Bitcoin Forum
October 21, 2017, 04:09:30 PM *
News: Latest stable version of Bitcoin Core: 0.15.0.1  [Torrent]. (New!)
 
   Home   Help Search Donate Login Register  
Pages: [1] 2 »  All
  Print  
Author Topic: Whonix Anonymous Operating System, anything, any Bitcoin client/server over Tor  (Read 6304 times)
adrelanos
Newbie
*
Offline Offline

Activity: 24



View Profile
October 20, 2012, 03:14:18 AM
 #1

Introduction:
Quote
Whonix is an operating system focused on anonymity, privacy and security. It's based on the Tor anonymity network, Debian GNU/Linux and security by isolation. DNS leaks are impossible, and not even malware with root privileges can find out the user's real IP.

Whonix consists of two parts: One solely runs Tor and acts as a gateway, which we call Whonix-Gateway. The other, which we call Whonix-Workstation, is on a completely isolated network. Only connections through Tor are possible.

https://whonix.org/w/images/9/90/Whonix.jpg

The official Bitcoin-qt client works, thanks to the Transparent Proxy feature, very well in Whonix out of the box. Connections to normal and hidden servers work. Setting up a hidden Bitcoin server should also work, since Whonix supports everything Tor support and more, just with stronger guarantees of hiding IP/location. The usual IP/DNS leak issues vanish.

This topic is supposed to find and solve any Tor/anonymity related problems with respect to Bitcoin. I am also probing for general interest in this project.

The offical Bitcoin-qt client is unfortunately not yet included into Whonix by default, because Bitcoin-qt didn't make it into Wheezy. It has to be installed manually (works well). I am also open for other clients.

Another advantage is, that any Bitcoin client, no matter if it has proxy settings or not, can be used safely over Tor. I am currently looking at and into electrum.

Whatever you wanted to do over Tor, it likely works well and safely in Whonix. Of course it inherits all weaknesses of Tor (exit node sniffing...), but it makes it much harder to misconfigure something on your side.

Please give me feedback about Whonix and free your mind about a future Bitcoin integration.

Homepage with documentation:
https://www.whonix.org

Screenshots:
https://whonix.org/wiki/Screenshots

Announcement:
https://lists.torproject.org/pipermail/tor-talk/2012-October/025921.html

Connectivity is very good. Hidden services can be connected without proxy settings, without torsocks etc.
Code:
~ $ nslookup idnxcnkne4qt76tg.onion
Server:         192.168.0.10
Address:        192.168.0.10#53

Non-authoritative answer:
Name:   idnxcnkne4qt76tg.onion
Address: 10.192.0.2


/usr/bin/wget 10.192.0.2
--2012-10-20 02:49:00--  http://10.192.0.2/
Connecting to 10.192.0.2:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 492 [text/html]
Saving to: `index.html.1'

100%[==========================================================================================================================================>] 492         2.25K/s   in 0.2s    

2012-10-20 02:49:13 (2.25 KB/s) - `index.html.1' saved [492/492]


/usr/bin/wget http://idnxcnkne4qt76tg.onion/
--2012-10-20 02:50:21--  http://idnxcnkne4qt76tg.onion/
Resolving idnxcnkne4qt76tg.onion (idnxcnkne4qt76tg.onion)... 10.192.0.2
Connecting to idnxcnkne4qt76tg.onion (idnxcnkne4qt76tg.onion)|10.192.0.2|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 14440 (14K) [text/html]
Saving to: `index.html.2'

100%[==========================================================================================================================================>] 14,440      --.-K/s   in 0.1s    

2012-10-20 02:50:44 (95.5 KB/s) - `index.html.2' saved [14440/14440]

-
1508602170
Hero Member
*
Offline Offline

Posts: 1508602170

View Profile Personal Message (Offline)

Ignore
1508602170
Reply with quote  #2

1508602170
Report to moderator
Bitcoin addresses contain a checksum, so it is very unlikely that mistyping an address will cause you to lose money.
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
1508602170
Hero Member
*
Offline Offline

Posts: 1508602170

View Profile Personal Message (Offline)

Ignore
1508602170
Reply with quote  #2

1508602170
Report to moderator
1508602170
Hero Member
*
Offline Offline

Posts: 1508602170

View Profile Personal Message (Offline)

Ignore
1508602170
Reply with quote  #2

1508602170
Report to moderator
1508602170
Hero Member
*
Offline Offline

Posts: 1508602170

View Profile Personal Message (Offline)

Ignore
1508602170
Reply with quote  #2

1508602170
Report to moderator
gusti
Legendary
*
Offline Offline

Activity: 1102


View Profile
October 20, 2012, 03:22:00 AM
 #2

Cool, I will give it a try. Do you know how it compare to TAILS ?

If you don't own the private keys, you don't own the coins.
adrelanos
Newbie
*
Offline Offline

Activity: 24



View Profile
October 20, 2012, 10:26:46 PM
 #3

Cool, I will give it a try. Do you know how it compare to TAILS ?
Yes, this has been extensively compared.

https://whonix.org/wiki/Comparison_with_Others

Feel free to ask if there are still questions open.

-
adrelanos
Newbie
*
Offline Offline

Activity: 24



View Profile
October 21, 2012, 09:44:40 AM
 #4

Sorry to hijack,

I don't see it as hijacking.

but OpenBSD and FreeBSD developers disagree, they claim virtualbox or hypervisor is just bugs on top of an already buggy arch and the idea that they can't break out from their weak software isolation is ideology not computer science. Look up virtualization on both mailing lists for more info, esp Theo De Raadts comments:
By the way, there is a statement about OpenBSD:
https://whonix.org/wiki/FAQ#Why_aren.27t_you_using_OpenBSD.2C_it.27s_the_most_secure_OS_ever.21.21.211.21

Quote from: Theo De Raadt
x86 virtualization is about basically placing another nearly full
kernel, full of new bugs, on top of a nasty x86 architecture which barely has correct page protection. Then running your operating system on the other side of this brand new pile of shit.

You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can't write operating systems or applications without security holes, can then turn around and suddenly write virtualization layers without security holes.

You've seen something on the shelf, and it has all sorts of pretty colours, and you've bought it.

That's all x86 virtualization is.

This massive move towards VM use is a worrying trend and I am scared of the side effects we will face from so many people (essentially) choosing to run 2-3 operating systems instead of 1 ... and doing this when their guest choice is 'OpenBSD for security'. I really wonder how people arrive at such a position... without logic or technological understanding, I suppose.
BSD has different goals. My impression is they lack the goal to bring more security to the masses.
https://whonix.org/wiki/FAQ#Why_aren.27t_you_using_OpenBSD.2C_it.27s_the_most_secure_OS_ever.21.21.211.21

The Virtual Box concern is very valid. I added a new FAQ entry for it:
https://whonix.org/wiki/FAQ#Isn.27t_Virtual_Box_an_insecure_choice.3F

Feel free to further comment on it.

Wouldn't it be better to run an actual firewall, and dmz with your tor server in it then proxy all your communications through it with pf rules? This can be accomplished with tiny boxes, old servers and even a couple of $200 laptops instead of virtualization.
Yes. You can do that with Whonix already. It is recommend on the Security page. Please see:
https://whonix.org/wiki/Physical_Isolation

-
adrelanos
Newbie
*
Offline Offline

Activity: 24



View Profile
July 17, 2013, 10:02:20 PM
 #5

Our new website is online!
https://whonix.org

We are also looking for developers to make Whonix even better!
https://whonix.org/w/images/a/a3/Whonix-ad.png

-
marcus_of_augustus
Legendary
*
Offline Offline

Activity: 2408



View Profile
July 18, 2013, 11:37:01 AM
 #6

Does it spoof MAC address?

adrelanos
Newbie
*
Offline Offline

Activity: 24



View Profile
July 19, 2013, 05:32:50 PM
 #7

Does it spoof MAC address?

From whom?

Applications usually don't send the MAC address to anyone else and malicious applications inside a Whonix-Workstation VM could only send a virtual MAC address (which isn't your real one) to someone.

In home networks, there is no reason to change it, since its never send to the ISP.

In public networks it gets really difficult. Just using a random MAC address isn't sane. It depends on threat models, what is best.

There is a whole documentation chapter about that topic: See:
https://whonix.org/wiki/Pre_Install_Advice#MAC_Address

And to find out how difficult it was to solve the controversy of MAC addresses in public networks, see:
https://whonix.org/wiki/Dev/MAC

At the moment no one knows the answers, its only clear, that it's not as simple as "use a random MAC".

-
threeip
Full Member
***
Offline Offline

Activity: 154



View Profile WWW
July 19, 2013, 05:41:38 PM
 #8

(is there a typo in the thread subject? makes me think of )

ส็็็็็็็็็็็็็็็็็็็็็็็็็ GPG:2AFD99BB ಠ_ಠ mon
marcus_of_augustus
Legendary
*
Offline Offline

Activity: 2408



View Profile
July 20, 2013, 01:50:31 AM
 #9


Of the connecting device running WHONIX. It is a known vulnerability of Tor routing that many (all?) ISPs record MAC addresses. So that when you connect without WHONIX the MAC address will be the same as when connecting with WHONIX, unless it spoofs the MAC address on the network connection.

Quote
In home networks, there is no reason to change it, since its never send to the ISP.

In public networks it gets really difficult. Just using a random MAC address isn't sane. It depends on threat models, what is best.

There is a whole documentation chapter about that topic: See:
https://whonix.org/wiki/Pre_Install_Advice#MAC_Address

And to find out how difficult it was to solve the controversy of MAC addresses in public networks, see:
https://whonix.org/wiki/Dev/MAC

At the moment no one knows the answers, its only clear, that it's not as simple as "use a random MAC".

Yeah, I bet there is ... the ISPs are selling their customers out by not keeping private data private. These are not new problems.



01BTC10
VIP
Hero Member
*
Offline Offline

Activity: 742



View Profile
July 20, 2013, 01:59:10 AM
 #10

I don't understand how the ISP could record your MAC address unless they have access to your router. MAC address is only needed on LAN and is not broadcast to the WAN.
adrelanos
Newbie
*
Offline Offline

Activity: 24



View Profile
July 22, 2013, 12:11:38 PM
 #11

True. 01BTC10 said it already. This is only an issue in public networks, i.e. WiFi hotspots.

-
jantenner81
Full Member
***
Offline Offline

Activity: 228


CIYAM - UI/UX design


View Profile WWW
July 24, 2013, 07:16:04 AM
 #12

cool idea. will give it a try  +1

@adrelanos: you got PM




AT - Automated Transactions
CIYAM | Developer
pcpro101
Newbie
*
Offline Offline

Activity: 16


View Profile
July 24, 2013, 09:57:37 AM
 #13

Does this protect you against the nsa
adrelanos
Newbie
*
Offline Offline

Activity: 24



View Profile
July 24, 2013, 12:01:50 PM
 #14

What if you are not under active surveillance? I want to avoid passive data collection.

The second part of my answer was supposed to answer that.

Quote
For the other cases, that depends if Tor does protect from nsa. The answer to that is not really clear:
https://lists.torproject.org/pipermail/tor-talk/2013-July/029014.html

And even if Tor was a whole lot better, you can never prove a negative. So I am hesitate with any broad claims and would be skeptical if some other project claimed that.

Also Whonix does not make such broad claims. For an related statement about three letter agencies, also see:
https://whonix.org/wiki/Dev/Technical_Introduction#With_more_technical_terms

-
pcpro101
Newbie
*
Offline Offline

Activity: 16


View Profile
July 24, 2013, 12:41:48 PM
 #15

What if you are not under active surveillance? I want to avoid passive data collection.
adrelanos
Newbie
*
Offline Offline

Activity: 24



View Profile
July 25, 2013, 04:49:06 PM
 #16

What if you are not under active surveillance? I want to avoid passive data collection.

The second part of my answer was supposed to answer that.

Quote
For the other cases, that depends if Tor does protect from nsa. The answer to that is not really clear:
https://lists.torproject.org/pipermail/tor-talk/2013-July/029014.html

And even if Tor was a whole lot better, you can never prove a negative. So I am hesitate with any broad claims and would be skeptical if some other project claimed that.

Also Whonix does not make such broad claims. For an related statement about three letter agencies, also see:
https://whonix.org/wiki/Dev/Technical_Introduction#With_more_technical_terms

-
an0nymous
Newbie
*
Offline Offline

Activity: 11


Personal text


View Profile WWW
August 01, 2013, 05:55:53 PM
 #17

My 10cents for offtopic,

Read you FAQ

https://whonix.org/wiki/FAQ#Why_aren.27t_you_using_OpenBSD.2C_it.27s_the_most_secure_OS_ever.21.21.211.21

Quote
There doesn't seem to be a modern MAC, instead there's systrace which has been criticized for having fundamental security problems (this may or may not have changed since then)

Why don't you take a FreeBSD? There is a complete modern MAC.


Quote
OpenBSD is also a very small OS (small TCB),
It is not a Linux zoo, you right. It is secure focused OS.


Quote
OpenBSD's target audience aren't end users, that's why they don't care to provide signed updates for the masses, see How to check downloaded package on OpenBSD 5.1?.

OpenBSD produce OpenSSH, there is rsync gateway for download packages, also there is AFS(Andrew File System) with alot of mirrors of OpenBSD repositories.


Quote
OpenBSD's website isn't reachable over SSL or as a Tor hidden service. How are users supposed to securely view the OpenBSD site and not learn things set up by a man-in-the-middle?

You develop over TOR, Do you know how it can help you browse OpenBSD's website? You still worry about the middle?


Quote
"buy the CDs"

Let me tell you once again, look at AFS( Andrew File System ).

Anyway, Linux - is a great choose, too. Good luck you with your job!

- In what we trust ? :/ -
marcus_of_augustus
Legendary
*
Offline Offline

Activity: 2408



View Profile
August 02, 2013, 12:21:53 AM
 #18

http://www.theguardian.com/world/2013/jul/31/nsa-top-secret-program-online-data

Quote
the ability to search HTTP activity by keyword permits the analyst access to what the NSA calls "nearly everything a typical user does on the internet".

You might find some of the information above relevant ...

adrelanos
Newbie
*
Offline Offline

Activity: 24



View Profile
August 05, 2013, 10:48:14 PM
 #19

Yes, that needs update/rewrite.

Quote
Quote
There doesn't seem to be a modern MAC, instead there's systrace which has been criticized for having fundamental security problems (this may or may not have changed since then)

Why don't you take a FreeBSD? There is a complete modern MAC.

Does FreeBSD have a secure package manager?

Does it defend this (w)?

Does it cover the TUF threat model (w)?

Can every user download from an already existing '''signed''' repository or is it required to run an own repository?

Quote
Quote
OpenBSD's target audience aren't end users, that's why they don't care to provide signed updates for the masses, see How to check downloaded package on OpenBSD 5.1?.

OpenBSD produce OpenSSH, there is rsync gateway for download packages, also there is AFS(Andrew File System) with alot of mirrors of OpenBSD repositories.
Not sure how rsync helps? Its just a great tool to conveniently sync files, but doesn't help with verification, unless download over ssh.

AFS: Any link to information how to use it?

Who signs packages? Must mirrors be trusted or do signatures come from OpenBSD?

Quote
Quote
OpenBSD's website isn't reachable over SSL or as a Tor hidden service. How are users supposed to securely view the OpenBSD site and not learn things set up by a man-in-the-middle?

You develop over TOR, Do you know how it can help you browse OpenBSD's website? You still worry about the middle?

Yes.

user <-> user ISP <-> internet <-> OpenBSD ISP <-> OpenBSD server
       MITM less likely for this route |  no help for this route




-
jantenner81
Full Member
***
Offline Offline

Activity: 228


CIYAM - UI/UX design


View Profile WWW
August 06, 2013, 06:27:52 PM
 #20

hey adrelanos,

should i post the new logo here then too? Or do you want to do this?!

AT - Automated Transactions
CIYAM | Developer
Pages: [1] 2 »  All
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!