens to read it without ending up in serious legal trouble.
Statements like yours are the problem and I seriously hope that you take the time to educate yourself. Ignorance may be funny to you, but it makes it more dangerous for legitimate activists and journalists to use Tor.
Why is a hidden service needed? If someone can access onion websites, they can access any site. All Propublica would need to do is make sure they don't block tor exit nodes (some CDNs like cloudlfare will).
I don't see what benefits there are of having a hidden service if you don't need to hide. The only thing would be encouraging/enforcing safe usage, but that doesn't enable anything, only forces people to use security that was already available.
(To be clear, I'm only talking about hidden services, not tor in general.)
>If the anonymous user connects to a part of ProPublica that isn’t SSL-encrypted—most of the site runs SSL, but not yet every page—then the malicious relay could read what the user is viewing.
So using a hidden service was easier to set up than enforcing SSL on every page?
>Or even on SSL-encrypted pages, the exit node could simply see that the user was visiting ProPublica. When a Tor user visits ProPublica’s Tor hidden service, by contrast—and the hidden service can only be accessed when the visitor runs Tor—the traffic stays under the cloak of Tor’s anonymity all the way to ProPublica’s server.
The exit node sees that someone visited Propublica, not who, or what was fetched. (Assuming it's over SSL.) That really doesn't seem like sensitive information.
I've always interpreted "darknet" to mean the content itself, rather than Tor. That would make the parent comment's question entirely reasonable, without saying anything about the usefulness of Tor.
That's a good interpretation and I'd do well to keep that possibility in mind. Sorry if I came across as too aggressive.
Based on the context, I assumed that the parent was talking about needing Tor to access the Darknet. If that's the case, the parent would be talking about Tor hidden services. While there are some really shitty hidden services, there are also some amazing applications - SecureDrop is one example.
Therein lies the problem. You can't trust VPN providers.
https://gist.github.com/joepie91/5a9909939e6ce7d09e29