tor question

[Carl05885]

hello,

how does tor work ? I know that question has probably been asked hundreds of times, and yet I couldn't find an answer that met my needs in google. I did find that forum though, and I hope you'll be able to help.
What I would like to know is the technical details of an internet request using tor, and especially the encrypted part (including the exchange of public/private keys, RSA+AES etc), which is basically the green arrows in the images of this page : http://www.torproject.org/about/overview.html
For example, one thing I would like to know (but please try to explain the whole process, this is just a question I had in mind) is whether the encryption is being made between alice and the last tor node before bob (only one encryption, a sort of tunneling), or whether there is one encryption and one exchange of between every tor node.

Also, on a quite unrelated matter, I was wondering if it is possible to use tor for flash content, and if so then how to configure it, because for now all I've been able to do is to use html.

Thanks.

[redcell]

If you wanna use TOR, I recommend you use Vidalia bundle which has TOR enable button for Firefox. Personally, I use TOR on top of VPN.
http://www.wilderssecurity.com/showthread.php?t=294518
I realize that TOR is not really that anonymous as it gives away some DNS leaks in suspected SOCKS 4/5.
http://www.wilderssecurity.com/showthread.php?t=294388

SteveTX suggested using JanusVM to VPN TOR. Unfortunately, I never get it working despite daily experiences in VMware for software testing.

Since TOR is a relay concept, it's notorious for "swinging IPs"
I encountered several times locked out from (anonymous account) gmail due to this and gmail wouldn't let me unless I verified code via text message to a cellphone which I didn't.

[I no more]

Originally Posted by redcell

I realize that TOR is not really that anonymous as it gives away some DNS leaks in suspected SOCKS 4/5.
http://www.wilderssecurity.com/showthread.php?t=294388

Tor doesn't leak DNS. Your browser (or more generally any application) does if you don't configure it properly. And FYI, it's not just DNS that can leak. Your browser can leak your IP to the website you want to contact. DNS isn't as bad as an IP leak.

Tor can't force your application not to bypass it. You have to configure it properly.

JanusVM was one solution. I use a firewall. And others mentioned Torbutton. Since I don't use Torbutton, I can't vouch for it, but others here say that it works.

[redcell]

Originally Posted by I no more

Tor doesn't leak DNS. Your browser (or more generally any application) does if you don't configure it properly. And FYI, it's not just DNS that can leak. Your browser can leak your IP to the website you want to contact. DNS isn't as bad as an IP leak.

Tor can't force your application not to bypass it. You have to configure it properly.

JanusVM was one solution. I use a firewall. And others mentioned Torbutton. Since I don't use Torbutton, I can't vouch for it, but others here say that it works.

By default, TOR button enabled uses SOCKS 5 which cause certain web application like Tinychat webcam channel flash not to load up.
When I changed it to SOCKS 4, it can load up but my real IP got exposed (exposed only at webcam site, IP checker still stated IP anonymous) as I tested. Some suggested it's DNS leaks or application-related.

I attempted to mask all connections (browser, Java, flash) using additional Sockscap and firewall. That didn't work also

Eventually, I resorted to double layer VPN and TOR to ensure my IP totally hidden. http://www.wilderssecurity.com/showthread.php?t=294518

[I no more]

Originally Posted by redcell

By default, TOR button enabled uses SOCKS 5 which cause certain web application like Tinychat webcam channel flash not to load up.
When I changed it to SOCKS 4, it can load up but my real IP got exposed (exposed only at webcam site, IP checker still stated IP anonymous) as I tested. Some suggested it's DNS leaks or application-related.

I attempted to mask all connections (browser, Java, flash) using additional Sockscap and firewall. That didn't work also

Eventually, I resorted to double layer VPN and TOR to ensure my IP totally hidden. http://www.wilderssecurity.com/showthread.php?t=294518

When I use a firewall, the tinychat flash also doesn't load up when I'm using Tor. I'm not sure if it's just my browser or all browsers are like that. But, the flash on tinychat apparently requires that your browser connect directly (i.e. not through Tor).

So, if you're using Tor properly (with a firewall or Torbutton), you can't watch the flash. The problem is that you altered the default Torbutton configuration, which allowed the flash to load (and compromised your IP address).

So, I guess the lesson is don't modify Torbutton (or use a firewall or JanusVM instead of Torbutton). Or you can use a combination of these.

p.s. I don't know if JanusVM would allow you to load the tinychat flash through Tor, but I know a firewall and Torbutton don't.

p.p.s. It's still not a Tor leak. It's a browser leak.

[I no more]

Originally Posted by Carl05885

For example, one thing I would like to know (but please try to explain the whole process, this is just a question I had in mind) is whether the encryption is being made between alice and the last tor node before bob (only one encryption, a sort of tunneling), or whether there is one encryption and one exchange of between every tor node.


Thanks.

The reason I didn't respond sooner is because of your request that the whole process be explained. I can't do that.

However, I can say that it is three separate layers of encryption, with one encryption/decryption step happening at each node. So, my understanding is that before any request leaves your PC, it's encrypted three times, then a decryption step happens at each node until it finally passes unencrypted to the website from the exit node (unless you're using https, which would be a fourth layer of encryption separate from Tor).

Carl05885

It's all here:
http://www.torproject.org/docs/docum...l.en#DesignDoc