Slashdot Mirror

Since we're discussing Tor, one of the most fucked up things about Tor Browser Bundle (TBB) for Linux was made public in a recent update:

Tor Browser 7.0.3 is released (major security bugfix release for Linux users only) - 2017-08-01 - via SoylentNews

"This release features an important security update to Tor Browser for Linux users.

On Linux systems with GVfs/GIO support Firefox allows to bypass proxy settings as it ships a whitelist of supported protocols. Once an affected user navigates to a specially crafted URL the operating system may directly connect to the remote host, bypassing Tor Browser. Tails and Whonix users, and users of our sandboxed Tor Browser are unaffected, though."

== SCARY:

"We believe that previous versions of Tor Browser are affected as well (definitely 6.5.2 which I tested).

There is no particular version this bug got added as the offending code has been in Firefox for years. "

Tor Browser 7.0.3 is released (major security bugfix release for Linux users only)

"This release features an important security update to Tor Browser for Linux users. On Linux systems with GVfs/GIO support Firefox allows to bypass proxy settings as it ships a whitelist of supported protocols. Once an affected user navigates to a specially crafted URL the operating system may directly connect to the remote host, bypassing Tor Browser. Tails and Whonix users, and users of our sandboxed Tor Browser are unaffected, though."

https://www.whonix.org/

TAILS tries to provide anonymity within the context of kernel-based security, but browser and privilege exploits are quite plentiful and such malware can go on to reprogram your firmware and peripherals. Qubes provides better protection of the core system, and Whonix ensures that Tor is utilized in a way that's optimum for anonymity.

There are plenty of security-focused Linux OSes, e.g. Tails, Qubes, Whonix, Ubuntu Privacy Remix, Kali Linux - just to mention a few. And then there is also the whole BSD family of free Unix OSes who are very security vetted, e.g. NetBSD, OpenBSD and FreeBSD. So I'm not sure what you mean by "the linux community is not capitalizing on the situation" ..?

https://www.whonix.org/wiki/Ab...

This is probably the safest way to use Tor.

Basically, set up two VMs, the first only gets networking through the second, and the second is configured to run everything through TOR and TOR alone.

Now this has been made easy and "done for us" so to speak (but always, ymmv, everything has bugs, security is a mindset, etc etc etc):

http://en.wikipedia.org/wiki/W...
http://en.wikipedia.org/wiki/T...

From the whonix homepage: "Whonix is an operating system focused on anonymity, privacy and security. It's based on the Tor anonymity network[1], Debian GNU/Linux[2] and security by isolation. DNS leaks are impossible, and not even malware with root privileges can find out the user's real IP. "
https://www.whonix.org/

For latest developments, here is where it's at:
https://www.whonix.org/blog/ma...
https://www.whonix.org/wiki/Qu...
http://en.wikipedia.org/wiki/Q...

PS, some current "wisdom" (but check out the cutting edge above, which also more generic solutions):
https://blog.torproject.org/bl...
https://torrentfreak.com/tribl...
http://torguard.net/howtodownl...
http://www.tribler.org/
http://tor.stackexchange.com/q...
https://wiki.vuze.com/w/Tor_Ho...
http://www.howtogeek.com/76801...

Seriously, we live in abundance - enjoy :)

Basically, set up two VMs, the first only gets networking through the second, and the second is configured to run everything through TOR and TOR alone.

Now this has been made easy and "done for us" so to speak (but always, ymmv, everything has bugs, security is a mindset, etc etc etc):

http://en.wikipedia.org/wiki/W...
http://en.wikipedia.org/wiki/T...

From the whonix homepage: "Whonix is an operating system focused on anonymity, privacy and security. It's based on the Tor anonymity network[1], Debian GNU/Linux[2] and security by isolation. DNS leaks are impossible, and not even malware with root privileges can find out the user's real IP. "
https://www.whonix.org/

For latest developments, here is where it's at:
https://www.whonix.org/blog/ma...
https://www.whonix.org/wiki/Qu...
http://en.wikipedia.org/wiki/Q...

PS, some current "wisdom" (but check out the cutting edge above, which also more generic solutions):
https://blog.torproject.org/bl...
https://torrentfreak.com/tribl...
http://torguard.net/howtodownl...
http://www.tribler.org/
http://tor.stackexchange.com/q...
https://wiki.vuze.com/w/Tor_Ho...
http://www.howtogeek.com/76801...

Seriously, we live in abundance - enjoy :)

Basically, set up two VMs, the first only gets networking through the second, and the second is configured to run everything through TOR and TOR alone.

Now this has been made easy and "done for us" so to speak (but always, ymmv, everything has bugs, security is a mindset, etc etc etc):

http://en.wikipedia.org/wiki/W...
http://en.wikipedia.org/wiki/T...

From the whonix homepage: "Whonix is an operating system focused on anonymity, privacy and security. It's based on the Tor anonymity network[1], Debian GNU/Linux[2] and security by isolation. DNS leaks are impossible, and not even malware with root privileges can find out the user's real IP. "
https://www.whonix.org/

For latest developments, here is where it's at:
https://www.whonix.org/blog/ma...
https://www.whonix.org/wiki/Qu...
http://en.wikipedia.org/wiki/Q...

PS, some current "wisdom" (but check out the cutting edge above, which also more generic solutions):
https://blog.torproject.org/bl...
https://torrentfreak.com/tribl...
http://torguard.net/howtodownl...
http://www.tribler.org/
http://tor.stackexchange.com/q...
https://wiki.vuze.com/w/Tor_Ho...
http://www.howtogeek.com/76801...

Seriously, we live in abundance - enjoy :)

The other question is a Tails https://en.wikipedia.org/wiki/... or Whonix (Tor anonymity network, Debian GNU/Linux and security by isolation) https://www.whonix.org/
That would in theory contain any more direct ip requests sent from any site or network.
Re "how would anyone with a basic understanding of networking not see?"
funded by the US government (16, 2014)
http://pando.com/2014/07/16/to...
The parallel construction that still seems to hold up is the sending of a page or code to show the real ip that always seems to leak out.

https://www.whonix.org/

Magnet links:
magnet:?xt=urn:btih:A031805E690BB0E03114A8FEB52485517218D3CE&dn=Whonix-Gateway-8.1.ova&tr=http%3a%2f%2fannounce.torrentsmd.com%3a6969%2fannounce&ws=http%3a%2f%2fwebseed.whonix.org%3a8008%2f8.1%2fWhonix-Gateway-8.1.ova

magnet:?xt=urn:btih:AB89247534553946C500EDF3A78E9C30F9C956ED&dn=Whonix-Workstation-8.1.ova&tr=http%3a%2f%2fannounce.torrentsmd.com%3a6969%2fannounce&ws=http%3a%2f%2fwebseed.whonix.org%3a8008%2f8.1%2fWhonix-Workstation-8.1.ova

And here's the magnet link for Tails v0.23 for good measure:
magnet:?xt=urn:btih:B7EE06A2568630EED830CFFBF45B6BFD5DE796D4&dn=tails-i386-0.23&tr=http%3a%2f%2ftorrent.gresille.org%2fannounce

You mean like Whonix?

First of all, use Whonix to access Tor, never the same browser you use for any other purpose. Second, use Firefox with a JonDoFox profile which is not included in Whonix Workstation by default. Third, go to ip-check.info and run the test on your browser. Everything should be green or yellow at the worst. If you see anything in red, fix it before you go to any questionable site. Finally, make sure you don't have any DNS Leaks in your host OS by running this test also from your regular host browser. Don't use or trust DNS from your ISP. If you want to be extra-cautious, run the Whonix Gateway after you establish a VPN connection. Choose an offshore provider that has multi-hop technology to avoid traffic analysis. I'm using iVPN who is located in Malta.

First of all, use Whonix to access Tor, never the same browser you use for any other purpose. Second, use Firefox with a JonDoFox profile which is not included in Whonix Workstation by default. Third, go to ip-check.info and run the test on your browser. Everything should be green or yellow at the worst. If you see anything in red, fix it before you go to any questionable site. Finally, make sure you don't have any DNS Leaks in your host OS by running this test also from your regular host browser. Don't use or trust DNS from your ISP. If you want to be extra-cautious, run the Whonix Gateway after you establish a VPN connection. Choose an offshore provider that has multi-hop technology to avoid traffic analysis. I'm using iVPN who is located in Malta.

evden eve nakliyat istanbul firmalar inaat sektöründe uygun fiyat kaliteli hizmet tamaclk sunan sosyal ulamdr Her zaman güvenilir haritalar gezip dolaarak 7/24 bize ulaabilirsiniz.Sizda ayrcalklardan yararlanp deerlendirmek için frsatlara katln.

First of all, use Whonix to access Tor, never the same browser you use for any other purpose. Second, use Firefox with a JonDoFox profile which is not included in Whonix Workstation by default. Third, go to ip-check.info and run the test on your browser. Everything should be green or yellow at the worst. If you see anything in red, fix it before you go to any questionable site. Finally, make sure you don't have any DNS Leaks in your host OS by running this test also from your regular host browser. Don't use or trust DNS from your ISP. If you want to be extra-cautious, run the Whonix Gateway after you establish a VPN connection. Choose an offshore provider that has multi-hop technology to avoid traffic analysis. I'm using iVPN who is located in Malta.

First of all, use Whonix to access Tor, never the same browser you use for any other purpose. Second, use Firefox with a JonDoFox profile which is not included in Whonix Workstation by default. Third, go to ip-check.info and run the test on your browser. Everything should be green or yellow at the worst. If you see anything in red, fix it before you go to any questionable site. Finally, make sure you don't have any DNS Leaks in your host OS by running this test also from your regular host browser. Don't use or trust DNS from your ISP. If you want to be extra-cautious, run the Whonix Gateway after you establish a VPN connection. Choose an offshore provider that has multi-hop technology to avoid traffic analysis. I'm using iVPN who is located in Malta.

evden eve nakliyat istanbul firmalar inaat sektöründe uygun fiyat kaliteli hizmet tamaclk sunan sosyal ulamdr Her zaman güvenilir haritalar gezip dolaarak 7/24 bize ulaabilirsiniz.Sizda ayrcalklardan yararlanp deerlendirmek için frsatlara katln.

First of all, use Whonix to access Tor, never the same browser you use for any other purpose.
 
Second, use Firefox with a JonDoFox profile which is not included in Whonix Workstation by default.
 
Third, go to ip-check.info and run the test on your browser. Everything should be green or yellow at the worst. If you see anything in red, fix it before you go to any questionable site. Finally, make sure you don't have any DNS Leaks in your host OS by running this test also from your regular host browser. Don't use or trust DNS from your ISP.
 
If you want to be extra-cautious, run the Whonix Gateway after you establish a VPN connection. Choose an offshore provider that has multi-hop technology to avoid traffic analysis. I'm using iVPN who is located in Malta.

No, Whonix is a system. The key part of the system is the Gateway which is indeed Linux, but the Workstation portion can be easily swapped by Windows or anything else. Read a bit more before you comment.

You can achieve the same result today with Whonix which allows you to "torify" basically any network I/O traffic from the workstation VM. Heck, you can even have a Windows VM go through the Tor gateway for that matter.