"Total Privacy" <nosnoops@xxxxxxxxxxx> wrote: > I´d like to know where and how to put in wich packetlogger > to get as close as possible to the border of encryption at > my user computer side of Tor, to watch exactly what´s going > in and out (not only what´s visible in the browser). > My firewall packetlogger only takes the already encrypted > stuff that looks like random garbage, thus it are a little > to late to see the actual content of it. Don't put the sniffer between the Tor client and the world outside, but between your Tor client and the Tor using program on the inside. If you are mainly interested in HTTP, you can use Privoxy and enable header debugging (3.0.5 beta has some improvements there), or Firefox' LiveHTTPHeader extension. Note that if you use a HTTP proxy, a browser can't reliable tell you which HTTP headers reach or leave your system. Also note that Firefox tends to invent its own data for some HTTP failures without displaying an error message. For example if you open a new tab, and access an URL where the chunk decoding fails, Firefox shows you its about:blank page while still displaying the URL you asked for. If connections time out, LiveHTTPHeaders sometimes show you status code 200, even though the proxy didn't send it. Konqueror (and probably some other browser) can also show you HTTP headers, but I don't know how (un)reliable it works or if it's possible to log them. > In my theory, the possibility may be that if someone running > running an exit node (or even a middle or entry node?) and > tamper with it, this may be an firewall free entry into the > user computer to hack it or do what ever whitout be stopped > by the user´s firewall. Tor does some kind of Network Address Translation, it's easy to open a connection to get out, but you can't simply reach the inside without invitation. Of course a bug inside your Tor client could open an entry, but the same is true for every other program you run with Internet access. It's always a good idea to restrict Tor (and Privoxy and every other program where it's possible) with Jails, systrace or something like that, but I think usually the browser is the weakest link. Fabian -- http://www.fabiankeil.de/
Attachment:
signature.asc
Description: PGP signature