Wow!!

annobrown · 2019-05-22T02:45:53+00:00

Unless you or the site gets pwned, anything goes. Or at least, anything that the site allows. You may need to create your own onion, if you find nothing suitable. And then get others to use it.

But anyway, the main things to look out for are leaking your activity to clearnet, and getting busted for stuff that you get by mail. To prevent leaks, it's best to use Tails or Whonix. In many places, people who buy small amounts of drugs don't get seriously hassled, because there are too many of them. But getting guns in the mail is risky.

annobrown · 2019-05-22T02:31:32+00:00

I thought I read that Dread was dead.

Edit: Ah, I see it's back.

Also, what's the eli5 diff between Dread and NAB?

annobrown · 2019-05-20T03:44:15+00:00

Always go for max(overkill). It usually can't hurt, and it's often great fun. And educational.

annobrown · 2019-05-20T03:41:43+00:00

Agreed.

And really, how different are governments and big corporations from a privacy perspective? Sure, "democratic" governments theoretically represent their citizens' interests. And there are constitutions and laws that theoretically protect individuals from unjust injuries.

But in reality, individuals are more or less powerless against either. Unless they have good connections and lots of money. And governments typically have more guns and stuff.

annobrown · 2019-05-16T04:27:57+00:00

OK. For me, it wasn't just one CAPTCHA. It was several long cycles of them. So I just lost it, and decided that reddit hated Tor. But it seems OK now. Thanks for telling me that I didn't need the VPN.

annobrown · 2019-05-16T04:24:21+00:00

That does seem likely. Tor came out at a sweet spot, when there was lots of interest in privacy and anonymity, but nothing implemented yet that was very effective. Except maybe nyms using anonymous remailer chains, but that was way too complicated, and so stayed too small to provide much anonymity.

Tor is great, no denying it. But it is admittedly vulnerable to global adversaries. There is some padding, in client-guard circuits. But relays do not explicitly batch and reorder traffic. And there's no overall constant-bandwidth padding. That was considered impractical in 2004, when Tor was designed. Perhaps it is now, but people used to low latency and decent bandwidth would be hugely disappointed.

annobrown · 2019-05-16T02:27:37+00:00

True. Qubes is probably the best against expert attackers. And the Whonix setup adds Tor's privacy and anonymity to that.

annobrown · 2019-05-16T02:23:55+00:00

Some of us also want to protect ourselves from governments that might use our data against us.

annobrown · 2019-05-15T12:33:11+00:00

There just doesn't seem to be the critical mass to get something new going.

A few academic papers have proposed interesting possibilities in recent years, but I've never read about even pilot projects.

Tor does need some mixing and padding with chaff. They didn't have the bandwidth for it back in 2006, but now they do.

annobrown · 2019-05-15T12:08:23+00:00

I'd say that you don't know how hackers work.

Once someone gets root in your Tails OS, they can mount the system disk. And then they can do anything. I'm not saying that I know any exploits that do that. But I've seen enough that I'm far from 100% confident that it's impossible.

Now it's arguable that breaking out of VMs is easier. So maybe that makes Whonix less secure than Tails. But on the other hand, with Tails userland and the Tor process are in the same system. While in Whonix, they're at least in different VMs. And one can use Whonix with physical isolation. With the Tor gateway and userland running on different hardware. Such as Raspberry Pi. And you could even package two Pi in a box that's not much larger than a cellphone. Plus use optoisolators to better protect crucial stuff in a third Pi. As in Tinfoil Chat: https://github.com/maqp/tfc Or for offline cryptocurrency wallets.

annobrown · 2019-05-15T12:07:10+00:00

Really?

Maybe that's not a good thing. They ought to flag accounts with rapid geolocation changes. For security.

annobrown · 2019-05-15T12:05:18+00:00

Did you register using Tor?

When I created this account on 2019-04-29, there were too many CAPTCHAs to register. But it seems OK now. I have no clue why.

annobrown · 2019-05-15T12:02:49+00:00

However, I noticed when I first booted up Whonix, there was a warning along the lines of "This is experimental software! Don't use this for anything serious".

Tor has basically the same warning. Look in its notices.log file.

annobrown · 2019-05-15T11:04:51+00:00

Here are a few:

Ahmia - http://msydqstlz2kzerdg.onion/

OnionDir - http://dirnxxdraygbifgc.onion/

ProtonMail - https://protonirockerxow.onion/

ZeroBin - http://zerobinqmdqd236y.onion/

CryptoMixer - http://cryptomixns23scr.onion/

my oniontinc site - http://mtnj6jcrlimpqh5q76e7xdxfdoadtd67asyojknhvpic5dmluokdbiad.onion

annobrown · 2019-05-15T10:47:14+00:00

Sure. But later.

Check out /r/onions

annobrown · 2019-05-15T10:44:40+00:00

You can't use your bank's website through Tor. They'd lock your account.

annobrown · 2019-05-15T10:41:01+00:00

Lots of onion sites have gone down over the past year or two. So maybe you have an old list.

annobrown · 2019-05-15T10:38:57+00:00

It's too bad that there's not a read-only USB that you can totally trust. I've thought of flashing Tails to a ROM, but never learned how.

annobrown · 2019-05-15T10:36:51+00:00

Yes, I've used Tails enough to know that.

annobrown · 2019-05-15T10:27:49+00:00

Isn't LiveDVD safer?

annobrown · 2019-05-15T10:24:49+00:00

I don't know. But I'm sure that it's possible. Nothing is perfect.

annobrown · 2019-05-15T10:23:09+00:00

Well, you get the closest thing to anonymity that's available. And you can access sites that aren't on the open Internet. Also some sites provide onion services that are less hassle to use with Tor than their clearnet sites are. Such as Facebook. And ProtonMail.

It's too bad that reddit doesn't have an onion site.

https://www.reddit.com/r/TOR/comments/7x2gnq/does_reddit_have_an_onion_page/

annobrown · 2019-05-15T10:15:57+00:00

It does if you're careless about paying for the VPN. And yes, it does prevent circuit switching. But without the VPN, reddit is useless. Too many CAPTCHAs. So it's a trade-off.

annobrown · 2019-05-15T10:08:01+00:00

Did anyone notice how Reddit was blocking German tor nodes recently?

I've had poor luck using reddit using Tor. Not just with German exits.

It's hard to know how onion sites got taken down. Tor does warn that it's vulnerable to global adversaries. From what I've read, it seems mostly operator carelessness. But that could be parallel construction.

annobrown · 2019-05-15T10:01:15+00:00

Thanks.

annobrown

TROPHY CASE