Qubes-Whonix vs. Qubes

[andrewe...@safe-mail.net]

Hello all,

I just recently became aware of the Qubes project and am very interested in it, and excited about getting a new laptop (hopefully) soon that will be compatible.

I was hoping I could ask you some questions that I have been unable to find the answers to.

The Whonix team made a big deal about their Qubes-Whonix update earlier this year (and if I recall correctly, Joanna Rutkowska gave them a shout out on twitter as well), but I have been a little confused about their project. My main question is, how is Qubes-Whonix any different than Qubes TorVM?

Specifically, I have found the following page on the Whonix site: https://www.whonix.org/wiki/Comparison_with_Others
Yet the above link seems out of date.

I apologize that I am not very technical, but summarized below are the major differences posted on their site, and I was hoping someone could comment on whether these differences still exist and if they are viewed as substantial or not. Thank you!

In Whonix, Stream Isolation is pre-configured, but must be set manually in Qubes.

Whonix is marked as having verifiable builds, while Qubes does not.

For Qubes: the ISP can guess the project type from the Network Fingerprint.

While for Whonix the Web Fingerprint is the same as TBB, Qubes differs from TBB.

Whonix has the following: "Connection Wizard preventing one from unwanted and accidental connections to the public Tor network"; Qubes has a question mark under this category.

The chart says Qubes does not include the Tor Browser from the Tor Project, and also does not have a privacy enhanced browser.

The chart also says that Qubes does not have secure distributed network time synchronization, and also does not hide your time zone.

For Whonix, the VM host time differs from operating system time, and the unsafe browser time differs from torified browser time. For Qubes, these are labeled as no.

For a small clock skew attack against NTP: Whonix says sdwdate will fix it, while for Qubes it says "If the user visits a page which is under observation by the adversary, the adversary knows who is connecting."

The chart says that Qubes does not have either randomized Network Time Synchronization when booting, or randomized Network Time Synchronization when during Session - but it also states that thess might not be important or necessary.

Thank you for all of your help!

AEO

[cprise]

The question keeps coming up. Here is an answer from a Whonix guy:

https://groups.google.com/d/msgid/qubes-users/5575A01C.6030606%40whonix.org

I think you summarized it pretty well though. As for Torvm, I don't
think it has changed much if at all for some time. Torvm is decent if
you limit yourself to browsing *and* you add and reconfigure Tor Browser
to it yourself. Torvm also serves a purpose in helping builds to take
place without serruptitious interference.

[Unman]

Unfortunately Patrick's' post isn't an answer to the question, and, as
Andrew says, the comparison table is out of date. It's also misleading
in parts.

It's true that torvm hasn't changed for some time: I'm not aware of any
feature requests or bugs raised against it, so this isn't surprising.
It's certainly not limited to browsing use: that said, if you want
a hardened browser, setting up and configuring TBB to use it is trivial.

Here's my take on the situation. (I should make it clear that I am NOT a
Whonix guy.)
Whonix has two parts- the gateway and the workstation. The gateway
ensures that all traffic runs through tor network, while the workstation
contains applications preconfigured for secure use, to enhance
anonymity.
So far the whonix-qubes effort has brought both parts of this in to the
qubes environment.

The torvm is a gateway to the tor network. With the addition of a torfw,
and some minor configuration changes this can provide almost all the
features of the whonix gw, and easy qubes style host access control too.
It seems to me that this this is the best way for whonix on qubes to
go, rather than just importing the current model. (But as I say I'm not
a whonix guy.) I'm currently testing out some scripts that will do this
and that seem to provide the best of the whonix gw in a "native" qubes
way.

The advantage of this is that all qubes tor users get the benefit,
whether they choose to use the whonix wstation or not. And if you DO
want a vm with hardened applications you download the whonix wstation
template and base your qubes vms off that.

I dont know if this helps you Andrew. I suggest you evaluate what your
needs are and see how they fit within the qubes model. It may be that a
torvm and torfw together with use of a variety of appvms gives you all
you need. If you want the preconfigured applications go for whonix-qubes.

unman

[Unman]

On Mon, Jun 15, 2015 at 10:06:33PM -0400, cprise wrote:

[Otto Kratik]

I set up and configured TorVM (on Qubes R2) some time ago according to the official instructions, and it seems to work well as intended, for every purpose imaginable and not just browsing (email, FTP, chat, video etc). But I've never seen mention before of adding a "TorFW" on top of this. Where is there a description or guide for this extra step?

[Unman]

It was Joanna who first pointed out that the TorVM wont honour firewall
rules set for downstream VMs. If you want to use firewall rules to
enforce separation then you have to insert a fw between the client and
the TorVM:that's the TorFW.
One thing to be wary of, that I've pointed out before: if you simply use
a standard qubes fw then you get to enforce network level policies BUT the
TorFW will alias all clients to the same IP address, so you lose the
benefit of stream isolation in the TorVM.
This is almost certainly not what you want.

To get round this I use a simple script on the TorFW to set SNAT to
preserve the singularity of client addresses, and a script on the TorVM
that sets appropriate routing.

unman

[7v5w7go9ub0o]

On 07/14/2015 07:55 PM, Unman wrote:
> On Thu, Jul 09, 2015 at 12:23:28PM -0700, Otto Kratik wrote:
>> I set up and configured TorVM (on Qubes R2) some time ago according to the
>> official instructions, and it seems to work well as intended, for every
>> purpose imaginable and not just browsing (email, FTP, chat, video etc). But
>> I've never seen mention before of adding a "TorFW" on top of this. Where is
>> there a description or guide for this extra step?
>>

Thank you for posting this.

I am NOT trying to be argumentative - I don't understand and will post
questions as statements:

> It was Joanna who first pointed out that the TorVM wont honour firewall
> rules set for downstream VMs.

IIUC,
1. She was referring to typical firewall protections (e.g. stateful
packet control, syn cookies, etc) and was thereby suggesting that TorVM
go out via the firewallVM!?

2. What other "downstream VMs" would one want?

> If you want to use firewall rules to
> enforce separation then you have to insert a fw between the client and
> the TorVM:that's the TorFW.
> One thing to be wary of, that I've pointed out before: if you simply use
> a standard qubes fw then you get to enforce network level policies BUT the
> TorFW will alias all clients to the same IP address, so you lose the
> benefit of stream isolation in the TorVM.
> This is almost certainly not what you want.

3. It used to be argued that a single outbound TOR connection was better
because it is "busier" and therefor more resistant to timing attacks!?

4. Is stream isolation intended to assure different exit nodes? At exit
point, is there a way to correlate the traffic to the same client!?

To get round this I use a simple script on the TorFW to set SNAT to
preserve the singularity of client addresses, and a script on the TorVM
that sets appropriate routing.
>

Again, I'm not wanting to be argumentative - just trying to ask clear
questions.

TIA

[R]

Sorry to go a bit off topic, but isn't TOR overrated?
https://newworldorderg20.wordpress.com/2015/01/03/nsa-claims-tor-is-a-secure-way-to-guard-your-privacy-yet-tor-is-in-bed-with-u-s-government/
Read that. Makes sense doesn't it? Just use VPN instead, or:
http://fossbytes.com/best-alternatives-to-tor-browser-to-browse-anonymously/

[conp...@gmail.com]

On Wednesday, 15 July 2015 09:58:24 UTC+1, R wrote:
> Sorry to go a bit off topic, but isn't TOR overrated?
> https://newworldorderg20.wordpress.com/2015/01/03/nsa-claims-tor-is-a-secure-way-to-guard-your-privacy-yet-tor-is-in-bed-with-u-s-government/
> Read that. Makes sense doesn't it? Just use VPN instead, or:
> http://fossbytes.com/best-alternatives-to-tor-browser-to-browse-anonymously/
>
>

As you're suggesting VPN instead of TOR then we're not talking about Darknet activities. In the list of "TOR alternatives" those that are not based on TOR are not suitable for anonymous activities in the public internet, i.e., there are no alternatives. (BTW, why isn't Qubes or Whonix mentioned?)
Qubes-Whonix integration was also funded by the US government. If you think this compromises Qubes then you shouldn't use it. :)

[☣Adam]

On 7/15/15, 7v5w7go9ub0o <7v5w7g...@gmail.com> wrote:
>
>
> On 07/14/2015 07:55 PM, Unman wrote:
>> On Thu, Jul 09, 2015 at 12:23:28PM -0700, Otto Kratik wrote:
>>> I set up and configured TorVM (on Qubes R2) some time ago according to
>>> the
>>> official instructions, and it seems to work well as intended, for every
>>> purpose imaginable and not just browsing (email, FTP, chat, video etc).
>>> But
>>> I've never seen mention before of adding a "TorFW" on top of this. Where
>>> is
>>> there a description or guide for this extra step?
>>>
>
>
> Thank you for posting this.
>
> I am NOT trying to be argumentative - I don't understand and will post
> questions as statements:
>> It was Joanna who first pointed out that the TorVM wont honour firewall
>> rules set for downstream VMs.
>
> IIUC,
> 1. She was referring to typical firewall protections (e.g. stateful
> packet control, syn cookies, etc) and was thereby suggesting that TorVM
> go out via the firewallVM!?

Did I miss a link to the archived comments? I'll need the context to
comment on this.

> 2. What other "downstream VMs" would one want?

If TorVM is effectively a router, then the downstream VMs would be
things like your e-mail client, web browser, ftp client, and so forth.
If the TorVM is a box with your apps and Tor all in one, then I
wouldn't expect there to be any downstream VMs.

>
>> If you want to use firewall rules to
>> enforce separation then you have to insert a fw between the client and
>> the TorVM:that's the TorFW.
>> One thing to be wary of, that I've pointed out before: if you simply use
>> a standard qubes fw then you get to enforce network level policies BUT
>> the
>> TorFW will alias all clients to the same IP address, so you lose the
>> benefit of stream isolation in the TorVM.
>> This is almost certainly not what you want.
>
> 3. It used to be argued that a single outbound TOR connection was better
> because it is "busier" and therefor more resistant to timing attacks!?

I haven't seen any evidence that would make you more resistant to
timing attacks. For example, there's a timing attack where the
attacker views the traffic at a Tor user's ISP, and at the datacenter
of the server they are suspected of visiting. If the attacker sees
packets arrive at the server, which came from a Tor exit node, all
they have to do is check to see if these packets emanated from the Tor
user in question just a few ms prior.

There's been a lot of good academic work on deanonymizing Tor[1]. If
you haven't already read "Users Get Routed: Traffic Correlation on Tor
by Realistic Adversaries"[2], it might be a good place to start. Of
course, you'll want to read the related work too.

[1] http://scholar.google.com/scholar?hl=en&as_sdt=0,39&q=deanonymizing+tor
[2] www.dtic.mil/cgi-bin/GetTRDoc?AD=ADA602282

> 4. Is stream isolation intended to assure different exit nodes? At exit
> point, is there a way to correlate the traffic to the same client!?

I'm not familiar with "stream isolation" in this context. If you are
using a TorVM as a router, I would expect all of the downstream VMs to
share a pool of Tor routes, but I haven't verified this myself. Tor
settings may have an affect on this. See academic work above for
correlation attacks from the exit node (as well as other points in the
network).


As for the user who suggested using a VPN in place of Tor, it depends
on the threat model. If a user is concerned that their adversary can
break Tor, would it be unreasonable to think that they can break VPNs
too?

For the threat models where a VPN is an acceptable replacement, one
should be aware of a recent academic paper[3] which shows that the
majority of VPN providers leak information, such as IPv6 addresses.
If a VPN is being used in place of Tor, this is probably something
that is important. In fact, the authors even mention "Tor vs VPN" in
the conclusion section.

[3] http://www.eecs.qmul.ac.uk/~hamed/papers/PETS2015VPN.pdf

[R]

I suggesting VPN for general web surfing. VPN will raise fewer red flags in my opinion. Is it safer than TOR? Who knows. For my purpose a trustworthy VPN is safe enough.

As for darknet...

Freenet (one of the examples in the list):
"Freenet is a peer-to-peer to resist the censorship similar to I2P. It uses the same P2P technology of distributing data storage to deliver and keep the information but separates the protocol of user interaction and network structure. This makes it easy to access the Freenet network using a variety of ways like FProxy. Freenet comes with the two-tier security: Darknet and Opennet. With the help of Opennet, users connect to arbitrarily with other users. Using Darknet, users connect to only those users with whom they exchanged Public Keys in the past. Both of these modes could be used together. It comes with a free software suite to enhance the censorship free communication over the web. Freenet itself includes anonymous websites ("freesites"), filesharing, searching, and more, but you can also use third party applications for chat, filesharing, to help you upload freesites, etc."

And IP2 (another example in the list):

"I2P is an anonymous peer-to-peer distributes communication layer which is built using the open source tools. It is a complete Tor alternative. Just like any other P2P software, the software implementing this computer network layer is called I2P layer and other computers running I2P is called I2P node.It is designed and optimized for hidden services, faster than Tor with fully distributed and self-organizing capability. Unlike Tor, peers are selected based on continuous ranking and profiling. There are unidirectional tunnels instead if bidirectional circuits, thus making the number of nodes double which a node has to compromise to get the same information."

Personally I don't care much about high level governmental agencies being able to infiltrate into electronic communication. If some high level NSA branch sees what I do through TOR, so be it. Total anonymity is an illusion. I'm happy if I'm protected from most hackers out for profit and random eavdropping practices by lower level local agencies. Not because *I* have something to hide, but because *THEY* are doing something illegal.

I know TOR is not perfect, but I still use it. Same for Facebook. But I try to advise alternatives. So more people become aware of them. Nothing wrong with supporting the underdogs....

Cheers :)

[Otto Kratik]

One of the main considerations is that TOR is completely free, whereas VPN's generally are not. Also TOR is a distributed, decentralized network of nodes with no one owner, whereas VPN's are each individually owned by one specific individual or corporate entity.

Personally when using TorVM on Qubes, I've never felt the need or inclination to set up further firewall rules or infrastructure, at least not for web browsing. Is an additional FW mostly meant to be useful in situations such as using an email client, and wanting to ensure that it ONLY ever connects to the IP address of the mail server specified, and can't accidentally load hot-linked HTML content from the body of the message, etc?

Also personally, I don't have much interest in darknet content or anything illegal. I use anonymizing tools because I just don't *like* the idea of the government watching everything I ever do and say, making a list (and checking it twice) of all my friends, statements, activities, political opinions, entertainment tastes and what-have-you. If I want to tell an acquaintance what I thought of the latest Dwayne Johnson movie, I should be able to do so without being forced to also tell the government at the same time.

[Unman]

On Tue, Jul 14, 2015 at 09:11:09PM -0400, 7v5w7go9ub0o wrote:
>
>
> On 07/14/2015 07:55 PM, Unman wrote:
> > On Thu, Jul 09, 2015 at 12:23:28PM -0700, Otto Kratik wrote:
> >> I set up and configured TorVM (on Qubes R2) some time ago according to the
> >> official instructions, and it seems to work well as intended, for every
> >> purpose imaginable and not just browsing (email, FTP, chat, video etc). But
> >> I've never seen mention before of adding a "TorFW" on top of this. Where is
> >> there a description or guide for this extra step?
> >>
>
>
> Thank you for posting this.
>
> I am NOT trying to be argumentative - I don't understand and will post
> questions as statements:
> > It was Joanna who first pointed out that the TorVM wont honour firewall
> > rules set for downstream VMs.
>
> IIUC,
> 1. She was referring to typical firewall protections (e.g. stateful
> packet control, syn cookies, etc) and was thereby suggesting that TorVM
> go out via the firewallVM!?

No, she was referring specifically to using qubes firewall to enforce
network level policies. Her scenario was for one anon client: my point
was that you need to do more for more clients.

>
> 2. What other "downstream VMs" would one want?

Whatever you want. I route all my traffic though tor, and use the TorFW
as the updateVM. So ALL my personal network connected VMs are downstream
of TorVM.

>
> > If you want to use firewall rules to
> > enforce separation then you have to insert a fw between the client and
> > the TorVM:that's the TorFW.
> > One thing to be wary of, that I've pointed out before: if you simply use
> > a standard qubes fw then you get to enforce network level policies BUT the
> > TorFW will alias all clients to the same IP address, so you lose the
> > benefit of stream isolation in the TorVM.
> > This is almost certainly not what you want.
>
> 3. It used to be argued that a single outbound TOR connection was better
> because it is "busier" and therefor more resistant to timing attacks!?

I doubt there's any mileage in this idea given the available network
devices.

>
> 4. Is stream isolation intended to assure different exit nodes? At exit
> point, is there a way to correlate the traffic to the same client!?
>

Have a look at tor proposal 171 which explains this in detail.
The aim is to separate streams over different circuits.Lets say I have
one vm connecting to mail server and one for ssh into a dev box -
without isolation both would go through the same circuit, so an adversary
on the exit node would be able to correlate that traffic.
With stream isolation they'll get different circuits, so the correlation
is more difficult.

>
> To get round this I use a simple script on the TorFW to set SNAT to
> preserve the singularity of client addresses, and a script on the TorVM
> that sets appropriate routing.
> >
> Again, I'm not wanting to be argumentative - just trying to ask clear
> questions.
>
> TIA

I didn't imagine you were argumentative. I hope the answers were as clear
as your questions.

[7v5w7go9ub0o]

This is a wonderful thread on a recurring topic:

- thanks Cprise, for always offering help to us who don't quite get Whonix!
- thanks Otto Kratik for pretty much describing my privacy situation.
- thanks to R for bringing up the related VPN issue.
- thanks Adam and Unman for long, thoughtful, polite, information-dense
posts!

Some follow-up questions/thoughts for general comment, please:

First is background: my strong personal preference is to run
WAN-accessing apps in separate, individual DispVMs. Especially given I'm
still on R2 without routine upgrades, and expect to remain here 'til R3
is solid.

I typically run 6 dedicated, individual dispvms: two configurations of
TBird (one to usenet-type accounts via Qubes torVM, t'other directly to
various mail servers); Chrome (occasionally via Qubes TorVM), and three
configurations of Firefox (one is TBB NOT via Qubes TorVM, one monitors
site changes, and one streams media); again, each loaded into individual
DispVMS.

My theory is that an invasion is most likely to occur via a browser, and
I don't want it to have access to my mail client or anything else. Also,
because I run in a DispVM, it won't leave a "lingering presence" in the
user configuration/plugin/extension files.

I've stayed clear of Whonix. I may have this wrong, but IIUC:
- all Whonix apps are in the same VM, so if they get in via one, they
can get all - even those not active.
- Whonix is an AppVM, not DispVM, so any quiet compromise is permanent.

So my TBB dispvm uses the bundled proxy and connects to the firewallVM
and then the netVM; my usenet TBird dispvm connects to Qubes torvm, and
then to firewall appvm

Question1: While this does separate the streams, ISTM I may connect to
two different TOR entry nodes - is that an issue?

Question2: ISTM the TBB will always have the latest tech, and is not
dependent upon, e.g. Fedora, to keep TOR current. Given it is the most
"vulnerable" of my privacy apps, it makes sense to contain both the TBB
and TOR server within a single DispVM!?

Question3: How could I better configure?


Misc. RE: VPNs

- ISTM that R may be advocating VPNs in order to shutout a nosey ISP -
not wanting it to know that he uses TOR - which is admirable. The
question becomes, which is more pernicious: the ISP or the VPN host?

- FWIW, when I'm on the road, I'll TOR out of an open hotspot, and
connect to my home router's openvpn - this keeps hotspot kiddies from
exploring my home VPN; and it keeps a malicious TOR exit node from
seeing anything other than a VPN tunnel.

Question4: My ISP is Comcast. I guess(?) they're less nosey than some
local ISP - i.e. would you guys look to avoid them via a VPN service? If
so, which is a reputable, inexpensive VPN service in a
privacy-respecting nation (e.g. Switzerland)?

TIA

[Jeremy Rand]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 07/17/2015 10:39 AM, 7v5w7go9ub0o wrote:
> I've stayed clear of Whonix. I may have this wrong, but IIUC: -
> all Whonix apps are in the same VM, so if they get in via one,
> they can get all - even those not active. - Whonix is an AppVM,
> not DispVM, so any quiet compromise is permanent.

It is possible to have multiple Whonix AppVM's; doing so allows to
isolate the applications from each other. I've got about 5-6 Whonix
AppVM's; it was trivially easy to set this up.

I'm not sure about using Whonix as a DispVM; maybe someone else can
inform us whether this is possible?

- -Jeremy

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJVqV0+AAoJEAHN/EbZ1y06Md8P/0KhuH0FhqO9gRPziYiXjXBx
9JMvWQhKKJJtJw/Z/7NP6U9I5hVS+hhAq9f93eyUv5IMt3+YptgKQR7/XVicy8CK
mvyymUGPJPqxElpy5DfjU8UAWjk3TPnOFNyIf7LeeVlu1PMn+x8vadqUCJTOcYZk
v4jmG5ejlyd3ni19kuFUNmCQud3WRmpITDGZMNfZ0dQccHU5713T1Ety+V9Wvc7r
nCF62gIn8id/Vl7TVMhISxJCQMjh1+cEin53Y+WglgonbBweCxwDhzyqF8Dhuf2O
Z8GEa9WMIVo8eLm8MgcOcfz8FiZ0lnLnj3z5CbKm1e05bJGwX+WVy6il9q8pBjuD
01GLJLN0E6fZBb2uhFhtikexNevEf12IAzxfBp5ROQNX2mlwdawh3sgOtd9c1xIu
blHWp4VhR5AB9lrZD1apk60iyQrT2pJsaMGaGpey9LfJ49PIHQLN3wEVPzUjD/1E
7XwS1uTIvBzdlcY6zeVyWan/V46goTDizLAu9AF/WVmL7fALosyBI3SRBxr69rSx
ZyNuXg0v3KOHtjX5U0deHKzGPMi5ui2/7iqumPlxzSCi47ms0ekNujrvbiSQ1fVe
3SO+UezprvIu+0//vfI4AcpWQLJUHW770eEjiUhG/XVz7Xq38SVxcGOuFR8dF69B
u+QT6NLu2XjSCFJFgmkH
=BOzw
-----END PGP SIGNATURE-----

[R]

An ISP's business model is internet access. The better their reputation on speed /access /infrastructure/downtime, the more money they make. Privacy is not part of their core business. They probably won't protest when government asks for user data. They are probably even required to do so by law. They will try to avoid being sued for not complying with governments requests, which would jeopardize their core business model.

An VPN's core business is privacy. The better their reputation on privacy /not handing out user data, the larger they grow. If users find out they are handing out user data to governments, it would jeopardize their core business.

So, you do you trust? That's right, never trust any ISP. You are paying them for internet access, not to protect you against government enquiries. Use VPN for that.

To judge the trust level of an VPN, look at their background and philosophy.

Examples of trustworthy VPN's:

http://www.vpngate.net
VPN Gate Academic Experiment Project is an online service as an academic research at Graduate School of University of Tsukuba, Japan. The purpose of this research is to expand the knowledge of "Global Distributed Public VPN Relay Servers". VPN Gate will NEVER be a paying service in future.

https://airvpn.org/
AirVPN started as a project of a very small group of activists, hacktivists, hackers in 2010, with the invaluable (and totally free) help of two fantastic lawyers and a financing from a company interested in the project and operated by the very same people. AirVPN started as a completely free service for anyone in april 2010. Soon it added a commercial side aimed to keep the project financially sustainable, capable to support the impact of free access to activists in human rights hostile countries and ensure to the team a monetary basis which could allow a full-time dedication. We all feel that AirVPN is completely different from a commercial enterprise which aims exclusively to profits. Profits are important for us, otherwise keeping this infrastructure would be impossible, but they come after the security for our users and the respect of our policies and commitments.

http://www.cyberghostvpn.com/
See: http://techcrunch.com/2015/07/18/vpn-maker-cyberghost-aims-to-grow-a-privacy-hub-in-eastern-europe/

Like I said before, I prefer using a VPN instead of TOR. TOR raises red flags when you use it /browse about it. Also, TOR was made public by high level agencies with a simple purpose. To get more people to use it so it won't raise attention when one of their spies use it. These agencies have backdoor access to TOR. They won't use this power on average users like us (just like they hid the engima crack in WW2). But why support such a service? Why not support a VPN organisation with the heart in the good place trying to make the world a better place? They deserve it...

[Unman]

On Mon, Jul 20, 2015 at 08:27:02AM -0700, R wrote:
>
>
<snip>

I cant let this pass. I must have missed the paper where you identified
the backdoor in TOR. Strange, because I'm pretty well up on such
matters. Or perhaps it's in preprint - if so I'm sure you would be
prepared to share a copy with the group. Or more likely you're just
spreading the same old FUD that idiots raised against truecrypt.

Ok, you prefer a VPN. Yes, tor will raise a flag when you use it. Do
you really imagine that whatever adversary you are worried about
wouldn't be targeting use of a vpn service? Or that the agencies aren't
above infiltrating groups like airVPN?

You have a perfect right to promote commercial activity if you must. But
spreading FUD isn't the right way to do it.

unman

[Fabian Wloch]

I kinda have to agree with unman.
I never heard that TOR has backdoors. And also I hope this will never
happen.
But also I like to use VPN servies. Its just a matter of what exactly
I'm doing.
Usually I use TOR+VPN (Actually just 1 VPN provider, but I'm aiming for
more providers in a chain to get the best out of it).
If im watching videos (like youtube) I usually only use my VPN, since a)
iI dont want to burden the TOR network with that stuff, and b) videos
are loading slow as f... through TOR. Aswell, TOR isn't designed for YT
and stuff.
And to come to the Whonix-Topic: I think Whonix is a really good way to
use TOR under Qubes, cause its better isolated against possible leaks,
for example.

-Fabian

[Unman]

On Wed, Jul 15, 2015 at 01:36:24AM -0700, Manuel Amador (Rudd-O) wrote:

> Can you share the script?
>
> Does it only work with the non-SOCKS ports?
>
> Thanks.
>
> --
> Rudd-O
> http://rudd-o.com/
>
>

A friend pointed this out to me - I'd missed it. Sorry.
The script is really trivial - it works just fine for my use case: maybe
you can adapt it to yours. I've trimmed out a fair bit of extraneous
stuff to leave the basics. All it's doing is allowing traffic from other
IP addresses into the TorVM via the TorFW interface.

The if statements are a pretty crappy way of making sure I don't keep
resetting the routes.
X.Y is the IP address of the TorFW.
I use 201 et seq for the downstream clients.I've put in 2 IPs as
examples.

There's no reason why you cant use the socks ports from applications on
the clients if you want. If you do then you will have to reconfigure to
use clearnet: if you don't then you can just switch netvm.


iptables -P OUTPUT DROP
iptables -F OUTPUT
iptables -I OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -I OUTPUT -m owner --uid-owner 985 -j DROP
iptables -I OUTPUT -m owner --uid-owner 985 -p udp -m udp --dport 53 -j
ACCEPT
iptables -I OUTPUT -m owner --uid-owner 985 -p tcp -m tcp -j ACCEPT
iptables -I OUTPUT ! -o lo ! -d 127.0.0.1 ! -s 127.0.0.1 -p tcp -m tcp
--tcp-flags ACK,FIN ACK,FIN -j DROP
iptables -I OUTPUT ! -o lo ! -d 127.0.0.1 ! -s 127.0.0.1 -p tcp -m tcp
--tcp-flags ACK,RST ACK,RST -j DROP
iptables -I OUTPUT -m conntrack --ctstate INVALID -j DROP
iptables -I OUTPUT -m state --state INVALID -j DROP
iptables -A OUTPUT -o vif+ -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -j LOG --log-prefix "DROP OUT "

iface=`ip route|grep X.Y|cut -f3 -d ' ' `
if [ $iface ]
then
test2=`ip route|grep X.201|cut -b1-2 `
if [ $test2 ]
then
exit
else
iptables -t raw -I PREROUTING -i $iface -s x.x.x.201 -j ACCEPT
iptables -t raw -I PREROUTING -i $iface -s x.x.x.202 -j ACCEPT
ip route add x.x.x.201 dev $iface
ip route add x.x.x.202 dev $iface
fi
fi


unman

[cprise]

R does raise one good question that always pops up in discussions about
Tor's trustworthiness: If the US government supports it, then what is in
it for them?

The answer has something to do with how the US government continues to
view itself as a "liberator". Its a mindset firmly embedded within a
carapace of double standards and half-truths. So the self-image begins
to collide with the changing reality. People who believe their own BS
usually feel compelled to do self-defeating things.

In this particular case, I think it is also self-defeating to ascribe a
super-rational level of insight to any large corporations or government
institutions. One result of assuming "they" always know best when they
take any action is that you are paralyzed even in the face of their
*blunders*.

[7v5w7go9ub0o]

Hmmm...... ISTM these are two very important points.

Two very logical points, R; followed by some very nice VPN providers!!

Am thinking that the real threat for me is a "civic-minded" ISP keeping
track of customer's connections and downloads to/from "questionable"
sites (e.g. some terrorist-sympathetic site/newsgroup in the middle
east) and offering that list periodically to the local/regional police
authority as a means of staying on their good side. This could easily be
the routine practice of a small-scale, local provider.

Some random thoughts:

- I suppose that connections to TOR might qualify for this list.

- A connection to a "questionable" site could occur quite innocently
(hidden link, mis-typed address, etc.), resulting in the apparent
visitation or downloading of something you don't want on your computer -
dutifully monitored and reported by the local ISP to the local LE.

- A national-level TLA can likely put your monitored activity into a
reasonable context; a local LE might exuberantly over-react to an
innocent mistake and knock on your door.

- It is piggish to use TOR for everything 24/7- even if one is a
contributor (of $, or of nodes).

- Qubes readily allows "embedded" TOR connections within VPNs (something
that can done judiciously; e.g. for usenet groups).

Useful reply; time for a VPN. Thanks, R.

[Unman]

I think that R answered that question, and it's highlighted too on the
tor website. What the government gets is an anonymising tool and the
ability to hide their traffic among ordinary users. I dont think that
*use* of tor has anything to do with attitudes of the US miilitary or
government.

[R F]

My apologies. There is no hard proof TOR has backdoors, indeed. Just theories based on infiltrated darknet sites etc. Think Silk Road. Going back to the example of enigma. If the Germans noticed the allies systematically countered their attacks, they would know engima was cracked, without needing hard evidence. Thats why it was used only strategically in rare important occasions. If you apply this logic to TOR, and look at which darknet sites were infiltrated, which users using it were busted, etc. you could come to the same conclusion. It's not hard evidence, so I might have spoken too bluntly, but I wouldn't call it FUD - meaning based on nothing. I still use TOR. And combining it with VPN seems clever. No hate.

R

[Unman]

In all the cases I'm aware of if you read the papers closely you
will see that it is almost always poor tradecraft.
If you read the Silk Road court documents then you can see there was
little need to use a backdoor in Tor - Ulbricht just made basic mistakes
in opsec.
The same with Sabu.
The same with drive by javascript exploit against users of Freedom
Hosting.
No evidence at all for backdoors in Tor.

[R F]

If thats the case I stand corrected :)