Unofficial Tor Community

The EFF wrote in their most recent newsletter:

… Because it's your rights we're fighting for.

• Your right to speak and learn freely online, free of government censorship
• Your right to move through the world without being surveilled everywhere you go
• Your right to use your device without it tracking your every click, purchase, and IRL movement
• Your right to control your data, including data about your body, and to know that data given to one government agency won’t be weaponized against you by another
• Your right to do what you please with the products and content you pay for …

Cloudflare has been DoSing the whole Tor community for over a decade now. Those who are not excluded from CF sites (over ⅓ of the web), who are free to move around only have that liberty because they submit to surveillance and give up their privacy.

EFF has ties to the Tor Project that are closer than most people realise. At the same time, Tor Project itself has submitted to licking Cloudflare’s boots. TP has quietly removed material from their blogs that criticises Cloudflare.

Searching EFF newsletters for Meta, Facebook, Google, Amazon, etc has no shortage of hits. But not a word about Cloudflare -- the most direct adversary of what EFF claims to fight for.

People are already aware of Google and Facebook. If they choose to pawn themselves to those platforms, they know what they are signing up for. It’a waste of energy and resources to fixate on those known evils. EFF is doing a gross injustice by not informing people about Cloudflare.

Cloudflare is one of the few tech giants that wise users cannot escape. In some US states you cannot even register to vote without Cloudflare knowing. You can submit a paper registration but then the data entry worker still submits your personal data to a Cloudflare website.

It’s relatively trivial to escape Google and Facebook and protect yourself. Most of that battle is a matter of not registering and not accessing the services, and watching out for a few corner cases. Cloudflare fucks everyone by compromising websites whose admin doesn’t even know what they are signing up for and the fact that they are pawning all their own users. When your gov publishes legal statutes exclusively in Cloudflare’s walled garden or puts gov services inside CF, we’re fucked to an extent that is much more beyond our control.

I will not donate to EFF until they get their priorities straight.

WTF happened to onionmail.info?

So disturbing.

It was such a great resource for email. It was a quite unique infrastructure that gave a bit of freedom and privacy unlike any other email provider.

--cross-posted from !forced_obsolescence@slrpnk.net--

Shitty new captive portals are a new form of enshitification. Captive portals are getting so fancy that they are dysfunctional on old phones. They managed to fuck up the simple task of merely presenting a button that basically says “I agree not to shit on your network”.

It’s really infuriating to be on a bus or train for hours, unable to use Wi-Fi to plan your trip because some jackass dipshit coded a captive portal that assumes everyone is a pushover who continously buys recent phones, when all they need is to render a fucking button or tickbox.

I am betting that the clueless pricks behind the captive portals have enough incompetence that DNS traffic gets through. But for that to work you must run a server for the purpose of serving AndIodine. So it would be useful if some Tor entry nodes supported DNS traffic.

Captive portals are a form of oppression against people with old phones or non-standard software, esp. those w/out GUI browsers. I believe an anti-obsolescence mission to support people with old phones or non-standard software would be compatible with Tor Project’s principles.

A DNS bridge would be useful in other situations as well, such as where Tor is blocked deliberately. Normal traffic is slow over DNS, so Tor client could treat it as a last resort by attempting DNS after X number of connection failures. It would generally overall increase the availability of Tor access.

When visiting git.openprivacy.ca over tor but without using Tor browser, it automatically redirects to gitopcybr57ris5iuivfz62gdwe2qk5pinnt2wplpwzicaybw73stjqd.onion. The privacyinternational website used to do that, but not the last time I checked. A lot of sites seem to make use of a return header that tells the browser what the onion is without actually redirecting. Of course the problem with that is non-Tor browsers obviously do nothing with such headers. I thought it’s worth mentioning here that auto-redirection is the smart way to do this.

There are countless public wi-fi access points that push captive portals which collect identity info on users and track them. The purpose of the privacy intrusion is (allegedly) so they can respond to complaints about unacceptable use. Or worse, so they can directly snoop on their own users activity to police their behavior. Those burdens are not cost-free. Babysitters cost money.

Tor solves this problem. There can be no expectation that a service provider nanny Tor users because they naturally cannot see what users are doing. You are only responsible for what you know -- and for what data you collect. The responsibility of Tor users falls on the exit nodes (to the extent they are used, as opposed to onions).

It’s bizarre how public access admins often proactively block egress Tor traffic, out of some ignorant fear that they would be held accountable for what the user does. It’s the complete opposite. Admins /shed/ accountability for activity that they cannot monitor. If it’s out of their hands, it’s also beyond their responsibility. This is Infosec Legal Aspects 101 -- don’t collect the info if you don’t want the responsibility that the data collection brings. Somehow most of the population has missed that class and remains driven by FUD instead. They foolishly do the opposite: copious overcollection, erroneously thinking that’s the responsible thing to do.

In principle, if you want to deploy gratis Internet access to a population free of captive portals and with effortless administration that respects the privacy of users, then it is actually clearnet traffic that you would block. If you allow only Tor traffic, you escape the babysitter role entirely.

In thinking about how to configure this, first thought was: setup a Tor middlebox transparent proxy and force all traffic over Tor. The problem with that is you would actually still have visibility on the traffic before it gets packaged for Tor, so it fails in the sense that you could technically be held liable for not babysitting the traffic between the user and the Tor network. OTOH, the chances of receiving a complaint from the other side of the Tor cloud are naturally quite low. Still, it’s flawed.

It really needs to be a firewall that blocks all except Tor guard nodes. A “captive portal” of sorts could be used to inform clearnet users that only Tor traffic is permitted, which could give some basic advice about Tor, such as local workshops on installing a Tor client.

It imposes a barrier to entry of both knowledge and wisdom on users. So be it; it is what it is. Not everyone can expect a free hand-out, and it’s usually Tor users to face the oppression of access denial. Of course the benefit is that some people will decide to install Tor in order to use the hotspot.

A Turk was telling me about a peaceful demonstration he attended, in Turkey. He said police surrounded the protest. Then someone in plain clothes threw a stone at the police. One of the demonstrators noticed that the guy who threw the stone had handcuffs in his back pocket. IOW, a cop posing as a demonstrator threw a stone in order to justify the police tagging the protest as “violent” so they could shut it down.

So of course the question is, to what extent are bad actors on Tor actually boot lickers who are working to ruin Tor for everyone?

There are many situations where gov-distributed public information is legally required to be open access. Yet they block Tor.

To worsen matters, the general public largely and naively believes it’s correct to call something as “open access” when in fact there are access restrictions in place.

The resource should work like this:

1. User supplies an URL
2. Robot tries to access that page from a variety of different countries, residential and datacenter IPs, Tor, various VPNs, different user-agent strings, etc.
3. Report is generated that reports the site as “openly accessible” if no obsticles (like 403s) were detected. Otherwise tags the site as “restricted access” and lists the excluded demographics of people.

The report should be dated and downloadable as PDF so that activists can send it to the org behind site with a letter saying: “your website is not open access -- please fix”.

This need somewhat aligns with the mission of the OONI project, but they are not doing this AFAICT.

Update

I just read an announcement about Belgium’s “open data” law, which is basically a summary. It said something like “there should be no unnecessary access restrictions”. I’m not sure to what extent that accurately reflects the law, but it’s an example of what one country considers “open”, fwiw. From there, I would say most Tor blockades are not necessary but rather some lazy sysadmin looking for an easy job. They of course would then like to argue that it’s “necessary” to keep the baddies out.

Update 2

The Open Knowledge Foundation Network defines open data to be completely free from restrictions:

https://okfn.org/en/library/what-is-open/

There is a particular public hotspot where tor takes like an hour to establish a connection on. It’s stuck on 10% shows a running count of connection attempts upwards of 40.

What does this mean? Is it that the wi-fi operator is blocking guard nodes, but perhaps only a snapshot of guard nodes? When I finally connect, is it a case where I managed to get a more recent guard node than the wi-fi operator knows about?

Political parties around the world have flocked to nationbuilder.com for some reason. This tor-hostile Cloudflare site is blocking Tor users from accessing election info. This kind of sloppy lazy web administration is common.

But what’s a bit disturbing is that when I contact a political party to say I cannot reach their page because of the nationbuilder block page, they sound surprised, like it’s the first time they are hearing about web problems. So Tor users are lazy too. That’s the problem.

cross-posted from: https://lemmy.sdf.org/post/24375297

Tracker pixels are surprisingly commonly used by legitimate senders.. your bank, your insurance company, any company you patronize. These assholes hide a 1-pixel image in HTML that tracks when you open your email and your IP (thus whereabouts).

I use a text-based mail client in part for this reason. But I got sloppy and opened an HTML attachment in a GUI browser without first inspecting the HTML. I inspected the code afterwards. Fuck me, I thought.. a tracker pixel. Then I visited just the hostname in my browser. Got a 403 Forbidden. I was happy to see that. Can I assume these idiots shot themselves in the foot with a firewall Tor blanket block? Or would the anti-tor firewall be smart enough to make an exception for tracker pixel URLs?

To do an MX lookup over Tor, this command has worked for me for years:

$ torsocks dig @"$dns_server" -t mx -q "$email_domain" +noclass +nocomments +nostats +short +tcp +nosearch

In the past week or so it just hangs. My first thought was the DNS server I chose (8.8.8.8) started blocking tor. But in fact it does not matter what DNS server is queried. The whole Tor network is apparently blocking tor users from doing MX lookups.

Also notable that dig hangs forever. It does not timeout despite a default timeout interval of 5 seconds (according to the man page).

cross-posted from: https://sopuli.xyz/post/13489053

In the onion v2 days we had underwood2hj3pwd.onion. There were half a dozen other onion email providers but Underwood was the only one that did not have a clearnet email alias (IIRC). That was a useful feature because you could distribute an onion address to a MS Outlook or Gmail user and they could not use it to share their correspondence to you with Google or MS in the loop. They had just two options: step off the ad surveillance platform or not contact you at all. That option died with Underwood.

The other onion email services all have a clearnet translation. So if (for example) I give a gmail user this address:

foo@yllvy3mhtamstbqzm4wucfwab57ap6zraxqvkjn2iobmrtxdsnb37dqd.onion

and they are motivated to reach me, they can figure out that the corresponding clearnet alias is foo(/at/)onionmail.info and then they can use that address to send me a msg that is then shared with their surveillance advertiser. And worse, that’s less effort for them than obtaining an onion email account.

So what I do now is give an XMPP account. Since Google has abandoned jabber and MS never partook, XMPP avoids Google and MS. But XMPP is not a drop-in replacement for email. OMEMO is glitchy/buggy with pitfalls.

I would like to offer an email option. Ideally, an onion email service would offer a clearnet alias that cannot be determined from the onion address, which implies a different userid string.

What happens if an app uses UDP instead of TCP (or both UDP and TCP), and you use the torsocks wrapper script? Would the UDP connections all leak without the Tor user knowing?

I simply make a GDPR request. Write to a Tor-hostile data controller making an Article 15 request for a copy of all your data. Also ask for a list of all entities your data is shared with.

The idea is that if a website blocks Tor (or worse, uses Cloudflare to also share all traffic with a privacy offender), then they don’t give a shit about privacy. So you punish them with some busy work and that busy work might lead to interesting discoveries about data abuses.

Of course this only works in the EU and also only works with entities that have collected your personal data non-anonymously.