Re: [tor-talk] Tor exit+proxy
> However, I do not think this feature is likely to come from one of the > current developers. In the mailing list they stated that Tor + extra proxy > isn't a good idea because it's bad for anonymity. That's why I deduct that > this feature will not come, unless maybe someone sponsors a patch. I hope you`re wrong :) Because on the other hand, we have an options such as ExcludeExitNodes, ExitNodes, StrictNodes, ExcludeSingleHopRelays etc, which is much more dangerous when set without extensive brain usage. -- Greg ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Tor exit+proxy
> Those open proxy lists... Well, my guess how they are created... Some people > are scanning the internet and if they find an open proxy they'll add it to > the list. But it does not mean the admin of the open proxy is aware that he > is hosting an open proxy. In many cases open proxy's are just misconfigured > home or enterprise networks. Few are probable hosting them for evil reasons > and a minority for good reasons (want to give anonymity to people out of the > goodness of their heart like some tor node admins). Not all proxies are malwared or broken servers. You can buy some totally legal or you can set up your own. -- Greg ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Tor exit+proxy
> > VPN through Tor is in my todo list, so i will appreciate any solutions > > you will make. > > I began work on it but now I am somewhat stuck. Here is what I've got so far. > https://trac.torproject.org/projects/tor/wiki/doc/TorVPN > Let's work on it together. Feel free edit my page, it's a wiki. I don`t think I could help you with something, as I said I am not so very tech specialist, but I will do what I can as I researching. BTW, I found something similar, you may have a look: xqz3u5drneuzhaeo.onion/users/secureconfig/tutorial.html > I guess you mean TBB -> normal Tor chain with 3 proxys -> additional proxy, > like open proxy. > > [1] > It has been discussed. Like here. > https://lists.torproject.org/pipermail/tor-talk/2007-February/005653.html > Has been discussed many times like this. Yes, I meant just what described. Since 2007 TB became something more than bunch of programs that can be configured and run searately without any worries about security leaks. But now when I want to do something unusual, I always think of Mike Perry`s recent statement: "In fact, if we ever see headlines about a Tor user compromised, my money is on it being due to that user having used a custom or obsolete config." (c) > It's not recommend. And for cleartext http (not https) there will be now not > one, but two servers who can log and tamper your cleartext traffic. I understand that, but it doesn`t matter when anonimity (hiding your real IP as most important part of it) is more important than privacy. > > I see an instruction that tells use privoxy`s forward settings, didn`t > > try that yet, but I tried 3proxy (something the same proxy) with no > > success :( > > Sorry, didn't understand that. You mean a privoxy proxy chain? Yes, privoxy > supports that but I never tried it. Yes, it is what I meant. > Now imagine the idea Tor + open proxy gets promoted because the devs > encourage that with a new option like Tor + your personal extra proxy > chain... That wouldn't give Tor more credibility as it would be even harder > to stop abuse form it. Well, I think it is not that developers should worry about :) Not even in top-10 or top-100. It is more likely that some smart-ass would scare everyone with such words as "child abuse" and "terrorism" in the context of average Tor user. -- Greg ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
[tor-talk] Anonymity & HTTPS Everywhere Observatory
Have any recommendations from Tor Project been issued regarding the new? options in HTTPS Everywhere to use their "SSL Observatory," where certain info is transmitted to them? Now there's one more item for TBB users to make a decision about that could compromise anonymity. ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Anonymity & HTTPS Everywhere Observatory
On Sat, Jan 07, 2012 at 11:11:13AM -0600, joebtfs...@gmx.com wrote 0.4K bytes in 10 lines about: : Have any recommendations from Tor Project been issued regarding the : new? options in HTTPS Everywhere to use their "SSL Observatory," : where certain info is transmitted to them? Nothing official yet. We ship HTTPS Everywhere 1.2.1 which does not include the SSL Observatory code. The HTTPS Observatory code is in 2.0developmentx releases, see https://www.eff.org/files/Changelog.txt. Currently, when installing the 2.0developmentx release, the first prompt, after installation and restart of firefox, is to decide if you want to opt-in to the SSL Observatory collection (which does transmit via tor). The default is opt-out. If you are reading this and confused, start here, https://www.eff.org/observatory -- Andrew http://tpo.is/contact pgp 0x74ED336B ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
[tor-talk] 2 questions on HTTPS Everywhere settings
What are others' opinions of these setting in NoScript in TBB (latest TBB 2.2.35-4)? 1) In Options > HTTPS>Behavior, the "forbid active web content unless comes from an HTTPS connection. Default is "never," but there is a choice of "when using proxy (recommended w/ Tor)." What are some lesser known issues of keeping the Never default setting? What ALL active web content is it allowing by default setting of "Never" forbid? What are some of *desirable* sites or content that could break if set it to "when using a proxy" ? That could vary depending on a user's geographical location. 2) Under "General" tab, default is "scripts globally allowed". I suppose Tor devs chose to leave this as default, as many sites won't work well w/o JS. But, to allow scripts globally - in an anonymity software like Tor? No mention, AFAIK, in Tor documentation of what things users should consider about various settings in NoScript. NoScript has many other security functions besides allowing / disallowing scripts, that most users know little about. Yes, you can white list sites you want to allow, then disable "allow globally," but you'd better back that list up regularly because of frequent TBB releases & any NoScript updates. Thanks. ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Anonymity & HTTPS Everywhere Observatory
Well, when I installed TBB 2.2.35-4, the HTTPS Everywhere version is 2.0 dev 4. Possibly the version updated along w/ any other extensions, on 1st start of TBB 2.2.35-4? But, that's what I have & I'd never seen the pop up about the Observatory before now. On 1/7/2012 11:46 AM, and...@torproject.org wrote: On Sat, Jan 07, 2012 at 11:11:13AM -0600, joebtfs...@gmx.com wrote 0.4K bytes in 10 lines about: : Have any recommendations from Tor Project been issued regarding the : new? options in HTTPS Everywhere to use their "SSL Observatory," : where certain info is transmitted to them? Nothing official yet. We ship HTTPS Everywhere 1.2.1 which does not include the SSL Observatory code. The HTTPS Observatory code is in 2.0developmentx releases, see https://www.eff.org/files/Changelog.txt. Currently, when installing the 2.0developmentx release, the first prompt, after installation and restart of firefox, is to decide if you want to opt-in to the SSL Observatory collection (which does transmit via tor). The default is opt-out. If you are reading this and confused, start here, https://www.eff.org/observatory ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
[tor-talk] A question about Tor & Hidden Services
Hello all, I am wondering if it is possible to pass the hostname & private key on a hidden service directly to the control socket, without writing it to the hard drive (and without passing it to the process as a startup argument). Thanks! ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
