Slashdot Mirror
Tiny Wireless Device Offers Tor Anonymity
Lucas123 writes: The Anonabox router project, currently being funded through a Kickstarter campaign, has surpassed its original $7,000 crowdfunding goal by more than 10 times in just one day. The open source router device connects via Wi-Fi or an Ethernet cable making it harder for your IP address to be seen. While there have been other Tor-enabled routers in the past, they aren't small enough to fit in a shirt pocket like the Anonabox and they haven't offered data encryption on top of the routing network. The device, which is being pitched as a way for consumers to securely surf the web and share content (or allow businesses to do the same), is also being directed at journalists who may want to share stories in places where they might otherwise be censored.
Making Tor dead simple to use is great, but this is such a nice device for three-letter agencies to target inserting a backdoor into.
Its a cool idea. There are things that are problematic about it though, like the fact that the browser itself hasn't been properly anonymized. The Tor browser package tries to disable plugins and third party software that might inadvertently reveal your identity or cause other information leakage. There is no such guarantee in this instance, which is a bit of a false sense of security. Tor isn't a panacea for all anonymity issues, and you wouldn't want to route most of your traffic over it.
I'm personally more interested in the hardware, any specifics on that? I think it would be a nice platform for a lot of interesting projects, hardware based firewalling etc.
Making Tor dead simple to use is great, but this is such a nice device for three-letter agencies to target inserting a backdoor into.
Why would they bother? This thing is likely just going to route all the data over one Tor curcit. If anyone behind it sends one identifiable thing (say an application checking for updates of a license server, getting your email, logging into something etc) it will blow the whole thing to an observer on the backbone, exit node or server side. Unless you are really careful (and then its not dead simple to use) It basically offers all the security of a VPN run by an unknown potentially hostile party: it hides your traffic from your ISP, and makes your traffic slightly harder to associate with you.
If you don't like your ISP, this is a good way to piss them off, add latency, and hide your data from them. It won't do much else. I should note that this is a valid and useful thing to do if your ISP and related nation are more oppressive that those who do large scale spying. Ex: if you don't want to hide from the NSA, just Iran or something this might work (and get you killed, but Iran does that to lots of people)
Does it fit into the case of an answering machine?
I use Macs for work, Linux for education, and Windows for cardplaying.
The weak link in Tor security has always been its users.
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
Great, it'll help all the 3 letters to reduce the userspace with another metadata field where usesThingieToConnectToHoneypotNode=true. As if the systems weren't unique enough with the info the browser will spew.
i *had* a low uid, but lost it in my lawn
Freeze! Is that a crew membership badge of pirate Tor's ship in your pocket, or are you just happy to see me?
Aye, 'tis hard to arrrgue...
You have the right to remain sentient. If you give up the right to remain sentient, you will be elected to public office
According to the kickstarter page, the campaign is over $170,000.
A $51 pledge gets you one shipped to your house in the USA.
$5 / month hosted VPS on linux = awesome!
I hope it works, but the original goal would have never paid enough to legally seek FCC certification. The author of the kickstarter basically admits to violating law with previous versions. It is great that he is a rebel or whatever, but it gives me little confidence of his design knowledge or experience to break those fairly obvious laws.
Or move to Russia. Or move out of Russua. Your pick.
Using tor to acces a website that is served via cloudfront will get you a captcha to solve.
The capchas are sometime way too hard for humans to solve.
Most of the anonbox users will be annoyed by the constant capthca onslaught and decide that the device is broken and stop using it.
Internet restriction circumvention device. But *NOT* an anonymity device. Tor is great for avoiding deep packet inspection monitoring/blocking at the ISP level, but without a chain of anonymous accounts proxies outside the tor network, etc it's useless as an anonymity device. Sure you might be able to troll slashdot, or reddit, or digg, or whatever your favorite website is, but if even one of those is done with an account you made via the 'normal' net, it has the potential of being identified and tied back to you.
Given the comments about Comcast and Tor mentioned in an article here a few weeks back, I expect we'll see more of the social engineering angle coming at us from hostile incumbent ISPs. The FBI/NSA/USAFCC will mostly not care since they can probably use Tor as probable cause to hack your system (when you finish laughing over 'probable cause', like that would stop them from hacking you either way!)
Overall I think these devices, assuming the hardware is secure and the software is suitably hardened (and lacking either a heartbleed-esque memory leak, or remote exploitable hole offering root level system access), and firmware upgrades are not trojan'd en-route, should see a net increase in tor usage and perhaps wider adoption of anonymity enhancing technology. After all, it's a net gain for all of us if more people use tor, and if this device takes off, hopefully dozens more will spring up. Assuming consolidation is avoided, 10 different types of Tor routers with no more than 20-30 percent compromisation should ensure sufficient route anonymity for the average user.
That said, Windows, your CPU ID, your ethernet hardware address, and now Nvidia's GPU UUID, all seem like much larger and more immediate anonymity holes than tor network compromise. Can anyone verify for me if AMD's GPUs have a similiar UUID feature as Nvidia's cards, and if either or both have a method of disabling the return of said ID's to non-root/administrator applications (The latter obviously won't help with videogames however, since most have administrator level access through their DRM.)
You could use your android or linux phablet or phone as Tor proxy and gateway. Phablets and phone's are made to be portable, this device only makes sense as a dedicated in place hardware router and for that you could do it yourself and use a raspberry pi.
No it's not great, and no it's not a back door you need to worry about.
The fundamental problem is that anonymity is hard, very hard. There have been several people identified via Tor, seemingly smart people who thought they were covering their tracks. In many ways making Tor easy to use, and making a Tor proxy style router is the single worst way of using Tor.
We leave tracks everywhere we go. Our browser configuration, plugins, OS, etc all leave fingerprints for people to follow and using Tor doesn't stop that. Tor should be hard to use. It should require reading a manual. It should require understanding everything about anonymity. It should be used like Tails, a burner Linux distribution which should leave no trace on the system on which it was used.
The TLAs don't need to backdoor this device. It's quite likely that they welcome its use.
It's doesn't sound feasible to consumerize something like Tor, given the scarcity of exit nodes and the adversity that exit node operators are under (unless they're co-opted or decoys). People run them to protect whistleblowers, dissidents, etc. Having it turn into another consumer toy is likely to be demotivating for some.
The problem with Tor is that there are hundreds of leechers, even the agencies are using it to cover their tracks and it wouldn't be surprising if they controlled most of the exit nodes too!
What we need is to have every internet user to be an exit node, otherwise Tor will just collapse.
This device should at least be a client and relay device, being just a client is being a leecher.
One of the kickstarter rewards for buy the device is...
"Get your name on the sponsors page of our website"
I got a little chuckle at the irony in that.
It would be funny if the NSA pledged $1,337 or more. (Read the benefits section.)
Would mod down if i had the points
there's Onion Pi as an alternative ...
https://learn.adafruit.com/onion-pi/overview
http://arstechnica.com/information-technology/2013/06/onion-pi-turns-raspberry-pi-into-tor-proxy-and-wireless-access-point/
This is a different flavor of the TP-Link TL-WR703N wireless router I ordered from the SLBoat store on ebay.com. It comes preloaded with OpenWRT and I can then flash it with the PORTAL bin file from github.com. PORTAL uses TOR for all access to the Internet.
https://github.com/grugq/portal
Maybe I should release 20$ hardware with a 100% markup as a get rich quick scheme on kick starter... *cough* tplink 703n with tor on top of openwrt *cough*
It is [...] being directed at journalists who may want to share stories in places where they might otherwise be censored.
If #GamerGate taught us anything, it's that modern-day journalists don't care about an imposing government. They care about imposing advertisers. They don't care about truth in reporting, they care about page views. They don't care about exposing corruption. They care about getting their share of cash or flesh for saying "Everything is awesome!" because the corrupt have plenty of cash and flesh to share.
But don't mind the man behind the curtain! 99 out of 100 journalists agree that #GamerGate is about anti-feminism, and not about corrupt journalism!
Tor is not anonymous and is controlled by the CIA
and people will pay for this lolololololol
"A promotional video suggests several uses for the device, including using it to securely share Internet access with family and friends, or to stream live audio from sports games that are blocked in a specific region. "
First off, this is great project, but their promotional video makes me a bit upset with this company... Encouraging people to use this to get around blocks to allow streaming of their favorite sports game is just wrong, the service does not currently have bandwidth to realistically do that, especially not for a massive amount of people to go out purchasing this device for that reason!
They are basically saying we are going to sell our devices by abusing a free network so we can make profits while carelessly screwing over the reporters that need their anonymity, people who's governments put such tight restrictions on their internet use, allowing the NSA to continue on abusing their spying technologies, and on and on!!!
Now if they sold these devices and claimed they were going to donate a sizable amount of bandwidth based on sales, or better yet make an easy to integrate feature that allows users to share their own bandwidth with the TOR network, then I would not feel so negative towards their promotional video's advertising high-bandwidth consumption such as a sports game!
"A promotional video suggests several uses for the device, including using it to securely share Internet access with family and friends, or to stream live audio from sports games that are blocked in a specific region. "
First off, this is great project, but their promotional video makes me a bit upset with this company... Encouraging people to use this to get around blocks to allow streaming of their favorite sports game is just wrong, the service does not currently have bandwidth to even realistically do that, especially not for a massive amount of people to go out purchasing this device for that reason!
They are basically saying we are going to sell our devices by abusing a free network so we can make profits while carelessly screwing over the reporters that need their anonymity, people who's governments put such tight restrictions on their internet use, allowing the NSA to continue on their rapid spying technologies, and on and on!!!
Now if they sold these devices and claimed they were going to donate a sizable amount of bandwidth based on sales, or better yet make an easy to integrate feature that allows users to share their own bandwidth with the TOR network, then I would not feel so negative towards their promotional video's advertising high-bandwidth consumption such as a sports game!
The device is (as reddit already proofed) an clone of a tp-link router. And someone has already done the work to put TOR on the device. That leaves us only with hot air on this Kickstarter.