[smolloy]

After reading this thread started by cousinlucky I started thinking about online security. In particular I started thinking about my ISP collecting and storing information about my surfing habits, and how uncomfortable this made me feel. Well after a bit of browsing around, I cam across an application know as Tor (link).

This is based on a large network of nodes which are used to carry TCP packets from my computer to the website I request and back. But the beauty of this system is that the route is randomised across the hundreds of nodes there are out there -- the route is always changing, so it becomes almost impossible to track my surfing! On top of this, they encrypt the communications between Tor nodes, so someone spying on a particular node can't see the contents of the packets.

OK, sure, I might be being a little paranoid, but I'm thinking of trying it out, and I was wondering if any of you guys had any experience with it. Was it worth it? Did it have any effect on network speed? Ease of use/installation?

[fingal]

Hi smolloy

Yes, I use Tor from time to time. It works well, but significantly slows down your browsing. If you were to try to log into this site while running it, you would find it annoying, but it's fine for most websites.

What isn't widely realised (and I only found out by installing it myself) is that Firefox has a Tor plugin, which I think is available from their site. Lets you turn Tor on and off at will (while it runs in the background as a daemon).

So there's a trade-off between online privacy and browsing speed. Having said that, you could set yourself up as a Tor 'node' and that might help.

The way I installed Tor was to follow instructions in a Free Software Foundation magazine. It was very easy, but might not have been without that guide. I didn't quite understand that it would run as a daemon, but running 'top' and checking there confirmed that.

[smolloy]

Thanks fingal. The reason you only use it "from time to time" is due to the slower browsing speed?

I was thinking of setting myself up as a node, but I don't think that will speed anything up, since my internet session would still have to go through the same network of encrypted connections. We'll see. In any case, I like the fact that such a service exists. I've had a few people comment that it will help paedophiles, etc. hide their browsing, but I think it's more important that people can be guaranteed privacy when they want it. Chinese journalists for example.

I'll try it this weekend, and if I don't like it, I'll probably just browse normally, but still be set up as a node. That way I get a nice warm fuzzy feeling from helping people

[fingal]

Originally Posted by smolloy

Thanks fingal. The reason you only use it "from time to time" is due to the slower browsing speed?

Mostly that, but even more because I don't care that much about someone knowing which sites I visit. I don't do anything illegal, and even if I stray from the path and look at naked women from time to time, I don't care. If I'm going to gaol for that, then so is everyone. I'll complain about it later.

The thing about Tor is, it really does encrypt your browsing. The concept I like is the one I read in the magazine I mentioned. Something like, 'If you use Tor, you can no more decrypt the browsing history of an end user, than you can extract the eggs from a cake you've made.' My explanation is more clumsy than the article I read, but that was the gist.

As for paedophiles and other deviants, they will do what they do - and hopefully be arrested for it - despite encryption etc. At least I think so. I'm not sure that total privacy is always a good thing, but these days I'm not 100% sure about very much, and I don't want to be.

[cousinlucky]

It seems to me that encrypting your website history is going to entice some government agency to investigate you.

Personally I do not worry about my ISP keeping track of the web sites I visit. What I worry about is my ISP or anyone else scanning my computer and then downloading software that will record my keystrokes or mirror my computers functions.

I wish someone would come up with Linux software that would detect all outgoing and incoming computer traffic and provide a barrier requiring my permission the way that my old Kerio Firewall did within windows.

That would truly put my mind at ease.

[smolloy]

Originally Posted by cousinlucky

I wish someone would come up with Linux software that would detect all outgoing and incoming computer traffic and provide a barrier requiring my permission the way that my old Kerio Firewall did within windows.

That would truly put my mind at ease.

I imagine that such a program exists, and it's just a matter of finding it. I wonder if anyone out there knows of such a program

Originally Posted by cousinlucky

It seems to me that encrypting your website history is going to entice some government agency to investigate you.

I was thinking in exactly the same way, but that train of thought kinda bugged me. It's like admitting that the Big Bad Government is so big and bad that I shouldn't do something that I think will help people for fear of attracting the wrong sort of attention. It feels too much like being cowed by them, and I don't like that idea.

I think I'm gonna go ahead and install Tor, including setting up a server, over the weekend. I'll see how it runs, and try to figure out if,
a) It's the way I want to browse the web,
and
b) If it feels like being a Tor node is secure enough, and not a big bandwidth hit.

I'll let you know how it goes.

[fingal]

Smolloy - after you've installed Tor and got it running, you might consider checking it by getting someone/something to port scan you ... like this site: https://www.grc.com/x/ne.dll?bh0bkyd2

It's quite amusing to see it getting your IP addy wrong, telling you you live in China or somewhere, and then telling you how insecure your computer is. Wrong computer!

[ImNeat]

I think a tor/privoxy combo is recommended for security/anonymity. I haven't gotten them working in Arch yet tho. I tried a few months ago but gave up. I think I couldn't get the daemons to start...

[smolloy]

Hi guys. Posting this from the anonymity of the Tor network!

Browsing is noticeably slower than usual, but not so slow that I'm tearing my hair out, and there's a nice little firefox plugin that allows me to toggle Tor on and off at the touch of a button (ctrl-shift-t). Very nice!

Fingal, I tried a port scan, and it was funny to see that I am a computer in Germany with terrible security I then switched Tor off and got the usual, very secure, results I am used to.

Now to try to "give back to the community" by setting up my own Tor server.