Show HN: TorProxy, a kernel module which routes all network traffic through Tor(github.com)
github.com
Show HN: TorProxy, a kernel module which routes all network traffic through Tor
https://github.com/r-a-w/TorProxy
12 comments
I would assume if you're going this far you're likely running this module under a Linux VM so only specifics go through Tor.
If you do that then you may as well just use two VMs - Tor router and client - and that's basically Whonix.
It's a terrible idea to route all your traffic over tor. If you have any expectation of anonymity you'll be disappointed. Since tor does not do any application level filtering, it is easy for exit nodes to track you.
It's a neat idea but has the same problems as network wide tor routers.
It's a neat idea but has the same problems as network wide tor routers.
Exactly. Good implementations like Whonix take steps to isolate your circuits between different applications and profiles[0].
Further in those cases you're isolating your identities with virtual machines by default, which helps enforce good compartmentalization.
Forcing all traffic into one environment and then over a single circuit means everything you ever access is linked together. The other story on the front of HN is the accused stalker who was caught partly for doing exactly this (would access his real Gmail and then "stalker" Gmail over the same connection)
Whonix also provides a model of enforcing Tor by using an isolated proxy - which doesn't require kernel modules and also allows firewall policies
I'd classify this as a naive approach that sounds like a good idea at first inspection - but the Whonix developers have really thought this through and their Wiki[1] is a tremendous resource that explains why they use the model they do.
Qubes OS is another similar approach[2]
[0] https://www.whonix.org/wiki/Stream_Isolation
[1] https://www.whonix.org/wiki/Main_Page
[2] https://www.qubes-os.org/
Further in those cases you're isolating your identities with virtual machines by default, which helps enforce good compartmentalization.
Forcing all traffic into one environment and then over a single circuit means everything you ever access is linked together. The other story on the front of HN is the accused stalker who was caught partly for doing exactly this (would access his real Gmail and then "stalker" Gmail over the same connection)
Whonix also provides a model of enforcing Tor by using an isolated proxy - which doesn't require kernel modules and also allows firewall policies
I'd classify this as a naive approach that sounds like a good idea at first inspection - but the Whonix developers have really thought this through and their Wiki[1] is a tremendous resource that explains why they use the model they do.
Qubes OS is another similar approach[2]
[0] https://www.whonix.org/wiki/Stream_Isolation
[1] https://www.whonix.org/wiki/Main_Page
[2] https://www.qubes-os.org/
How does this compare to Tails? Conceptually they look similar, both having the kernel enforce that all traffic goes through Tor.
But Tails is a configured with security and Tor in mind. I don't see when I'd want to install such a kernel module on a normal distribution over a specialized distribution. (Or a multi-vm setup like whonix, instead of trusting the kernel)
But Tails is a configured with security and Tor in mind. I don't see when I'd want to install such a kernel module on a normal distribution over a specialized distribution. (Or a multi-vm setup like whonix, instead of trusting the kernel)
[deleted]
Is there any particular reason for being IPv4-only?
> /* Drop all ipv6 traffic */
> /* Drop all ipv6 traffic */
Yes.
> The Tor network currently only supports TCP ipv4 traffic
> The Tor network currently only supports TCP ipv4 traffic
TCP IPv6 traffic is supported. [https://trac.torproject.org/projects/tor/ticket/5547]
Only relay to relay traffic is actually IPv4 only. [https://trac.torproject.org/projects/tor/ticket/4565]
Only relay to relay traffic is actually IPv4 only. [https://trac.torproject.org/projects/tor/ticket/4565]
We need to pump this. Anonymity only protects the vulnerable in inverse proportion to it's ubiquity.
I can't even comment here when I use my homemade vpn, hosted digital ocean or linode. And HN is not the only place... I understand spam is a problem, but it feels like a hammer solution.
As soon as some packet that reaches the internet (through an exit node) that includes some identity information your Tor connection is no longer private. Routing all your traffic via Tor, increases the chance this will happen.
Also if many people use Tor for all their traffic, this will become a scalability problem for Tor (lack of exit nodes).