Re: [tor-talk] Tor and TBB Issues Needing Good Advice

[Andreas Krey <a.krey@xxxxxx>]

On Sun, 21 Jan 2018 11:05:01 +0000, Mirimir wrote:
> On 01/21/2018 04:52 AM, Andreas Krey wrote:
...
> > TBB works right out of the box. Dear casual reader, please don't be alarmed by this post.
> 
> It does indeed. But it's a fragile thing, in that there's no protection
> against malware that bypasses Tor. FBI's NIT is a clear demonstration.
> There's no firewall, unless the user configures one.

Ok, s/alarmed/overly alarmed/. :-)

The problem, even with the FBI's NIT, is not that tor needs to run
firewalled, but rather that firefox needs to be denied anything but the
SOCKS port (and X11, on unix).

...
> Documentation for using Tor as a standalone service is rather iffy and
> poorly maintained, is it not? Especially for Windows.

Windows services are iffy as they are. :-( And otherwise this
is too much distro-dependent (and too much dependent on the
wishes of the operator) to provide a click-through installer.

I.e. to some extend you need to know what you are doing there.

> Not that I'd
> encourage anyone to use Tor in Windows.

I have to 'admit' that I have a TBB instance running
partially so I can use putty to reach hidden services.

...
> > have a good tor there is nothing to protect against, and if you somehow
> > got a subverted tor, it will not be as stupid as to use separate outbound
> > TCP connections for phoning home, but instead do that through tor.
> 
> Maybe "a subverted tor" wouldn't be stupid enough to do that, but that's
> what FBI's NIT does. And that's how many Tor users got pwned by it.

Yes, but it wasn't tor that was subverted, it was the browser. And
the subversion was needed to locate the victim, not to phone home
the result of the location.

Basically, what we'd want to do is to isolate firefox, by iptables
or by putting it (but not tor) into a container without network
access - but either of these may not be available to a normal
user installing TBB - and then there is windows.

...
> > https://hub.docker.com/r/hkjn/tor-browser/
> > https://blog.jessfraz.com/post/running-a-tor-relay-with-docker/
> 
> This _is_ good stuff.

Interesting, but not quite right. It isolates the browser
from the system, but not from the network.

- Andreas

-- 
"Totally trivial. Famous last words."
From: Linus Torvalds <torvalds@*.org>
Date: Fri, 22 Jan 2010 07:29:21 -0800
-- 
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk