Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

There is a danger with running "just anything" over tor, which is that, ultimately, your data will be visible to the exit node. And if you run anything (like facebook, apps, etc.) over that same link, it will be very easy for the person running the exit node to tie the information to a particular person (you).


I was going to reply with a bunch of stuff about how Tor exit nodes don't terminate TLS, but I thought more about what you are saying. You're right, it's not a good idea at all to be logged into any account that de-anonymizes you in any way while using Tor, because then for the rest of that Tor session, you are potentially compromised.

Your anonymous presence and your public presence should always be 100% separate.


In general, I don't think it is a good idea to connect to multiple services over the same Tor link. One of those services could be compromised in some way (hacked, government backdoors, etc.), and could be used to de-anonymize sessions at other services, by using the ip-address of the exit-node and the time-frame in which the communication took place.


After discussion on the Tor mailing list a while back, that issue was solved in Cloak (http://reclaim-your-privacy.com and http://github.com/ReclaimYourPrivacy) by using different Tor circuits for each service! The relevant file is here: https://github.com/ReclaimYourPrivacy/cloak-cloak/blob/maste...




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: