Persistent Tor Entry Guard Relays can make you trackable Across Different Physical Locations

News
6

Good day,

sorry but trying to be polite, what you write there is completley non sensical. First of all, Pluggable transports are just one variant of bridges, why these are sperate I don’t know. Second, why would a proxy/VPN not be able to see my IP? That is simply not possible. They may not tell anyone, but they do know it and almost always also keep records of these (HideMyAss debacle, etc.). These is especially the case for those in the US and China, which you recommended. Asside from that, a free Proxy needs to make its money back as well, so…

Also, trusting an unproven, private, non verified proxy over the heavily fail proven entry guards provided by Tor is really naive to say the least. Furthermore, both VPNs and proxies have massive design issues, see here: News - Whonix Forum

The only thing you may do, is run your own entry guard and only use that. This however only works if you own a server/PC you may run the entire time, as well as a safe internet connection and find a way to circumvent the tracking based on that fact, mentioned in the first post, which if you’d do this would be even more dangerous and telling.

Have a nice day,

Ego

7

Quote:

We are not aware of any http(s) or socks4(a)/5 proxies that offer an encrypted connection between itself and the user.

From…

Also see:

Related:

8

FYI
research non-persistent Tor directory guards
https://phabricator.whonix.org/T469

9

(2xiangzi’s post should probably be in a separate thread.)

In @2xiangzi’s defense, I think by “Pluggable transports”, he meant “Bridge + Obfsproxy”, which does have different characteristics than using a bridge alone.

Also, unless his image was edited, he doesn’t deny that a proxy can see your IP.

I agree that VPNs really engage in FUD (Fear, Uncertainty, and Doubt) marketing. But in his threat model, I think they are certainly viable. I would guess that nearly any non-Chinese VPN provider would be more trustworthy than the Chinese security apparatus. Additionally, VPN encryption is likely more difficult to crack than obfsproxy fingerprinting. Does the Great Firewall not block VPN connections though?

As mentioned previously, bundling any type of proxy with Whonix is problematic for multiple reasons.

10

Thanks for mentioning Lantern. Had not heard of that before but will look into it. Briefly glanced at the User & Dev FAQ, Git Documentation, Google Groups user forum, and Reddit (start here). Basically, it’s a:

  • foss project aimed at promoting human rights
  • non-profit, funded primarily by US Department of State (who also supports Tor)
  • peer-to-peer volunteer network of nodes
  • give & get modes to provide or consume bandwidth
  • “blocked” traffic routed through network via https
  • “unblocked” traffic is untouched
  • runs transparently or per-application

How does Lantern detect if a website is blocked or not?

Lantern detects a combination of conditions including timeout, reset,
redirect and fake response to consider a site being blocked.

Not sure if that includes Cloudflare captchas?

How does Lantern relate to Whonix?

From FAQ:

Lantern is not an anonymity tool. Lantern was built for fast and open Internet access. If you feel you need to be anonymous online we recommend using Tor. Otherwise, Lantern will give you faster access to blocked sites.

In which situations are there no consequences for evading intentionally placed blocks? Watching cooking shows on NetFlix? Even if the block is placed by NetFlix and not by the Chinese Government, I would guess many videos on NetFlix are censored by the GFW for political reasons. Certainly, anonymity would be helpful/required for browsing Facebook/Twitter unless we’re talking purely about leisurely pursuits.

Very strange mission that Lantern has indeed. Seems best geared for gamers living in Western Europe and Japan - being curious about Western culture (ie cooking shows) may get you executed in North Korea. The Lantern team makes references to N. Korea, China, and Iran on the linked Reddit page. I hope they take great care in outlining the potential dangers of using their product.

I have serious reservations about trying to use Lantern to gain access to Tor. What if you connect to a new Entry Guard that hasn’t yet been blocked? Or you connect to a Bridge that’s later classified as belonging to the Tor network? Using Lantern, you would connect directly and be flagged as a Tor user. Even if you could enforce --always-use-lantern-network, you could still be discovered as a Tor user because your destination is unencrypted through the network. The resilience of the network to attacks is orders of magnitude less tested than Tor (which is encrypted anyway).

If anything, Lantern should be used to exit Tor, not enter it. Might be useful to evade Tor bans but might also introduce additional risks. You would be setting up a P2P network in your Workstation and potentially stressing the Tor network the way torrenting does. Still might be worth testing in client (get) mode and not server (give) mode. It’s free, anonymous (when tunneled through Tor), and I’ll do almost anything to get rid of these f@^*$^7#@-Cloudflare-bodies-of-water-crap… Has anyone tried this?

EDIT: Actually, I think my post needs to be moved as well to a new thread discussing Lantern.

11

Hello Ego Good to see you again :slight_smile:

First of all, Pluggable transports are just one variant of bridges, why these are sperate I don’t know. Second, why would a proxy/VPN not be able to see my IP? That is simply not possible.

The first two question have been answered by entr0py:)

They may not tell anyone, but they do know it and almost always also keep records of these (HideMyAss debacle, etc.). These is especially the case for those in the US and China, which you recommended. Asside from that, a free Proxy needs to make its money back as well, so…

I agree with you that most of the proxies or VPNs are doing what you said and that’s the reason why I would like to recommend some good ones.

Also, trusting an unproven, private, non verified proxy over the heavily fail proven entry guards provided by Tor is really naive to say the least.

I’m sorry that I didn’t make it clear enough. By saying “Using encrypted proxy/VPN”, I mean using it to connect to the Tor network(not using it instead of Tor). And in that case, the proxy/VPN at least knows your IP/Location and the fact that you’re using Tor. However, it doesn’t know which website you are surfing(the destination it can see is your entry guard IP).

12

To Patrick

We are not aware of any http(s) or socks4(a)/5 proxies that offer an encrypted connection between itself and the user.

That is exactly what I would like to discuss with you! I mean, as far as I see, a lot of proxies/VPNs are ‘user-to-proxy encrypted’. And please let me introduce some of them:
1. VPNGate: http://www.vpngate.net/en/
2. Psiphon3: Psiphon | Open Source
3. ShadowSocks: GitHub - Long-live-shadowsocks/shadowsocks
4. Lantern: GitHub - getlantern/lantern: Lantern官方版本下载 蓝灯 翻墙 代理 科学上网 外网 加速器 梯子 路由 - Быстрый, надежный и безопасный доступ к открытому интернету - lantern proxy vpn censorship-circumvention censorship gfw accelerator پراکسی لنترن، ضدسانسور، امن، قابل اعتماد و پرسرعت

13

Good day,

That is the whole concept of an entry guard and the reason why the Tor network always uses three relays, as I’ve mentioned. So there would be no benefit only disadvantages.

Have a nice day,

Ego

14

To entr0py

Thank you very much for helping me answer the questions:)

I would guess that nearly any non-Chinese VPN provider would be more trustworthy than the Chinese security apparatus.

That’s right! And some foreign VPN providers will cooperate with CCP by providing their logs or just using weak encryption.

Additionally, VPN encryption is likely more difficult to crack than obfsproxy fingerprinting.

That’s true :slight_smile: By the way, proxy encryption can be strong, for example, you can choose to use ‘aes-256-cfb’ when using ShadowSocks.

Does the Great Firewall not block VPN connections though?

GFW does block VPN connections but not all of them:
Some of them use weak encryption providing CCP a good way to understand what people are doing/thinking;
Some of them are widely used by foreign company so that it would hurt China’s economy a lot if CCP simply blocks it.

Very strange mission that Lantern has indeed. Seems best geared for gamers living in Western Europe and Japan - being curious about Western culture (ie cooking shows) may get you executed in North Korea. The Lantern team makes references to N. Korea, China, and Iran on the linked Reddit page. I hope they take great care in outlining the potential dangers of using their product.

Fun Fact: There’re about 1 million people able to circumvent the Internet Censorship in China and nobody has been arrested for reading/watching political sensitive materials. What the CCP really care is people who express themselves.

“blocked” traffic routed through network via https
"unblocked" traffic is untouched

Well, there’s an option called ‘Proxy ALL Traffic’ and if you turn it on, most of the problem you mentioned can be solved:)

Even if you could enforce --always-use-lantern-network, you could still be discovered as a Tor user because your destination is unencrypted through the network.

I’m sorry. I don’t understand ‘because your destination is unencrypted through the network’, dosen’t that mean your ISP is not able to know where you are going by using an encrypted proxy?

Not sure if that includes Cloudflare captchas?
Lantern should be used to exit Tor

You can use it to avoid Cloudflare captchas :slight_smile: And as you mentioned, Lantern sever will get the same information that Tor exit node can get.

You would be setting up a P2P network in your Workstation and potentially stressing the Tor network the way torrenting does

I’m wondering if Lantern is a strict P2P network because you can use it without contributing to it actually. And if you are not satisfied with the P2P features you can try other proxies I mentioned above:)

Has anyone tried this?

A lot of people I know have tired it.

15

Good day,

Sorry but this provider actually keeps logs of everything, see here: http://www.vpngate.net/en/about_abuse.aspx So, there is no advantage over the normal “entry guard design”, as if this’d be used to access Tor, they’d now as much as such an entry guard.

Have a nice day,

Ego

16

Then you should try ShadowSocks which the encrypted proxy provider can be yourself（all you need is a VPS） :slight_smile:

17

To Ego
I’m sorry but I don’t understand you :frowning:

Maybe you can understand something by answering the questions:

1. What information your ISP will get when you are using an encrypted proxy/VPN over Tor?
2. What information the provider will get when you are an encrypted proxy/VPN over Tor?
3. What information your ISP will get when you are using Tor without an encrypted proxy/VPN over Tor?
18

Good day,

For such things, I prefer to use OpenVPN, simply because it is per design more flexible than a proxy of any kind. However, like I’ve said, for accessing the Tor network that is not necessary, because, as the name suggests, inside “the onion router”, all traffic is already encrypted, in layers resembling an onion. There are at the moment simply no VPNs or proxys which are able to even get close to the encryption Tor provides by design.

Have a nice day,

Ego

19

Good day,

Depending on where you “use the proxy/VPN”, either you accessing the proxy/VPN or you accessing Tor via an entry guard.

What do you mean by “when you are an encrypted proxy/VPN”? Do you mean, when I provide one? Because otherwise, how may I “be” a proxy/VPN?

You accessing Tor via an entry guard.

Have a nice day,

Ego

20

To Ego
Sorry for my mistakes :frowning:

The question should be :

  1. What information your ISP will get when you are using an encrypted proxy/VPN to access to Tor?
  2. What information the provider will get when you are using an encrypted proxy/VPN to access Tor?
  3. What information your ISP will get when you are accessing Tor without using an encrypted proxy/VPN?

In China all ISPs are totally controlled by government and it will make you suspicious when they know you’re using Tor. So you have to use something to cover the fact that you are using Tor. For me, it is OK to use VPNGate because:

  1. The logs probably won’t be given to CCP;
  2. The traffic through it has been encrypted by Tor.

By the way, OpenVPN is great but the traffic characters of it is so obvious that GFW has blocked all the connections of it :frowning:

21

Good day,

You connecting to a proxy/VPN. Depending on the encryption used by the proxy/VPN they may be able to still deduce that you want to connect to Tor. The Chinese govnerment is allegedly able to do this via very advanced “deep packet inspection”. Some VPN providers are allegedly able to bypass this by using technology which builds on the concept of “pluggable transport” found in Tor, though this working has yet to be proven.

Your IP, as well as the place you want to connect to. When using a normal entry guard the fact that you want to connect to Tor. When using a bridge this is harder but depending on the situation can still be possible, when using “pluggable transport”, this is, at the moment, not possible.

You connecting to Tor. When using a bridge, this may be harder though not impossible. When using pluggable transport, this isn’t possible, even with “deep packet inspection”, as far as recent information is to be believed.

Have a nice day,

Ego

22

@2xiangzi

23

(copy/pasted from a text editor )

@2xiangzi Thanks for your insights. Congratulations to you and your 1 million friends for poking holes all over the GFW! (At the same time, it’s sad that 1 million is still less than one tenth of one percent of the population. Of course, I’m sure the number of people who have access to any computer technology is a much smaller subset to begin with.)

Fun Fact: There’re about 1 million people able to circumvent the Internet Censorship in China and nobody has been arrested for reading/watching political sensitive materials. What the CCP really care is people who express themselves.

I guess the CCP has too much on their hands to go after everybody. But it’s still better not to be watchlisted in the first place. Everybody who expresses themselves began by reading/watching first. The impending economic slowdown is going to send Chinese internal security into overdrive / crackdown mode. I’ve read that even more terrifying to the CCP than freedom of expression is freedom of association - people who organize any type of meetings / gatherings.

Even if you could enforce --always-use-lantern-network, you could still be discovered as a Tor user because your destination is unencrypted through the network.

I’m sorry. I don’t understand ‘because your destination is unencrypted through the network’, dosen’t that mean your ISP is not able to know where you are going by using an encrypted proxy?

Sorry, written poorly. What I meant was that Lantern uses https to route traffic. So, from the FAQ:

Lantern users acting as access points can see the website you’re accessing and where you’re accessing it from, but the actual content you are reading from or posting to that site is not visible to them because it is encrypted over HTTPS.

Assuming I understand correctly that Lantern is strictly direct P2P and not a multi-hop relay… My point is: Can’t the CCP set up a bunch of Lantern nodes and see which Chinese IPs are connecting to Tor? Because you’re using Tor, the final destination IP will be hidden but Lantern will not hide that you are using Tor. It seems Lantern would be easier to attack for a mass surveillance dragnet while a VPN would be easier to attack for targeting an individual. (Attack would be analogous to How can we help? | Tor Project | Support, but unlike Tor, Destination IPs are in the clear.)

Didn’t realize that OpenVPN was blocked. That does limit your choices.

You can use it to avoid Cloudflare captchas :slightly_smiling: And as you mentioned, Lantern sever will get the same information that Tor exit node can get.

I’m beginning to like the idea of using Lantern post-Tor to evade Tor bans. Since each destination could potentially route through different peer IPs, I’m guessing that Tor circuit creation will cycle normally? Sounds much better than using a static Tor circuit to connect to a static Socks5 proxy or VPN (most popular VPN IPs are blacklisted like Tor also but a custom VPS usually works (but then the disadvantage is using a non-shared IP)).

24

I assume you read this page:

How about using Lantern to connect to an obfuscated bridge? It’s not foolproof but the extra hop may make the other 999,999 people easier targets. When a bear is chasing you, you don’t have to outrun the bear - you just need to outrun the guy next to you.

25