Advanced Tor Browser Bundle config. - Anti-Spying - Anti-ECHELON - Anti-FiveEyes

[BitcoinFX]

Thanks for the info, I was thinking about installing a few addons to TBB (like Adblock Edge and Cryptocat) but I've read on the Tor site that to do not recommend it. Could you clarify whether it is safe to install addons, is there anyway to check to see if they are leaking any identifying information?

Most addons for TBB are unnecessary in terms of their ability to increase your privacy or anonymity

Adblock Plus and Adblock Edge (with easy privacy lists) are probably useful for most users. It will certainly make browsing faster by blocking ads and tracking elements.

Filter subscriptions for Adblock Plus and Adblock Edge are updated automatically when you are browsing or if you restart Firefox - if you don't disable this option. You can find settings to control automatic updates via Tools > Add-ons > Extensions > Options. It would probably be best to set automatic updates to 'off' and to manually update your lists via 'Filter Preferences...' when you deem that necessary.

Adblock Plus and Adblock Edge also log 'Count filter hits', although this is only a local setting, it should probably be switched off. Interestingly enough this option is 'unticked' in a default install of Adblock Edge.
 

I have not used Cryptocat in a while. Their was a discussion somewhere that it might be implemented as a 'default' Add-on in the TBB. If you install it then check all settings and options etc.


In terms of Add-ons the Tor advisory is really in relation to Plug-ins.

See: https://www.torproject.org/download/download-easy.html.en

"Want Tor to really work?

... c. Don't enable or install browser plugins

The Tor Browser will block browser plugins such as Flash, RealPlayer, Quicktime, and others: they can be manipulated into revealing your IP address. Similarly, we do not recommend installing additional addons or plugins into the Tor Browser, as these may bypass Tor or otherwise harm your anonymity and privacy. The lack of plugins means that Youtube videos are blocked by default, but Youtube does provide an experimental opt-in feature (enable it here) that works for some videos. ..."

Shockwave Flash and JavaScript are the worst for totally breaking your anonymity. If you enable Shockwave Flash for youtube (for example) then you might as well not be using Tor. Shockwave Flash installed on your local machine basically reveals your true IP to any Flash enabled website.

...

A 'plugin' that is OK to install would be the CAcert.org Certificate Signing Authority PEM. See: https://www.cacert.org/index.php?id=3

Installing this will allow you to visit websites that use CAcert.org Certificates without seeing any 'errors'.

For example, I run several web based proxy services that use this Certificate Signing Authority.

One of which can be found here: [proxy closed] - whilst Glype proxies are only one-hop server proxies and Tor certainly provides much better privacy and anonymity - combining Tor and an SSL enabled web proxy for certain browsing activities can massively increase your 'security'. My site has a 4096-bit SSL cert. (the highest level of website encryption - most sites only have 2048-bit SSL maximum - just inspect a few websites SSL Certs. in your browser, the current bitcointalk.org cert. is 2048-bit with the root cert. only being 1048-bit, for example - which is actually very common) - Anyway, browsing http web pages through this site over an SSL (https) connection and over the Tor network will add 4096-bit encryption across all of your Tor circuits. That makes for very very strong anonymity, privacy and security - ofc the reduction / offset is that it's quite slow.

The added benefit of doing something like this is that the websites that you visit won't know your using Tor and won't see your connection as a Tor Exit node. Also, in terms of server logging (which most web servers do automatically) my service does not know your real IP address because your using Tor, which is also really perfect.

...

DEFCON.19.Moxie.Marlinspike.SSL.And.The.Future.Of.Authenticity - https://www.youtube.com/watch?v=pDmj_xe7EIQ

Its a real shame that Convergence hasn't been updated to work with the latest version of Firefox. The above talk is a fascinating incite to the workings of SSL and https in general though.

[bernard75]

Thanks for the info, I was thinking about installing a few addons to TBB (like Adblock Edge and Cryptocat) but I've read on the Tor site that to do not recommend it. Could you clarify whether it is safe to install addons, is there anyway to check to see if they are leaking any identifying information?

I dont see how, other than helping to establish a unique fingerprint.

[BitcoinFX]

Howto enable an Encrypted DNS when using TBB

What is DNS ? - https://wikipedia.org/wiki/Domain_Name_System

DNS explained - http://www.opennicproject.org/dns-explained/

DNSCrypt : http://dnscrypt.org/ - A tool for securing communications between a client and a DNS resolver.

Originally conceived and built by OpenDNS: http://www.opendns.com/about/innovations/dnscrypt/ this is perhaps the "last mile" of internet security.

...

For Windows Download: http://dnscrypt.org/dnscrypt-proxy/downloads/ and https://github.com/Noxwizard/dnscrypt-winclient

1. Create a new folder named dnscrypt.

2. Extract the above .zip's : dnscrypt-proxy-win32-full-1.4.0.zip and dnscrypt-winclient-master.zip

3. Copy the contents of dnscrypt-proxy-win32 into > your dnscrypt folder i.e. the bin , includes and plugins folder(s).

4. Copy the contents of bin into dnscrypt.

5. Copy dnscrypt-winclient.exe into your dnscrypt folder from dnscrypt-winclient-master > dnscrypt-winclient-master > binaries > Release

6. Add a shortcut to dnscrypt-winclient.exe to your desktop and start it.

7. Tick box / Select your correct internet network adapter and select an appropriate DNS server from the drop down menu / tabs.

N.B. plugins don't function fully just yet.

8. Done now your using an Encrypted DNS.


This makes it even harder for your ISP and other potential adversaries to 'identify' your Tor browsing activities.

The 'default' list of servers included in dnscrypt-resolvers.csv can mostly be referenced here: http://www.opennicproject.org/

DNSCrypt (and other OpenNIC servers) status: http://wiki.opennicproject.org/Tier2

[BitcoinFX]

Thanks for the info, I was thinking about installing a few addons to TBB (like Adblock Edge and Cryptocat) but I've read on the Tor site that to do not recommend it. Could you clarify whether it is safe to install addons, is there anyway to check to see if they are leaking any identifying information?

I dont see how, other than helping to establish a unique fingerprint.

Indeed. Which is certainly one of the trickiest things to obfuscate properly.

[BitcoinFX]

Additional : Optional avoid servers list for ExcludeNodes :

Herewith, a 'block' of Tor nodes linked to an academic institution.

Also see: https://bitcointalk.org/index.php?topic=331077.msg8328447#msg8328447

and https://bitcointalk.org/index.php?topic=331077.msg8327557#msg8327557

EDIT: All these nodes are now offline and no longer operate as Tor Relay servers


UK nodes :

mighty1,81.150.197.163
mighty2,mighty3,81.150.197.165
mighty4,mighty5,81.150.197.166
mighty6,mighty7,81.150.197.167
mighty8,mighty9,81.150.197.168
mighty10,mighty11,81.150.197.170
mighty12,mighty13,81.150.197.171
mighty14,mighty15,81.150.197.172
mighty16,mighty17,81.150.197.173
mighty18,mighty19,81.150.197.174

Code:

mighty1,81.150.197.163,mighty2,mighty3,81.150.197.165,mighty4,mighty5,81.150.197.166,mighty6,mighty7,81.150.197.167,mighty8,mighty9,81.150.197.168,mighty10,mighty11,81.150.197.170,mighty12,mighty13,81.150.197.171,mighty14,mighty15,81.150.197.172,mighty16,mighty17,81.150.197.173,mighty18,mighty19,81.150.197.174

FR node :

southsea0,37.187.247.150

Code:

southsea0,37.187.247.150

Aside from the reasons already given in my other posts as to why the majority of Tor users might want to avoid Tor servers run by educational establishments and academic institutions...

All of the above are currently Tor Entry servers (non-Exit). The main 'mighty' block of servers have all been running for 107 days approx. (at the time of writing this post), so were started / installed at the same time. They are all utilizing almost 0 bandwidth availability. They are all running Tor 0.2.4.20 (as are many Tor servers) - which is an old version of Tor now known to have a security vulnerability.

Furthermore, all of these nodes have the same admin. / contact info. which can be found via http://torstatus.blutmagie.de/ The provided admin. contact is for a senior lecturer in computing, security and cryptography at a UK academic institution - yet these Tor servers have not set a list of fingerprints as advised for such a large set of Tor routers. RTM !?

See: https://www.torproject.org/docs/tor-manual.html.en

" NodeFamily node,node,…

    The Tor servers, defined by their identity fingerprints or nicknames, constitute a "family" of similar or co-administered servers, so never use any two of them in the same circuit. Defining a NodeFamily is only needed when a server doesn’t list the family itself (with MyFamily). This option can be used multiple times. In addition to nodes, you can also list IP address and ranges and country codes in {curly braces}. "

and

"MyFamily node,node,…

    Declare that this Tor server is controlled or administered by a group or organization identical or similar to that of the other servers, defined by their identity fingerprints or nicknames. When two servers both declare that they are in the same 'family', Tor clients will not use them in the same circuit. (Each server only needs to list the other servers in its family; it doesn’t need to list itself, but it won’t hurt.) Do not list any bridge relay as it would compromise its concealment.
    When listing a node, it’s better to list it by fingerprint than by nickname: fingerprints are more reliable."

How many Tor servers should one individual or entity operate, from the perspective of privacy and security, without even setting the torrc NodeFamily or MyFamily options ? Perhaps not this many.

You might also like to take a look at the administrators .me website - which you can research easily.

  

[dadugan]

Is Tor still considered a secure way to surf anonymously?

Heard plenty of story of people getting arrested even when using it.

[BitcoinFX]

Is Tor still considered a secure way to surf anonymously?

Heard plenty of story of people getting arrested even when using it.

Tor can help to protect against traffic analysis and provides improved anonymity and privacy when browsing on the internet.

No one should ever consider using Tor or the wider internet for any type of 'illegal' or malicious activity.

- "Tor can't help you if you use it wrong!"

Never confuse your 'Right to Privacy' with anything else.

[dadugan]

Is Tor still considered a secure way to surf anonymously?

Heard plenty of story of people getting arrested even when using it.

Tor can help to protect against traffic analysis and provides improved anonymity and privacy when browsing on the internet.

No one should ever consider using Tor or the wider internet for any type of 'illegal' or malicious activity.

- "Tor can't help you if you use it wrong!"

Never confuse your 'Right to Privacy' with anything else.

I considered it my right to consume and buy weed online, which doesn't harm anyone other than the tobacco industry.

[bitsmichel]

Is Tor still considered a secure way to surf anonymously?

Heard plenty of story of people getting arrested even when using it.

Tor can help to protect against traffic analysis and provides improved anonymity and privacy when browsing on the internet.

No one should ever consider using Tor or the wider internet for any type of 'illegal' or malicious activity.

- "Tor can't help you if you use it wrong!"

Never confuse your 'Right to Privacy' with anything else.

I considered it my right to consume and buy weed online, which doesn't harm anyone other than the tobacco industry.

In my opinion weed should be legal all across the globe. Other drugs are legal and kill way more people. They'll send 18 year olds on suicide missions which benefit only the industry, but can't smoke some greens?      Besides, even our president smoked it.

[BitcoinFX]

Please keep this thread on topic and lets focus on trying to improve speed, privacy, anonymity and security for regular Tor users by helping everyone to better understand how Tor works and how we can best utilize Tor to protect ourselves online.

[BitcoinFX]

Additional : Optional avoid servers list for ExcludeNodes :

Tor Entry Nodes run by Kaspersky Labs - See: https://wikipedia.org/wiki/Kaspersky_Lab

RO (Romania):

kasperskytor01
kasperskytor02
37.221.162.226

Code:

kasperskytor01,kasperskytor02,37.221.162.226

N.B. These Tor Relays would appear to be kept updated and are actually fast Entry servers.

However, as regular Tor users its probably preferable to avoid connections with a commercial 'research' company. They are very likely to be collecting Tor network data and metrics for their own commercial gain i.e. to help improve their products and services and to further protect their customers.

Such activities are perhaps not conducive with preserving individual privacy on the internet.

So, lets help Kaspersky Labs by reducing our genuine and 'good' Tor traffic to their Relays by avoiding their Tor nodes, perhaps then they will have much less data to sift through to locate the automated 'bad' robots and malicious software that also utilize the Tor network - then we will all be a bit safer on the internet!

[meeh]

TBB is soon history ;P

https://hideme.today/dev/
https://privacysolutions.no/

[BitcoinFX]

TBB is soon history ;P

https://hideme.today/dev/
https://privacysolutions.no/

Interesting projects, including the Abscond project / I2P (Tor) browser. Good work meeh.

I notice your including a couple of potentially useful privacy addons for Firefox and TBB. As always, everyone has to be careful that addons 'default' options do not revert or effect privacy settings already put in place by the TBB to work best with Tor. Anyway;

Private Tab - https://addons.mozilla.org/en-US/firefox/addon/private-tab/

Random Agent Spoofer - https://addons.mozilla.org/en-US/firefox/addon/random-agent-spoofer/

  

[BitcoinFX]

All example torrc configs. have been updated today 16th Aug. 2014.

- added current known 'Bad Exit' nodes to ExcludeNodes and some revisions to named servers.

[meeh]

TBB is soon history ;P

https://hideme.today/dev/
https://privacysolutions.no/

Interesting projects, including the Abscond project / I2P (Tor) browser. Good work meeh.

I notice your including a couple of potentially useful privacy addons for Firefox and TBB. As always, everyone has to be careful that addons 'default' options do not revert or effect privacy settings already put in place by the TBB to work best with Tor. Anyway;

Private Tab - https://addons.mozilla.org/en-US/firefox/addon/private-tab/

Random Agent Spoofer - https://addons.mozilla.org/en-US/firefox/addon/random-agent-spoofer/

  

Thanks for the feedback! I'm glad u liked the project I will sure look more into your sayings about plugins.

[kalisto]

Was searching for some tweaks on my torcc after watching https://www.youtube.com/watch?v=fTjNkbLBEqg and stumbled on this topic.

Thanks for providing the config! Saves me a full day research 

[Honeypot]

You plug yourself, yourself, willingly into the greatest surveillance tool known in the history of man.

You expect to 'outwit' it. Using something they invented and spearhead.




Good luck.

[godzülla]

First of all big thanks to coinfx for sharing his torrc with us its working very well sofar and one has not to be afraid to get his passwords stolen using it.


Secondly i want to comment on what honeypot has written.

You plug yourself, yourself, willingly into the greatest surveillance tool known in the history of man.

You expect to 'outwit' it. Using something they invented and spearhead.




Good luck.

Tor is a pretty badass anonimization concept though.
What more can we do than encrypting our traffic?
Even the exit node does not find out your real IP even if you do personal browsing lime checking your real life mail account with it.
Of course living in politically opressed country one should leave his hands from using tor or doing something illeagal on the internet if he does not know exactly what he is doing.

At last i have a question regarding orbot and utilizing the torrc on a android device.
I pasted exit nodes and entry nodes into the right fields in orbot becauae pasting in the torrc as a whole ddid not work in the first place but still the circuits are built using any random hops.
Has anybody experienced the same problems?

[chewi]

BitcoinFX,
Is it possible to update torrc config for Tor 3.6.5? It is crashing with torcc for 3.6.3 

[godzülla]

It is not crashing on my pc. Maybe you pasted the wrong partof the cfg.