Tiny Wireless Device Offers Tor Anonymity

Lucas123 writes: The Anonabox router project, currently being funded through a Kickstarter campaign, has surpassed its original $7,000 crowdfunding goal by more than 10 times in just one day. The open source router device connects via Wi-Fi or an Ethernet cable making it harder for your IP address to be seen. While there have been other Tor-enabled routers in the past, they aren't small enough to fit in a shirt pocket like the Anonabox and they haven't offered data encryption on top of the routing network. The device, which is being pitched as a way for consumers to securely surf the web and share content (or allow businesses to do the same), is also being directed at journalists who may want to share stories in places where they might otherwise be censored.

Comments

I wonder how much we can trust it

[PhrostyMcByte]

Making Tor dead simple to use is great, but this is such a nice device for three-letter agencies to target inserting a backdoor into.

Re:I wonder how much we can trust it

[Anonymous Coward]

Its open source and open hardware. All the good.

Re:I wonder how much we can trust it

[Anonymous Coward]

"Open" is rather misleading because it would be easy for "them" to compromise a few individual shipped units and poison the pool.

Do you plan to audit the code and make sure it's as-advertised, none of the code does anything shady, and the binaries are compiled from the code you saw?

Didn't think so.

Re:I wonder how much we can trust it

[ArmoredDragon]

A sha256sum of the entire firmware image should suffice for verification.

Re:I wonder how much we can trust it

[DaHat]

How do you determine that the checksum hasn't been modified in transit?

You could always audit the code yourself and compile it as well... but are you sure your compiler doesn't have any backdoors which might inject evil code just for something like this?

The bugger about paranoia... is you never know if you are sufficiently paranoid.

Re:I wonder how much we can trust it

[Sqr(twg)]

The three-letter agencies don't need to insert a backdoor. All they need to do is operate a bunch of Tor exit nodes.

As soon as you use Tor for everyday activities you are effectively not anonymous anymore.

Example: You set up the WiFi router and start doing your secret stuff. The bad guys have no idea who's behind the connection.
Then the jogging app on your iPhone connects over the same Tor tunnel. It opens an unencrypted connection to a "share my run" server, and now the bad guys know your email address, weight, and the GPS coordinates of the route you ran this morning. They don't even have to tap your or the server's connection. They get the information directly from their own exit node. (I.e. easier than if you had not been running Tor. Anyone can do this. Not just the three-letter agencies.)

Want anonymity? Install the Tor Browser. Then only use it for the anonymous stuff. Never visit any of the sites you ordinarily frequent.

Re:I wonder how much we can trust it

[Anonymous Coward]

Ahem! Everyone already *is* attacked by mass-surveillance. Tor gives protection.

Re:I wonder how much we can trust it

[oneandoneis2]

Don't over-dramatise. This is a way of making it easy & convenient for non-techies to use Tor. Anyone with anything to hide - criminals, terrorists, activisits, whatever - will have long-since spent the 30 seconds it takes to find out how to use tools like Tor without buying a gadget for it.

Re:I wonder how much we can trust it

[fuzzyfuzzyfungus]

Making Tor dead simple to use is great, but this is such a nice device for three-letter agencies to target inserting a backdoor into.

While that is a possibility(albeit one that could theoretically be ameliorated, barring hardware-level backdoors, by 'here's how to build Tor from mainline and replace our firmware' documentation), I'd be more worried about the fact that Tor isn't dead simple.

The project itself has a list of handy warnings concerning What Not To Do on Tor and expect the anonymity to keep working, even assuming there are no unknown attacks and vulnerabilities at play. Tor has no magical ability to scrub dangerously identifying information from the assorted dumb, lazy, or just plain user-hostile chatter generated by various programs on your computer. It also, as a necessary side effect of its design, exposes some traffic to the exit node, which requires that you be careful about SSL/TLS for anything that the exit node shouldn't see.

That's what makes me nervous about the projects(hardware or software, boxes like this or Android VPN plugins, or whatever) that make it dead easy to route all traffic through Tor. Unless you know exactly what you are doing, that probably isn't what you want. Your day-to-day OS is very likely to be far too dangerously chatty(which means that you really shouldn't use it at all, unless booted to a liveCD; with the Tor browser bundle, that passes only traffic from the Tor browser as a distant second best); but you definitely shouldn't just plug it into the magic Tor box. Some applications you just don't want going through Tor at all. If the traffic is intrinsically personally identifying the best case is that you'll gain nothing and the worst case is that you'll be less secure than you were.

Things that keep people from running the browser bundle on their poxed XP machines and expecting anonymity are good; but Tor simply isn't easy to use, even if it is made easy to set up, and that can bite you in the ass.

Re:I wonder how much we can trust it

[fuzzyfuzzyfungus]

The Tor Browser is better than 'just route all traffic through Tor'; but unless you trust that your machine isn't carrying 12 strains of cyber-syphilis, you probably want a non-persistent liveCD OS if you are doing something sensitive.

Re:I wonder how much we can trust it

[mrchaotica]

The very reason Truecrypt died was because they couldn't trust future compilers for Windows.

[citation needed]

Re:I wonder how much we can trust it

[The Ickle Jones]

As the other person said, everyone is already subject to mass surveillance.

But even if what you said were true, the more people that use this, the more targets they have to selectively harass. We need more and more people to use this sort of thing in order to better thwart their mass surveillance efforts.

Not secure

[BitcoinBenny]

Its a cool idea. There are things that are problematic about it though, like the fact that the browser itself hasn't been properly anonymized. The Tor browser package tries to disable plugins and third party software that might inadvertently reveal your identity or cause other information leakage. There is no such guarantee in this instance, which is a bit of a false sense of security. Tor isn't a panacea for all anonymity issues, and you wouldn't want to route most of your traffic over it.

I'm personally more interested in the hardware, any specifics on that? I think it would be a nice platform for a lot of interesting projects, hardware based firewalling etc.

Re:Not secure

[tlhIngan]

Its a cool idea. There are things that are problematic about it though, like the fact that the browser itself hasn't been properly anonymized. The Tor browser package tries to disable plugins and third party software that might inadvertently reveal your identity or cause other information leakage. There is no such guarantee in this instance, which is a bit of a false sense of security. Tor isn't a panacea for all anonymity issues, and you wouldn't want to route most of your traffic over it.

And therein lies the problem Well, one of several.

First, the users have to actually want to be anonymous. There's no magic "make me anonymous" magic pixie dust that can be applied - I mean, what's the point of using Tor if you're going to log into your Google, Facebook, Amazon, Twitter, or whatever else account? You've not only gave your anonymity up a long time ago, you've just defeated all the anonymity you're going to get because all those ad networks now will be able to re-link your Tor usage to you.

Additionally, Tor is not magic. Using it doesn't make you invisible. Especially if you're going on about "black helicopters" and such because the likes of the NSA have revealed to be running the largest number of high-speed exit nodes, and those who control exit nodes on Tor control it all. Either keep your traffic within the Tor network on Tor-specific sites, or realize that where ever your traffic exits, the exit node may be screwing with you.

Sure you may get certificate errors and such, but I'm sure most users will click through them anyways.

Hell, it almost seems all the spies want users using Tor because by making it magic box, they'll do the same old stupid shit over it and not only be really easy to track and monitor, but the users will think all is well, at that.

Of course its not idiot-proof

[penguinoid]

The weak link in Tor security has always been its users.

Re:Of course its not idiot-proof

[TrollstonButterbeans]

You did an unintentional double entendre there. You know, like, the weak link is the "users" as in user failing to understand how to safely browser anonymously and inadvertently compromise their security using Tor. Or the weak link is the "users" as in 'although the idea of anonymity is great' and some casual users will be attracted, it will be a magnet for underground malfeasance and Silk Road wannabees and drug traffickers.

Re:FBI reaction on sharing

[FatdogHaiku]

Freeze! Is that a crew membership badge of pirate Tor's ship in your pocket, or are you just happy to see me?

Aye, 'tis hard to arrrgue...

way more than 10x now....

[SethJohnson]

According to the kickstarter page, the campaign is over $170,000.

A $51 pledge gets you one shipped to your house in the USA.

Re:way more than 10x now....

[SethJohnson]

I just checked less than 24 hours later. It's up to $247,000. Something tells me there is strong consumer interest in this type of a product.

CDNs will render the device useless

[Anonymous Coward]

Using tor to acces a website that is served via cloudfront will get you a captcha to solve.
The capchas are sometime way too hard for humans to solve.

Most of the anonbox users will be annoyed by the constant capthca onslaught and decide that the device is broken and stop using it.

It should really be called a...

[Anonymous Coward]

Internet restriction circumvention device. But *NOT* an anonymity device. Tor is great for avoiding deep packet inspection monitoring/blocking at the ISP level, but without a chain of anonymous accounts proxies outside the tor network, etc it's useless as an anonymity device. Sure you might be able to troll slashdot, or reddit, or digg, or whatever your favorite website is, but if even one of those is done with an account you made via the 'normal' net, it has the potential of being identified and tied back to you.

Given the comments about Comcast and Tor mentioned in an article here a few weeks back, I expect we'll see more of the social engineering angle coming at us from hostile incumbent ISPs. The FBI/NSA/USAFCC will mostly not care since they can probably use Tor as probable cause to hack your system (when you finish laughing over 'probable cause', like that would stop them from hacking you either way!)

Overall I think these devices, assuming the hardware is secure and the software is suitably hardened (and lacking either a heartbleed-esque memory leak, or remote exploitable hole offering root level system access), and firmware upgrades are not trojan'd en-route, should see a net increase in tor usage and perhaps wider adoption of anonymity enhancing technology. After all, it's a net gain for all of us if more people use tor, and if this device takes off, hopefully dozens more will spring up. Assuming consolidation is avoided, 10 different types of Tor routers with no more than 20-30 percent compromisation should ensure sufficient route anonymity for the average user.

That said, Windows, your CPU ID, your ethernet hardware address, and now Nvidia's GPU UUID, all seem like much larger and more immediate anonymity holes than tor network compromise. Can anyone verify for me if AMD's GPUs have a similiar UUID feature as Nvidia's cards, and if either or both have a method of disabling the return of said ID's to non-root/administrator applications (The latter obviously won't help with videogames however, since most have administrator level access through their DRM.)

Bad idea!

[thegarbz]

No it's not great, and no it's not a back door you need to worry about.

The fundamental problem is that anonymity is hard, very hard. There have been several people identified via Tor, seemingly smart people who thought they were covering their tracks. In many ways making Tor easy to use, and making a Tor proxy style router is the single worst way of using Tor.

We leave tracks everywhere we go. Our browser configuration, plugins, OS, etc all leave fingerprints for people to follow and using Tor doesn't stop that. Tor should be hard to use. It should require reading a manual. It should require understanding everything about anonymity. It should be used like Tails, a burner Linux distribution which should leave no trace on the system on which it was used.

The TLAs don't need to backdoor this device. It's quite likely that they welcome its use.

yes, keep adding leechers!

[Anonymous Coward]

The problem with Tor is that there are hundreds of leechers, even the agencies are using it to cover their tracks and it wouldn't be surprising if they controlled most of the exit nodes too!

What we need is to have every internet user to be an exit node, otherwise Tor will just collapse.

This device should at least be a client and relay device, being just a client is being a leecher.

Designed to keep you anonymous and yet...

[0x537461746943]

One of the kickstarter rewards for buy the device is...

"Get your name on the sponsors page of our website"

I got a little chuckle at the irony in that.

Alternate solution.

[Anonymous Coward]

This is a different flavor of the TP-Link TL-WR703N wireless router I ordered from the SLBoat store on ebay.com. It comes preloaded with OpenWRT and I can then flash it with the PORTAL bin file from github.com. PORTAL uses TOR for all access to the Internet.

https://github.com/grugq/portal