From 9fb81a6fbf8dd277bb934b4a5e7cf6bc3763df5d Mon Sep 17 00:00:00 2001 From: Matt Pagan Date: Fri, 20 Dec 2013 00:42:12 +0000 Subject: [PATCH] Added three FAQ entries; fixed a typo. --- docs/en/faq.wml | 146 ++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 140 insertions(+), 6 deletions(-) diff --git a/docs/en/faq.wml b/docs/en/faq.wml index 9ca606e3..bbda3cab 100644 --- a/docs/en/faq.wml +++ b/docs/en/faq.wml @@ -90,6 +90,11 @@ tells been compromised.
  • My internet connection requires an HTTP or SOCKS Proxy
    • +
  • What should I do if I can't set a proxy + with my application?
    • +
  • I keep seeing + these warnings about SOCKS and DNS information leaks. Should I + worry?

    • Advanced Tor usage:

    @@ -180,6 +185,8 @@ relay. provide?
  • Can exit nodes eavesdrop on communications? Isn't that bad?
    • +
  • So I'm totally anonymous if I use + Tor?
  • What is Exit Enclaving?
  • Tell me about all the keys Tor uses.
    • @@ -1402,8 +1409,8 @@ recent logins and wondering if you actually logged in at those times.
    -

    My internet connection requires an HTTP - or SOCKS Proxy

    +

    My internet connection +requires an HTTP or SOCKS Proxy

    You can set Proxy IP address, port, and authentication information in @@ -1417,9 +1424,9 @@ if they're the same proxy.) Tor also recognizes the torrc options Socks4Proxy and Socks5Proxy.

    -Also check out HTTPProxyAuthenticator and HTTPSProxyAuthenticator if your -proxy requires auth. We only support basic auth currently, but if you need -NTLM authentication, you find this post in the archives useful.

    @@ -1431,6 +1438,70 @@ to restrict what ports your Tor will try to access.
    + +

    What should I do if I can't +set a proxy with my application?

    + +

    +On Unix, we recommend you give torsocks a try. +Alternative proxifying tools like socat and proxychains are also +available.

    +

    +The Windows way to force applications through Tor is less clear. Some tools have been proposed +, but we'd also like to see further testing done here. +

    + +
    + + +

    I +keep seeing these warnings about SOCKS and DNS information leaks. +Should I worry?

    +

    +The warning is: +

    +

    +Your application (using socks5 on port %d) is giving Tor only an IP address. Applications that do DNS resolves themselves may leak information. Consider using Socks4A (e.g. via Polipo or socat) instead. +

    +

    +If you are running Tor to get anonymity, and you are worried about an attacker who is even slightly clever, then yes, you should worry. Here's why. +

    +

    +The Problem. When your applications connect to servers on the Internet, they need to resolve hostnames that you can read (like www.torproject.org) into IP addresses that the Internet can use (like 209.237.230.66). To do this, your application sends a request to a DNS server, telling it the hostname it wants to resolve. The DNS server replies by telling your application the IP address. +

    +

    +Clearly, this is a bad idea if you plan to connect to the remote host anonymously: when your application sends the request to the DNS server, the DNS server (and anybody else who might be watching) can see what hostname you are asking for. Even if your application then uses Tor to connect to the IP anonymously, it will be pretty obvious that the user making the anonymous connection is probably the same person who made the DNS request. +

    +

    +Where SOCKS comes in. Your application uses the SOCKS protocol to connect to your local Tor client. There are 3 versions of SOCKS you are likely to run into: SOCKS 4 (which only uses IP addresses), SOCKS 5 (which usually uses IP addresses in practice), and SOCKS 4a (which uses hostnames). +

    +

    +When your application uses SOCKS 4 or SOCKS 5 to give Tor an IP address, Tor guesses that it 'probably' got the IP address non-anonymously from a DNS server. That's why it gives you a warning message: you probably aren't as anonymous as you think. +

    +

    +So what can I do? We describe a few solutions below. +

    + +

    + If you think that you applied one of the solutions properly but still experience DNS leaks please verify there is no third-party application using DNS independently of Tor. Please see the FAQ entry on whether you're really absolutely anonymous using Tor for some examples. +

    + +
    +

    I'm supposed to "edit my torrc". What does that mean?

    @@ -3085,8 +3156,71 @@ diversity,
    + +

    So I'm totally anonymous + if I use Tor?

    + +

    + No. +

    +

    + First, Tor protects the network communications. It separates where you + are from where you are going on the Internet. What content and data you + transmit over Tor is controlled by you. If you login to Google or + Facebook via Tor, the local ISP or network provider doesn't know you + are visiting Google or Facebook. Google and Facebook don't know where + you are in the world. However, since you have logged into their sites, + they know who you are. If you don't want to share information, you are + in control. +

    + +

    + Second, active content, such as Java, Javascript, Adobe Flash, Adobe + Shockwave, QuickTime, RealAudio, ActiveX controls, and VBScript, are + binary applications. These binary applications run as your user account + with your permissions in your operating system. This means these + applications can access anything that your user account can access. Some + of these technologies, such as Java and Adobe Flash for instance, run in + what is known as a virtual machine. This virtual machine may have the + ability to ignore your configured proxy settings, and therefore bypass + Tor and share information directly to other sites on the Internet. The + virtual machine may be able to store data, such as cookies, completely + separate from your browser or operating system data stores. Therefore, + these technologies must be disabled in your browser to use Tor safely. +

    +

    + That's where the Tor Browser + Bundle comes in. We produce a web browser that is preconfigured to + help you control the risks to your privacy and anonymity while browsing + the Internet. Not only are the above technologies disabled to prevent + identity leaks, the Tor Browser also includes browser extensions like + NoScript and Torbutton, as well as patches to the Firefox source + code. The full design of the Tor Browser can be read here. + In designing a safe, secure solution for browsing the web with Tor, + we've discovered that configuring any other browser for use with Tor is not safe. +

    + +

    + Alternatively, you may find a Live CD or USB operating system more to + your liking. The Tails team has created an entire bootable operating system + configured for anonymity and privacy on the Internet. +

    + +

    + Tor is a work in progress. There is still plenty of work + left to do for a strong, secure, and complete solution. +

    + +
    + -

    What is Exit Enclaving?

    +

    What is Exit Enclaving? +

    When a machine that runs a Tor relay also runs a public service, such as