Daily Archives: October 16, 2014

How to run all your Internet #39;s programs thru Tor Browser

By: Michael Bauermeister

More here:
How to run all your Internet's programs thru Tor Browser - Video

No tool in existence protects your anonymity on the Web better than the software Tor, which encrypts Internet traffic and bounces it through random computers around the world. But for guarding anything other than Web browsing, Tor has required a mixture of finicky technical setup and software tweaks. Now routingall your traffic through Tor may be as simple as putting a portable hardware condom on your ethernet cable.

Today a group of privacy-focused developers plans to launch a Kickstarter campaign for Anonabox. The $45 (28) open-source router automatically directs all data that connects to it by ethernet or Wifi through the Tor network, hiding the user's IP address and skirting censorship. It's also small enough to hide two in a pack of cigarettes. Anonabox's tiny size means users can carry the device with them anywhere, plugging it into an office ethernet cable to do sensitive work or in a cybercafe in China to evade the Great Firewall. The result, if Anonabox fulfils its security promises, is that it could become significantly easier to anonymise all your traffic with Tor -- not just Web browsing, but email, instant messaging, file sharing and all the other miscellaneous digital exhaust that your computer leaves behind online.

"Now all your programs, no matter what you do on your computer, are routed over the Tor network," says August Germar, one of the independent IT consultants who spent the last four years developing the Anonabox. He says it was built with the intention of making Tor easier to use not just for the software's Western fans, but for those who really need it more Internet-repressive regimes. "It was important to us that it be portable and small -- something you can easily conceal or even throw away if you have to get rid of it."

This has happened before Anonabox is by no means the first project to attempt to integrate Tor directly into a router. But Germar argues it will strike the best balance yet of cheapness, easy setup, size and security. Tor-in-a-box projects like Torouter and PORTAL, for instance, require the user to replace the software on a stock router. Another project called OnionPiis designed to be built one from a kit, and costs roughly twice as much as Anonabox.

In terms of consumer friendliness, the closest device yet to a plug-and-play Tor router has beenSafeplug, a $49 (31) variant on a Pogoplug router modified to route all traffic over Tor. But at more than twice the size, the Safeplug isn't nearly as portable as the Anonabox. And it's also been criticized for security flaws; Researchers at Princeton found in Septemberthat it didn't have any authentication on its settings page. That means a hacker could use a technique called a Cross-Site Request Forgery to trick a user into clicking on a link that would change the router's functions or turn off its Tor routing altogether. It also uses an outdated version of Tor, one that had been updated even before the device shipped last year.

Anonabox's security hasn't yet been audited for those sorts of flaws. But its creators point out that it will be entirely open source, so its code can be more easily scrutinised for errors and fixed if necessary.

The community is watching The non-profit Tor project itself is reserving judgment for now. But its executive director Andrew Lewman tells WIRED he's keeping an eye on the project, and that it "looks promising so far." Micah Lee, lead technologist for Glenn Greenwald's The Interceptand a frequent developer on Tor-related projects, says he's mostly encouraged by the idea. One of the potential vulnerabilities for Tor users, after all, is that a website they visit could run an exploit on their computer, installing malware that "phones home" to a server across a non-Tor connection to reveal their real IP address. "If you're using something like this, everything goes over Tor, so that can't happen," Lee says. "A Tor router can definitely have a big benefit in that there's physical isolation."

He nonetheless cautions that Anonabox alone won't fully protect a user's privacy. If you use the same browser for your anonymous and normal Internet activities, for instance, websites can use "browser fingerprinting" techniques like cookies to identify you. Lee suggests that even when routing traffic over Tor with Anonabox, users should use the Tor Browser, a hardened browser that avoids those fingerprinting techniques. (To avoid running their traffic through Tor twice and reducing bandwidth speeds to a crawl, he points to a setting in the Tor Browser called "transparent torification," which turns off the browser's own Tor routing.)

The Anonabox has been in the works since 2010, long enough that its developers have been able to evolve their own custom board as well as an injection-moulded case. That customisation, Germar says, means the tiny device still packs in 64 megabytes of storage and a 580 megahertz processor, easily enough to fit the Tor software and run it without any slowdowns.

Built for civil disobedience Germar says he and his friends began thinking about the possibility for the device around the time of the Arab Spring in late 2010 and early 2011. The Anonabox is ultimately intended for users in other countries where Tor's anti-censorship and privacy properties can help shield activists and journalists. It can be used in a cybercafe, for instance, where users can't easily install new software on computers. And it's capable of so-called "pluggable transports" -- extensions to Tor that often allow its traffic to better impersonate normal encrypted data.

Continue reading here:
This tiny box anonymises all your online actions

A new gadget with the potential to strike terror into the hearts of online marketers has just set off a crowdfunding frenzy on Kickstarter.

The Anonabox is a tiny, 2.4 inch by 1.6 inch router that aims to anonymize online activity by redirecting Ethernet and Wi-Fi traffic through the Tor network. It launched its fund-raising campaign on Sunday night with a sub-$50 price target and smashed through its $7,500 goalin less than six hours. It has raised nearly $500,000 at the time of writing.

The Tor network is a chain of computers (or nodes) that act as a relay for Internet traffic. When using Tor, requests from your PC are bounced through this network rather than accessing a website or service directly. This masks IP addresses and other information that could be used to discover your identity.

Anonabox isnt the first bit of Tor-enabled hardware weve seen. Last year, the Tor Project announced the Torouter Dreamplug but youll be lucky to get your hands on one. According to the Tor website, Dreamplug is still highly experimental and while seemingly functional, we have lots of bugs to iron out and features to implement.

Another option is the Safeplug, which retails for $49. It adds in ad-blocking software, but doesnt encrypt network traffic as the Anonabox promises to do. Its also a bit on the hefty side, being the same size as your typical home router.

Of course, you can always download the Tor browser itself, but that will only anonymize your browsing your Skype chats, email client and other software will still be unprotected.

At the moment, the Anonabox appears to have a unique value proposition. Its plug-and-play and fits inside a shirt pocket for easy portability between home and office. It can also be installed between a router and a modem to anonymize all devices that connect to the router.

But the project is also drawing some criticism. In an ask me anything session on Reddit with Anonabox developerAugust Germar, several members pointed to similarities between Anonabox and a $20 mini router being sold on AliExpress. Germar insisted that his design is original, but critics said his answers were vague and unconvincing. For now, the mini-controversy isnt stopping Anonabox from continuing to sign up Kickstarter backers at the rate of $10,000 per hour.

More:
Investors flock to tiny device that promises online anonymity