Anonabox: a Tor hardware router(kickstarter.com)
kickstarter.com
Anonabox: a Tor hardware router
https://www.kickstarter.com/projects/augustgermar/anonabox-a-tor-hardware-router
10 comments
I'm 100% that most of the people who use tor through these devices, use it because it's cool. They will try login to their Gmail account and their Facebook page or watch Netflix through it. Some might use it for torrents. That's about it...
I don't believe that it will be used to anonymise their internet profiles. They probably need just some sort of authority circumvention.
I don't believe that it will be used to anonymise their internet profiles. They probably need just some sort of authority circumvention.
That is what I'm afraid of. Popularizing Tor in this manner is actively harmful to the Tor network and doesn't provide any real benefits. Tor operates its network on a limited budget.
The people this is marketed too should use a VPN if they want to circumvent local network policies.
https://blog.torproject.org/blog/bittorrent-over-tor-isnt-go...
> The attack is actually worse than that: apparently in some cases uTorrent, BitSpirit, and libTorrent simply write your IP address directly into the information they send to the tracker and/or to other peers. Tor is doing its job: Tor is _anonymously_ sending your IP address to the tracker or peer. Nobody knows where you're sending your IP address from. But that probably isn't what you wanted your Bittorrent client to send.
> So what's the fix? There are two answers here. The first answer is "don't run Bittorrent over Tor". We've been saying for years not to run Bittorrent over Tor, because the Tor network can't handle the load; perhaps these attacks will convince more people to listen. The second answer is that if you want your Bittorrent client to actually provide privacy when using a proxy, you need to get the application and protocol developers to fix their applications and protocols. Tor can't keep you safe if your applications leak your identity.
The people this is marketed too should use a VPN if they want to circumvent local network policies.
https://blog.torproject.org/blog/bittorrent-over-tor-isnt-go...
> The attack is actually worse than that: apparently in some cases uTorrent, BitSpirit, and libTorrent simply write your IP address directly into the information they send to the tracker and/or to other peers. Tor is doing its job: Tor is _anonymously_ sending your IP address to the tracker or peer. Nobody knows where you're sending your IP address from. But that probably isn't what you wanted your Bittorrent client to send.
> So what's the fix? There are two answers here. The first answer is "don't run Bittorrent over Tor". We've been saying for years not to run Bittorrent over Tor, because the Tor network can't handle the load; perhaps these attacks will convince more people to listen. The second answer is that if you want your Bittorrent client to actually provide privacy when using a proxy, you need to get the application and protocol developers to fix their applications and protocols. Tor can't keep you safe if your applications leak your identity.
I am surprised in fact that some of the VPN providers don't sell small cheap routers like these, set up to route all traffic through their VPN.
VPN providers do sell them. Not so cheap though. It is time intensive, they have to get regular routers and install Tomato or DDWRT. Is kind of interesting since you can get ASUS N routers that can run DD-WRT for $20-$25. They don't sell much because tech savvy people will just do it themselves.
They do:
http://www.flashrouters.com/routers/vpn-types/privateinterne...
The problem is they are all overpriced 'cause of manuals steps to flash an existing piece of hardware.
Really, what I want to see is more open hardware routers so we can automate the build process to setup a VPN on them.
http://www.flashrouters.com/routers/vpn-types/privateinterne...
The problem is they are all overpriced 'cause of manuals steps to flash an existing piece of hardware.
Really, what I want to see is more open hardware routers so we can automate the build process to setup a VPN on them.
Pointing out that just using Tor without changing your behavior might not be enough is definitely important. Using a separate piece of hardware that's dedicated just to routing all your traffic through Tor still has a lot of security benefits, since it limits the target surface just to Tor (and the OS stack required to run Tor), as opposed to your browser, OS or any other software you might use that could potentially leak your true identity.
No, it doesn't.
You are sorely, severely mistaken and misguided (just like the people creating this Tor product).
> since it limits the target surface just to Tor (and the OS stack required to run Tor) as opposed to your browser, OS or any other software you might use that could potentially leak your true identity.
That is completely 100% false. The attack surface of the browser remains along with the attack surface of the OS. All this does is mask your IP address/network origins.
Tor is no more effective at "reducing the attack surface" of your OS & Browser as a VPN.
You are sorely, severely mistaken and misguided (just like the people creating this Tor product).
> since it limits the target surface just to Tor (and the OS stack required to run Tor) as opposed to your browser, OS or any other software you might use that could potentially leak your true identity.
That is completely 100% false. The attack surface of the browser remains along with the attack surface of the OS. All this does is mask your IP address/network origins.
Tor is no more effective at "reducing the attack surface" of your OS & Browser as a VPN.
Of course it's still possible to exploit any software you might be running behind the router. That is why I agree it should be just one of many steps you ought to take if you care about anonymity. I never said this is a plug-and-play solution to internet anonymity. Still, hiding your IP address is one important factor in anonymity and probably the biggest use-case for Tor. Using a separate, dedicated device for this purpose makes it practically impossible for your IP address to leak e.g. because of a browser exploit.
Case in point, when the FBI busted users of child porn sites in 2013, they used a Zero-day in Firefox [1] to leak the users IP addresses. This would not have worked for users with a device like this. They could've tried to gather evidence through other means using this exploit, but that's definitely harder than simply opening a network connection and would only work in cases where the exploit could access anything that would identify the user.
(Obviously I'm not unhappy about child porn users getting busted, but I thought it would serve as a good example.)
[1]: https://www.mozilla.org/security/announce/2013/mfsa2013-53.h...
Case in point, when the FBI busted users of child porn sites in 2013, they used a Zero-day in Firefox [1] to leak the users IP addresses. This would not have worked for users with a device like this. They could've tried to gather evidence through other means using this exploit, but that's definitely harder than simply opening a network connection and would only work in cases where the exploit could access anything that would identify the user.
(Obviously I'm not unhappy about child porn users getting busted, but I thought it would serve as a good example.)
[1]: https://www.mozilla.org/security/announce/2013/mfsa2013-53.h...
What benefits does it have (except anonymity)?
Note that Tor is still being actively funded by US law enforcement (http://pando.com/2014/07/16/tor-spooks/) and that Tor's security has been repeatedly broken by US law enforcement in order to take down sites illegal under US law. (http://www.wired.com/2014/09/fbi-silk-road-hacking-question/)
It is debatable if Tor provides any more security than just using someone else's open wifi point. Great for evading bans on online forums, worthless against the DEA.
It is debatable if Tor provides any more security than just using someone else's open wifi point. Great for evading bans on online forums, worthless against the DEA.
Not sure why the above post is being downvoted. I read the Pando article, and it seems to be a comprehensive and well-researched piece that documented:
- How Tor was created by the U.S. government (Naval Research Lab) for the purpose of providing anonymity to intelligence agencies. It is now also widely used by law enforcement agencies to maintain anonymity in criminal investigations.
- How the project was funded primarily by intelligence agencies.
- How the NSA, which can monitor a large fraction of internet traffic, can unmask Tor users by correlating traffic directed at Tor entry points with traffic observed at Tor exit points. Snowden's leaks revealed that the NSA was working on breaking Tor anonymity and believed its efforts were "pretty much guaranteed to succeed".
- How Tor was created by the U.S. government (Naval Research Lab) for the purpose of providing anonymity to intelligence agencies. It is now also widely used by law enforcement agencies to maintain anonymity in criminal investigations.
- How the project was funded primarily by intelligence agencies.
- How the NSA, which can monitor a large fraction of internet traffic, can unmask Tor users by correlating traffic directed at Tor entry points with traffic observed at Tor exit points. Snowden's leaks revealed that the NSA was working on breaking Tor anonymity and believed its efforts were "pretty much guaranteed to succeed".
The above comments is downvoted IMHO because of: It is debatable if Tor provides any more security than just using someone else's open wifi point.
That's absolutely not true and if the author doesn't understand why, then he doesn't have a clue about what he is talking about.
That's absolutely not true and if the author doesn't understand why, then he doesn't have a clue about what he is talking about.
Tor traffic is monitored. Many high-bandwidth endpoints and relays are run by law enforcement, and Tor is configured to preferentially use high-bandwidth nodes. It is a given that, at minimum, all Tor metadata is logged; if not all content.
Additionally, the list of exit nodes is open and public, (https://www.torproject.org/projects/tordnsel.html.en) so any given server can tell if you're using Tor.
Comparing Tor to your neighbor's open wifi was an example of how poor Tor's anonymity is, rather than how good your neighbor's connection is.
Additionally, the list of exit nodes is open and public, (https://www.torproject.org/projects/tordnsel.html.en) so any given server can tell if you're using Tor.
Comparing Tor to your neighbor's open wifi was an example of how poor Tor's anonymity is, rather than how good your neighbor's connection is.
The fact that exit nodes are controlled by rogue third parties doesn't mean a thing if you use Tor to anonymise your connection. That's the purpose this is why it was built that way.
Tor anonymises extremely well both client and server. All other stuff in between should be used through SSL and with caution (after all SSL is kinda broken and the NSA can perform MiTM attack or steal and sign certificates from major authorities).
If you 'leak' metadata using JS or by logging to services e.g. to Facebook (the dumbest use of TOR I've ever seen), then obviously state-level authorities are not your concern. Otherwise you wouldn't real had public profiles on social networks anyway.
Comparing the neighbours Open WiFi to TOR is very naive, even if the NSA is after you. The Open WiFi will a give 1km radius of your CURRENT position on-the-fly. On the other hand to analyse metadata sniffed from an exit-node will probably take hours if not weeks and still would be a (mostly) wild guess over where you where at the time of the attack.
Tor anonymises extremely well both client and server. All other stuff in between should be used through SSL and with caution (after all SSL is kinda broken and the NSA can perform MiTM attack or steal and sign certificates from major authorities).
If you 'leak' metadata using JS or by logging to services e.g. to Facebook (the dumbest use of TOR I've ever seen), then obviously state-level authorities are not your concern. Otherwise you wouldn't real had public profiles on social networks anyway.
Comparing the neighbours Open WiFi to TOR is very naive, even if the NSA is after you. The Open WiFi will a give 1km radius of your CURRENT position on-the-fly. On the other hand to analyse metadata sniffed from an exit-node will probably take hours if not weeks and still would be a (mostly) wild guess over where you where at the time of the attack.
On the one hand, I frequently (and loudly) point out to people that Tor is US Govt funded, etc. - I think it's important that everyone be aware of that.
OTOH, I am not sure this is a bad thing, at least in terms of the "legality of Tor" ... it's often discussed whether simply using Tor will, at some point, be legally questionable and I think there is a built-in legal defense here: How can merely using Tor ever be illegal if it is currently funded by the government ?
OTOH, I am not sure this is a bad thing, at least in terms of the "legality of Tor" ... it's often discussed whether simply using Tor will, at some point, be legally questionable and I think there is a built-in legal defense here: How can merely using Tor ever be illegal if it is currently funded by the government ?
Yeap at some point in time ARPANET was a military project too. So where drones, small GPS devices (iPhones?!) and google glass-like equipment :-)
My problem with this is that I only want 10% of my traffic filtered over tor. This is useless to most people that want to stream movies or need some of their traffic over a regular network.
I guess that you use the wired connection for Tor, wifi from the router for everything else? Then you still have to enable/disable the network card you want to use at the time.
The current tor browser is perfect. I just switch back and forth between it and my regular browsers as needed.
I guess that you use the wired connection for Tor, wifi from the router for everything else? Then you still have to enable/disable the network card you want to use at the time.
The current tor browser is perfect. I just switch back and forth between it and my regular browsers as needed.
If you are using Tor for a serious reason, you should have separate machines for Tor vs non-Tor activity. There was recently a high profile case (silk road?) where a user forgot to switch browser modes once before logging in to an monitored account to post a quick comment. It only takes once.
Good point, better safe than sorry, but in my case (and probably a large number of Tor users - I don't use Tor for "serious" reasons. Mostly to support privacy.
[deleted]
Also see the PORTAL travel router: https://github.com/grugq/portal
It uses the GL-Inet travel router. They already run OpenWRT by default and have both LAN and WAN ports. Eliminates the problems of Kickstarter.
I may do this tonight, as I have a few of them at home (they're great for "need a wifi bridge", "need a repeater", "friend needs a replacement router" type tasks).
http://www.amazon.com/Gl-iNet-Router-Openwrt-Mobile-Control/...
It uses the GL-Inet travel router. They already run OpenWRT by default and have both LAN and WAN ports. Eliminates the problems of Kickstarter.
I may do this tonight, as I have a few of them at home (they're great for "need a wifi bridge", "need a repeater", "friend needs a replacement router" type tasks).
http://www.amazon.com/Gl-iNet-Router-Openwrt-Mobile-Control/...
I'm pretty sure a VPN would achieve the level of security that most users looking for a "Tor" router would want, as Tor is a bit overkill, and silly if you're willing to commit to the behavior changes to make it effective.
Perhaps someone should partner with a popular VPN like PrivateInternetAccess or another major VPN, as it'd allow people to continue using the services they know and love, and keep some of the prying eyes away from their unencrypted traffic.
Perhaps someone should partner with a popular VPN like PrivateInternetAccess or another major VPN, as it'd allow people to continue using the services they know and love, and keep some of the prying eyes away from their unencrypted traffic.
This has already been done:
http://www.technologyreview.com/news/521676/online-anonymity...
You can buy the product here [1] for $49. As far as I can tell, the only difference is that one is opensource while the other doesn't seem to be.
[1] https://pogoplug.com/safeplug
http://www.technologyreview.com/news/521676/online-anonymity...
You can buy the product here [1] for $49. As far as I can tell, the only difference is that one is opensource while the other doesn't seem to be.
[1] https://pogoplug.com/safeplug
That's a huge and critical difference. Open source down to the hardware is the only way you can be sure that what you're getting is actually Tor and not Tor + secret backdoor. (Though I suppose you still have to trust the hardware manufacturer, but the buck does have to stop somewhere.)
This is mentioned in the article including a couple points about the size (safeplug is twice the size so less convenient for taking with you) as well as the security flaws found in September.
The article he is referring to is this one: http://www.wired.com/2014/10/tiny-box-can-anonymize-everythi...
The kickstarter page makes no mention to other similar products, which to me seems pretty dishonest. Nobody uses the "Risks and challenges" section correctly.
The kickstarter page makes no mention to other similar products, which to me seems pretty dishonest. Nobody uses the "Risks and challenges" section correctly.
Ah yea, thanks for that. When I originally clicked the link it was to the wired article, must have been updated to the kickstarter page.
What hardware is that ? Is that custom designed for their project, or are they using an existing travel router whose form factor I have never seen before ?
I am always interested in the smallest possible non-wireless device with two ethernet ports ... all of the dual ethernet tp-link devices have wireless capability, so they are disqualified.
Related: this, and every device like it, should be a plug ... even at the expense of compactness...
I am always interested in the smallest possible non-wireless device with two ethernet ports ... all of the dual ethernet tp-link devices have wireless capability, so they are disqualified.
Related: this, and every device like it, should be a plug ... even at the expense of compactness...
Does anyone know if the following is a good idea:
Run two SSIDs on a router: one regular internet, the other TOR only. TOR would be running on the router itself.
Are routers too underpowered to run TOR?
PORTAL looks good. Not sure why it has to have a separate 3g modem/wireless card. Any good reason to avoid ethernet? Reason to have this as a separate box?
Run two SSIDs on a router: one regular internet, the other TOR only. TOR would be running on the router itself.
Are routers too underpowered to run TOR?
PORTAL looks good. Not sure why it has to have a separate 3g modem/wireless card. Any good reason to avoid ethernet? Reason to have this as a separate box?
Hello,
I won't comment on the configuration because I don't know what you'd like to achieve.
A router could run a tor node if the traffic is limited. If the traffic up/down increases (e.g. 50 Mbits up/down) then it can't handle on-the-fly encryption/decryption.
However, you could install/run a tor node (private) on digital ocean for 5 USD/month and route all your traffic through the VPS.
You could use Tor Browser or custom running on your Desktop. The configuration depends on how often you use tor and for what reason.
I won't comment on the configuration because I don't know what you'd like to achieve.
A router could run a tor node if the traffic is limited. If the traffic up/down increases (e.g. 50 Mbits up/down) then it can't handle on-the-fly encryption/decryption.
However, you could install/run a tor node (private) on digital ocean for 5 USD/month and route all your traffic through the VPS.
You could use Tor Browser or custom running on your Desktop. The configuration depends on how often you use tor and for what reason.
Apparently the product was a huge success. I don't understand it's use case. Seriously I don't:
* Is it hard to buy an RPi and set-it-up for a home Tor node? * To buy a VPS and setup a Tor-node then route all the traffic through it?! * Run tor-browser on your desktop when/if you need Tor?
A use how has avg Joe's internet's workflow through Tor, protects himself from whom? Rogue internet caffe access points?!
Anyway it seems neat but to me is pointless.
* Is it hard to buy an RPi and set-it-up for a home Tor node? * To buy a VPS and setup a Tor-node then route all the traffic through it?! * Run tor-browser on your desktop when/if you need Tor?
A use how has avg Joe's internet's workflow through Tor, protects himself from whom? Rogue internet caffe access points?!
Anyway it seems neat but to me is pointless.
> * Is it hard to buy an RPi and set-it-up for a home Tor node? * To buy a VPS and setup a Tor-node then route all the traffic through it?! * Run tor-browser on your desktop when/if you need Tor?
Well... yeah, it is hard. It's undeniably much, much harder than buying a box and plugging it in, even if you're the kind of person who thinks configuring a VPS safely for Tor, then flawlessly configuring local network routing is an easy task. Hell I'm certified nerd and I'd still be scared to (flawlessly) do that. Not to mention a box is cheaper than a monthly VPS.
Tor browser is slightly easier but still crappy, because as the Kickstarter says it's just your browser and less tech-savvy people might wrongly equate "my browser" with "all of my computer's internet activity".
This project is a fantastic idea.
Well... yeah, it is hard. It's undeniably much, much harder than buying a box and plugging it in, even if you're the kind of person who thinks configuring a VPS safely for Tor, then flawlessly configuring local network routing is an easy task. Hell I'm certified nerd and I'd still be scared to (flawlessly) do that. Not to mention a box is cheaper than a monthly VPS.
Tor browser is slightly easier but still crappy, because as the Kickstarter says it's just your browser and less tech-savvy people might wrongly equate "my browser" with "all of my computer's internet activity".
This project is a fantastic idea.
> I don't understand it's use case.
If there's a chance that the Government or some other entity will come after you for whatever you're doing on Tor, and you don't want there to be any way that your machines (clients or servers) could leak their public IP address, you could put them behind this.
If there's a chance that the Government or some other entity will come after you for whatever you're doing on Tor, and you don't want there to be any way that your machines (clients or servers) could leak their public IP address, you could put them behind this.
They can deanonymize you at the NSA's scale. They can deanonymize you with browser exploits at the FBI's scale.
If you are going to be actively targeted using Tor is not sufficient.
Tor is an effective defense against passive, generalized surveillance. It isn't effective against FBI/NSA-level resources because they will just drop 0 days in your path until you get hit by one.
If you are going to be actively targeted using Tor is not sufficient.
Tor is an effective defense against passive, generalized surveillance. It isn't effective against FBI/NSA-level resources because they will just drop 0 days in your path until you get hit by one.
We know of at least one Tor hidden service which was deanonymized because it leaked an IP address at some point. This protects against that flaw being likely to happen again. That is what the use case of this is. Of course it's not enough on its own. It protects against a specific attack in an easy-to-setup way.
IF you were serious about this, setup a router to TOR correctly using quality hardware. Use a router distribution (e.g. PFSense) on real hardware. Otherwise, you'll be just as screwed because your service will be ridiculously slow.
This wouldn't be able to handle anything more than a consumer grade internet connection at relatively low speeds. "By our fourth round of prototypes we had created a model with 64mb memory and a 580mhz CPU. This not only runs the software well, it flies! At last happy with the board, we designed a simple, minimalist case in plain white to house it. The end result is our current model. We decided to name it the anonabox."
Running CPU intensive processes (e.g. encryption) on a high throughput connection (e.g. web server) isn't going to work unless its only used by you and your 5 friends.
This wouldn't be able to handle anything more than a consumer grade internet connection at relatively low speeds. "By our fourth round of prototypes we had created a model with 64mb memory and a 580mhz CPU. This not only runs the software well, it flies! At last happy with the board, we designed a simple, minimalist case in plain white to house it. The end result is our current model. We decided to name it the anonabox."
Running CPU intensive processes (e.g. encryption) on a high throughput connection (e.g. web server) isn't going to work unless its only used by you and your 5 friends.
Url changed from http://www.wired.com/2014/10/tiny-box-can-anonymize-everythi..., which points to this.
Educating users all over the world on how to resist censorship and protect their anonymity is important. Buying a piece of hardware doesn't achieve that.