6 ms·

Tor Browser 8.5

181 points by rahiel 7y ago

HNLurker2 7y ago
I wish people used the deep web for something besides illegal buying and child pornography
- mikeq101101 7y ago
  Thank you for your service.
- friendly_chap 7y ago
  I do and a lot of people I know also do. Just for added privacy, or anything sensitive but legal. Tor became such a pleasant (and fast, unlike it used to be) experience that it can be used for general anon surfing.
  - edoo 7y ago
    You have to be a little weary using tor. Anyone can run an exit node and it is trivial to rewrite and inject onto web pages. You can also on the fly intercept SSL requests and generate your own self signed certificate that fails proper verification but looks real enough if inspected that will always trick a percentage of users. If you've used tor with any frequency you've probably hit weird SSL cert errors that go away if you change routes.
    - cyphar 7y ago
      It is fair to say that using unauthenticated protocols like HTTP over Tor is a pretty bad idea (and there really should be more warning bells about this in the Tor Browser). However on the TLS comment -- almost all modern websites use HSTS, so sslstrip doesn't really work any more.
      - throwaway66hack 7y ago
        How about sslstrip2 ([1], check demo)? A weakness of HSTS is that is stored per domain and the exit node can also control your DNS traffic. I wonder how hard it is to pull this off as a Tor exit node, for local networks there are tools like bettercap [2]. [1] https://github.com/byt3bl33d3r/sslstrip2 https://github.com/byt3bl33d3r/sslstrip2 [2] https://www.bettercap.org/legacy/ https://www.bettercap.org/legacy/
        deleted 7y ago
        [deleted]
        cyphar 7y ago
        That is a pretty neat attack, but I disagree it would be useful against Tor. DNS traffic is funneled through a different Tor circuit than the web traffic. You'd need to apply the bad DNS to all users, which would almost certainly in your exit node being dropped from the network. I'm also not sure how this would be handled with HSTS preload lists -- HSTS preload applies to all subdomains so you'd need to come up with a completely different domain (and protections against homograph attacks mean that avenue is restricted). It'd probably be simpler to just set up an actual website with LetsEncrypt than to bother with stripping the TLS in this manner.
        throwaway66hack 7y ago
        You are right. With different Tor circuits, the attacker needs to control a lot of exit nodes to correlate the initial HTTP request to ssl-stripped page and the DNS query (to be a global adversary).
      - edoo 7y ago
        I mean you can intercept the request, retrieve the real cert, generate a self signed cert with the exact same details, then submit that to the user and be man in the middle. Of course the user gets the blank SSL cert error page on the browser, but a percentage of those users will override and continue. Copying the cert details increases that percentage as some will actually look at the invalid cert. It is quite blatant but it is just a numbers game at that point. If you ever hit an SSL cert error with TOR you should force a new onion path.
    - friendly_chap 7y ago
      To be fair I mostly use it for not overly sensitive stuff. Let me give you an idea: I prefer to not have my ISP log my requests to reddit.com/r/LSD. Not because I do anything illegal (I don't even take acid), but in this dystopian world where every action on the internet is recorded, the last thing I want is to end up on lists purely because of my curiosity. If I would do anything I could get into trouble for (which I won't), I would definitely research more about how to use Tor safely.
      - ikornaselur 7y ago
        Please correct me if I'm wrong, but can't your ISP only see that you're requesting reddit.com, as long as you're using https? Now sure, if you go to lsd.reddit.com, it can be logged as a subdomain, but anything beyond reddit.com shouldn't be viewable by your ISP. I'm not saying that you shouldn't use tor, just that as far as I understand, the whole request, including path and method, is encrypted over tls/ssl after your browser establishes a tcp connection to the server.
        friendly_chap 7y ago
        I do believe the url path is visible even over HTTPS. Off to do some research on this. Edit: apparently the url is not visible, but the domain (more like IP, which can be easily resolved to domain). Same thing still applies, perhaps not with reddit subreddits, but with specific domains/websites.
        tialaramex 7y ago
        With ordinary DNS you are asking in plain text hey, what's the IP address for reddit.com and it does not take a genius to guess that's because you're visiting reddit.com With HTTPS using TLS 1.2 or earlier the site sends its certificate in plaintext too, so even if you just remember the IP address, it will tell anybody snooping "Hi, this is reddit.com". In TLS 1.3 the site's certificate is encrypted. However the SNI, which is used to make virtual hosting work, is not encrypted. So your ISP can see where you said you were going, but not whether they proved they were the real deal. DPRIVE such as DNS over HTTPS cures the first thing, you use an encrypted transport to do DNS queries against somebody trustworthy who won't rat you out. eSNI (encrypted SNI) is intended to one day cure the other problem. Even with both these, seeing that you visited a very popular system like Facebook or Reddit is always going to be easy. So Tor remains important.
- Nursie 7y ago
  I've used it to maintain normal(ish) internet service for myself when visiting places like China.
  - edoo 7y ago
    When I went to China I expected problems so I setup my laptop with an SSL tunnel on port 443 to a virtual server and then routed openvpn over that. It worked like a charm. My favorite feature of openvpn is it can maintain state, so even if the tunnel resets and openvpn has to reconnect all the tcp connections just pick up where they left off.
    - mikorym 7y ago
      What is the difference between this and just having a normal SSH tunnel; for example, how does this differ from using sshuttle?
      - bepvte 7y ago
        For one, openvpn can use udp unlike ssh, which means the annoying overhead of double tcp is gone
      - edoo 7y ago
        Openvpn allows you to connect to and have a routable IP on the network. SSH tunnels are great for some things but being logically on a network is another thing.
    - walrus01 7y ago
      This will work for a short while, but consistent long term openvpn-matching packets are now seen the the GFW's automated dpi systems, eventually the IP of your non-china VPN endpoint will get blocked.
    - Nursie 7y ago
      That sounds much more prepared than I was, I arrived and then wanted a quick solution on the fly, Tor fit the bill nicely. I would probably use my StrongSwan IPSEC VPN setup to home now that I have one.
- sametmax 7y ago
  They do, not everybody enjoy democraty.
  - r3bl 7y ago
    Unfortunately, such cases will always be less appealing to write about compared to "assassins for hire on the dark web", leading to this wrong generalization of what Tor is about.
- cyphar 7y ago
  Less than 3% of Tor traffic is to onion services of any kind (which means 97% is to websites already accessible on the public internet), and the most popular onion service on the internet by a large margin is Facebook's (facebookcorewwwi.onion). More than 2 million people use Tor every day -- are they all bad people? Heck, government agents use Tor when traveling abroad. Do bad people do bad things using Tor? Yes. Do political dissidents in oppressive regimes use Tor? Yes. However the vast majority of people are just ordinary citizens using Tor to access the internet -- the cross-section of Tor users is the same as the cross-section of ordinary internet users.
  - dooglius 7y ago
    > the most popular onion service on the internet by a large margin is Facebook's How do you know? It shouldn't be possible to collect this sort of data.
    - tgragnato 7y ago
      Counting hits on HSDir(s) and extrapolating a statistic. Related: https://trac.torproject.org/projects/tor/ticket/8106 https://trac.torproject.org/projects/tor/ticket/8106
    - jandrese 7y ago
      Exit nodes can track which sites are hit to a degree. CDNs make this more difficult, but it's not too hard to figure out what percentage of your traffic is Facebook. It also won't work if you're going to the Facebook onion site of course.
      - deleted 7y ago
        [deleted]
      - cyphar 7y ago
        Exit nodes aren't used like that for .onion sites, so they cannot track usage of .onion sites. The way it works is that the client and server pick a "rendezvous node" (the server generates 6 HSDir entries, each with 3 random nodes every day, and the client picks a random HSDir entry and a random one of those node to use). Then, they communicate through the rendezvous node which doesn't know who the client or server are (because both are connected through Tor circuits and neither reveals the .onion URL that was looked up in the HSDir). The way the statistics work is that some Tor relays opt-in to sharing statistics about how many HSDir lookups happened through them, and then those figures are extrapolated to figure out how many .onion service accesses happen. The relay doesn't know which service is being looked up, and the rendezvous node doesn't know which service is being talked to.
- Izmaki 7y ago
  I wish people would at least learn the difference between "deep web" and "dark web". ;) I bet you use the "deep web" multiple times each week. The "dark web" on the other hand, probably not.
  - tgragnato 7y ago
    Depends who you ask. I transparently use the darknet continuously every day. Multiple home servers owned by me and my colleagues make up a VPN we share with friends and family. Amongst the trusted recursive resolvers we use there's the DoT v3 onion from Cloudflare. A proxy redirects our traffic for Facebook and DuckDuckGo over the respective onions, same for Debian updates. A next generation firewall inspects our traffic and use Tor for some websites that are censored or geoblocked.
- mikorym 7y ago
  If using the definition for the dark/deep web that I think, then it includes traffic to and from any networked entity that does not have a URL (or otherwise public frontend). This could then include stored data, VPNs or other company/govt/organisational data that is not accessible via normal web traffic.
  - bepvte 7y ago
    I believe thats just the definition for deep web.
    - r3bl 7y ago
      Both terms are just stupid. Deep web: stuff not indexed by search engines. Private forums, non-public social media accounts, Telegram rooms, Discord servers etc. are technically "deep web". Dark web: a subset of deep web that requires specific software or configuration to access. Slightly more precise, but still includes every possible use case for IPFS, Dat, ".onion" etc. Note that this is nowhere close to what people usually mean when they use the term "dark web". They're referring to the subset of a subset of deep web that's used for criminal activities.
      - rendx 7y ago
        There are gateways to onion services and IPFS, so those are "indexed by search engines" without any change necessary. Furthermore, any search engine has to be adapted to the medium used, and there are specialized search engines for pretty much anything including Freenet and I2P etc, so saying that the "dark web" is a subset of the "deep web" is incorrect. There is some overlap, but it's not a "part of" relationship. The problem is that there is one (academic) definition of "deep web", but many incompatible definitions of "dark web", invented by the media basically for whatever they want it to be.
- superkuh 7y ago
  I host all kinds of completely normal websites (ie, amateur radio) as tor hidden services. TOR is great because you actually own your domain instead of just leasing it on the whim of some corporation. Once you get past the controversy TOR hidden services are more like the 1990s web than what you describe.
Tinfoilhat666 7y ago
How is this better than Brave browser?
- mcjiggerlog 7y ago
  Tor Browser routes all data via the Tor network. Brave is a standard browser with built in ad-ware.
  - joshuakelly 7y ago
    This is amusingly uninformed. Saying nothing about the ad-ware comment, since that seems designed to deliberately obfuscate/obscure reality, you probably weren't aware of: https://brave.com/tor-tabs-beta https://brave.com/tor-tabs-beta To OP - check out the issues, there's a reason it's still in beta: https://github.com/search?utf8=&q=is%3Aopen+is%3Aissue+org%3Abrave+label%3Ator%2Fleakproofing&type=Issues https://github.com/search?utf8=&q=is%3Aopen+is%3Aissue+org%3...
    - trpc 7y ago
      This is amusingly uninformed. Describing Brave as adware is generous to say the least, Brave is more of a scam than a business. The kind of scams you would find in tech bubbles like what happened in late 1990s.
      - sjustinas 7y ago
        Could you elaborate? As far as I know, Brave promises to give you a browser and it gives you a browser. Does not sound like something I would call a "scam".
    - daxterspeed 7y ago
      Brave's "Basic Attention Token" was described as replacing ads on websites with ads from Brave's own ad network[0], which I recall is a common practice among adware to go unnoticed on an infected user's machine. The homepage of the Basic Attention Token completely fails to mention that it blocks publisher's "genuine" ads and replaces it with their own ads[1]. On top of that Brave has seemingly no interest in asking for consent for this practice, while also going as far as to use people's names and photos to solicit donations to them, without those people even being aware that Brave is accepting money for them[2]. Now I believe the ad-replacement feature is opt-in, but I'm not willing to install Brave and go through the opt-in flow to determine if it goes through the proper steps in explaining that the Brave Ad money may never reach its intended recipient. [0] https://cryptobriefing.com/what-is-basic-attention-token-introduction-to-bat-and-brave/ https://cryptobriefing.com/what-is-basic-attention-token-int... "Brave integrated BAT into its browser to block ads at the site level, and instead serve them through the browser itself." [1] https://basicattentiontoken.org/ https://basicattentiontoken.org/ [2] https://twitter.com/tomscott/status/1076160882873380870 https://twitter.com/tomscott/status/1076160882873380870
dessant 7y ago
I'm rooting for Mozilla and the Tor Project to uplift Tor into Firefox. Imagine a world where people need to opt in to get less privacy.
- JulianMorrison 7y ago
  The reason to have a Tor browser is that regular browser features aren't well suited to secure anonymous browsing. The reason to have a regular browser is that you want those features, and the low latency of a direct connection.
- tomatotomato37 7y ago
  It's interesting, the only way that would work is if they also turn every browser into a through node, which would be both highly controversial while also a great boon to the Tor network as a whole
  - close04 7y ago
    Using "Tor mode" instead of "private mode" in regular Firefox would be nice.
    - deleted 7y ago
      [deleted]
  - computerfriend 7y ago
    Why would that be the only way it would work? Because integrating Tor into Firefox is currently planned and making clients Tor nodes is not part of that plan.
- ve55 7y ago
  I'm not. I prefer the Tor Project to make their decisions independently of Mozilla, which has a worse track record in most areas. Additionally, tor isn't something that every Internet user should be using. I say this because when they get 10 ReCaptchas in a row, then try to log into their bank and have their credit card automatically frozen, then wonder why google search isn't working, then give up and just use Facebook all day anyway, they will definitely not be appreciating the 'anonymity' that we gave them.
Izmaki 7y ago
Allow me to send a big shoutout and my deepest thanks to the maintainers and volunteers of both the Tor Browser and the Tor Project in general. You make the world a better place, even if the majority of the population don't realise they should pay more attention to your work. You're the real MVPs!
- chii 7y ago
  more people ought to use TOR so that the users who _need_ tor gets the protection of anonymity in a crowd. If nobody uses TOR, then TOR users immediately becomes suspicious and nothing prevents the real world investigation from uncovering them.
  - dewey 7y ago
    Nitpick, but it’s Tor not TOR
  - Iv 7y ago
    I make everybody smile when I open Tor to watch some technical documentation. Still gave my boss a pause when I asked him if we were ever going to consider Google a competitor in any field (which we were in a niche field) and if he would be comfortable with a competitor owning the search history of all his employees.
  - loceng 7y ago
    Aren't large internet providers blocking TOR from working or am I confusing that with something else security related being prevented?
- kohnstamm 7y ago
  > You make the world a better place Do they? As far as I can tell, it's the world's premier human rights violation software, and the internet's child pornography backbone. Yeah, I'm aware of the official narrative of providing a shield for journalists from government snooping and so forth, that everyone blindly repeats. But I'm not drinking the kool aid. They really showed their true colors when they felt it necessary to publish a statement that they regretted that their software was used to distribute an obscure Nazi magazine. So much for their high ideals about freedom of speech. Apparently, the child abuse and cartel violence they facilitate is just collateral damage, but someone expressing extreme ideas was a little too much.
dmos62 7y ago
Are there any casual users of Tor around? Someone who does it not for the sake of safety, but just privacy? I'd happily use Tor, but the last time I used it (which was ~5 years ago), it was terribly slow for regular browsing (not streaming, or anything considered bandwidth heavy).
- neiman 7y ago
  What do you mean by casual? I use it relatively often, when I want to access a website privately (I don't trust any VPN service that much). I'm pretty sure I'm not the only person doing that. But maybe you mean if someone using it as the main browsing tool for privacy reasons? This I doubt, since it's indeed slow. I also don't think that Tor is meant to be used as your main browser really.
  - dmos62 7y ago
    That's pretty much what I meant my casual -- Tor as main browsing tool.
- pawal 7y ago
  Yes, I use it often. My Debian installations use Tor for installing updates. Just as an example.
- maeln 7y ago
  I use Tor/Tor Browser quite often. I use it mostly for privacy, but also to test a few thing like price of plane tickets and such. The speed is much better nowadays. Unless your unlucky and you circuit has a slow node in it (which the protocol try to avoid if i remember correctly), you should have a decent web browsing experience. Sure, it will be slower than your "normal" connection, but usually not by that much. Although, if you plan on downloading large files via Tor, you will hit a bandwidth cap fairly quickly. You can look in detail here: https://metrics.torproject.org/torperf.html https://metrics.torproject.org/torperf.html Available bandwidth quadruple since 2014: https://metrics.torproject.org/bandwidth-flags.html?start=2014-02-21&end=2019-05-22 https://metrics.torproject.org/bandwidth-flags.html?start=20...
- 7y ago
tptacek 7y ago
Tor Browser might be the least mainstream safe browser on the Internet: * It permanently tracks the lagging ESR Firefox. * It puts its users on Tor, which "anonymizes" them but also flags their traffic as interesting. * It collapses all those users down to a single set of browser releases, making it cost-effective to target exploits to. Use Firefox if you really like Firefox, but use the most recent version you can possibly get. Mozilla's is not the best-hardened browser. Use Tor if you really believe in Tor. But use it explicitly, not as part of a browser bundle. Your choice of browser has a significant impact on your operational security; don't let a bunch of volunteers at Tor make that decision for you.
- BenElgar 7y ago
  Though it's important to note that using Tor directly rather than the browser bundle means that your browser fingerprint is even more distinct than it would otherwise be.
- juliusmusseau 7y ago
  The one time I ever used the Tor Browser (at work, out of curiosity), my desk phone rang within 5 minutes: the in-house IT security team wanted to know what I was doing. So you're not kidding when you say it makes one's internet traffic more "interesting"!
- jancsika 7y ago
  > But use it explicitly, not as part of a browser bundle. I hope you're conflating two issues here. You surely aren't recommending users who "believe in Tor" install Tor directly and attempt to manually proxy their favorite browser traffic over it? Not to say I disagree with your points against using TBB.
  - packet_nerd 7y ago
    I do this, using an up-to-date chromium browser proxied through Tor for regular browsing. I do this instead of the regular Tor browser on the theory that there's less potential for 0-day exploits. Of course, this does compromise anonymity a bit in some respects, since there are probably few people who run chromium on Tor and because it's not as resistant to fingerprinting as the regular Tor browser. That's acceptable to me, as I only use that browser on Tor, and use another browser for things that could potentially leak my real identity.
rishav_sharan 7y ago
Dear lord, Windows antivir protection has gone full stupid with this. I am on Win10 and it will not allow me to install it in Program Files. If I install it in Desktop, it will keep flagging tor.exe as a virus. After marking 4 times that the Windows Virus and Threat Protection should restore the exe, i was able to start the browser. Then the windows antivir went full dystopian mode, and flagged it again. Now it is asking me to reboot the computer to delete tor.exe from the device.
aunetx 7y ago
Well thank you, we love you muchhh

Tor Browser 8.5

181 points by rahiel 7y ago

HNLurker2 7y ago

I wish people used the deep web for something besides illegal buying and child pornography

mikeq101101 7y ago
Thank you for your service.
friendly_chap 7y ago
I do and a lot of people I know also do. Just for added privacy, or anything sensitive but legal. Tor became such a pleasant (and fast, unlike it used to be) experience that it can be used for general anon surfing.
- edoo 7y ago
  You have to be a little weary using tor. Anyone can run an exit node and it is trivial to rewrite and inject onto web pages. You can also on the fly intercept SSL requests and generate your own self signed certificate that fails proper verification but looks real enough if inspected that will always trick a percentage of users. If you've used tor with any frequency you've probably hit weird SSL cert errors that go away if you change routes.
  - cyphar 7y ago
    It is fair to say that using unauthenticated protocols like HTTP over Tor is a pretty bad idea (and there really should be more warning bells about this in the Tor Browser). However on the TLS comment -- almost all modern websites use HSTS, so sslstrip doesn't really work any more.
    - throwaway66hack 7y ago
      How about sslstrip2 ([1], check demo)? A weakness of HSTS is that is stored per domain and the exit node can also control your DNS traffic. I wonder how hard it is to pull this off as a Tor exit node, for local networks there are tools like bettercap [2]. [1] https://github.com/byt3bl33d3r/sslstrip2 https://github.com/byt3bl33d3r/sslstrip2 [2] https://www.bettercap.org/legacy/ https://www.bettercap.org/legacy/
      - deleted 7y ago
        [deleted]
      - cyphar 7y ago
        That is a pretty neat attack, but I disagree it would be useful against Tor. DNS traffic is funneled through a different Tor circuit than the web traffic. You'd need to apply the bad DNS to all users, which would almost certainly in your exit node being dropped from the network. I'm also not sure how this would be handled with HSTS preload lists -- HSTS preload applies to all subdomains so you'd need to come up with a completely different domain (and protections against homograph attacks mean that avenue is restricted). It'd probably be simpler to just set up an actual website with LetsEncrypt than to bother with stripping the TLS in this manner.
        throwaway66hack 7y ago
        You are right. With different Tor circuits, the attacker needs to control a lot of exit nodes to correlate the initial HTTP request to ssl-stripped page and the DNS query (to be a global adversary).
    - edoo 7y ago
      I mean you can intercept the request, retrieve the real cert, generate a self signed cert with the exact same details, then submit that to the user and be man in the middle. Of course the user gets the blank SSL cert error page on the browser, but a percentage of those users will override and continue. Copying the cert details increases that percentage as some will actually look at the invalid cert. It is quite blatant but it is just a numbers game at that point. If you ever hit an SSL cert error with TOR you should force a new onion path.
  - friendly_chap 7y ago
    To be fair I mostly use it for not overly sensitive stuff. Let me give you an idea: I prefer to not have my ISP log my requests to reddit.com/r/LSD. Not because I do anything illegal (I don't even take acid), but in this dystopian world where every action on the internet is recorded, the last thing I want is to end up on lists purely because of my curiosity. If I would do anything I could get into trouble for (which I won't), I would definitely research more about how to use Tor safely.
    - ikornaselur 7y ago
      Please correct me if I'm wrong, but can't your ISP only see that you're requesting reddit.com, as long as you're using https? Now sure, if you go to lsd.reddit.com, it can be logged as a subdomain, but anything beyond reddit.com shouldn't be viewable by your ISP. I'm not saying that you shouldn't use tor, just that as far as I understand, the whole request, including path and method, is encrypted over tls/ssl after your browser establishes a tcp connection to the server.
      - friendly_chap 7y ago
        I do believe the url path is visible even over HTTPS. Off to do some research on this. Edit: apparently the url is not visible, but the domain (more like IP, which can be easily resolved to domain). Same thing still applies, perhaps not with reddit subreddits, but with specific domains/websites.
        tialaramex 7y ago
        With ordinary DNS you are asking in plain text hey, what's the IP address for reddit.com and it does not take a genius to guess that's because you're visiting reddit.com With HTTPS using TLS 1.2 or earlier the site sends its certificate in plaintext too, so even if you just remember the IP address, it will tell anybody snooping "Hi, this is reddit.com". In TLS 1.3 the site's certificate is encrypted. However the SNI, which is used to make virtual hosting work, is not encrypted. So your ISP can see where you said you were going, but not whether they proved they were the real deal. DPRIVE such as DNS over HTTPS cures the first thing, you use an encrypted transport to do DNS queries against somebody trustworthy who won't rat you out. eSNI (encrypted SNI) is intended to one day cure the other problem. Even with both these, seeing that you visited a very popular system like Facebook or Reddit is always going to be easy. So Tor remains important.
Nursie 7y ago
I've used it to maintain normal(ish) internet service for myself when visiting places like China.
- edoo 7y ago
  When I went to China I expected problems so I setup my laptop with an SSL tunnel on port 443 to a virtual server and then routed openvpn over that. It worked like a charm. My favorite feature of openvpn is it can maintain state, so even if the tunnel resets and openvpn has to reconnect all the tcp connections just pick up where they left off.
  - mikorym 7y ago
    What is the difference between this and just having a normal SSH tunnel; for example, how does this differ from using sshuttle?
    - bepvte 7y ago
      For one, openvpn can use udp unlike ssh, which means the annoying overhead of double tcp is gone
    - edoo 7y ago
      Openvpn allows you to connect to and have a routable IP on the network. SSH tunnels are great for some things but being logically on a network is another thing.
  - walrus01 7y ago
    This will work for a short while, but consistent long term openvpn-matching packets are now seen the the GFW's automated dpi systems, eventually the IP of your non-china VPN endpoint will get blocked.
  - Nursie 7y ago
    That sounds much more prepared than I was, I arrived and then wanted a quick solution on the fly, Tor fit the bill nicely. I would probably use my StrongSwan IPSEC VPN setup to home now that I have one.
sametmax 7y ago
They do, not everybody enjoy democraty.
- r3bl 7y ago
  Unfortunately, such cases will always be less appealing to write about compared to "assassins for hire on the dark web", leading to this wrong generalization of what Tor is about.
cyphar 7y ago
Less than 3% of Tor traffic is to onion services of any kind (which means 97% is to websites already accessible on the public internet), and the most popular onion service on the internet by a large margin is Facebook's (facebookcorewwwi.onion). More than 2 million people use Tor every day -- are they all bad people? Heck, government agents use Tor when traveling abroad. Do bad people do bad things using Tor? Yes. Do political dissidents in oppressive regimes use Tor? Yes. However the vast majority of people are just ordinary citizens using Tor to access the internet -- the cross-section of Tor users is the same as the cross-section of ordinary internet users.
- dooglius 7y ago
  > the most popular onion service on the internet by a large margin is Facebook's How do you know? It shouldn't be possible to collect this sort of data.
  - tgragnato 7y ago
    Counting hits on HSDir(s) and extrapolating a statistic. Related: https://trac.torproject.org/projects/tor/ticket/8106 https://trac.torproject.org/projects/tor/ticket/8106
  - jandrese 7y ago
    Exit nodes can track which sites are hit to a degree. CDNs make this more difficult, but it's not too hard to figure out what percentage of your traffic is Facebook. It also won't work if you're going to the Facebook onion site of course.
    - deleted 7y ago
      [deleted]
    - cyphar 7y ago
      Exit nodes aren't used like that for .onion sites, so they cannot track usage of .onion sites. The way it works is that the client and server pick a "rendezvous node" (the server generates 6 HSDir entries, each with 3 random nodes every day, and the client picks a random HSDir entry and a random one of those node to use). Then, they communicate through the rendezvous node which doesn't know who the client or server are (because both are connected through Tor circuits and neither reveals the .onion URL that was looked up in the HSDir). The way the statistics work is that some Tor relays opt-in to sharing statistics about how many HSDir lookups happened through them, and then those figures are extrapolated to figure out how many .onion service accesses happen. The relay doesn't know which service is being looked up, and the rendezvous node doesn't know which service is being talked to.
Izmaki 7y ago
I wish people would at least learn the difference between "deep web" and "dark web". ;) I bet you use the "deep web" multiple times each week. The "dark web" on the other hand, probably not.
- tgragnato 7y ago
  Depends who you ask. I transparently use the darknet continuously every day. Multiple home servers owned by me and my colleagues make up a VPN we share with friends and family. Amongst the trusted recursive resolvers we use there's the DoT v3 onion from Cloudflare. A proxy redirects our traffic for Facebook and DuckDuckGo over the respective onions, same for Debian updates. A next generation firewall inspects our traffic and use Tor for some websites that are censored or geoblocked.
mikorym 7y ago
If using the definition for the dark/deep web that I think, then it includes traffic to and from any networked entity that does not have a URL (or otherwise public frontend). This could then include stored data, VPNs or other company/govt/organisational data that is not accessible via normal web traffic.
- bepvte 7y ago
  I believe thats just the definition for deep web.
  - r3bl 7y ago
    Both terms are just stupid. Deep web: stuff not indexed by search engines. Private forums, non-public social media accounts, Telegram rooms, Discord servers etc. are technically "deep web". Dark web: a subset of deep web that requires specific software or configuration to access. Slightly more precise, but still includes every possible use case for IPFS, Dat, ".onion" etc. Note that this is nowhere close to what people usually mean when they use the term "dark web". They're referring to the subset of a subset of deep web that's used for criminal activities.
    - rendx 7y ago
      There are gateways to onion services and IPFS, so those are "indexed by search engines" without any change necessary. Furthermore, any search engine has to be adapted to the medium used, and there are specialized search engines for pretty much anything including Freenet and I2P etc, so saying that the "dark web" is a subset of the "deep web" is incorrect. There is some overlap, but it's not a "part of" relationship. The problem is that there is one (academic) definition of "deep web", but many incompatible definitions of "dark web", invented by the media basically for whatever they want it to be.
superkuh 7y ago
I host all kinds of completely normal websites (ie, amateur radio) as tor hidden services. TOR is great because you actually own your domain instead of just leasing it on the whim of some corporation. Once you get past the controversy TOR hidden services are more like the 1990s web than what you describe.

Tinfoilhat666 7y ago

How is this better than Brave browser?

mcjiggerlog 7y ago
Tor Browser routes all data via the Tor network. Brave is a standard browser with built in ad-ware.
- joshuakelly 7y ago
  This is amusingly uninformed. Saying nothing about the ad-ware comment, since that seems designed to deliberately obfuscate/obscure reality, you probably weren't aware of: https://brave.com/tor-tabs-beta https://brave.com/tor-tabs-beta To OP - check out the issues, there's a reason it's still in beta: https://github.com/search?utf8=&q=is%3Aopen+is%3Aissue+org%3Abrave+label%3Ator%2Fleakproofing&type=Issues https://github.com/search?utf8=&q=is%3Aopen+is%3Aissue+org%3...
  - trpc 7y ago
    This is amusingly uninformed. Describing Brave as adware is generous to say the least, Brave is more of a scam than a business. The kind of scams you would find in tech bubbles like what happened in late 1990s.
    - sjustinas 7y ago
      Could you elaborate? As far as I know, Brave promises to give you a browser and it gives you a browser. Does not sound like something I would call a "scam".
  - daxterspeed 7y ago
    Brave's "Basic Attention Token" was described as replacing ads on websites with ads from Brave's own ad network[0], which I recall is a common practice among adware to go unnoticed on an infected user's machine. The homepage of the Basic Attention Token completely fails to mention that it blocks publisher's "genuine" ads and replaces it with their own ads[1]. On top of that Brave has seemingly no interest in asking for consent for this practice, while also going as far as to use people's names and photos to solicit donations to them, without those people even being aware that Brave is accepting money for them[2]. Now I believe the ad-replacement feature is opt-in, but I'm not willing to install Brave and go through the opt-in flow to determine if it goes through the proper steps in explaining that the Brave Ad money may never reach its intended recipient. [0] https://cryptobriefing.com/what-is-basic-attention-token-introduction-to-bat-and-brave/ https://cryptobriefing.com/what-is-basic-attention-token-int... "Brave integrated BAT into its browser to block ads at the site level, and instead serve them through the browser itself." [1] https://basicattentiontoken.org/ https://basicattentiontoken.org/ [2] https://twitter.com/tomscott/status/1076160882873380870 https://twitter.com/tomscott/status/1076160882873380870

dessant 7y ago

I'm rooting for Mozilla and the Tor Project to uplift Tor into Firefox. Imagine a world where people need to opt in to get less privacy.

JulianMorrison 7y ago
The reason to have a Tor browser is that regular browser features aren't well suited to secure anonymous browsing. The reason to have a regular browser is that you want those features, and the low latency of a direct connection.
tomatotomato37 7y ago
It's interesting, the only way that would work is if they also turn every browser into a through node, which would be both highly controversial while also a great boon to the Tor network as a whole
- close04 7y ago
  Using "Tor mode" instead of "private mode" in regular Firefox would be nice.
  - deleted 7y ago
    [deleted]
- computerfriend 7y ago
  Why would that be the only way it would work? Because integrating Tor into Firefox is currently planned and making clients Tor nodes is not part of that plan.
ve55 7y ago
I'm not. I prefer the Tor Project to make their decisions independently of Mozilla, which has a worse track record in most areas. Additionally, tor isn't something that every Internet user should be using. I say this because when they get 10 ReCaptchas in a row, then try to log into their bank and have their credit card automatically frozen, then wonder why google search isn't working, then give up and just use Facebook all day anyway, they will definitely not be appreciating the 'anonymity' that we gave them.

Izmaki 7y ago

Allow me to send a big shoutout and my deepest thanks to the maintainers and volunteers of both the Tor Browser and the Tor Project in general. You make the world a better place, even if the majority of the population don't realise they should pay more attention to your work. You're the real MVPs!

chii 7y ago
more people ought to use TOR so that the users who _need_ tor gets the protection of anonymity in a crowd. If nobody uses TOR, then TOR users immediately becomes suspicious and nothing prevents the real world investigation from uncovering them.
- dewey 7y ago
  Nitpick, but it’s Tor not TOR
- Iv 7y ago
  I make everybody smile when I open Tor to watch some technical documentation. Still gave my boss a pause when I asked him if we were ever going to consider Google a competitor in any field (which we were in a niche field) and if he would be comfortable with a competitor owning the search history of all his employees.
- loceng 7y ago
  Aren't large internet providers blocking TOR from working or am I confusing that with something else security related being prevented?
kohnstamm 7y ago
> You make the world a better place Do they? As far as I can tell, it's the world's premier human rights violation software, and the internet's child pornography backbone. Yeah, I'm aware of the official narrative of providing a shield for journalists from government snooping and so forth, that everyone blindly repeats. But I'm not drinking the kool aid. They really showed their true colors when they felt it necessary to publish a statement that they regretted that their software was used to distribute an obscure Nazi magazine. So much for their high ideals about freedom of speech. Apparently, the child abuse and cartel violence they facilitate is just collateral damage, but someone expressing extreme ideas was a little too much.

dmos62 7y ago

Are there any casual users of Tor around? Someone who does it not for the sake of safety, but just privacy? I'd happily use Tor, but the last time I used it (which was ~5 years ago), it was terribly slow for regular browsing (not streaming, or anything considered bandwidth heavy).

neiman 7y ago
What do you mean by casual? I use it relatively often, when I want to access a website privately (I don't trust any VPN service that much). I'm pretty sure I'm not the only person doing that. But maybe you mean if someone using it as the main browsing tool for privacy reasons? This I doubt, since it's indeed slow. I also don't think that Tor is meant to be used as your main browser really.
- dmos62 7y ago
  That's pretty much what I meant my casual -- Tor as main browsing tool.
pawal 7y ago
Yes, I use it often. My Debian installations use Tor for installing updates. Just as an example.
maeln 7y ago
I use Tor/Tor Browser quite often. I use it mostly for privacy, but also to test a few thing like price of plane tickets and such. The speed is much better nowadays. Unless your unlucky and you circuit has a slow node in it (which the protocol try to avoid if i remember correctly), you should have a decent web browsing experience. Sure, it will be slower than your "normal" connection, but usually not by that much. Although, if you plan on downloading large files via Tor, you will hit a bandwidth cap fairly quickly. You can look in detail here: https://metrics.torproject.org/torperf.html https://metrics.torproject.org/torperf.html Available bandwidth quadruple since 2014: https://metrics.torproject.org/bandwidth-flags.html?start=2014-02-21&end=2019-05-22 https://metrics.torproject.org/bandwidth-flags.html?start=20...
7y ago

tptacek 7y ago

Tor Browser might be the least mainstream safe browser on the Internet: * It permanently tracks the lagging ESR Firefox. * It puts its users on Tor, which "anonymizes" them but also flags their traffic as interesting. * It collapses all those users down to a single set of browser releases, making it cost-effective to target exploits to. Use Firefox if you really like Firefox, but use the most recent version you can possibly get. Mozilla's is not the best-hardened browser. Use Tor if you really believe in Tor. But use it explicitly, not as part of a browser bundle. Your choice of browser has a significant impact on your operational security; don't let a bunch of volunteers at Tor make that decision for you.

BenElgar 7y ago
Though it's important to note that using Tor directly rather than the browser bundle means that your browser fingerprint is even more distinct than it would otherwise be.
juliusmusseau 7y ago
The one time I ever used the Tor Browser (at work, out of curiosity), my desk phone rang within 5 minutes: the in-house IT security team wanted to know what I was doing. So you're not kidding when you say it makes one's internet traffic more "interesting"!
jancsika 7y ago
> But use it explicitly, not as part of a browser bundle. I hope you're conflating two issues here. You surely aren't recommending users who "believe in Tor" install Tor directly and attempt to manually proxy their favorite browser traffic over it? Not to say I disagree with your points against using TBB.
- packet_nerd 7y ago
  I do this, using an up-to-date chromium browser proxied through Tor for regular browsing. I do this instead of the regular Tor browser on the theory that there's less potential for 0-day exploits. Of course, this does compromise anonymity a bit in some respects, since there are probably few people who run chromium on Tor and because it's not as resistant to fingerprinting as the regular Tor browser. That's acceptable to me, as I only use that browser on Tor, and use another browser for things that could potentially leak my real identity.

rishav_sharan 7y ago

Dear lord, Windows antivir protection has gone full stupid with this. I am on Win10 and it will not allow me to install it in Program Files. If I install it in Desktop, it will keep flagging tor.exe as a virus. After marking 4 times that the Windows Virus and Threat Protection should restore the exe, i was able to start the browser. Then the windows antivir went full dystopian mode, and flagged it again. Now it is asking me to reboot the computer to delete tor.exe from the device.

aunetx 7y ago

Well thank you, we love you muchhh