News Feed
- DrugHub has agreed to fully refund all users who lost money in the SuperMarket exit scam.
- Retro Market has gone offline. Circumstances of the closure unknown.
- SuperMarket has closed following an exit scam by one of the admins.
- The admin of Incognito Market, Pharoah, has been arrested by the FBI several months after exit scamming.
- Silk Road
- darknet markets list
- Popular P2P exchange LocalMonero has announced it is closing.
For other options, see post /post/f12b38fc9337bce6ae34
But I still have a question. Let's imagine that I use the default Tor bridge. Does my traffic still pass through three random servers (like it should be with Tor) and this Tor bridge is just an init point? Or the 3-servers rule doesn't work in this case?
For other options, see post /post/f12b38fc9337bce6ae34
You may also find this write up helpful: /post/1e03cc92f64e42c498fc
/u/DaVenom I appreciate you mentioned my post.
Actually this isn't true and information shouldn't be spread as such.
Though it says so in the Whonix documentation (whonix org/wiki/Bridges) which you've reposted, we shouldn't be taking everything at face value without verification. Correctly configured VPN will absolutely not show any activity within the VPN tunnel doesn't matter if Tor usage or not or if you're a state actor. Excluding cases where they would see the entire Internet then they can deduct but still not able to see directly within the tunnel itself.
To both you, OP /u/OnTheEggshells and /u/dread_dead_head I recommend reading the post /post/5f1ba84246ac7d2f386f
To add completeness to /u/DaVenom answer OP should too read comment /post/8714394170635447819a/#c-5c9547de6c55a598c6 discusses using bridges.
My intention was not to claim that Tor usage cannot be concealed by a VPN tunnel at all.
The research of the Whonix project* indicates that in certain cases and if certain adversaries are involved, it could be reasonable to assume that Tor usage could still be detected. We operate in an area where often no absolutely secure statements can be made. I suggest caution by considering multiple possible outcomes. This led to my mitigating expression.
Everyone should conduct their own research before making a decision about their setup.
*https://www.whonix.org/wiki/Tunnels/Introduction
I understand now what you meant. Perhaps you meant global rather than state actors? State would still have issue if you're utilizing OBFS4 bridge as explained in my original post such correctly configured bridges still work within China to escape the Great Firewall. Global on the other hand there are limited choices to bypass their view.
Global adversaries can certainly access more information and putting a VPN before or after Tor won't matter as such in a simplistic connection chain. Every situation is unique and I agree with you every person should do their own threat models as there isn't a one size fits all solution.
No one is talking about using Tor directly. Did you bother to read the post /post/5f1ba84246ac7d2f386f at all before commenting?
Very clearly states and I actually outlined it in bold red letters again for you.
To be able to view and detect Tor usage within a VPN tunnel you need to have broken the encapsulation beforehand. Present any research or proof of concept saying otherwise. While it may be easier to detect if you're visiting a website while using VPN (but not Tor) for some variety of factors, when using VPN then Tor to visit websites those factors become irrelevant due to the nature of onion routing.
I'll say it once more don't blindly read and repeat stuff without verifying it.
On the other hand thank you I didn't think we'd see another asfaleia moment as soon /u/DaVenom /u/Beelzebub /d/Dreadmoments stock going up.
My so called misinformation had a direct quote from the Tor project website. I'll digest it for you to be fed in baby steps.
[gitlab torproject org/legacy/trac/-/wikis/doc/TorPlusVPN#VPNSSHFingerprinting]
Did you notice the last sentence in big red enlarged text? No research papers on the topic.
DPI in properly encrypted encapsulated traffic can reveal many details? I've read it many times and the only solution I can say is to send your quote to /d/Dreadmoments for more stonks.
Do you understand what DPI is? How can DPI be in properly encrypted encapsulated (??) tunnel? For DPI systems to be able to read whats inside the VPN tunnel they must decrypt. You must be confusing it with corporate network systems whom in most cases are able to intercept most whitelisted connections and mostly because of CAs installed on devices.
You're making absolutely no sense but just being toxic for the sake of it. And making a fool out of yourself but based on your posts doesn't seem to be issue with you.
To begin with in what you referenced the word VPN is used only once and in passing. No research has been done on if you use a VPN.
Direct quote the linked research paper
Tor project has its own more detailed rebuttal against Website Traffic Fingerprinting Attacks take a look at blog torproject org/critique-website-traffic-fingerprinting-attacks/
Nowadays Tor not only has Tor Browser to minimize (not eliminate completely) the risk of specific website visits being fingerprinted but also Connection and Circuit level padding. They help against DPI in the beginning of the connection.
We've talked so far about Tor connections. My post /post/5f1ba84246ac7d2f386f actually deals with OBFS4 and detecting Tor connections from one of the best tools in world to do so Great Firewall of China. Adding OBFS4 bridge adds additional complexity for DPI systems on local level against Website Traffic Fingerprinting attacks as I've explained in there including options like IAT mode.
Now add all of that under a mathematically sound and well configured VPN. You can see the level of layered security in the manner. To claim you're able to break that chain and see end websites is absurd to say the least. For completeness sake I'll reiterate again going through VPN and then Tor isn't always the smartest choice from global adversaries but where you don't have a choice (China, Iran) it certainly isn't a bad choice.
You're able to break the VPN tunnel and then OBFS4 bridge, then magically view through the onion routing and finally tell us what websites are being visited? Prove it. Everyone always big fluff talk but no proof.
I believe this should be clear enough. Now son buy yourself a penis pump for that confidence and attitude and while you're at it ask your Dad how to respectfully talk to people.
1. warning
2. flair of shame
3. exit node
I need an escalator emoji
Ascii is better
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣀⣀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢰⣿⣿⣷⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⢿⣿⠏⠀⠀⠀⠀⠀⣠⣾⣿⣿⣿⣿⣿⣿⣿⡇⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢠⣤⣤⣄⠀⠀⠀⣠⣾⣿⣿⣿⣿⣿⣿⣿⣿⣿⡇⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣼⣿⣿⣿⠀⣠⣾⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡇⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣿⣿⠟⣡⣾⣿⣿⣿⣿⣿⣿⣿⣿⠟⠉⠉⠉⠉⠁⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠛⣡⣾⣿⣿⣿⣿⣿⣿⣿⣿⠟⠁⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⣾⣿⣿⣿⣿⣿⣿⣿⣿⠟⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⣠⣾⣿⣿⣿⣿⣿⣿⣿⣿⠟⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⢠⣤⣤⣤⣤⣾⣿⣿⣿⣿⣿⣿⣿⣿⠟⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠟⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⠟⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠸⠿⠿⠿⠿⠿⠿⠿⠟⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
Not as majestic as /u/Beelzebub one but this you can put on flairs as one liner.