Recent comments in /f/Tor

not_bob wrote

I use Tor Browser on android often enough. But, I use GrapheneOS. As stated here before, Android is not private in it's default state. And, even if there is an opt out checkbox somewhere, can you really trust it?

But, it depends on your use case. If you want to hide things from you wife, it doesn't matter. If you want to do something seriously criminal? Bad idea.

If you want to torrent films? Whatever.

1

jackal wrote (edited )

Can we trust the Tor Foundation?

tldr: The Tor Foundation can't be trusted, the Tor network however can be trusted so long as you use it properly.

No, or at least that's what their public relations are telling me. They've been pushing hard to turn Tor into something else than an actual darknet. They keep pushing to turn the Tor network into a VPN to access clearnet "privately or anonymously" which makes less and less sense as time goes on.

Tor should be used the same way I2P is, privacy and anonymity exist so long you don't touch exit nodes or outproxies, and it seems their effort is more aimed at making sure people do not make the network bigger but rather they just use it as a VPN proxy for clearnet.

On the topic these videos discuss, it seems like all of these issues have to do precisely with the misuse of Tor as a proxy/VPN solution rather than as a darknet, I got a small comment on the useragent spoofing thing, though, that one seems sketchy, really sketchy, and apparently everyone involved seems to be throwing back bullshit reasons to justify why not even general.useragent.override is working (as I realized a moment ago).

4

jackal wrote

Reply to comment by Saint_Cuthbert in Tor Browser on mobile by Gambino9

Will there be a choice to opt-out? Yeah, you'll probably get a button somewhere to express that you don't want to be spied at least if you're in Europe. Will there be any auditable method for them to prove that they do respect consent? Nope, they never truly cared about consent in the first place if they make these opt-out rather than opt-in, mostly because they know that if this was opt-in most people wouldn't use it as it doesn't benefit them.

The problem is that this software is proprietary, the phones are proprietary and they give far more control to Google, Apple, Samsung and manufacturers than users, that's exactly why we have the privacy and security nightmare we have today with smartphones, and they're trying the same moves on computers as well, albeit with less success.

Where could I research this matter further?

See every single top-notch/latest flagship smartphone being announced from any major brand: Samsung, Google and Apple are all selling local AI assistant as a feature on these upcoming phones.

1

jackal wrote

Tldr: Unless your phone is running Lineage, Graphene or similar, without Google/Facebook and such spyware you do not have privacy nor security.

The long explanation is that it depends on the phone and what operating system is running, a stock Android experience is not private nor secure by design so if you're doing something that could get you in trouble with the government you will want to do such on a proper computer running Linux. On the latest and upcoming phones surveillance is gonna get worse than merely big tech getting some telemetry data and profiling shenanigans, upcoming phones will have hardware acceleration to make LLMs and AI power efficient, they definitely can and will snoop through your shit 24/7, taking screenshots or even screen recording, piping them through the algorithm and sending the digested data directly to their servers, with high accuracy and bypassing computational constraints because your phone's hardware will be doing the heavy lifting.

4

righttoprivacy wrote (edited by a moderator )

Reply to comment by privacy_is_dead in Onion Mail by privacy_is_dead

There is an onionmail project that offers both internal tor onion to onion emails, and clearnet (video on this also on channel showing i2pmail below in link).

But highly recommend is I2PMail if you haven't tried it yet. If you're running I2P or I2P+, you can access it via the SusiMail webmail client.

If unaware, you get you@i2pmail.org and you@mail.i2p (internal I2P mail).

Have some videos sharing set up: http://tube.i2p/watch?v=js7ldFYZelk

You can set it up with PGP in thunderbird, and it's free.

My favorite mail service.

2

bolvan wrote

For free plan daily allowed quota for sent/forward messages is -1 messages. You can't send mail without money.

2

cumlord wrote

Pretty much. tor is comparatively centralized and a lot more high profile than i2p. Fingerprinting is the thing that scares me the most, there's lots of identifiable metrics. Also instructive to look at how people have gotten deanon in the past but it doesn't anticipate the future or current capabilities. I'd think they'd spend the most energy targeting or trying to compromise high value targets/individuals like marketplaces/admins for the intel they could attain over a long period and we would be none the wiser. even if they don't have a big picture view of everything right now there's lots of tools that can be used to focus in on something of interest. I guess a good defense is to not be of interest.

1

Saint_Cuthbert OP wrote

There are only some odd-thousand tor nodes out there. For a powerful adversary to run many of them doesn't seem too unbelievable (50 cent army). They may not be able to hire someone to watch each and every node al the time, but they could possibly automate the process with artificial intelligence.

The Whonix documentation discusses how Tor users can be fingerprinted by their typing speed, among other things. And remember that it wasn't public knowledge that emails and phone calls could be tracked on a large scale until somewhat recently. In The Art of War is says to make your enemy think that you're weak when you're strong and strong when you're weak.

3

cumlord wrote

I've always assumed that it's monitored to some degree. Not like all tor users can be monitored clearly at all times, but from the aspect that running tor doesn't make you nsa proof. nothing does, but it does a good job at making you blend in, so when i want to look like everyone else and not do something identifiable, tor doesn't seem so bad. i think that's probably it's best use case, when what you chose to do with it would be like a needle in a haystack identifying you, but it can't correct for user error.

good to see new people interested in this kind of stuff even if they show you they just logged into their bank account with tor. they got the right spirit i guess.

3

NotQball wrote

The Official router does block through TOR traffic. It is an OK decision since it is an entry level router. I rarely test that version. The truth is that you do not want a lot of traffic over 30% (varies depending on conditions) through slower networks: satellite, ygg, flokinet some cell, modems, some VPNs. It does help with security but at a cost. Don't be stupid... in theory some entry guard may be able to block you unless you use your own servers. Again: If your threat model dictates it don't hesitate!

1

NotQball wrote

I did NOT monitor TOR the same way as i2p. There are some obvious "concessions"/sell-outs. I do NOT want to open THAT can of worms. What is obvious:

  1. Bad crappers: some entry guards and some exit nodes. These guys sell your data even from browsing ebay and Amazon. That desperate.
  2. In MY OPINION Tor Browser is mediocre...
  3. If you run YOUR OWN Tor servers and i2p routers (plural), despite of what you heard, SOME i2p traffic through Tor will help you out with TOR. You NEED 2 KNOW what you are doing on both networks and have some monitoring tools. This is for people in dire situations with enough knowledge of both networks. It is more of a problem for i2p than TOR. Don't make me sorry that I brought it up!
1

9995Deluxe wrote

If you are using the Tor Browser Bundle and have set DuckDuckGoOnion as your default search engine, it still uses the v2 URL. It looks like they will switch this to the v3 onion once the v2 onion goes offline.

1

Rambler wrote (edited )

Reply to comment by sitefights in Raddle v3 onion by sitefights

Why are they hard on RAMBLE?

Something to do with me having insensitive humor and me possessing the radical belief in free speech, even speech promoting ideas that I disagree with.

We have a lot more in common than we have in our differences, the main difference is that I don't believe speech needs strict regulation and I don't jump to conclusions about someone's deeply rooted political and personal beliefs based on insignificant online interactions.

With that said, they've got a decent site. Like said over there: they do their thing and we do ours. Nothing to bicker over. A lot of the members here would get banned there, and a lot of the members there would scoff at some of the content here and not return after experiencing an unsavory exchange.

No big deal.

4

sitefights OP wrote

Reply to comment by Rambler in Raddle v3 onion by sitefights

If I find a user of what I made, I'll be glad and kind to the user. Why are they hard on RAMBLE? Btw I'm having fun with fights between them and RAMBLE a bit. Just a bit.

3