[Freedombox-discuss] Tor

[Tim Retout]

On Tue, 2013-10-08 at 11:04 +0200, Petter Reinholdtsen wrote:
> So to me, it seem like routing all traffic through Tor bring the
> advantage of making it harder to track your location while changing
> the set of people that can perform MITM attack on you.  It is not like
> using Tor for everything is introducing some new threat.  It is
> already known that NSA and China rutinely perform MITM attach on
> non-Tor traffic, and I assume others do as well.  So we are left with
> probability calculations instead to evaluate the threat.

I agree to some extent, but my assessment of the probabilities is still
that using Tor unencrypted is going to cause you new and interesting
security problems.

Privacy and anonymity are different things, and actually I am more
worried about privacy first.  There's no point using Tor to access a
cloud-based email service.  I want to focus on getting everyone's data
decentralized, and their communications encrypted.

> While talking about these topics with a friend, I just got a tip
> about PORTALofPi, which is a ARch based Raspberry Pi setup to force
> all traffic over Tor.  See <URL: https://github.com/grugq/PORTALofPi/ >
> for that recipe.

Grugq's writing is very interesting: http://grugq.github.io/

He recommends using a VPN over Tor to avoid monitoring by malicious exit
nodes (which of course won't avoid monitoring by the VPN provider):

http://grugq.github.io/blog/2013/06/14/you-cant-get-there-from-here/

http://www.slideshare.net/grugq/opsec-for-hackers (NSFW, slide 137
onwards)

-- 
Tim Retout <diocles at debian.org>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part
URL: <http://lists.alioth.debian.org/pipermail/freedombox-discuss/attachments/20131010/2fd44b8a/attachment.sig>