Tracing sent emails back to your home or office...

[spurr]

Hey OldPork,

FWIW #1, I was the impetus for the current implementation of TorButton. Back before the current TorButton, all TorButton did was change the proxy settings of Firefox. At that time I started hacking that old version of TorButton to protect users from web attacks, JS attacks, etc., but I didn't have the skills to do so properly. I wrote about what I was doing on the Tor IRC channel and Mike Perry took over and did all the heavy lifting.

FWIW #2, I was also the impetus for Tor Browser Bundle (TBB). Back before TBB existed I started hacking Tor, Firefox, Polipo, etc., to all be complied in portable mode on Linux (using Ubuntu), and windows too. I wrote a how-to to compile the programs and build the first TBB (back then I didn't call it TBB); but just like TorButton I hit a wall in my skill level. So, just like TorButton I wrote about what I was doing on Tor IRC and Dr. Steven J. Murdoch took an interest in my project. He was nice enough to take over for me, and he made the first offical TBB for Tor.

Thus, without my early (and limited/failed) attempts at hacking the original TorButton, Tor, Firefox, etc., we might not have TorButton (as it is today) or TBB...

Perhaps there's been a misunderstanding here. Tor, in and of itself as a stand-alone application, does not do the trick.

Yes it does, Tor is the only critical part. Vidalia is merely a GUI for Tor, Vidalia is not needed, but does make using Tor easier for most people. For years I used Tor before there even was a GUI, back before there was Polipo, and all we had was Privoxy and Tor (no TorButton either)...

People can use other web browsers with Tor, not just Firefox, but Firefox is the only one that should be used because of the add-on TorButton. That add-on is critical to safely using a web browser to defeat many various attacks against browsers.

Tor works out of the box and does not need to be configured for vanilla usage. To use a web browser with Tor, all you need to do is set the bower proxy settings (HTTP, HTTPS and Socks 5) to proxy: 127.0.0.1 and port: 9050 and use remote DNS look-up (which will route through Tor). Of course, that works only if the browser properly handles Socks 5 traffic. Firefox (un-hacked) does not properly handle Socks 5 traffic so we need to use a HTTP/S proxy such as Polipo or Privoxy, which uses port 8118. Thus, to use any web browser and Tor, all you need to due is use Polipo or Privoxy and set the browser proxy settings (HTTP and HTTPS) to proxy: 127.0.0.1 and port: 8118 and set the Socks proxy setting to 127.0.0.1:9050, along with using remote DNS lookup.

BUT, not so with the Tor Browser "Bundle" which consists of these bundled applications, already pre-configured for anonymity for you with a portable version of Firefox so it can even be run from a thumb drive:
Vidalia 0.2.10 (with Qt 4.6.2)
Tor 0.2.1.28 (with libevent-1.4.13, zlib-1.2.3 and openssl-0.9.8p)
Polipo 1.0.4.1
FirefoxPortable 3.6.13
\_ Firefox 3.6.13
\_ Torbutton 1.2.5
\_ HTTPS Everywhere 0.9.9.development.2
PidginPortable 2.7.4
\_ Pidgin 2.7.5
\_ OTR 3.2

Only the windows bundle offers Pidgin, and the Linux bundle now does not have Polipo because the Linux version uses a hacked Firefox that properly handles Socks 5.

Also, there are many add-ons to Firefox one should use, I made a list in another post that I think VG made into a thread in this sub-forum with my nic in the thread title. The windows bundle is lacking an important add-ons that is present in the Mac and Linux version of the bundle: NoScript

Not using an HTTP/S proxy makes surfing faster, but is only possible with the Linux bundle at this time. Also, using Polipo with forums like ICmag causes a recurring SSL error. That is why I wrote how to use Privoxy instead because Privoxy does not have the same bugs as Polipo that causees the SSL error.

You are 100% anonymous, and there is no way your real ip address or your MAC is seen...even on the remote server you are communicating with.

That is untrue, I wish it was true, but it's not. For example, there are many ways JavaScript, Flash, etc., can break your anonymity. TorButton does a very good job of making JS 'safe', but it's not a fail-safe. Also, cookies (especially flash cookies and HTML5 cookies) are a major issue that can break your anonymity, and without additional add-ons cookies are harder to control, even with TBB and TorButton. Not only that, but TBB has the same limits that Tor (installed version) has: MIMT attacks, exit node packet sniffing (on HTTP), SSL cert spoofing, etc., etc.

In a perfect world, without websites using JS in evil ways, and without worries about evil exit nodes, etc., you are correct, Tor is 100% anonymous...but we don't live in a perfect world.

Tor is the best legal option there is, but it has limits to it's ability to anonymize us if we are attacked, or if Tor is attacked (such as the Tor Directly Authorities, flooding the network with evil nodes, etc.).

The Tor Software for Windows comes bundled in three different ways:
■The Tor Browser Bundle contains everything you need to safely browse the Internet. This package requires no installation. Just extract it and run. (This is what I am recommending for anonymous browsing... including ordering seeds and tracking them)

TBB does not have "everything you need to safely browse the Internet". You should at least install the following add-ons if you want a higher level of anonymity:

• RefControl (to spoof referrer; needs to be configured properly)
• BetterPrivacy (auto-deletes Flash cookies)
• NoScript (prevents much JS junk, webbugs, etc)
• CookieCuller (to make removing normal cookies more user friendly)

Also, no discussion about Tor (or any proxy) is complete without mentioning that HTTPS should be used at all times whenever possible, especially when using sites that can identify you, even if it's only a pseudonym, like your nic "OldPork" here at ICmag. And when logging into any site HTTPS is a must if you care about trying to protect your username and password.

■The Vidalia Bundle contains Tor, Vidalia, and Polipo for installation on your system. You need to configure your applications to use Tor.

Errr, kind of. You will need to configure you application (like Firefox) to use Poilpo, which in turn is pre-configured to use Tor. For Pidgin (anon IRC) you just use Tor socks proxy settings: 127.0.0.1:9050.

■The Expert Package contains just Tor and nothing else. You'll need to configure Tor and all of your applications manually.

You don't need to configure Tor, it works out of the box, but you will need to install and configure an HTTP/S proxy to use Tor (for most web browsers), then configure the web browser to use the HTTP/S proxy, etc.

 

[spurr]

BUT if you are using an outgoing (smtp) mail server that belongs to your workplace, then the recipient will be able to see that the email was sent from that particular server, even if it is a web based email server. SO careful there.

FWIW, most Tor exit nodes to not allow SMPT traffic via normal SMPT port (i.e. 25) because of spam abuse. Default Tor exit node policy blocks port 25. A few Tor exit nodes do allow SMPT but the vast majority do not. Thus, if you are using a work place web based email server (analogous to Yahoo, Google, etc) you are correct, but if trying to use work place SMTP server via Tor (ex. via a mail client), it won't work 99% of the time.

And the TOR bundle will never protect you if you are using a non-webbased email client, like outlook or eudora.

That is not correct. You could configure your email client to use Tor from TBB via email client proxy settings. But because nearly all Tor exit nodes block SMPT traffic using an email client with Tor doesn't work well (i.e. often).

 

[BlackThumbGrowr]

wow. very self important. for what its worth, it aint worth

 

[mugenbao]

FWIW #1, I was the impetus for the current implementation of TorButton.

Heh, it's a small world, isn't it? I submitted a few patches for TorButton fairly early after it was initially released. It's a great idea, though initially there was a little bit of an impedance mismatch between what was required for security and how you have to work with the browser to accomplish that. I'm no open-source fanatic, but I will say that I'm extremely happy that the folks making Tor and Firefox have been able to communicate effectively and openly, and that the Tor folks (among others) have managed to impress upon the Firefox folks how critical some of these issues are.

.

 

[spurr]

wow. very self important. for what its worth, it aint worth

LOL, OK, sure.

FWIW, stating facts that are on topic and of interest is not being self important. And if you didn't notice, I wrote I failed to complete my goals at both attempts to hack TorButton and TBB, a self important person would not have happily admitted they failed

 

[spurr]

Heh, it's a small world, isn't it? I submitted a few patches for TorButton fairly early after it was initially released. It's a great idea, though initially there was a little bit of an impedance mismatch between what was required for security and how you have to work with the browser to accomplish that. I'm no open-source fanatic, but I will say that I'm extremely happy that the folks making Tor and Firefox have been able to communicate effectively and openly, and that the Tor folks (among others) have managed to impress upon the Firefox folks how critical some of these issues are.

.

Haha, yup, small world! Who wudda thunk two cannabis smokers would have had a hand in TorButton? Neat

I had to take a sledge hammer to Firefox when I first started hacking TorButton, thankfully I failed and Mike Perry was willing to bring TorButton up to speed.

That's very kind of you to submit patches, I for one thank you!

 

[OldPork]

Thanks for the great info, Spurr and for being an impetus in developing the bundle. Looks like I'll have to snag those other add-ins like NoScript, which I have just added and I LIKE it. You mentioned exit node packet sniffing. Question: Even if the packets were being sniffed at the point of leaving the exit node, wouldn't your real ip address have been supplanted at that point by the ip address of the last host in the onion router sequence? Yes someone could read the contents of what it is you are posting or sending but still not determine the true originating ip. So anonymous yes, encrypted no. Is this the case? Final question...whatcha smoking these days bro? You need to ratchet up the potency and bring your intelligence down to normal levels.
lol Thanks again bro good stuff.

BTW, ever since I installed the NoScript add-on, the TOR browser bundle seems to be performing much faster. Response times from this and other forums have increased dramatically. I love it! Is this your experience as well?

 

[Krull]

.

 

[!!!]

No offense but some of your are straight up paranoid, and not the productive kind.

I order equipment and seeds for me and my friends using my CCs directly to my grow. I've been doing it for years and have used almost every popular hydro site based in the US. The latter was stupid to do, but I stuck to using old established businesses instead of new sites that popped up overnight (these are risky.) I also drive directly to/from local hydro shops at least once a month.

In many countries, it's very common for police to place bags of drugs in your pocket and take you in lest you pay them. Authorities can also come take you away in the middle of the night never to be seen again, just for praying to the wrong gods or doing something else they don't like. I personally would be paranoid using the Internet in China and other places, but not in the US. We have laws that protect our citizens. It's fucking fantastic! It's tough at times but overall we have it much better here than we do in most parts of the world. Learn the laws and learn what you can/cannot do, learn what LEO can/cannot do, and then decide how you're going to protect yourself.

If you're paranoid, you should be. You're committing a felony by growing weed. But here's what you should care about:

1) no tell
2) no smell
3) no sell

That removes 99.99% of the chance of getting caught. There's still the tiny tiny chance of bad luck, like the recent news article of the Baltimore guy who had a random BMW crash into his grow op, getting him busted.

Focus on those 3 rules. You can break the 3rd rule if you're careful, but obviously no foot traffic and no hand-to-hand dealing.

Police almost never go on IP alone unless they're VERY desperate or it involves a very serious crime. The only crimes that come to mind are credit card fraud and child porn, and for CC fraud they rarely give a shit about IP these days because IPs are just "assumed" to be cloaked. Everyone has a dozen hotspots around their home and can choose any of them to commit crime, so LE doesn't bother.

You don't need to hide your IP from seed sites nor from checking tracking, nor ordering equipment. I'm not sure where you would need to hide it really.

 

[OldPork]

4) No yell

 

[DiscoBiscuit]

no hell