1 of 31

“If you’re not using Tor you’re doing it wrong.”

Christopher Sheats is an Encryption Evangelist

volunteer at the ACLU of Washington

2 of 31

sources

“Use Tor Browser, or harden Firefox, for privacy?”

https://yawnbox.com/index.php/2016/01/04/use-tor-browser-or-harden-firefox-for-privacy/

“Comparing HTTP, HTTPS, VPN, and Tor with “snail mail” metaphors”

https://yawnbox.com/index.php/2015/10/25/comparing-http-https-vpn-and-tor-with-snail-mail-metaphors/

3 of 31

http / postcard

4 of 31

http / postcard

you → http://bbc.co.uk

5 of 31

https / letter

6 of 31

https / letter

you → https://yandex.ru

7 of 31

virtual private network… 1-hop proxy

message, sender → mail proxy → recipient

content, sender → traffic proxy → recipient

8 of 31

vpn / postcard

you → ipredator → http://amazon.com

9 of 31

vpn / letter

you → ipredator → https://wikipedia.org

10 of 31

vpn circuits

  1. less latency
  2. more bandwidth
  1. always static
  2. must trust 1 operator

11 of 31

the onion router… 3-hop proxy

message, sender → 1st mail proxy → 2nd mail proxy → 3rd mail proxy → recipient

content, sender → guard relay → middle relay → exit relay → recipient

12 of 31

tor / postcard

you → tor → http://ebay.com

13 of 31

tor / letter

you → tor → https://twitter.com

14 of 31

tor circuits

  1. generated randomly
  2. created every time a user starts a new session
  3. re-created every ten minutes
  1. high latency
  2. low bandwidth
  3. must trust ~2,000 guard operators and ~1,000 exit operators (but should never be the same operator)

15 of 31

tor circuits

Users, relays, and services diversity and volume are critical.

16 of 31

ads

nsa

vs.

“I could build a dossier on you. You would have a unique identifier, linked to demographically interesting facts about you that I could pull up individually or en masse. Even when you changed your ID or your name, I would still have you, based on traces and behaviors that remained the same — the same computer, the same face, the same writing style, something would give it away and I could relink you. Anonymous data is shockingly easy to de-anonymize. I would still be building a map of you. Correlating with other databases, credit card information (which has been on sale for decades, by the way), public records, voter information, a thousand little databases you never knew you were in, I could create a picture of your life so complete I would know you better than your family does, or perhaps even than you know yourself.”

"Spy agencies are keen to find any available way to recognize a particular user by their devices’ behavior on the Internet, and that cookies sent with unencrypted web requests are one of the easiest and most straightforward ways of picking out an individual device even as it moves from network to network."

17 of 31

vpn behavior

18 of 31

vpn behavior

19 of 31

vpn behavior

Use a VPN and log into any of your online accounts and you are now probabilistically associated with your provider and a limited IP subnet.

If your VPN provider claims they do not retain data, National Security Letters, which typically contain gag orders, can force your provider to lie.

20 of 31

tor behavior

21 of 31

tor behavior

22 of 31

tor behavior

Users, relays, and services diversity and volume are critical.

23 of 31

onion services

you → tor ← http://www.propub3r6espa33w.onion

24 of 31

onion services

  1. Authentication, end-to-end encryption
  2. No domain name system (dns) security problems
  3. No certificate authority (ca) security problems
  4. No border gateway protocol (bgp) security problems

"Users should be the ones who get to choose what sort of security properties they want. It shouldn't be about what the website thinks the users should have."

25 of 31

onion services

26 of 31

onion services behavior

27 of 31

onion services hosting

“Tor Hidden (Onion) Services Best Practices”

https://help.riseup.net/en/security/network-security/tor/onionservices-best-practices

“Building Enterprise Tor Onions: Tips and Notes”

https://storify.com/AlecMuffett/tor-tips

“How to Get a Company or Organisation to implement an Onion Site, i.e. a Tor Hidden Service”

https://www.facebook.com/notes/alec-muffett/how-to-get-a-company-or-organisation-to-implement-an-onion-site-ie-a-tor-hidden-/10153762090530962

28 of 31

tor browser

“How to: Use Tor for Windows”

https://ssd.eff.org/en/module/how-use-tor-windows

“How to: Use Tor on Mac OS X”

https://ssd.eff.org/en/module/how-use-tor-mac-os-x

29 of 31

tor browser

  1. Protects your public IP address
  2. Spoofs your time zone, internal IP address, inner browser resolution and outer browser dimension, browser user agent, screen resolution, color depth, and system fonts
  3. Disables privacy-violating remote fonts, rendered content, hardware APIs, and browser convenience features

30 of 31

tor applications

  • Tor Browser
  • Cwtch
  • Onion Share
  • Orbot (Android)
  • Onion Browser (iOS)
  • Tails
  • Qubes
  • Whonix
  • apt-transport-tor
  • tor (“little-T” tor (linux, bsd))
  • SecureDrop
  • GlobaLeaks

31 of 31

questions?

use Tor, kthxbi