Tor-Firefox-Proxomitron

[Liquidslam]

Hi,

I have the above three (latest versions of Tor and Firefox) and would like to know how to integrate them. The only threads I have been able to find on this subject relate to using Tor with Proxomitron and either Privoxy or SocksCap. But nothing on this or any other site relating to all three. Hopefully somebody can point me in the right direction.
Originally I toyed with the idea of using Jap instead of Tor which would have made things easier but I was put off by the infamous backdoor scandel of a few years back. Other than that is there much difference between the two as far as security is concerned?

Many thanks for your help.

[WSFuser]

check this thread (http://kyeu.info//proxo/forums/viewtopic.php?t=577&sid=8fffc89544a2f9c0e73fe478fc407723) from teh The Un-Official Proxomitron Forum

[Liquidslam]

I'm in your debt.
Thanks to the info on that site I was able to put the whole thing together and it actually works, though I'm not too sure how to check whether the Tor part is pulling it's weight. It also cleared up a misconception. Because I'd read that you did not need a proxy like Privoxy when using Firefox with Tor I had assumed that the threads relating to Tor-Proxomitron-Privoxy\SocksCap integration only applied when using IE. In otherwords I hadn't done my homework.

[thnx]

thanks for this thread. Question: Do I have to allow each one of these pop ups?
There's a lot.

http://img380.imageshack.us/img380/7468/tor5xq.png (http://imageshack.us)

[tony62]

thnx,
see post #13 of this thread here (http://www.wilderssecurity.com/showthread.php?t=55748&highlight=proxomitron+sockscap),

{QUOTE-> Liquidslam Hi,

I have the above three (latest versions of Tor and Firefox) and would like to know how to integrate them. <-QUOTE}
I have used this method here (http://www.imperialviolet.org/deerpark.html), after trying almost all. I have found that this approach is faster, and i can confirm that it does not leak DNS requests;) Providing you don't use any extensions that perform IP lookups.

[WSFuser]

{QUOTE-> thanks for this thread. Question: Do I have to allow each one of these pop ups?
There's a lot.

http://img380.imageshack.us/img380/7468/tor5xq.png (http://imageshack.us) <-QUOTE}
i do not know of any rules for tor in outpost, until u find rules, either allow each one or allow all.

[thnx]

{QUOTE-> thnx,
see post #13 of this thread here (http://www.wilderssecurity.com/showthread.php?t=55748&highlight=proxomitron+sockscap),

<-QUOTE}
thanks for that. Some of the ports were different when setting them for privoxy after following this setup (http://kyeu.info//proxo/forums/viewtopic.php?t=577&sid=8fffc89544a2f9c0e73fe478fc407723)

[thnks]

I have a quick question. Following this set up:
{QUOTE->
'Torifying' Select Sites

For those of you who have some sites you would like to be anonymous on, this filter I wrote will be handy.

It consists of one header filter, and a Lists file. Sites included in the List file will be routed through Tor (and Privoxy). This makes it so that you do not have to turn on Proxomitron's "Remote Proxy" feature!

Simply download it, extract the Lists folder and "Torify.mergeme" to the same folder "Proxomitron.exe" is located and merge "Torify.mergeme" with your config file. <-QUOTE}

If I turn off remote proxy in proximitron, my real IP shows at: http://www.whatismyip.com/ - is there something wrong with set up?

[Paranoid2000]

{QUOTE-> I have used this method here, after trying almost all. I have found that this approach is faster, and i can confirm that it does not leak DNS requests <-QUOTE}It's worth noting that using Firefox's SOCKS proxy settings to connect to Tor directly will bypass Proxomitron. To use Proxomitron's filtering, Firefox has to connect to it (using HTTP proxy settings) and Proxomitron then has to connect to Tor - either via Privoxy or by being launched using SOCKScap/Freecap.{QUOTE-> If I turn off remote proxy in proximitron, my real IP shows at: http://www.whatismyip.com/ - is there something wrong with set up? <-QUOTE}If you disable Remote Proxy in Proxomitron, it will connect directly, not using Tor, so there is nothing wrong with your setup. You need to keep the Remote Proxy setting enabled if you wish to have online anonymity.

[thks]

{QUOTE-> If you disable Remote Proxy in Proxomitron, it will connect directly, not using Tor, so there is nothing wrong with your setup. You need to keep the Remote Proxy setting enabled if you wish to have online anonymity. <-QUOTE}perhaps you did not read my quoted post but I appreciate your reply - also does tor need to be running in taskbar? It can't go to tray?:

{QUOTE-> 'Torifying' Select Sites

For those of you who have some sites you would like to be anonymous on, this filter I wrote will be handy.

It consists of one header filter, and a Lists file. Sites included in the List file will be routed through Tor (and Privoxy). This makes it so that you do not have to turn on Proxomitron's "Remote Proxy" feature! <-QUOTE}

* - * I sure get a lot of "404" using this

[tknx]

looks like I need to edit the tor file

[Paranoid2000]

{QUOTE-> perhaps you did not read my quoted post but I appreciate your reply <-QUOTE}I'll plead insanity ;) (though it is also past my bedtime here in Blighty...). If you are using a filter to control proxy access to specific sites then you would need to add the likes of WhatIsMyIP to it to see the result of Tor.{QUOTE-> - also does tor need to be running in taskbar? It can't go to tray?: <-QUOTE}Tor itself can only be minimised to the Taskbar. However you could try Tor Control Panel (http://www.freehaven.net/~edmanm/torcp/) if you want something "system trayable".

[toploader]

i'm getting confused about all this, it's complicated and i don't really fully understand SOCKS and SOCKSCAPS etc :)

why do you need proxomitron if you are using tor and privoxy? presumably it's for reasons other than anonimity?

i thought p2000 answered the question as to why anonimity was lost when turning remote proxy off? didn't he ??? :)

can someone sum up in simple language where we have got to and what works and what doesn't?

confused of tunbridge wells

[Paranoid2000]

{QUOTE-> why do you need proxomitron if you are using tor and privoxy? presumably it's for reasons other than anonimity? <-QUOTE}Some form of web filtering is essential for full anonymity. Tor can disguise your real IP address and conceal your traffic from your ISP but certain features of browsers and web pages (e.g. cookies, web bugs, referers) can still be used to build a profile on you or track your online activities. A web filter can take care of these and Proxomitron is one of the most powerful.

[Deviladvocate]

{QUOTE-> i'm getting confused about all this, it's complicated and i don't really fully understand SOCKS and SOCKSCAPS etc

why do you need proxomitron if you are using tor and privoxy? presumably it's for reasons other than anonimity?
<-QUOTE}

Here's what i gather.

1) Tor is a socks proxy, if your application supports socks directly you don't need anything else.

2) Firefox, IE, Opera most browsers *do* support socks directly, so you can connect to Tor directly if you wish except for a little snag.

3) Prior to 1.5, firefox has some technical problem due to DNS leaks (basically DNS lookups are not sent through TOR) not too bad a problem, but it can possibly tell whoever is monitoring DNS lookups (your ISP!) which site you are going to.

4) To solve 3), people chain Firefox with privoxy which supports Socks.

5) But some people prefer proxomitron which is more popular and has a lot of excellent filter packs around but there's a snag,.Proxomitron unlike privoxy does not support Socks. This led to two possible solutions.

6) One solution is to 'sockify' proxomitron. Once you sockify any application it can now work with socks. So people sockified Proxomitron with either freecap or sockscap. So you get the solution Firefox + Proxomitron (sockified) + Tor

This is the method mentioned on one of the posts here on wilders forum

7) Second solution is to chain proxomitron and Privoxy. This is the method advocated by Kyle - a big proxomitron fan. In effect you have Firefox + Proxomitron + Privoxy + Tor

8) It seems based on the information given now, problem 3) no longer applies with firefox 1.5, so there is no reason why you can't run Firefox directly with Tor.

9)Unless you want the filtering that Proxomitron provides of course. But if you have other ways of handling that (say you turn off javascript, java 100%, you set firefox or use extensions to change your user agent, referrer)
or you don't care at all about anything but showing a different ip on server logs (assuming no javascript,java tricks), You can now dispense with either of the two methods above.

Is this an accurate summary Paranoid2000?

[Deviladovcate]

Small addition

9a) To solve the problem with firefox and DNS, you need to follow the instructions here (http://www.imperialviolet.org/deerpark.html)

PS I haven't tried this method, unlike the other two methods.

[tony62]

{QUOTE-> It's worth noting that using Firefox's SOCKS proxy settings to connect to Tor directly will bypass Proxomitron. To use Proxomitron's filtering, Firefox has to connect to it (using HTTP proxy settings) and Proxomitron then has to connect to Tor - either via Privoxy or by being launched using SOCKScap/Freecap.If you disable Remote Proxy in Proxomitron, it will connect directly, not using Tor, so there is nothing wrong with your setup. You need to keep the Remote Proxy setting enabled if you wish to have online anonymity. <-QUOTE}
Yes this is true P2K, as i have used all of the various setups.
What i have now found though, is what i believe to be a better setup:

1, Firefox 1.5 with this setup here (http://www.imperialviolet.org/deerpark.html)
2,Selective extensions from this guide here (http://www.wilderssecurity.com/showthread.php?t=107817)

Works flawlessly, easy to control, and only requires two process running to do the job.

Thank you all the same, for all the hard work that you and all the others have put into the terrific guides, that also works very well:)

{QUOTE-> Deviladovcate Small addition

9a) To solve the problem with firefox and DNS, you need to follow the instructions here (http://www.imperialviolet.org/deerpark.html)

PS I haven't tried this method, unlike the other two methods. <-QUOTE}
I have already mentioned this in post #5

[deviladvocate.]

{QUOTE->

I have already mentioned this in post #5 <-QUOTE}

Yes, on the behalf of the whole Wilders Security Forum, neigh the whole security community of the internet I thank you for bringing this to my attention.

But my comment holds, I haven't tried it yet and verified if it worked.

I like some of your links particularly this one

{QUOTE-> 2,Selective extensions from this guide here (http://www.wilderssecurity.com/showthread.php?t=107817)

<-QUOTE}

But, as Paranoid2k will tell you soon, as good as these extensions are (I alluded to them in my post #15 point 9 in general ), proxomitron and so on, are probably more flexible if you need it. Greasemonkey might perhaps match it to some degree.

[Paranoid2000]

{QUOTE-> Is this an accurate summary Paranoid2000? <-QUOTE}Both accurate and very comprehensive. Congratulations. :)

There are also two benefits to using Privoxy rather than a SOCKSified Proxomitron. First, with Privoxy it is possible for Proxomitron to control whether Tor is used or not - with a SOCKSified Proxomitron, everything goes via Tor, regardless of Proxomitron's settings (exceptions have to be set in SocksCap/FreeCap but this requires a restart of Proxomitron).

Second, Proxomitron adds an extra "Forwarded by" header to HTTP requests. This means that web sites could detect Proxomitron being used (Leader Network Tools (http://www.leader.ru/secure/who.html) does this - see the "PROXO-TOR NETWORK" (http://kyeu.info/proxo/forums/viewtopic.php?t=361) thread for more details). Privoxy can strip out this extra header if configured following the recommendations in Kye-U's FAQ (http://kyeu.info/proxo/forums/viewtopic.php?t=577) (which includes a Privoxy configuration file which disables all other filtering and logging to boost performance).

[deviladvocate]

Yes. Very cool Paranoid2k.

Exactly the reasons why I do Proxomitron + Privoxy.

Knowing your concern about 'the dangers of HTTPS' I thought it might also be interesting to consider what happened if you went a https page like GRC's
in the following cases.

1) Direct connection via bare firefox + Tor as favoured by Tony

2) Firefox + Privoxy + Tor

3) Firefox + Proxomitron +freecap/sockcap + Tor

4) Firefox + Proxomitron + Privoxy + Tor

[tony62]

{QUOTE-> Yes, on the behalf of the whole Wilders Security Forum, neigh the whole security community of the internet I thank you for bringing this to my attention.

But my comment holds, I haven't tried it yet and verified if it worked. <-QUOTE}
If you had read my post correctly, you would have noticed that i had already gave that particular link and verifyed that the setup worked...NO DNS LEAK.
{QUOTE-> But, as Paranoid2k will tell you soon, as good as these extensions are (I alluded to them in my post #15 point 9 in general ), proxomitron and so on, are probably more flexible if you need it. Greasemonkey might perhaps match it to some degree. <-QUOTE}
This isn't the first time that P2K and myself have discussed a topic in a thread you know, so don't try and hide behind him.

Let's get a few things straight:

1, Privoxy, in most cases, is used simply to connect Proxomitron - Tor, since as you have mentioned, Proxo can not handle Socks. Most people who understand Firewalls will only use Privoxy for this reason, NOT to filter additional traffic.(in other words you SHOULD have Privoxy disabled).

2, Firefox now supports sending of SOCKS5 requests with DNS names, using this setup
{QUOTE-> Now, type “about:config” into the address bar, as if it were a URL and hit enter. The resulting page has a text entry at the top labeled “Filter”. In it, type “socks_remote_dns” (don't hit enter).

As you type the list of settings should shrink until there's only one. Double click it and it should go bold and its value should be “true”. <-QUOTE}
hence NO NEED FOR PRIVOXY.

3, Proxomitron over Firefox extensions, hmm......for the more experienced, then Proxomitron. It's all very well using a filterset created by another person, when in truth, does that individual understand how to debug the probmatic webpage, when in trouble?

What i propose, is an alternative to the complexities of Proxomitron/Privoxy.

P2k has always been a motovation of mine, both here and over at the Outpost Forum, however, there are sometimes ideas brought by other users, which may be at least worth testing.

Have you tested it? I guess not!

Edit: Besides, post #13 explains to P2K that i have found an alternative, since he knows that i WAS a Proxo user, and is probably somewhat baffled by my earlier post.

[deviladvocate]

{QUOTE-> If you had read my post correctly, you would have noticed that i had already gave that particular link and verifyed that the setup worked...NO DNS LEAK.
<-QUOTE}

Sigh, I know you tested it. But my statement was about ME. And at the time I posted, I haven't tested it.

No offense, but you seem eager to claim credit afraid people didn't see your post, and when I said innocently *I* haven't tested it, you jump all over me. I didn't say it didn't work, I didn't say other people haven't tried it, I said only *I* haven't tried it.

Sheesh, get over yourself will you? :)



{QUOTE->
This isn't the first time that P2K and myself have discussed a topic in a thread you know, so don't try and hide behind him.
<-QUOTE}

I hide behind NO ONE. I'm insulted you think so. You must be new here.

{QUOTE->
1, Privoxy, in most cases, is used simply to connect Proxomitron - Tor, since as you have mentioned, Proxo can not handle Socks. Most people who understand Firewalls will only use Privoxy for this reason, NOT to filter additional traffic.(in other words you SHOULD have Privoxy disabled).
<-QUOTE}

LOL, yes only you understand firewalls.


{QUOTE->
2, Firefox now supports sending of SOCKS5 requests with DNS names, using this setup

hence NO NEED FOR PRIVOXY.
<-QUOTE}

I already said THAT!!!!

See I'm also eager for credit. Just kidding. :)

{QUOTE->
P2k has always been a motovation of mine, both here and over at the Outpost Forum, however, there are sometimes ideas brought by other users, which may be at least worth testing.
<-QUOTE}

Did I say 'your' idea is not worth testing? What gave you that idea?
And BTW I don't always agree with Paranoid2k either.

{QUOTE->
Have you tested it? I guess not! <-QUOTE}

Are you blind? Remember the parts where I said I haven't tested it yet? And you insist there is no leak? The parts you object to?

But I have tested it now, and it works yes.

Happy? You are the greatest.. Rah Rah...

[tony62]

In all honesty i had missed your post #15(large enough, as it is)::) , when browsing late last night, and jumped straight to post #16. So maybe i owe you some sort of appology.:-[
Like i was saying though, i don't doubt for any minute that P2K's approach is very, very secure. That said mine is (i've found) faster and very easy to configure 'on the fly'.:)

[Paranoid2000]

Both approaches (Firefox with extensions or Proxomitron + Privoxy) should theoretically give the same level of security since both can handle https: content and filter out potentially compromising web content.

The Firefox approach should have the advantage of ease-of-use (less setup and configuration necessary, fewer warning prompts when accessing https sites, no need to debug Proxomitron filtersets).

The advantages of Proxomitron/Privoxy are multi-browser support (anything able to connect to a proxy) and more powerful filtering with several filtersets available - Firefox's Greasemonkey extension looks to be the closest competitor to Proxomitron but, being script-based, it looks unlikely to offer the same level of performance and does not seem to cover HTTP headers (though other extensions can handle this - including those mentioned in Tony62's link, a very interesting post about client-side-script abuse BTW).

At this point the differences are probably small enough to come down to personal preference so all informed debate about the alternatives should be welcomed. I'd really miss the absolute control that Proxomitron gives, but I'd also be the among the first to admit that writing filters for it can be hellishly difficult (and I salute those that do, and make them available for others).

[toploader]

test your privacy (http://gemal.dk/browserspy)

[Deviladvocate]

{QUOTE-> In all honesty i had missed your post #15(large enough, as it is)::) , when browsing late last night, and jumped straight to post #16. So maybe i owe you some sort of appology.:-[
<-QUOTE}

I'll accept your some sort of apology.

{QUOTE-> Like i was saying though, i don't doubt for any minute that P2K's approach is very, very secure. That said mine is (i've found) faster and very easy to configure 'on the fly'.:) <-QUOTE}

Try not to be so insecure next time, nobody said 'your' method is bad.
And if I were a glory hound, I would point out that the second link in post #17 was actually a post of mine!!!!!

And being an equally glory hound, I would say that paranoid2k's #24 just repeats points I've already made. :)

{QUOTE-> test your privacy (http://gemal.dk/browserspy) <-QUOTE}

Bah, I already mentioned this link way back in 2003! :) :)

Just kidding.

[tony62]

{QUOTE-> Yes, on the behalf of the whole Wilders Security Forum, neigh the whole security community of the internet I thank you for bringing this to my attention. <-QUOTE}
With sarcastic comments like this, what do you expect?
{QUOTE-> And if I were a glory hound, I would point out that the second link in post #17 was actually a post of mine!!!!! <-QUOTE}
How many names do you have?

[deviladovcate]

{QUOTE-> With sarcastic comments like this, what do you expect?
<-QUOTE}

Just poking fun at you, look at your own post #17 again.

{QUOTE->
How many names do you have? <-QUOTE}

Some of the deviladvocates are not me.

[tony62]

{QUOTE-> Just poking fun at you, look at your own post #17 again. <-QUOTE}
I'm looking.......What is soooooo bad about post #17 that gives you such a h@#* on???????????

Anyway, as P2K has clearly stated, it's probably worth checking both varients out, before we condemn.
I have tested both, and after using the Proxo method with several headaches configuring it to suite my needs, i've gone for the easy option(extensions).

[deviladvocate]

{QUOTE-> I'm looking.......What is soooooo bad about post #17 that gives you such a h@#* on???????????
<-QUOTE}

It's not bad, just over anxious. As you admitted you jumped in without reading my post #15.

{QUOTE->
Anyway, as P2K has clearly stated, it's probably worth checking both varients out, before we condemn.
<-QUOTE}

There you go again being overly sensitive. Show me any sentence where I or paranoid2k or anyone for that matter *condemn* . Nobody was condemning anything. Just stating why someone might conceviably prefer one method rather than another that's all.

In fact if you read my post #15, you can see I was explaining how the whole big mess began with the firefox flaw and slowly evolved to the complicated mess we have today. And the implication was that people made a virtue out of necessity.

Seriously this is silly, for someone who claims to be knowledgable about firewalls, shouldnt you be spending your time teaching people about firewalls???

[tony62]

Right, enough is enough.
For the original question(whatever that was), please bear in mind both suggestions, as they both work/tested. Proxo is very difficult to configure, however there is an abundance of info on how to do so(castlecops being my favourite).

Good day to you all, goodnight.;D

Edit: Oops spelling error!!

Edit Edit: P2K, reference this thread 'Run application' - Privoxy/Tor (http://outpostfirewall.com/forum/showthread.php?t=15374&highlight=proxomitron+privoxy), as promised, this is my solution.

Thank you.

[bent]

wow, some boards do not like this proxy. Sometimes google tell me I have malware or malware uses this IP

http://img520.imageshack.us/img520/3511/poof9iv.jpg (http://imageshack.us)

[Paranoid2000]

{QUOTE-> wow, some boards do not like this proxy. Sometimes google tell me I have malware or malware uses this IP <-QUOTE}Yes, I've had this issue too - it is apparently due to new Tor exit nodes needing to be registered with Google so that it then permits a higher volume of requests from them.

In the meantime, you may find the Proxomitron Google-Scroogle redirector (http://castlecops.com/t141124-Google_Scroogle_redirector_for_Tor_users.html) filter a suitable workaround (not to mention another string to Proxomitron's bow...).

[bent]

wow. That was a lot to absorb and try to understand. I did not see any of those folders in proxomitron.

[loansome George]

This seem to be a very "often temporary failure" I don't think I can accept so much of this -

{QUOTE-> This is often a temporary failure, so you might just try again. <-QUOTE}

{QUOTE-> This is Privoxy 3.0.3 on localhost (127.0.0.1), port 8118, disabled <-QUOTE}

[loansome]

lol - that was easy. I fixed it.

[tony62]

{QUOTE-> lol - that was easy. I fixed it. <-QUOTE}
How did you fix it,, mate??

[Liquidslam]

I just now checked back with this thread for the first time in two weeks and am amazed at the number of replies that came in and the overall professional level. None of the one-eyed leading the blind stuff that I've encountered on some other forums. I see I should have become a member of this one a long time ago.

[tony62]

{QUOTE-> I just now checked back with this thread for the first time in two weeks and am amazed at the number of replies that came in and the overall professional level. None of the one-eyed leading the blind stuff that I've encountered on some other forums. I see I should have become a member of this one a long time ago. <-QUOTE}
Glad we could all help.........and entertain:)

EDIT: After experimenting alot with both Firefox Extensions and Proxomitron, i've decided to stick with Proxo. Although i learned alot with the Extensions, proxo does offer better control over the pages you are viewing(just alot more difficult to troubleshoot).

[_john]

HI all. I'm very new to this and managed to set it up and it works.

whatismyip.com cannot detect my True IP. BUT.. whenever I visit this site:

https://www.grc.com/x/ne.dll?bh0bkyd2

It detects it. How come?

[Paranoid2000]

{QUOTE-> It detects it. How come? <-QUOTE}The GRC URL is using the https (encrypted web access) protocol - you need to ensure that your browser is set up to use Tor for https as well as http traffic.

[-john]

No wonder. the (s) at the end of http.

I can't find it in FireFox.. all I have are:

http
ssl
ftp
Gopher
Socks

I can't find (https)

Also is it safe to Log into Forum while using Tor? Will my username password be compromised?

[Paranoid2000]

{QUOTE-> I can't find it in FireFox.. all I have are:...I can't find (https) <-QUOTE}ssl (Secure Sockets Layer) = https{QUOTE-> Also is it safe to Log into Forum while using Tor? Will my username password be compromised? <-QUOTE}Without Tor any http data you send is sent in the clear and visible to your ISP and anyone else with access to your local network (or any part of the route followed by your request as it travels to Wilders). With Tor it is sent encrypted to the Tor network and is only "in the clear" when it exits Tor - it has to be decrypted at this stage since the server you are contacting expects unencrypted data. With https, traffic is encrypted all the way with Tor adding extra levels of encryption.

The benefit of using Tor (and similar systems) is that the website you contact does not know where you are (assuming you are running a web filter to disable Java/ActiveX applets which could be used to find this out) and your ISP/local administrator cannot determine what sites you are visiting.

As for username/password data, usernames for vBulletin forums (like this one) are send in the clear while the password is scrambled (it is actually sent hashed using MD5). Therefore even if someone did pick up your login data they would not be able to determine the password.

[deviladvocate]

{QUOTE-> ssl (Secure Sockets Layer) = httpsWithout Tor any http data you send is sent in the clear and visible to your ISP and anyone else with access to your local network (or any part of the route followed by your request as it travels to Wilders). With Tor it is sent encrypted to the Tor network and is only "in the clear" when it exits Tor - it has to be decrypted at this stage since the server you are contacting expects unencrypted data. With https, traffic is encrypted all the way with Tor adding extra levels of encryption.
<-QUOTE}



Practically speaking though you don't need to fill in anything in the "SSL proxy" field in the browser??

If you are using the proxomitron+Tor method, you need to setup proxomitron via the method posted in your thread about dangers of HTTPS (http://www.wilderssecurity.com/showthread.php?t=31087)

then it seems just putting 127.0.0.1 in the normal "http proxy" field is enough, proxomitron itself handles HTTPS automatically then????

If you use the method discovered, invented ,trademarked, copyrighted and patented by Tony62 it seems just filling in the 127.0.0.1 for the socks field is enough as well.

This (second thing) surprised me when i was testing it a while ago. i dont really understand the whole business.


{QUOTE->
The benefit of using Tor (and similar systems) is that the website you contact does not know where you are (assuming you are running a web filter to disable Java/ActiveX applets which could be used to find this out) and your ISP/local administrator cannot determine what sites you are visiting.
<-QUOTE}


Personally I wouldn't do HTTPS + Tor for stuff like ebanking. Just plain HTTPS is enough. I mean ISPs can't really snoop in and see the content (what kinds of transactions are happening, or see your password) though they can see the site (bank site) you are connecting . For most people except for terrorists or drugdealers trying to hide the flow of transactions this isn't important.

Right?

And on the flip side, you generally (though the paranoid certainly can dream up scenarios where this isn't true) don't need to be annoymous to your bank either. They have far more sensitive information on your then your current ip.

Right?

{QUOTE->
As for username/password data, usernames for vBulletin forums (like this one) are send in the clear while the password is scrambled (it is actually sent hashed using MD5). Therefore even if someone did pick up your login data they would not be able to determine the password. <-QUOTE}

Well you of course a simple naive hashing of the password alone isn't sufficient, because of the possibility of a replay attack. Because in such a case They don't actually need your password, just capture the hashed md5, and it's as good as the password.

You already know this of course, i'm just saying.

[WSFuser]

doesnt proxomitron need a couple of DLL files (ssleay32.dll and libeay32.dll) to decrypt SSL? (link to setup Proxo for SSL (http://www.geocities.com/yosponge/proxossl.html))

[deviladvocate]

Yes of course, the link i made to dangers of HTTPS also links to those files.

But Tony62's method doesnt even need this, and it still works with HTTPS sites!!!

[axnz]

{QUOTE-> With Tor it is sent encrypted to the Tor network and is only "in the clear" when it exits Tor - it has to be decrypted at this stage since the server you are contacting expects unencrypted data. With https, traffic is encrypted all the way with Tor adding extra levels of encryption. <-QUOTE}

TOR alone can do all that with no other programs like Proximitron and PRIVOXY?

I have Priv/proximitron and TOR running right now and have set it up but there are a lot I don't know yet. So my first question is: What can "TOR" alone do for me?

[devilish]

{QUOTE-> TOR alone can do all that with no other programs like Proximitron and PRIVOXY?
{QUOTE-> With Tor it is sent encrypted to the Tor network and is only "in the clear" when it exits Tor - it has to be decrypted at this stage since the server you are contacting expects unencrypted data. With https, traffic is encrypted all the way with Tor adding extra levels of encryption. <-QUOTE}
<-QUOTE}

Tor alone can do that yes for both HTTP and HTTPS if you follow the instructions given here http://www.imperialviolet.org/deerpark.html.

Whether HTTPS is available is however up to the server you are visiting, you cannot control this with or without proxomitron/privoxy.

Sidenote: I'm still amazed this method alone handles HTTPS as well without any special setup. Guess it shows what i know about socks proxies. LOL.


{QUOTE->
I have Priv/proximitron and TOR running right now and have set it up but there are a lot I don't know yet. So my first question is: What can "TOR" alone do for me? <-QUOTE}

The long detailed reason why people use priv/proxomitron instead of straight Tor +firefox is described here in post #15 of this thread. Don't worry if it's confusing.

For simplicity, I now follow the lead of Tony62 by recommending the method described here http://www.imperialviolet.org/deerpark.html . Just browser+Tor is enough.

You don't have to care if the site is http or https, that setting alone will ensure Tor is used.

[axnzz]

{QUOTE-> Tor alone can do that yes for both HTTP and HTTPS if you follow the instructions given here http://www.imperialviolet.org/deerpark.html. <-QUOTE}

THank. I managed to configurated for FireFox and I'm using Proximitron to filter out web junks. One question I have is the "use remote proxy" in Proximitron. I have set it up to hide my IP but it lag my browsing so I don't use it that much that mean I leave it "unchecked".

So that mean my IP will be visible to the sites that I visit. Regardless of whether my IP is hidden or not TOR still hide the site I go to from my ISP. Correct?

[devilish]

{QUOTE-> THank. I managed to configurated for FireFox and I'm using Proximitron to filter out web junks. One question I have is the "use remote proxy" in Proximitron. I have set it up to hide my IP but it lag my browsing so I don't use it that much that mean I leave it "unchecked".
<-QUOTE}

HUH? which method are you using? The link i gave is a method that does not involve proxomitron/privoxy at all.

Are you using A)Tor+proxomitron+ privoxy?

or B)Tor+Proxomitron(sockified with sockcap or freecap)?

or C)Tor + Privoxy?

Or just D)Tor alone?

I do not recommend C) because it cannot handle HTTPS.

If you are using Method B) , you don't need to check "use remote proxy" to use Tor

If you are using Method A) which I suspect you are, You definitely need to check "use remote proxy" to chain it to privoxy. Otherwise you won't be using Tor!

Method A is this

Firefox---> Proxomitron--->Privocy--->Tor--->website

Check remote proxy in proxomitron tells proxomitron to forward to Privoxy, and privoxy will then forward to Tor. If you break up the chain by not checking the box you get

Firefox-->proxomitron--->website

You are not using Tor at all!


{QUOTE->

So that mean my IP will be visible to the sites that I visit. Regardless of whether my IP is hidden or not TOR still hide the site I go to from my ISP. Correct? <-QUOTE}

No! No! No!

When Tor is on, you gain both benefits together. If Tor is not on, you lose both!

Proxomitron/Privoxy do not hide your ip from websites, neither do they hide activity from your ISP.


If this is not clear, please give exact details on what you are doing. Otherwise we are just wasting time.

[axnzzz]

Ok here is what I have set up right now.

http://img465.imageshack.us/img465/4513/ff0tx.jpg
I also set sock dns to true via (about:config for firefox) So I think FireFox and TOR is now compatible.

I also have PRIV running but don't know too much about it (will learn more about later when i have the time to read). I also downloaded [Privoxy Tor Settings.zip] somewhere via this forum and in it it contains [config.txt default.action and standard.action] which I replaced with the default files in PRIV folder.

Proximitron is not new to me. I've been using it alone without TOR and PRIV for a very long time. What is new to me is SOCKS and setting it to work with TOR and PRIV.

[devilery]

clear out the lines for SSL and http. just leave the line for Socks. 127.0.0.1 9050

That way you can use firefox + Tor without anything else.

This is the easiest method to use Tor for both http and https

***************************************************

Your current setup lines actually requires the use of proxomitron minimal and either freecap/sockcaps or privoxy. I assume you use privoxy+proxo.

Using this alternativesetup, you just need to fill in 127.0.0.1 8080 for http. You don't even need anything at all in the fields for socks proxy or even SSL, but what you have now doesn't hurt.

Please ensure your proxomitron is setup according to instructions given in
#45 of this thread.

The rest should be straight forward for an old timer of proxomitron like yourself.

Briefly you need to select a remote proxy for 127.0.0.1:8118 in proxomitron and select the box "use remote proxy". I'm assuming standard privoxy setup.

Then set up privoxy as per files you downloaded.

That should do it.

There will definitely be slow down in speeds when using Tor. It might be intolerantly slow for you. or it might not

For more complication you can setup proxomitron so it only goes to privoxy (and hence Tor) on some sites but not others.

Similarly some people are running Tor as a windows service for greater stability. More complication but not strictly necessary.

Good Luck.

[axnzzzz]

Alright, it looks like I'm using

A) Tor + Proxomitron + privoxy


{QUOTE->
{QUOTE-> So that mean my IP will be visible to the sites that I visit. Regardless of whether my IP is hidden or not TOR still hide the site I go to from my ISP. Correct? <-QUOTE}

When Tor is on, you gain both benefits together. If Tor is not on, you lose both! <-QUOTE}

I have TOR on but unchecked "Use Remote Proxy" ( 127.0.0.1:8118 ) in Proxomitron. So that means my IP is not concealed.

My question now is: Can TOR really protects me from my ISP when my true IP is shown to sites like whatismyip.com because I have "Use Remote Proxy" turned off? How useful it is to have your path encrypted by TOR and your true IP showned. Or am I missing something?

[tony62]

{QUOTE-> If you use the method discovered, invented ,trademarked, copyrighted and patented by Tony62 it seems just filling in the 127.0.0.1 for the socks field is enough as well. <-QUOTE}
Ha ha!!;D

[WSFuser]

{QUOTE-> Alright, it looks like I'm using

A) Tor + Proxomitron + privoxy




I have TOR on but unchecked "Use Remote Proxy" ( 127.0.0.1:8118 ) in Proxomitron. So that means my IP is not concealed.

My question now is: Can TOR really protects me from my ISP when my true IP is shown to sites like whatismyip.com because I have "Use Remote Proxy" turned off? How useful it is to have your path encrypted by TOR and your true IP showned. Or am I missing something? <-QUOTE}
if u uncheck "use remote proxy" then ur only using proxomitron. u need to check it to reap the benefits of using tor. reread devilish's post (#50)

[axnzzzz]

{QUOTE-> if u uncheck "use remote proxy" then ur only using proxomitron. <-QUOTE}

So for those that uses FireFox+TOR is useless then...?

[WSFuser]

if u use proxomitron + tor + privoxy, u will need to check "use remote proxy" for proxomitron. if ur only using tor and firefox, dont worry about. and lastly if ur lost, refer the link in my post (http://www.wilderssecurity.com/showpost.php?p=623680&postcount=2).

[devilish]

{QUOTE-> {QUOTE-> When Tor is on, you gain both benefits together. If Tor is not on, you lose both! <-QUOTE}

I have TOR on but unchecked "Use Remote Proxy" ( 127.0.0.1:8118 ) in Proxomitron. So that means my IP is not concealed.
<-QUOTE}

No No. Look at my post 50 again. You are creating a chain as follows

Firefox--->Proxomitron--->privoxy--->Tor

The use remote proxy option tells proxomitron to connect to privoxy!

If you don't use that option the chain is broken and you will not use Tor even if it is on! I don't know why you don't get this!

I seriously urge you follow the method of just Firefox + Tor, the other method is probably too complicated for you.

[axnzzzzz]

{QUOTE-> Firefox--->Proxomitron--->privoxy--->Tor

The use remote proxy option tells proxomitron to connect to privoxy!

If you don't use that option the chain is broken and you will not use Tor even if it is on! I don't know why you don't get this! <-QUOTE}

Privoxy --> Tor

Proxomitron (127.0.0.1:811) direct to

Privoxy
/
forward-socks4a / 127.0.0.1:9050 .
forward-socks4a :443 127.0.0.1:9050 .
forward-socks4a :53 127.0.0.1:9050 .
/

Which directs to TOR (127.0.0.1:9050) is this it? <-QUOTE}

I'm currently using FireFox+Proxo+Privoxy+Tor and I think it's working since I have "Use Remote Proxy" checked. I even used Ethereal to watch the data going out on both scenarios. When checked use remote proxy data are not in plain text and the IP of the actual site are not shown. When unchecked I see GET HTTP and web junks and the IP of the actual site that I visited.

One last question. Since using TOR with "Use Remote Proxy" means you are using another computer to surf the web. Do People who use TOR sign onto forums? Is it a smart thing to do? Does the site writes cookie into the other people's computer since it's not your IP?

[devilish]

{QUOTE-> Privoxy --> Tor

Proxomitron (127.0.0.1:811) direct to

Privoxy
/
forward-socks4a / 127.0.0.1:9050 .
forward-socks4a :443 127.0.0.1:9050 .
forward-socks4a :53 127.0.0.1:9050 .
/

Which directs to TOR (127.0.0.1:9050) is this it? <-QUOTE}

Yes! And as i said proxo's use remote proxy connects to privoxy.

{QUOTE->
I'm currently using FireFox+Proxo+Privoxy+Tor and I think it's working since I have "Use Remote Proxy" checked. I even used Ethereal to watch the data going out on both scenarios. When checked use remote proxy data are not in plain text and the IP of the actual site are not shown. When unchecked I see GET HTTP and web junks and the IP of the actual site that I visited.
<-QUOTE}

Finally. You know how to use ethereal??

{QUOTE->
One last question. Since using TOR with "Use Remote Proxy" means you are using another computer to surf the web. Do People who use TOR sign onto forums? Is it a smart thing to do? Does the site writes cookie into the other people's computer since it's not your IP? <-QUOTE}

LOL. No the cookie is on your computer. Remember the Tor server is only redirecting the HTTP stream, it doesn't actually use it's own browser to connect to the site.

But yeah, i believe the last Tor server (maybe even those in between) in the link can see everything you send in plain text. This will include passwords.

But your forum password is not a really big prize anyway.

Anything important you send will probably be in HTTPS anyway, and that will be protected even if send via Tor as per usual.

[axnzzzzzzz]

I heard that there is a security hole in Proxomitron and Sygate firewall. This is my concern since I'm using sygate with Proxomitron, how do I go about fixing this local proxy hole?

[WSFuser]

idk if there is a fix or if the debug builds fix that issue but id recommend switching firewalls if it worries u so.

[axnzzzzz]

Is it even safe to use TOR+Privoxy+Proxomitron all together? I've experienced lagness while playing game and I off TOR since I'm not browsing the web.

Using a direct connection for firefox and off TOR+Privoxy+Proxomitron my ports are protected but using TOR and others it opens the following ports:

ftp (port21)
ssh (port22)
domain (port53)
www (port80)

http://www.digconsys.com/testdir/portscan.html

I used that site to scan and it managed to get throught... Now I'm wonder what caused it.

[WSFuser]

if ur using a proxy/anonymizer then isnt the other computer the one getting scanned?

[axnzzzzzz]

You are right. I'm forgetting the Obvious. LOL.

Anyway, about the Lag while playing game I believe it's TOR. I turned on Ethereal and let it sat there with Tor running. all programs were off just to see what is being sent and I notice TOR send and recieve a lot of bytes every now and then and from different IPs.

Is that normal?

[WSFuser]

i doubt it as TOR should be idle while u game. does ur game have proxy settings by any chance? otherwise i guess ull just have to shutdown tor while u game.