are there any other multi-hop vpn services that don't log?

[scrty001]

I'm trying out xerobank and so far I'm impressed. I want to do some comparisons so I'm wondering are there any other multi-hop vpn services, maybe not necessarily 3 hops but, even 2? also any other vpn services that don't log?

these are the few that I was thinking of:

findnot (keeps logs for 5 days)
steganos
swiss vpn

I'm not sure if it was steganos or swissvpn but, I heard one of them in 2009 is going to have to start logging so that means they don't log as of now?

besides xerobank who else do you think is up there in terms of anonymity and privacy?


Thanks

[fuzzylogic]

there are a few that offer 'double vpn', a 2 hop system, but so fair only xb offers any multi-hop network. Openvpn.ru and secretsline.net are the only ones i know of and there isn't much of the way of information about them. you can always have search.

[SteveTX]

There is only one other who is truly competitive with XeroBank on a technological and corporate level. That would be KryptoHippie.

[scrty001]

{QUOTE-> There is only one other who is truly competitive with XeroBank on a technological and corporate level. That would be KryptoHippie. <-QUOTE}

kryptohippie doesn't offer any services do they?

and what do you think about double vpn?

[Paranoid2000]

JAP (http://anon.inf.tu-dresden.de/index_en.html) can route traffic via multiple servers (known as mixes) though the default "mix" is a single server - it is free (and therefore slow) but it does have a commercial option, JonDoNym which should offer better performance (I've not tried it myself though).

Just to forestall the inevitable "it's been backdoored!" posts, I would point out that JAP was on the receiving end of a court order which they fought and overturned - virtually any other commercial provider would have caved in quietly. See their Crime Prevention (http://anon.inf.tu-dresden.de/strafverfolgung/index_en.html) page for more details.

Any service will have to do some degree of logging (for accounting and abuse prevention, as well as to comply with local legislation in many countries) so using a multi-hop service with nodes in different countries (requiring co-operation between law enforcement agencies to track a user, which is likely only in serious cases) is the most prudent method of maintaining anonymity. If you are up to serious mischief though, it is unlikely that any (legal) anonymity service could (or would) guarantee complete privacy.

[Webby]

Using the Jondo Client (Jap) https://www.jondos.de/en/jondonym at this moment with the JonDofox Browser https://www.jondos.de/en/jondofox
over mixed paid cascades.

Love it!

[SteveTX]

{QUOTE-> kryptohippie doesn't offer any services do they? <-QUOTE}

They do for corporate clients, and last year they said they wanted to start offering retail to the public.

{QUOTE->
and what do you think about double vpn? <-QUOTE}

Depends on what you're trying to accomplish. Mostly a lousy idea, but it could have a use.

[fuzzylogic]

Good mention on JAP, its a great system and not badly priced either. Make sure to pay for Large park, you'll find it very quick and you'll burn through the quote very quicly.

For a multi-hop vpn, you could do PTPP/IPSEC over openvpn, or SSH over openvpn.

Krytohippie; the site has been devoid of information for a while now, would be good to have a company that directly handles data security/anonymity open up to the public.

[scrty001]

Thanks for the replies!

[scrty001]

Is JonDoNym a VPN service or is it like a paid tor service?

If you use JonDoNym along with a VPN service will that more hops and will you still stay anonymous? or will you be exposing unencrypted traffic to the internet more?

Also what about if you used a VPN service such as xerobank, steganos, etc.. and connected to an offshore PC remotely and used that for the internet?

There are some web hosting companies that let you rent a PC (kind of expensive, more than VPN services) and you can login remotely with your remote desktop software. What if you connected to VPN and then connected to the offshore PC remotely. Would that add extra anonymity, more hops, etc..?


Thanks

[fuzzylogic]

Jondo is a paid JAP service, which also provides free services. The paid services give you acccess to faster 3-hop mixes, the free option gives access to the slower 1/2-hop mixes. Using JAP over a vpn will add another several hops, it is encrypted between you and the mixes but does not layer the encyrption like TOR does.

Remote desktops are another option in private browsing, they are bandwidth dependent therefore make sure there isn't too many hops between you and the remote desktop, otherwise it will seem like your using a 486 thus a very laggy internet session. Providers of remote desktop include cosmopod, gopc and nivio, the former two are linux based, the later is windows xp based.

[scrty001]

{QUOTE-> Using JAP over a vpn will add another several hops, it is encrypted between you and the mixes but does not layer the encyrption like TOR does. <-QUOTE}

Thanks for your response. Could you explain the disadvantage of not having the layer encrypted like tor?

[Paranoid2000]

{QUOTE-> Thanks for your response. Could you explain the disadvantage of not having the layer encrypted like tor? <-QUOTE}Tor's layered encryption (like the layers of skin on an onion) means that you don't have to worry about the first or second nodes being able to eavesdrop on traffic (though the exit node can since the traffic has to be sent decrypted from it). With JAP, an abusive operator could theoretically monitor incoming traffic after decryption but before it is encrypted for sending onto the next mix) whatever their position in the chain.

JAP therefore is more vulnerable to abuse by a rogue operator but the project places limits on who can run a mix server. Tor is less vulnerable in one sense (only the exit operator can commit abuse) but anyone can operate a Tor node so it is more vulnerable in another.

As for "combining" a VPN service with Tor or JAP, there is very little point since you are more likely to weaken your anonymity. If you use Tor/JAP to chain onto a VPN service, the VPN operator will still be able to identify you by seeing which account you use - if you use a VPN service to connect to the first node of Tor/JAP then you have the possibility of the VPN operator intercepting traffic before it is sent to the Tor/JAP client (which would have to be running on their machine for this to work).

The only case proxy chaining can be useful that I've come across, is when using a "free" proxy via Tor/JAP in order to work around a site blocklist.

[scrty001]

{QUOTE->
As for "combining" a VPN service with Tor or JAP, there is very little point since you are more likely to weaken your anonymity. If you use Tor/JAP to chain onto a VPN service, the VPN operator will still be able to identify you by seeing which account you use - if you use a VPN service to connect to the first node of Tor/JAP then you have the possibility of the VPN operator intercepting traffic before it is sent to the Tor/JAP client (which would have to be running on their machine for this to work).

The only case proxy chaining can be useful that I've come across, is when using a "free" proxy via Tor/JAP in order to work around a site blocklist. <-QUOTE}

What about using Tor or Jap to connect to another computer with remote desktop. Is that different than connecting to another computer via VPN? Will that increase your anonymity as well?


Thanks

[Paranoid2000]

{QUOTE-> What about using Tor or Jap to connect to another computer with remote desktop. Is that different than connecting to another computer via VPN? Will that increase your anonymity as well? <-QUOTE}Assuming that you could run a Remote Desktop connection over Tor or JAP, then the situation would be largely identical to a VPN - if the remote system belongs to you then it will be traceable by other means breaking your anonymity.

If it isn't, then you still have no gain in anonymity (the connections from the remote PC will be in the clear and, assuming you're the only one using it, it will be trivial to backtrack and see the incoming traffic coming from Tor) but will have (significantly) slower performace due to Remote Desktop's overheads.

In fact, the increase in traffic volume (due to the need to transmit screen data) would likely make your activities more easily traceable through Tor (this applies to file transfers/video streaming generally) than simple web browsing would be.

Why the obsession with trying to "improve" on something like Tor or JAP?

[scrty001]

{QUOTE->

Why the obsession with trying to "improve" on something like Tor or JAP? <-QUOTE}

Just trying to find ways to increase anonymity as much as possible. Although, I understand what you're saying, Steve - (xerobank) has said the same thing. Just stick with one service.

Where do you think there is more advantage using JAP (paid, mix cascades) or using a VPN service?

With JAP since it's a mix cascade you get a different IP regularly such as ToR correct? I like that concept more than having 1 set IP all the time. Although I like how with a VPN service all your traffic is encrypted so your ISP can't see it. Does JAP work like that as well?

If somebody was to try to trace you through JAP they could possibly have to go through many jurisdictions due to all the different cascades?

I know 100% anonymity isn't possible but, I want to make it as difficult and costly as possible to trace.

I'm not really concerned if anybody sees what I'm doing as you were saying could be possible on a cascade network (rogue operator) since I'm not doing anything wrong. I'm just concerned with being anonymous and being traced.


Thanks again for your replies.

[Paranoid2000]

{QUOTE-> Just trying to find ways to increase anonymity as much as possible. Although, I understand what you're saying, Steve - (xerobank) has said the same thing. Just stick with one service. <-QUOTE}Tor and JAP provide as anonymous a service as you are likely to get. {QUOTE-> Where do you think there is more advantage using JAP (paid, mix cascades) or using a VPN service?... <-QUOTE}Please review the JonDo/JAP FAQ (http://anon.inf.tu-dresden.de/help/jap_help/en/help/index.html) and other project documentation - this answers the questions you have raised.

If anonymity is your main concern then forget about VPNs completely (and any similar single-hop solutions, which includes virtually all other "anonymity services" except JonDoNym and XeroBank) since all they do is place your browsing details in the hands of the VPN provider rather than your ISP. Only if performance is important and you just wish to avoid ISP tracking should you consider them.

[scrty001]

{QUOTE->

since all they do is place your browsing details in the hands of the VPN provider rather than your ISP. <-QUOTE}

That's what I was thinking and never felt comfortable going with any VPN service, I barely got myself to try xerobank only due to what I've heard from this site. Even after being recommended VPN services and reading up on them, I felt that ToR has a much better system but, I didn't like the idea of honeypots and anybody being able to setup their own server.

Since I like ToR's system, I want to try JAP's mix cascade system. Although what they say below on their site is one reason I thought VPN could be more reliable:

"JonDo fakes your IP address against websites, and replaces it by another, fixed IP of the JonDonym system. Unfortunately this alone is not enough to ensure the web surfer's anonymity. On many websites there are so-called active contents that may lead to the disclosure of the IP address, and the web browsers send data that may be used for profiling. Currently, JonDo does not block such content yet, but this may be done by additional applications."

I have all the plug-ins to help stop that from no-script, no-referrer, turn off javscript, etc.. etc.. but, then some sites need javascript, if you're trying to browse some forums or trying to order something. I had some issues with this when using ToR.

Although, I also saw this (below) on there so I think this could be a solution to that problem.

"Proxomitron is a filter proxy running as a local service on the own computer. Using filters enables Proxomitron to filter harmful JavaScript, Java applets, cookies and HTTP Headers. This is accomplished by rewriting requested websites before passing them on to the browser."

If somebody was going to try and trace you through JAP how would they have to go about doing that? Would it be really complicated?


Thanks

[Paranoid2000]

Proxomitron is a more powerful filter than NoScript (in that it can be more selective) but it is more complex also. Essentially, if a site requires Javascript, you are going to encounter problems regardless of whether you are using Proxomitron or NoScript to block it - you have to decide whether the site is important enough to you to allow Javascript for it (or alternatively, to bypass Tor when using it).

For someone to trace a Tor or JAP user, they would have to check the traffic logs for the exit node, try to find out which middle node was being used, check the traffic logs for that to find the entry node and then check its logs. If the nodes are in different countries then this would require co-operation between national law enforcement agencies, which in practice is only likely for major wrongdoing (and anyone in that category would need "help" well outside the province of this forum).

JAP does have the ability to report access to specific IP addresses as a result of a previous court case (which the project fought and overturned, but may still be subject to in the future) but that is documented on their Crime Prevention (http://anon.inf.tu-dresden.de/strafverfolgung/index_en.html) page.

[LockBox]

One other thing when it comes to Javascript, etc. Make use, as much as you can, of sites created for mobile use. With the explosion of these devices, most all the major sites have "mobile views" that require only the basics to access their content. A simple example would be CNN. Instead of going to cnn.com - go to http://m.cnn.com . Few people realize these can be accessed by any computer. Even a no-frills gmail can be accessed at http://m.gmail.com . You can quickly make a personalized links page, a "mobile portal" if you will, and look at it as your privacy portal when accessing sites using TOR, JAP or whatever. Think MOBILE.

[traxx75]

{QUOTE-> One other thing when it comes to Javascript, etc. Make use, as much as you can, of sites created for mobile use. With the explosion of these devices, most all the major sites have "mobile views" that require only the basics to access their content. A simple example would be CNN. Instead of going to cnn.com - go to http://m.cnn.com . Few people realize these can be accessed by any computer. Even a no-frills gmail can be accessed at http://m.gmail.com . You can quickly make a personalized links page, a "mobile portal" if you will, and look at it as your privacy portal when accessing sites using TOR, JAP or whatever. Think MOBILE. <-QUOTE}Another advantage is that "made for mobile" sites are generally a lot more bandwidth-friendly and, as a result, more useable over restricted-bandwidth services like TOR and JAP :)

[SteveTX]

{QUOTE-> Tor and JAP provide as anonymous a service as you are likely to get. <-QUOTE}

oh? (http://xerobank.com/docs/Blacknet.pdf) :D

[scrty001]

{QUOTE-> oh? (http://xerobank.com/docs/Blacknet.pdf) :D <-QUOTE}

do they have a portable size for laptops that you can carry around?

[SteveTX]

doesn't require a cryptorouter, you could use a ipsec or opvn connection, but yes the hardware is portable if you wanted to move it around.

[scrty001]

does anybody know if you can use JanusVM with the paid version of JAP?

[scrty001]

I was really considering JAP but, I'm starting to think the risk of leaks (javascript, etc..) doesn't seem worth it. In that sense VPN seems more reliable. I'd rather have higher security between the websites I'm visiting VS. the service provider.

[scrty001]

{QUOTE-> doesn't require a cryptorouter, you could use a ipsec or opvn connection, but yes the hardware is portable if you wanted to move it around. <-QUOTE}

I'm not sure what you mean, are you saying I can get that cryptorouter service without any hardware? or are you saying that I can place the cryptorouter at a particular location and use that service from my laptop from any location without carrying the hardware around?

[scrty001]

at first I was really interested in JAP with the multi-cascade setup and still am some-what but, the more I think about the javascript leaks and what-not. I think VPN might be more reliable since if there was a leak then any website you visit or ISP has your traffic without any problems. If you go through a VPN service all your traffic is encrypted and they have to go through courts to get your information which can take time and be costly to pursue. (assuming you're not doing anything serious).

[Paranoid2000]

There's been plenty of discussion in other threads about the potential risks of Javascript, Java or Flash content in webpages. There is no way that I know of that Javascript alone can be used to de-anonymise you and Java/Flash can easily be handled by using a firewall to restrict your browser (and Javaw.exe) to connecting via the Tor/JAP client only. Alternatively, you could take the VM approach (as Xerobank's client does).

The trouble with single-hop/VPN services is that you are relying on the willingness of a single company (or even individual) to keep your data secure - and if they're based in the US, that data can be obtained without a court order. Indeed, it would be in the commercial interests of most privacy services to co-operate quietly with official information requests in the hope of avoiding any publicity.

[scrty001]

{QUOTE-> There's been plenty of discussion in other threads about the potential risks of Javascript, Java or Flash content in webpages. There is no way that I know of that Javascript alone can be used to de-anonymise you and Java/Flash can easily be handled by using a firewall to restrict your browser (and Javaw.exe) to connecting via the Tor/JAP client only. Alternatively, you could take the VM approach (as Xerobank's client does).

The trouble with single-hop/VPN services is that you are relying on the willingness of a single company (or even individual) to keep your data secure - and if they're based in the US, that data can be obtained without a court order. Indeed, it would be in the commercial interests of most privacy services to co-operate quietly with official information requests in the hope of avoiding any publicity. <-QUOTE}

Thanks for your reply, it sounds like we both have the same viewpoint towards VPN.

Do you know where I can find information on how to setup my firewall to restrict my browser with JAP? If I can set this up it it definitely encourages me to try JAP. Just like your viewpoint towards 1-hop, all data with 1-company (VPN) really doesn't make me feel comfortable. Anyway I can use JAP as securely as possible is what I would like.

Also, I'm not sure what you mean by the VM approach? Is that Virtual Machine? xb Machine? can you setup xb machine with JAP or do they have a VM for the paid version of JAP?


Thanks!

[Paranoid2000]

{QUOTE-> Do you know where I can find information on how to setup my firewall to restrict my browser with JAP? If I can set this up it it definitely encourages me to try JAP. <-QUOTE}It really depends on the firewall you use - the key is to create a rule allowing browser access to 127.0.0.1 (your own computer) and JAP's source port (4001 by default) and another to block any other access. That limits the browser to JAP only. For javaw.exe, you need to provide rules for JAP itself (it is a Java applet) - creating specific rules for each mix is the safest option but requires a little more work (you'll need to allow access to infoservice.inf.tu-dresden.de:6543 for the status update, then for the Dresden-Dresden mix, mix.inf.tu-dresden.de:20,80,443,6544 and so on).

A suggested ruleset for Outpost firewall (with Tor, Proxomitron and Privoxy) can be found here (http://www.wilderssecurity.com/showpost.php?p=384351&postcount=13) if you want a more concrete example.{QUOTE-> Also, I'm not sure what you mean by the VM approach? Is that Virtual Machine? xb Machine? <-QUOTE}Yes, VM = Virtual Machine which is the approach xB Machine/XeroBank use. xB will only connect to Tor or XeroBank - if you want to create a version for JAP, you will need to build your own VM image.

It is worth noting that the JAP client can be used to connect to the Tor network, so you can switch between them (in this case though, you would need to give javaw.exe unlimited outgoing access which would prevent you using a firewall to prevent Java leaks - a workaround would be to make a separate copy of javaw.exe and use that, with unlimited rules, for JAP/Tor only).

[scrty001]

Thanks again you've been really helpful.

quick question, I remember Steve saying something about that it's possible for Xerobank to trace a live connection. Is this possible with JAP as well?


Thanks



{QUOTE-> It really depends on the firewall you use - the key is to create a rule allowing browser access to 127.0.0.1 (your own computer) and JAP's source port (4001 by default) and another to block any other access. That limits the browser to JAP only. For javaw.exe, you need to provide rules for JAP itself (it is a Java applet) - creating specific rules for each mix is the safest option but requires a little more work (you'll need to allow access to infoservice.inf.tu-dresden.de:6543 for the status update, then for the Dresden-Dresden mix, mix.inf.tu-dresden.de:20,80,443,6544 and so on).

A suggested ruleset for Outpost firewall (with Tor, Proxomitron and Privoxy) can be found here (http://www.wilderssecurity.com/showpost.php?p=384351&postcount=13) if you want a more concrete example.Yes, VM = Virtual Machine which is the approach xB Machine/XeroBank use. xB will only connect to Tor or XeroBank - if you want to create a version for JAP, you will need to build your own VM image.

It is worth noting that the JAP client can be used to connect to the Tor network, so you can switch between them (in this case though, you would need to give javaw.exe unlimited outgoing access which would prevent you using a firewall to prevent Java leaks - a workaround would be to make a separate copy of javaw.exe and use that, with unlimited rules, for JAP/Tor only). <-QUOTE}

[Paranoid2000]

{QUOTE-> quick question, I remember Steve saying something about that it's possible for Xerobank to trace a live connection. Is this possible with JAP as well? <-QUOTE}Only if all the mix server operators on the selected route agreed (and this would have to be in advance for live tracing) - with the possible exception of specific IP addresses (as noted in their Crime Prevention (http://anon.inf.tu-dresden.de/strafverfolgung/index_en.html) page).

While the default mix is a single server, there are others available that involve multiple administrators which is why, from a privacy perspective, I'd give JonDoNym the edge over XeroBank (whose servers come under the same administration) - more so now that JonDo accept the cash-like payment service PaySafeCard (https://www.jondos.de/en/paysafecard). And XeroBank in turn would have a not insignificant edge over any single hop anonymity service.

[scrty001]

It looks like PaySafeCard is only for Europe. Is that correct?

This should be my last questions in this thread, you've helped greatly. Since it works similiar to ToR, does that means every time you connect you get a new IP?

Is there anything that you think I should know when I set this up? I'm going to get the paid mix cascade server with JonDoNym and use a FW to route all traffic through JAP. Is that all I do?


Thanks



{QUOTE-> Only if all the mix server operators on the selected route agreed (and this would have to be in advance for live tracing) - with the possible exception of specific IP addresses (as noted in their Crime Prevention (http://anon.inf.tu-dresden.de/strafverfolgung/index_en.html) page).

While the default mix is a single server, there are others available that involve multiple administrators which is why, from a privacy perspective, I'd give JonDoNym the edge over XeroBank (whose servers come under the same administration) - more so now that JonDo accept the cash-like payment service PaySafeCard (https://www.jondos.de/en/paysafecard). And XeroBank in turn would have a not insignificant edge over any single hop anonymity service. <-QUOTE}

[Paranoid2000]

{QUOTE-> It looks like PaySafeCard is only for Europe. Is that correct? <-QUOTE}It seems to be for the time being.{QUOTE-> This should be my last questions in this thread, you've helped greatly. Since it works similiar to ToR, does that means every time you connect you get a new IP? <-QUOTE}With both Tor and JAP networks, the IP address that you will seem to have (to sites you visit) will be that of the exit node. With Tor, this changes every 10 minutes by default - with JAP it changes only when you change mixes (i.e. select a different route in the JAP client). JAP's "fixed IP" is an advantage in dealing with sites that make you login again if your IP address changes but as JAP has far fewer exit nodes than Tor, it is easier to block by webmasters (who may see it as a source of abuse).{QUOTE-> Is there anything that you think I should know when I set this up? I'm going to get the paid mix cascade server with JonDoNym and use a FW to route all traffic through JAP. Is that all I do? <-QUOTE}Experiment with the free JAP service first before committing yourself to JonDo. Don't worry about firewall rules to start with - get things working first and tighten up the setup later.

Make sure that you are using proper web filtering tools - in particular, sites that are allowed to set cookies will be able to tag and track you regardless of proxy usage (not a problem with forums like this one - but advertisers and trackers like Google Analytics, Webtrendslive, Nielsen Netratings and Omniture are best blocked by default). Ensure that your filtering can cope with https: traffic (see the Dangers of HTTPS (http://www.wilderssecurity.com/showthread.php?t=31087) thread for more info). Also make use of test sites like BrowserSpy (http://gemal.dk/browserspy/) or Leader Network Tools (http://www.leader.ru/secure/who.html) to check what websites can see about your system.

Good luck - and have fun. ;)

[scrty001]

{QUOTE->

Make sure that you are using proper web filtering tools - in particular, sites that are allowed to set cookies will be able to tag and track you regardless of proxy usage (not a problem with forums like this one - but advertisers and trackers like Google Analytics, Webtrendslive, Nielsen Netratings and Omniture are best blocked by default). Ensure that your filtering can cope with https: traffic (see the Dangers of HTTPS (http://www.wilderssecurity.com/showthread.php?t=31087) thread for more info). Also make use of test sites like BrowserSpy (http://gemal.dk/browserspy/) or Leader Network Tools (http://www.leader.ru/secure/who.html) to check what websites can see about your system.

Good luck - and have fun. ;) <-QUOTE}

You mean web filtering tools such as "no-script", etc..? The possibility of leaks makes me have 2nd thoughts again since I'm not sure if I understand how all this works well enough to be able to make my system "leak-proof" by myself. That was one of the advantages I was thinking with vpn is that all I have to do is connect to their vpn and not have to worry about the leaks.

[Paranoid2000]

{QUOTE-> You mean web filtering tools such as "no-script", etc..? <-QUOTE}No-Script is a good place to start, but it is an all-or-nothing tool (i.e. you can't choose to allow Javascript only while blocking Java or Flash) and you still need something to handle cookies. Since it is a Firefox plugin though, it will cope with https: pages.

The issue isn't leaks (which a firewall can deal with) but browser exploits. Firefox is not immune to these (though vastly better than IE) but with active content (Javascript, Java, etc) disabled, there is very little a hostile webpage can do.

VPNs generally provide no web filtering so don't help on this issue - which is more a security than a privacy concern.

[scrty001]

{QUOTE-> No-Script is a good place to start, but it is an all-or-nothing tool (i.e. you can't choose to allow Javascript only while blocking Java or Flash) and you still need something to handle cookies. Since it is a Firefox plugin though, it will cope with https: pages.

The issue isn't leaks (which a firewall can deal with) but browser exploits. Firefox is not immune to these (though vastly better than IE) but with active content (Javascript, Java, etc) disabled, there is very little a hostile webpage can do.

VPNs generally provide no web filtering so don't help on this issue - which is more a security than a privacy concern. <-QUOTE}

I understand what your saying that these are browser leaks. Although with VPN even if there is a browser exploit, they can't see your actual IP addresss correct? or track you? Since all your traffic is being routed through the VPN.

Do you mind recommending some plug-ins that I should be using with Firefox for web-filtering?


Thanks

[Paranoid2000]

{QUOTE-> Although with VPN even if there is a browser exploit, they can't see your actual IP addresss correct? or track you? Since all your traffic is being routed through the VPN. <-QUOTE}If your system is ever compromised, it won't matter to the attacker responsible whether you're on a VPN or not. In such a situation, the danger isn't having your ISP-assigned IP address revealed, but having your private data accessed and your PC taken over.

As for tracking, cookies can do this regardless of VPN or proxy used - that is why dealing with them is important (either blocking by default or making them all session only).{QUOTE-> Do you mind recommending some plug-ins that I should be using with Firefox for web-filtering? <-QUOTE}I don't use Firefox as my main browser (it normally gets fired up for placing fake orders with spam websites using Imperator) so I'm not best placed to make recommendations. There is plenty of information here (http://www.wilderssecurity.com/showthread.php?t=122085) and elsewhere.

[scrty001]

Instead of doing all that (finding extensions for web-filtering to make firefox more secure), can't you just use JonDoFox?

[scrty001]

alright well, seems I have another question...

With JAP/JonDoNym is all your traffic (including non-browser traffic) running through JAP and anonymized? Example: if you use VPN, your AIM, MSN messenger, smtp e-mail, etc..etc.. is all running through the VPN. Unlike if you use a web-proxy only your traffic through your browser is "anonymised".

[Paranoid2000]

See How can I use JonDoNyn for FTP, and other apps other than my browser (https://www.jondos.de/en/uieforum?c=showthread&ThreadID=1758).

[scrty001]

{QUOTE-> See How can I use JonDoNyn for FTP, and other apps other than my browser (https://www.jondos.de/en/uieforum?c=showthread&ThreadID=1758). <-QUOTE}

Thanks, you've been a great help with all this.


There wasn't much discussion in that thread but, they recommended http tunneling software such as htthost.com.

Maybe, I'll need to register and post there although do you know how I can test to make sure I've setup FTP correctly with a tunneling software and JonDonym? With a browser I can just check any IP check website to give my IP so I can see I'm connected through JonDonym, how can I check that with 3rd party applications?


Thanks


Edit: I decided to post there but, if you want to reply I'd be interested in hearing what you say. I'm guessing if I configure my firewall to direct all traffic through JonDonym and if I can't connect through FTP means it's not setup correctly, if it does connect that it's probably configured correctly?

I saw this on their site that says, they don't support 3rd party applications, FTP, e-mail (except web-based) etc..etc..

http://anon.inf.tu-dresden.de/help/jap_help/en/help/supportedPrograms.html

[jondos]

Hi there, I just saw this thread and would like to help. The current JonDo help files are a little bit outdated: The paid services allow all HTTP ports, and will also support SOCKS proxies before the end of this year. This should work with a lot of messenger and FTP programs.

{QUOTE-> Using JAP over a vpn will add another several hops, it is encrypted between you and the mixes but does not layer the encyrption like TOR does. <-QUOTE}

{QUOTE-> With JAP, an abusive operator could theoretically monitor incoming traffic after decryption but before it is encrypted for sending onto the next mix) whatever their position in the chain.

JAP therefore is more vulnerable to abuse by a rogue operator but the project places limits on who can run a mix server. Tor is less vulnerable in one sense (only the exit operator can commit abuse) but anyone can operate a Tor node so it is more vulnerable in another. <-QUOTE}

JAP/JonDo also layers the encryption. This is a basic principle of the JonDonym security concept, like in Tor. Otherwise, the first Operator of a Mix Cascade could in fact deanonymise the users (he would see ingoing and outgoing addresses).

{QUOTE-> As for "combining" a VPN service with Tor or JAP, there is very little point since you are more likely to weaken your anonymity. If you use Tor/JAP to chain onto a VPN service, the VPN operator will still be able to identify you by seeing which account you use - if you use a VPN service to connect to the first node of Tor/JAP then you have the possibility of the VPN operator intercepting traffic before it is sent to the Tor/JAP client (which would have to be running on their machine for this to work).
<-QUOTE}

If you additionally use a trusted VPN, it may at least protect you from leaking your IP address if you need to activate any active plugin (Java, Flash, Silverlight) on a web page. This is another layer of protection, so why not? If you tunnel all your traffic through your local Tor/JonDo application, the VPN operator won't see anything, and your security therefore won't decrease.

[scrty001]

{QUOTE->

If you additionally use a trusted VPN, it may at least protect you from leaking your IP address if you need to activate any active plugin (Java, Flash, Silverlight) on a web page. This is another layer of protection, so why not? If you tunnel all your traffic through your local Tor/JonDo application, the VPN operator won't see anything, and your security therefore won't decrease. <-QUOTE}

Thanks for your input!

That would be great if I could use a VPN and then also use JAP for the mix cascades. The javascript IP leak is a big concern to me, since a while back I started using Tor and I got the no-script plug-in to disable javascript but, the problem was that most of my browsing needed javascript, such as signing up for a service, making an order, etc.., so it felt kinda pointless that at all the important areas that I wanted to anoymize myself from required javascript and I had no choice but to disable javascript.

Although I'd like if somebody else here could confirm your statement since I've seen here a few times people say to use just one service and for one reason or another chaining 2 services could make you more vulnerable. I've heard that you're revealing your decrypted traffic to the internet twice instead of one time if you just use one service.

I'm not really concerned about my traffic, anybody could monitor my traffic all day long and it won't matter to me that's not my concern. What I am concerned with is my original IP being leaked. I'm not concerend with anybody seeing my traffic but, I don't want my original IP leaked, I don't want anybody to be able to get my original IP, that's my main point.

In my case does anybody think it would be ok to use a VPN service and then run it through JAP? I realize it might sound kind of strange not being concerned about traffic being seen yet only concerned with IP but, think of it like this. If I make a phone call to somebody and a 3rd party is listening in, I'm not concerned with what they hear but, my concern is not wanting my phone number to be traced by the receiving end (I know this is not 100% possible but, as much difficult as it could be).


Thanks

[Paranoid2000]

{QUOTE-> With a browser I can just check any IP check website to give my IP so I can see I'm connected through JonDonym, how can I check that with 3rd party applications? <-QUOTE}If you want to be absolutely certain, install a packet sniffer (e.g. Wireshark) or port monitor (e.g. Port Explorer, VitalAgent 0.9) on your PC and check the outgoing packets. Normal FTP packets will contain readable data (like the filename requested) while anything sent via Tor/JAP should be encrypted and unreadable. A simpler solution is just to install a software firewall that shows network connections and check that all outgoing connections are to the first JAP/Tor mix/node.{QUOTE-> JAP/JonDo also layers the encryption. This is a basic principle of the JonDonym security concept, like in Tor. Otherwise, the first Operator of a Mix Cascade could in fact deanonymise the users (he would see ingoing and outgoing addresses). <-QUOTE}Thanks for the correction there. However the protocol description (http://anon.inf.tu-dresden.de/develop/doc/mix_short/) states that the first mix supplies the public keys of the second and third to the client. What is there to prevent a first-mix operator from attempting a man-in-the-middle attack by supplying different keys? (giving them the opportunity to decrypt and inspect traffic before re-encrypting using the proper keys).{QUOTE-> If you additionally use a trusted VPN, it may at least protect you from leaking your IP address if you need to activate any active plugin (Java, Flash, Silverlight) on a web page. This is another layer of protection, so why not? If you tunnel all your traffic through your local Tor/JonDo application, the VPN operator won't see anything, and your security therefore won't decrease. <-QUOTE}If you are talking about running a VPN before JAP, then that would require the VPN operator to run the JAP client on their server. They may well agree to this, but it would nonetheless be possible for them to intercept/log traffic before it is sent onto JAP/Tor (Java/Flash leaks would reveal the VPN server IP address in this case, but that is hardly a price worth paying given they can be handled by a software firewall just as well).

If you are talking about running a VPN after JAP (i.e. using JAP to connect to a VPN service) then the issue of Java/Flash still exists and you lose any anonymity with a commercial VPN (where you have to supply a login name/password) since your account will identify you.{QUOTE-> The javascript IP leak is a big concern to me... <-QUOTE}There is no way currently known for Javascript alone to reveal your IP address - Java or Flash have to be used to make a direct connection (outside of the browser) and this can be blocked by a software firewall. If you want to allow Javascript while blocking Flash/Java, you can set this up in your browser without any plugins needed (Tools/Options/Content in Firefox for Java, for Flash just uninstall the Flash plugin).

[jondos]

Thank you for your responses. We will add some explanations about these issues in our new help files (we are just working on them) and ask the Dresden people to clarify their texts.

{QUOTE-> However the protocol description (http://anon.inf.tu-dresden.de/develop/doc/mix_short/) states that the first mix supplies the public keys of the second and third to the client. What is there to prevent a first-mix operator from attempting a man-in-the-middle attack by supplying different keys? <-QUOTE}

This should be written clearer, it seems. There are severaly ways to make a man-in-the-middle quite hard:


All Operators are certified by JonDos. That means no one can just sneak in with self-signed certifices. We have also developed algorithms (finished this month) for allowing two or more additional certificate authorities per Operator (multi-CA-certification), for which we hopefully find an NGO or another trusted party willing to act as additional CA in 2009.
Information about Operators, available Cascades, Mixes and Operators/Mixes in the Cascades is published in a distributed InfoService and polled by JonDo. You may see all details in JonDo, can filter out single-Operator-services, specific Operators, Cascades, black/whiltelist and so on. If JonDo connects to a Cascade, it always checks if the information from the Cascade still matches your filter criteria. If it does not (e.g. if the first Mix sends you modified data so that he may lead the traffic over itself), connection is not allowed.
If ever the first Mix modifies the Cascade information and the connection was allowed (your filter criteria were still met), the data stucture in JonDo for this Cascade changes. Users will see that this Cascade has changed and could be alarmed. If JonDos gets thereby noticed from malicious Cascade changes, the Operators are liable for breaking contracts and for all direct or indirect damages caused thereby.


We hope that these measures are sufficient for preventing insider attacks. If you have suggestions what else we could do to protect the users, please feel free to propose any ideas and I will discuss it. Security is never perfect, and the internet is a bunch of insecure communication protocols.

{QUOTE-> There is no way currently known for Javascript alone to reveal your IP address - Java or Flash have to be used to make a direct connection (outside of the browser) and this can be blocked by a software firewall. <-QUOTE}

Right. However, not everyone is able to configure his firewall (or even the browser) correctly. While professionals will do it this way, it might be an alternative for other people to add a VPN connection to Tor or JonDo. We also recommend our development JonDoFox especially for unexperienced users, which at least provides a secure browser configuration and standardised HTTP header values. We also have contact to Mike Perry for creating a common anonmyous browser standardisation for Tor and JonDonym, so that anonymity groups get bigger.

{QUOTE-> If you are talking about running a VPN after JAP (i.e. using JAP to connect to a VPN service) then the issue of Java/Flash still exists and you lose any anonymity with a commercial VPN (where you have to supply a login name/password) <-QUOTE}

This is difficult, as JonDo currently only forwards TCP traffic, and no IP traffic. While you could at least tunnel OpenVPN TCP connections through JonDo, though, this might not be very fast. And you are right that the leakage problem persists and your might get identified by the VPN Operator (at least he may link different actions to your pseudonym). This is therefore not recommended.

{QUOTE-> If you are talking about running a VPN before JAP <-QUOTE}

Yes, this is the method of choice.

{QUOTE-> then that would require the VPN operator to run the JAP client on their server. <-QUOTE}

No, this is not how a VPN works. Just imagine as if the VPN provider gives you a very long cable to his NAT gateway. You may use the VPN as if you were in the VPN Operator's internal network. The Operator therefore does not need to run the JAP/JonDo client on his server. You just "tunnel" (it is not quite the right word here but easier to describe) your JonDonym connection through the VPN from your local client program as in any other network.

Therefore you may use a VPN as fallback solution, even if you do not put much trust in the VPN provider.

{QUOTE-> If you want to allow Javascript while blocking Flash/Java, you can set this up in your browser without any plugins needed (Tools/Options/Content in Firefox for Java, for Flash just uninstall the Flash plugin). <-QUOTE}

Maybe you should have a short look at JonDoFox. We do our best to create a secure Firefox profile which accounts all these issues and the users' requests and needs.

Thank you for your comments!

[fuzzylogic]

you can now try crytohippie (https://secure.cryptohippie.com/), they are a distributed VPN network, with servers spread through germany, USA, Netherlands and switzerland. they are US$275 annually. they have very minimal logging, and its usually only records connecting servers (its a multi-hop network).

[SteveTX]

I can vouch for cryptohippie. good setup, we contract with them and vice versa.

[fuzzylogic]

i'm actually surprised you don't join forces, use their network and then configure your software/hardware. They provide a large distributed network and you provide a harden software/hardware solution, bone fida security solution. ;D

[SteveTX]

;) It's an interesting thought.