{"action":"created","issue":{"url":"https://api.github.com/repos/privacytoolsIO/privacytools.io/issues/296","repository_url":"https://api.github.com/repos/privacytoolsIO/privacytools.io","labels_url":"https://api.github.com/repos/privacytoolsIO/privacytools.io/issues/296/labels{/name}","comments_url":"https://api.github.com/repos/privacytoolsIO/privacytools.io/issues/296/comments","events_url":"https://api.github.com/repos/privacytoolsIO/privacytools.io/issues/296/events","html_url":"https://github.com/privacytoolsIO/privacytools.io/issues/296","id":244510007,"number":296,"title":"Remove the Tor Browser from the recommendations because it's a security catastrophy and puts people at risk","user":{"login":"ghost","id":10137,"avatar_url":"https://avatars3.githubusercontent.com/u/10137?v=4","gravatar_id":"","url":"https://api.github.com/users/ghost","html_url":"https://github.com/ghost","followers_url":"https://api.github.com/users/ghost/followers","following_url":"https://api.github.com/users/ghost/following{/other_user}","gists_url":"https://api.github.com/users/ghost/gists{/gist_id}","starred_url":"https://api.github.com/users/ghost/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ghost/subscriptions","organizations_url":"https://api.github.com/users/ghost/orgs","repos_url":"https://api.github.com/users/ghost/repos","events_url":"https://api.github.com/users/ghost/events{/privacy}","received_events_url":"https://api.github.com/users/ghost/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":{"login":"Shifterovich","id":4354706,"avatar_url":"https://avatars1.githubusercontent.com/u/4354706?v=4","gravatar_id":"","url":"https://api.github.com/users/Shifterovich","html_url":"https://github.com/Shifterovich","followers_url":"https://api.github.com/users/Shifterovich/followers","following_url":"https://api.github.com/users/Shifterovich/following{/other_user}","gists_url":"https://api.github.com/users/Shifterovich/gists{/gist_id}","starred_url":"https://api.github.com/users/Shifterovich/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Shifterovich/subscriptions","organizations_url":"https://api.github.com/users/Shifterovich/orgs","repos_url":"https://api.github.com/users/Shifterovich/repos","events_url":"https://api.github.com/users/Shifterovich/events{/privacy}","received_events_url":"https://api.github.com/users/Shifterovich/received_events","type":"User","site_admin":false},"assignees":[{"login":"Shifterovich","id":4354706,"avatar_url":"https://avatars1.githubusercontent.com/u/4354706?v=4","gravatar_id":"","url":"https://api.github.com/users/Shifterovich","html_url":"https://github.com/Shifterovich","followers_url":"https://api.github.com/users/Shifterovich/followers","following_url":"https://api.github.com/users/Shifterovich/following{/other_user}","gists_url":"https://api.github.com/users/Shifterovich/gists{/gist_id}","starred_url":"https://api.github.com/users/Shifterovich/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Shifterovich/subscriptions","organizations_url":"https://api.github.com/users/Shifterovich/orgs","repos_url":"https://api.github.com/users/Shifterovich/repos","events_url":"https://api.github.com/users/Shifterovich/events{/privacy}","received_events_url":"https://api.github.com/users/Shifterovich/received_events","type":"User","site_admin":false},{"login":"bakku","id":9559624,"avatar_url":"https://avatars3.githubusercontent.com/u/9559624?v=4","gravatar_id":"","url":"https://api.github.com/users/bakku","html_url":"https://github.com/bakku","followers_url":"https://api.github.com/users/bakku/followers","following_url":"https://api.github.com/users/bakku/following{/other_user}","gists_url":"https://api.github.com/users/bakku/gists{/gist_id}","starred_url":"https://api.github.com/users/bakku/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bakku/subscriptions","organizations_url":"https://api.github.com/users/bakku/orgs","repos_url":"https://api.github.com/users/bakku/repos","events_url":"https://api.github.com/users/bakku/events{/privacy}","received_events_url":"https://api.github.com/users/bakku/received_events","type":"User","site_admin":false},{"login":"privacytoolsIO","id":11730911,"avatar_url":"https://avatars1.githubusercontent.com/u/11730911?v=4","gravatar_id":"","url":"https://api.github.com/users/privacytoolsIO","html_url":"https://github.com/privacytoolsIO","followers_url":"https://api.github.com/users/privacytoolsIO/followers","following_url":"https://api.github.com/users/privacytoolsIO/following{/other_user}","gists_url":"https://api.github.com/users/privacytoolsIO/gists{/gist_id}","starred_url":"https://api.github.com/users/privacytoolsIO/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/privacytoolsIO/subscriptions","organizations_url":"https://api.github.com/users/privacytoolsIO/orgs","repos_url":"https://api.github.com/users/privacytoolsIO/repos","events_url":"https://api.github.com/users/privacytoolsIO/events{/privacy}","received_events_url":"https://api.github.com/users/privacytoolsIO/received_events","type":"User","site_admin":false},{"login":"kewde","id":13770485,"avatar_url":"https://avatars0.githubusercontent.com/u/13770485?v=4","gravatar_id":"","url":"https://api.github.com/users/kewde","html_url":"https://github.com/kewde","followers_url":"https://api.github.com/users/kewde/followers","following_url":"https://api.github.com/users/kewde/following{/other_user}","gists_url":"https://api.github.com/users/kewde/gists{/gist_id}","starred_url":"https://api.github.com/users/kewde/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kewde/subscriptions","organizations_url":"https://api.github.com/users/kewde/orgs","repos_url":"https://api.github.com/users/kewde/repos","events_url":"https://api.github.com/users/kewde/events{/privacy}","received_events_url":"https://api.github.com/users/kewde/received_events","type":"User","site_admin":false}],"milestone":null,"comments":46,"created_at":"2017-07-20T22:04:40Z","updated_at":"2017-08-18T20:08:07Z","closed_at":"2017-08-17T11:49:56Z","body":"\r\n\r\n\r\n\r\nAnd before you laugh at me, here are some leading experts in infosec, cryptography, ... advising against it because of its laughable security:\r\n\r\n@dguido [emphasis mine]\r\n\r\n> There’s a couple of issues. First off, the network itself can’t be trusted. It’s very easy for random people to set up what are called exit nodes. Those exit nodes are the routers in the Tor network that actually a lot of network traffic passes through.\r\n>\r\n> It’s an opportunity for somebody to sniff that traffic, to modify that traffic. In the past, there’s been many documented cases where this has happened. Almost every time you go looking, it’s easy for researchers to find what are called malicious exit nodes or basically a person that’s monitoring traffic through the Tor network and manipulating it.\r\n>\r\n> It’s span the gamut from state-sponsored attackers, like there’s been a Russia based APT group that was adding malware into people’s downloads. There have been individual hackers that have been sifting through data to find passwords that were going through it and unencrypted network communication.\r\n>\r\n> Even WikiLeaks, when it first started, the original document set that WikiLeaks put on the Internet were documents they collected by running a Tor exit node. The network itself, no matter how you access it, is hostile. You should assume that when you’re sending traffic in the Tor network, that there’s somebody that’s looking at it.\r\n>\r\n> That’s different because I can sit down and I can run a Tor exit node. I can offer to the Tor Foundation, like, “Hey, I have, you know, a box of co-lo and I’d be happy to let you pump like 10 megabits per second of traffic through it. Here’s what you need to hook me up. Go ahead and send some traffic.”\r\n>\r\n> I can do that and I can get access to tens of thousands of people’s network traffic that way. What I can’t do is I can’t call up Verizon and say, “Hey, can you route customer x, y, z’s Web browsing through my machine now?” I would have to break into Verizon to do that.\r\n>\r\n> You actually put yourself at more risk and a greater likelihood that you’re being surveilled by going through Tor than if you just stick on your regular home ISP. That’s the case for most people that are using Tor.\r\n>\r\n> **Then there is a problem of accessing the Tor network. The software that most people use to access the Tor network is the worst, most insecure set of browser components available.** ***I’m talking about the Tor browser bundle. It is an out-of-date version of Firefox that lacks proper exploit mitigation like sandboxing, that has a unique network signature that a network owner can detect.***\r\n>\r\n> **It makes you stick out like a sore thumb.** ***It’s also because it’s out-of-date and because it’s easy to exploit,*** **people do exploit it. If you’re browsing the Internet through the Tor browser, it is easier for people to write exploits that break into your computer when you use that,** ***as compared to using the latest version of Chrome or the latest version of Internet Explorer.***\r\n>\r\n> **Not only that, but it also creates a model culture. Everybody uses the same copy of the Tor browser bundle, means that I only need to write one exploit, instead of writing maybe 10 or more than that.** I know that all the sketchy people on the Internet are using the Tor browser bundle, so I just need one exploit to get them all.\r\n\r\nhttps://georgianpartners.com/the-problem-with-the-tor-network-and-commercial-vpns/\r\n\r\n\r\n> \"Tor Browser is an abomination.\" All the audits in the world won't fix something that's broken by design. https://news.ycombinator.com/item?id=8468442 \r\n\r\nhttps://twitter.com/dguido/status/523238566294732800\r\n\r\n> Read the Tor design doc and ctrl+f for “does not.” Many pushing for use cases that don’t make sense.\r\n\r\nhttps://twitter.com/dguido/status/494571338821279744\r\n\r\n> Tor levels the playing ground for bad actors. Anyone can intercept your traffic and no one uses a browser sandbox.\r\n\r\nhttps://twitter.com/dguido/status/844196671747776514\r\n\r\n> for a multitude of reasons, it is trivial for network administrators to separate Tor traffic from non-Tor traffic.\r\n\r\nhttps://twitter.com/dguido/status/755102215795273728\r\n\r\n> Final thoughts: the Tor Browser Bundle is unable to protect those that need it most. If you rely on it, strongly reconsider your choices.\r\n\r\nhttps://twitter.com/dguido/status/803840526260797440\r\n\r\n> Consider the difficulty of running a Tor exit node that injects this exploit into every HTTP session. ¯\\_(ツ)_/¯\r\n\r\nhttps://twitter.com/dguido/status/803845309373808640\r\n\r\n@thegrugq\r\n\r\nHe has an article on the Tor Browser Bundle in his medium: https://medium.com/@thegrugq/tor-and-its-discontents-ef5164845908#.6gwjjg57l\r\n\r\n>\r\n> [Tor Browser Bundle] collapses state-level targeting of browsers to a small set of Firefox versions; TBB is the most risky browser you can possibly run\r\n>\r\n> — Thomas Ptacek \r\n\r\n@matthew_d_green\r\n\r\n> Tor browser\r\n>\r\n> ![](https://pbs.twimg.com/media/C4brIx8WcAEVRZi.jpg)\r\n\r\nhttps://twitter.com/matthew_d_green/status/830609724106276864\r\n\r\n@tqbf\r\n\r\n> # An extremely commonly held position among experts: Tor Browser is the least safe common browser.\r\n>\r\n> It’s built on Firefox’s design, not Chromes, so it’s inferior at an architectural level. BUT, WORSE:\r\n> \r\n>  Matthew Green‏ @matthew_d_green Feb 11\r\n>\r\n> Not to mention a slow rewrite/update schedule. Chrome rewrites kill 0days more reliably than @citizenlab.\r\n>\r\n> \r\n>\r\n> @attractr @bartongellman @matthew_d_green Worse than Safari?\r\n>\r\n> Thomas H. Ptáček‏ @tqbf Feb 13\r\n>\r\n> Yes, far worse.\r\n\r\n\r\n\r\nhttps://twitter.com/tqbf/status/830511154950766595\r\n\r\n\r\n\r\n\"An extremely commonly held position among experts: Tor Browser is the least safe common browser.\" was even retweeted by @rootkovska\r\n\r\n\r\nAnd even their defenses against exploits are utter complete fails, \r\n\r\n@halvarflake's presentation on exploit mitigation,\r\n\r\n![](https://pbs.twimg.com/media/DDFE5f_WsAAwEW_.jpg)\r\n\r\nImportant take-away: \"users may choose Tor Browser over better alternatives. Verdict: Near-zero or negative benefit\"\r\n\r\n\r\n\r\n# AS Thomas H. Ptáček‏ @tqbf SAID YOU'RE HURTING PEOPLE BY PUSHING THEM TO THE LEAST SECURE BROWSER IN THE MARKET.\r\n\r\nNOTE: I'm NOT arguing against using Tor (although @dguido makes very well thought arguments about making own VPN with AWS or DigitalOcean is far better), I'm arguing against using the abomination that is the Tor Browser.\r\n\r\nSOLUTION: Recommend Chrome with own made VPN (here's an easy guide that I recommend https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-that-works/ using Algo - which is better than Streisand - https://github.com/trailofbits/algo/)\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/privacytoolsIO/privacytools.io/issues/comments/323449319","html_url":"https://github.com/privacytoolsIO/privacytools.io/issues/296#issuecomment-323449319","issue_url":"https://api.github.com/repos/privacytoolsIO/privacytools.io/issues/296","id":323449319,"user":{"login":"Atavic","id":21977578,"avatar_url":"https://avatars3.githubusercontent.com/u/21977578?v=4","gravatar_id":"","url":"https://api.github.com/users/Atavic","html_url":"https://github.com/Atavic","followers_url":"https://api.github.com/users/Atavic/followers","following_url":"https://api.github.com/users/Atavic/following{/other_user}","gists_url":"https://api.github.com/users/Atavic/gists{/gist_id}","starred_url":"https://api.github.com/users/Atavic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Atavic/subscriptions","organizations_url":"https://api.github.com/users/Atavic/orgs","repos_url":"https://api.github.com/users/Atavic/repos","events_url":"https://api.github.com/users/Atavic/events{/privacy}","received_events_url":"https://api.github.com/users/Atavic/received_events","type":"User","site_admin":false},"created_at":"2017-08-18T20:08:07Z","updated_at":"2017-08-18T20:08:07Z","body":"Yes, for everyone (even Palestinians)."}}
{"actor":{"display_login":"Atavic"}}