[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-talk] Help me secure my setup

Hash: SHA1

s7r <s7r@xxxxxxxxxx>:

> Periodic consensus downloads, as well as keeping always some fresh
> circuits on the list in order to attach streams to when requested via
> the SocksPort. In other words, not much traffic but not 0 traffic as well.

And what about a client that connects only with a bridge? Does a client 
connect anywhere else besides the bridge (or bridges) that are configured 
in this client?

> Related to your other questions, you might be using too much
> complexity which is in most of cases not desired. To be frank I didn't
> understand your goals and threat model...

My threat model is law enforcement, government and my ISP. I don't care if 
ISP at my datacentre sees that I'm using Tor, but I don't want my home ISP 
to see it. Also, if I have an option, I'd prefer my datacentre server to 
be seized in case of anything rather than my home equipment.

Of course I don't want anything to be seized at all.

> If I were you I would just configure a good vpn on the server in the
> datacenter (say openvpn for example with my own certs and everything)
> and connect to the vpn first, then normally (no bridges) to Tor. This
> will probably obfuscate some adversaries in learning that you are
> using Tor from home.

So option 2 from my list...

Another question is if it would be better to run a client only when I'm 
active on Tor, or use a client that is constantly connected. I feel that 
activity done after client startup (downloading consensus, building 
circuits) could be correlated with my Tor usage timeframe somehow, that's 
why I have a client running constantly now.

> Connecting to the VPN after you connect to Tor will provide you an
> unique static exit point from the Tor network which will make you very
> very distinguishable so I would not do that if I were you.

You mean routing VPN traffic through Tor? I didn't even consider it, as 
it would give no anonymity anyway...

Aeris <aeris+tor@xxxxxxxxxx>:

> Why do you absolutely want to route all your traffic through your VPN ?
> You want to hide to your ISP the fact you use Tor ?


> From my point of view, << secure >> (no security possible without clean
> specification of your threat model) network will be gateway of your 
> network with strong firewall allowing only output to known Tor node (with 
> iptables and ipset for example),

So you recommend manually specifying an entry guard, instead of letting 
Tor choose? Why?

> If you want to hide Tor to your ISP, just forward all Tor connection 
> from your gateway through your VPN

So you're opting for option 2 from my list, too.

Thanks, I think I'll do it this way then.

> (I don't take time to study the security of doing this, perhaps other 
> people here will find troubles).

If there are any troubles in this setup, I hope they will...

Thank you both for your input!

- -- 
Oskar Wendel, o.wendel@xxxxxxxxxxxxxxxxx
Pubkey: https://pgp.mit.edu/pks/lookup?search=0x6690CC52318DB84C
Fingerprint: C8C4 B75C BB72 36FB 94B4 925C 6690 CC52 318D B84C


tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to