We need a separate general-purpose browser for Workstation in new realities

Support
1

Hi. I’ve been using Whonix for many years and I’ve found your solution as the best privacy and anonymity tool on market.

To cut a long story short, I think we need an additional, general-purpose browser on a Workstation. Why do I think so? I hope for your understanding. It is not just my will, it is a reality.

It is becoming more and more difficult to use a pure Tor scheme (ISP -> Tor -> website) in order to browse the Internet anonymously. The main problem is not in Tor Project or Whonix. The key problem is in destination websites we want to visit. More and more websites nowadays are fighting against freedom of speech and block visits from Tor exit nodes IPs. Some sites’ administrators just blacklist Tor exit nodes IPs so it is impossible to visit a website at all. Some of websites accept visits from Tor exit nodes IPs, but make impossible to complete an account registration through Tor. Many global social networks and even small sites don’t allow users to sign up through Tor exit nodes IPs and immediately suspend a newly created account from Tor because of ‘suspicious activity’.

So, in a new era of the Internet reality, the usage of Tor is very limited. I’d like to say that you can only browse the Internet with Tor in a ‘read-only’ mode nowadays because many websites don’t allow account registrations through Tor.

The reason is that all Tor exit nodes IPs are public and immediately go to websites blacklists.

The only way to bypass Tor exit node bans from destination websites is to combine Tor with other tunnels such as VPN or proxy using a ISP -> Tor -> VPN/proxy -> website scheme. From my practice, many sites’ administrators don’t block VPN/proxy IPs as aggressively as they block Tor exit nodes IPs. VPN IPs are being blocked nowadays too, but proxy IPs are not being blocked as often as VPN/Tor exit nodes IPs.

The only way to use VPN/proxy anonymously in a leak-free manner is to configure them through Whonix.

In order to use this scheme safely, we need to have a separate browser for this. I’ve been playing with Firefox about:config settings for many years and I almost reached the same fingerprint as Tor Browser has (I checked fingerprint strings using AmIUnique dot org). But a huge work is still needed.

I would like Whonix developers to suggest to improve leak protection for ISP -> Tor -> VPN/proxy -> website scheme and also I would like to suggest to create a separate, Firefox based general-purposed browser for a Workstation which can be used specially for combining Tor with other tunnels (usually VPN or proxy).

Thank you for your understanding.

2

Check this out.

Quote:

One easy way to watch progress in action is to look at the open-source tests of web browser privacy provided by privacytests.org. You can see examples of how other browsers stack up against Tor Browser, and how many tools are coming closer to offering Tor Browser’s level of protection–but that there is still more to be done.

https://twitter.com/privacytests

In the past there was SecBrowser.

SecBrowser was a way to reconfigure Tor Browser so it could be used without Tor, i.e. using clearnet or a VPN.

Wow!

However, I don’t think that is sufficient. There are many browser tests.

Some browser test websites perform different types of tests. And then there’s also false positives.

Maybe your efforts would result in a bigger impact if you contributed to any of the privacy-focused browser projects?

3

I don’t promote to use ISP → Tor → VPN/proxy → website scheme without a real need!

If you are able to visit a destination website and CAN complete an account registration through Tor exit node IP, then you DON’T need to set up an additional VPN/proxy connection after Tor.

In general, there are two scenarios of Tor exit node IPs blocks by destination websites:

  1. Web-server (Apache/Nginx etc) level block by anti-spam system on a destination side: in this case you will not be able to visit a destination website through Tor at all. You will receive a notification from a destination web-server security system that your IP address (Tor exit node IP) is blocked and the destination webpage will not be loaded. In some cases, you cannot even see any messages from a destination website (the connection to it will be closed)
  2. Site-level (web-app level) block: in this case, you will be able to visit the destination website through Tor but won’t be able to proceed an account registration. Once you try to sign up a new account through Tor exit node IP on such kind of a website, your account will be immediately shadowbanned or suspended due to ‘suspicious activity’ detected.

In these two cases, the only way to visit a destination website and successfully proceed an account registration is to connect to VPN or proxy anonymously (ISP → Tor → VPN/proxy → website) in order to obtain an IP address which is not banned by a destination website security system. This is Whonix specific part because the only way to connect to proxy or a VPN anonymously in a leek-free manner is to use Whonix.

My advices for ISP → Tor → VPN/proxy → website scheme:

  1. Prefer to use proxies instead of VPNs. Many VPNs are paid so if you don’t have a mined cryptocurrency, you won’t be able to offer a VPN anonymously.
  2. Most of free of charge VPNs IPs are blacklisted in abusable IPs trackers because many VPNs IPs are not being changed for years
  3. Prefer to use SOCKS proxies instead of http(s) as http(s) proxies can contain x-forward option which can disclose Tor exit node IP (this will not lead to de-anonymization but this will make your usage of proxy more detectable)
  4. Before visiting a destination website which blocks Tor exit node IPs, obtain a list of open proxies
  5. Important: Use one proxy IP per one session!!! Do not use the same proxy IP for several websites.
  6. Every time you visit a destination website which blocks Tor exit node IPs, use a different proxy IP. This will decrease your fingerprint.

Browser-specific part. First of all, I turned on permanent private browsing mode in order to wipe all cookies and site data after Firefox is closed. Then I turned off Pocket, Firefox Account etc extensions through about:config. Then, I enabled the protection against fingerprinting:

support . mozilla . org/en-US/kb/firefox-protection-against-fingerprinting

Then, I disabled Firefox automatic connections to telemetry web-servers:

support . mozilla . org/en-US/kb/how-stop-firefox-making-automatic-connections

Finally, I disabled some features like client-side webpage caching (to reduce fingerprinting) and so on.

As I result, I got almost the same fingerprint (checked through AmIUnique dot org) as Tor Browser has.

I checked this scheme through several tests:

  1. Wireshark (on a host-side) - no leaks detected. Shows only Tor entry node IP
  2. IP / DNS leak test (on a proxy side, on the end of the circuit): depends on proxy you use. In some cases, DNS shows no leaks, in other cases, DNS server leaks Tor exit node IP which is located on a different circuit than a circuit you connect to proxy thanks to Stream Isolation! (monitored through Onion Circuits on a Gateway machine)
  3. Fingerprint tests: user-agent is the same as Tor Browser, timezone, screen size etc are almost the same as TBB (check the link above about Firefox resist fingerprinting)

Further development is still needed.