Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
Cellphones Privacy Your Rights Online

Anonymous Browsing On Android Phones Using Tor 109

Posted by Soulskill
from the privacy-on-the-move dept.
ruphus13 writes "Privacy is becoming a scarce commodity, especially with geo-aware phones. Now, Android phone users can browse anonymously using Tor — a capability, until now, limited to the desktop. From the post: 'We have successfully ported the native C Tor app to Android and built an Android application bundle that installs, runs and provides the glue needed to make it useful to end users. Secure, anonymous access to the web via Tor on Android is now a reality,' writes Guardian Project team member Nathan Freitas. The Tor 0.2.2.6-alpha release uses toolchain wrapper scripts to run Tor without requiring root access."
This discussion has been archived. No new comments can be posted.

Anonymous Browsing On Android Phones Using Tor

Comments Filter:
  • !secure (Score:5, Informative)

    by sopssa (1498795) * <sopssa@email.com> on Sunday October 25, 2009 @09:43AM (#29864529) Journal

    Secure, anonymous access to the web via Tor on Android is now a reality

    People should really stop using the word secure with Tor. Anonymous, sure, but you actually forfeit some of your security and privacy when using Tor. Anyone can snoop your outgoing connections from Exit node, or if you're using https or other secure connection, change the certificates. On top of that there's a change the exit node changes your http pages in addition to stealing or just snooping for information. Implying "secure" in news likes this gives lots of false sense of security to users, like has been seen many times before.

    Eavesdropping by exit nodes

    In September 2007, Dan Egerstad, a Swedish security consultant, revealed that by operating and monitoring Tor exit nodes he had intercepted usernames and passwords for a large number of email accounts.[15] [wired.com] As Tor does not, and by design cannot, encrypt the traffic between an exit node and the target server, any exit node is in a position to capture any traffic passing through it which does not use end-to-end encryption, e.g. SSL. While this does not inherently violate the anonymity of the source, it affords added opportunities for data interception by self-selected third parties, greatly increasing the risk of exposure of sensitive data by users who are careless or who mistake Tor's anonymity for security.[16] [securityfocus.com]

    Another thing is that you are still usually leaking DNS queries to your ISP, which may even return false results if you're being censored in China or something and they still see what sites you're visiting.

    The summary also quickly mentions geo-aware phones. If you happen to be using that bad exit node, now your geo-location updates will be transmitted via it too. And goverments should be able to set up a lot different exit nodes all around the world easily.

    So no, it's not secure. It's maybe anonymous, if you use it correctly and don't login to your banking, slashdot account or whatever with it.

    • Re: (Score:3, Insightful)

      TL;DR : only use Tor if you know what the hell you are doing.

      • TL;DR : use Tor for what it was ment to do.

        40 4

      • TL;DR : only use Tor if you know what the hell you are doing.

        I don't have a problem with multi-sentence posts. But Tor, while a laudable and useful idea, has its limitations with mobile devices...

        ...the main one being that someone can whack you over the head in the street, taking your phone, and your security is gone with last year's business management theories.
      • Re: (Score:1, Redundant)

        by _Sprocket_ (42527)

        TL;DR : only use Tor if you know what the hell you are doing.

        The Devil's in the details here and the OP provided sufficient details. Your summery doesn't. And furthermore, the "TL;DNR" meme is yet another example of willful ignorance in snarky packaging.

        • The Devil's in the details here and the OP provided sufficient details. Your summery doesn't. And furthermore, the "TL;DNR" meme is yet another example of willful ignorance in snarky packaging.

          Relax guy. I was only trying to humourously point out that if you wan't to use programs like Tor you have to know about the details (like the OP) otherwise you're actually making things worse. Which excludes most of the population, who will probably understand more of my summary than of the OP's post. You can remove the rod from your backside now.

          • by _Sprocket_ (42527)

            I understand the attempt at humor. However, your "summary" doesn't point out that you need to know the details. Someone may think they "know what they hell [the're] doing" simply because they know how to use TOR or even the basics of how TOR works. But without understanding the ramifications that the OP pointed out, they fall in to the same danger.

            Yes - your "summary" is nice and easy to digest and I'm sure there's a lot of people who understand it (or at least, THINK they understand it) better than the

            • Re: (Score:2, Informative)

              by Anonymous Coward

              The count attacks got it wrong. Tor works in combination with privoxy and that routes DNS requests over Tor to avoid letting your ISP know what sites you are surfing. Stop spreading this FUD. Certainly users need to be educated about these issues- and not all will understand the implications. The problem is people here don't seem to understand Tor either and make false or missleading statments about it.

              • by _Sprocket_ (42527)

                I'm not sure why you're responding to me. Nothing that I said, nor the OP for that matter, made any mention of DNS - proxied or otherwise. The OP's link talks about a malicious exit node sniffing and analyzing traffic it handles. Hiding your DNS lookups from your ISP doesn't enter in to it. And large-scale count-correlation attacks tend to be a bit more involved than matching DNS lookups to traffic (which is the only thing I could imagine being remotely relevant).

                As a side note - congratulations on gett

        • Re: (Score:1, Offtopic)

          by Toonol (1057698)
          And furthermore, the "TL;DNR" meme is yet another example of willful ignorance in snarky packaging.

          Agreed. It's aggressive idiocy, like the rephrased quoting with "FIXED IT FOR YOU" meme.
          • And furthermore, the "TL;DNR" meme is yet another example of willful ignorance in snarky packaging.

            Agreed. It's aggressive idiocy, like the rephrased quoting with "FIXED IT FOR YOU" meme.

            There, I fixed that for you.

      • TL;DR : only use Tor if you know what the hell you are doing.

        I think his point was that people who know what the hell they're doing DON'T use Tor. Tor is a solution for the rest of the users who don't get freenet, or don't care enough to wait on freenet. In those roles, I think it's pretty good.

      • TL;DR : Read the manual before using Tor. It explains all of this.
    • I'm not sure I understand this. How is monitoring an exit node different from monitoring any node on the internet? Can't I just intercept usernames and passwords at any node? Or are you saying that TOR exit nodes are just a more popular target, because they route more? I'm puzzled by what you are saying. :-/
      • by sopssa (1498795) *

        In Tor network the traffic is routed encrypted like you->middle node->middle node->exit node. But since protocols like http, ftp, irc and many im networks dont support encryption, the exit node will always be able to monitor traffic. And those exit node's can be set up by anyone.

        • Re: (Score:3, Informative)

          by Arancaytar (966377)

          Right in principle, but it's fortunately not as bad as you think.

          SSL is a transparent layer on top of TCP, which means any protocol can be tunneled through it, including HTTP and IRC. (Though for FTP, you'd tunnel through SSH instead.) Admittedly, few IRC networks support SSL at present, but that will hopefully change. Freenode says they're working on it. Either way, IRC traffic is generally semi-public and the most sensitive stuff is your NickServ password (enabling exit nodes to impersonate random people

          • by cbhacking (979169)

            I'd like to quickly expand on the Off-The-Record reference; OTR is a feature that uses end-to-end encryption of instant messenger conversations. It's available as a plug-in for Pidgin (on Windows or *nix) and is built into Adium (on Mac). If you're even slightly concerned about your conversations getting snooped on, you should use it. I believe it uses asymmetric crypto to exchange a shared key that is unique to each conversation. Validating the public key of your friends will provide authentication and pro

      • I run an exit node, as can anyone. If I were sufficiently nosy, I could use Wireshark et al to listen in.

        It would be impossible to target or identify a specific person due to the randomized infrastructure, but phishing for non-SSL access to random online accounts is very possible.

        That's why you don't want to use Tor to log in anywhere that doesn't use SSL.

      • by _Sprocket_ (42527)

        It's an issue of opportunity. If you want to sniff traffic, you have to put yourself in to a position to do so. Either you work for a large enough network that gives you access to the appropriate devices, convince those network owners that they should provide you with information, insert your own devices in someone else's network, or you build your own network large enough for sufficient targets. Setting up an exit node allows you to slip in your own device in a large network with very little cost.

    • Re: (Score:3, Informative)

      by tolan-b (230077)

      > or if you're using https or other secure
      > connection, change the certificates.

      Am I missing something here? I know about Tor MITM attacks from exit nodes, but how are they supposed to fake a cert? Seeing as proper certificates 'guarantee' identity as well as encryption.

      Assuming they're not using that null in the name string attack. But let's assume they're using a secure browser to begin with :)

      • by sopssa (1498795) *

        Just create self-signed certificate in the middle. It probably wouldn't work for people who always checks the certificate and it's validity, but I can bet there's enough stupid people who just click "OK, continue anyway".

        • by schon (31600)

          So in other words, it's no more or less secure, and you were just blowing smoke?

          • It's about opportunity. Any attack that your ISP can perform on a normal connection, a random Tor exit node operator can perform over Tor. It's up to you to decide whether you can trust your ISP more or less than a Tor exit node operator. If you live, for example, in Iran then you possibly can't, but if you live in most of the western world then you probably can.
        • by tolan-b (230077)

          Latest FF and IE at least make a *huge* fuss about self-signed certs, you have to do something like 3 clicks, including waits, plastered with big warnings.

    • Re: (Score:2, Informative)

      by Anonymous Coward

      THANK YOU!

      Tor is only secure for doing anonymous things.
      The instant you login to anything, you are really risking giving up that information and breaking the point of the system in the first place.
      The creator really needs to put this in as a warning in big red letters.

    • Another thing is that you are still usually leaking DNS queries to your ISP, which may even return false results if you're being censored in China or something and they still see what sites you're visiting.

      any traffic passing through it which does not use end-to-end encryption, e.g. SSL.

      Well, like any other security/anonymity tool it only works for users who know their stuff and use it carefully. Don't access sensitive information without end-to-end encryption, and for heaven's sake make sure DNS queries ar

    • by joaobranco (55662)

      Another thing is that you are still usually leaking DNS queries to your ISP, which may even return false results if you're being censored in China or something and they still see what sites you're visiting.

      I believe you don't leak DNS queries if you use tor like a SOCKS proxy (therefore proxying the DNS queries). Although the exit note could mess with your DNS queries if you do so (a hard security trade-off, to be sure).

    • Re: (Score:3, Informative)

      by 56 (527333)
      The problem for me is that the actual android phone itself is logged into google! Doesn't that make it insecure by their very nature?

      I have an HTC Magic/G2, and I've often been concerned about this when connecting to an open wifi ap. I only use wifi, so the fact that my cell phone company can see my usage over 3g is a non-issue (canceled my data plan when the free trial ran out). But it seems to me that my google password is probably not well protected from whoever owns the ap I'm connecting to.

      I just dow

    • by skeeto (1138903)

      and don't login to your banking

      Online banking uses https, so it's safe to do over Tor (though pointless anyway). Just don't ignore any self-signed certificate warnings.

    • >>Secure, anonymous access to the web via Tor on Android is now a reality
      >
      >People should really stop using the word secure with Tor. Anonymous, sure

      Not even anonymous in some situations!
      Let's think about China: they control the network so they can easily know *who* is using Tor (by monitor Tor's access gateways) and even though they don't know what you're doing with Tor, they know that you're trying to bypass the filtering..
      Now it depends on the number of Tor users, if they are numerous, you're

    • People should really stop using the word secure with Tor. Anonymous, sure, but you actually forfeit some of your security and privacy when using Tor. Anyone can snoop your outgoing connections from Exit node, or if you're using https or other secure connection, change the certificates. On top of that there's a change the exit node changes your http pages in addition to stealing or just snooping for information. Implying "secure" in news likes this gives lots of false sense of security to users, like has been seen many times before.

      And this is different from regular web browsing....how, exactly? You're not forteiting any of your security or privacy. You're just not necessarily gaining any more in certain areas. But, this only applies if the exit node you happen to be using for that connection is a malicious node. Yes, governments can set up an awful lot of nodes, but the size of the network itself is going to dwarf anything a government can do. The vast majority of exit nodes are legitimate.
      You can also specify not to use certain

  • by Presto Vivace (882157) <marshall@prestovivace.biz> on Sunday October 25, 2009 @09:45AM (#29864539) Homepage Journal
    The company who figures out how to protect our privacy while using all the cool gadgets and online tools is going to make a boat load of money.
    • by CharlyFoxtrot (1607527) on Sunday October 25, 2009 @09:50AM (#29864567)

      The company who figures out how to protect our privacy while using all the cool gadgets and online tools is going to make a boat load of money.

      Because you know these days we need companies to do what the governments should be doing.

      • Re: (Score:1, Troll)

        by sopssa (1498795) *

        So goverment should disallow "all the cool gadgets and online tools" so stupid people who dont know how to use them can maintain their privacy?

        • So goverment should disallow "all the cool gadgets and online tools" so stupid people who dont know how to use them can maintain their privacy?

          No, they should regulate the companies based in their countries to respect people's privacy. Mind blowing concept, huh ? The EU actually has made some progress [wikipedia.org] towards this but not enough.

          The whole reason we have this representative government thing is to make sure the rights of the many aren't violated for the good of a few. It'd be nice if governments grew a pair and started doing their job.

          • by TheLink (130905)
            > It'd be nice if governments grew a pair and started doing their job.

            It'd be nice if voters grew some brains and started doing their jobs too.

            Hopefully the US people get lucky with Obama...
    • In most of the "cool gadgets" cases, the problem is a security/convenience trade-off. You wouldn't be using them for entertainment if they were inconvenient enough to guarantee privacy.

      However, in other respects you have a point - political dissenters are still using Facebook and Twitter to organize (eg. in Iran), and these users have to be provided either with a secure if inconvenient way to use them, or with a better (if inconvenient) alternative.

      • but what if you could make it convenient to protect your privacy? People might even pay money for that.
        • That would be wonderful.

          I'm skeptical that it can be done, though. As Bruce Schneier says, security is a state of mind. Cryptographic technology and security protocols are now so advanced that the most significant vulnerability is the user.

          For example, SSL's CA implementations may have had (and still have) a few nasty technical holes, but the easiest way to stage a MITM attack is probably to simply self-sign your fake certificate and trust that the user will scroll past the "WARNING WARNING DO NOT IGNORE TH

    • Are you kidding me? Perhaps for the /. crowd, but what about the average Facebook wielding user? Almost every "application" on the site states that you are forsaking your own privacy and that of your "friends." Those requirements don't stop many from agreeing to the terms of use. The average user doesn't even think of privacy.
    • Companies are already making too much money abusing our lack of privacy. Why stop now?
      • Re: (Score:3, Funny)

        by Presto Vivace (882157)
        the more companies that make money by abusing our privacy, the more demand there is for privacy tools. The company which solves this problem will make a boat load of money.
        • > the more companies that make money by abusing our privacy, the more demand
          > there is for privacy tools.

          Oh you mean like the business model of the anti-virus industry? :-)

  • ....respect your anonymity while making you feel so much more secure... just like car alarms, free buffets in Vegas, and condoms.
  • You must still assume that the Tor nodes you are using are not hacked NSA or Chinese intelligence agency nodes, with a nice 'log traffic to disk' function added. If you really care, you need something like Opportunistic Encryption.

    • Re: (Score:3, Funny)

      by poofmeisterp (650750)

      You must still assume that the Tor nodes you are using are not hacked NSA or Chinese intelligence agency nodes, with a nice 'log traffic to disk' function added. If you really care, you need something like Opportunistic Encryption.

      So you shouldn't use it if you don't want to be a Tor-get of investigation? :>

    • If you have data that's so important that you don't want the Chinese or NSA looking at it, send it by snail mail on a disk!
      • If you have data that's so important that you don't want the Chinese or NSA looking at it, send it by snail mail on a disk!

        Too easily intercepted. The only way to keep it secure is to whisper it in someone's ear on a lonely beach. Time was when crowded streets and shopping malls might have been good, but there seem to be cameras everywhere these days...

        When I was a kid, Mr Blair's "1984" seemed a little improbable. Now it's just old hat.
        • by sopssa (1498795) *

          Too easily intercepted. The only way to keep it secure is to whisper it in someone's ear on a lonely beach.

          Until you realize that there's a guy listening to your conversation under you in the sand.

        • If you have data that's so important that you don't want the Chinese or NSA looking at it, send it by snail mail on a disk!

          Too easily intercepted. The only way to keep it secure is to whisper it in someone's ear on a lonely beach. Time was when crowded streets and shopping malls might have been good, but there seem to be cameras everywhere these days...

          When I was a kid, Mr Blair's "1984" seemed a little improbable. Now it's just old hat.

          Why not just encrypt the disk? Are you worried about the two generals problem [wikipedia.org]?

    • No, use end-to-end encryption with either pre-shared keys or keys signed by a mutually trusted party in addition to Tor. Don't just use Tor by itself and expect it all to be happy and magic.
    • by arevos (659374) on Sunday October 25, 2009 @03:59PM (#29867101) Homepage

      You must still assume that the Tor nodes you are using are not hacked NSA or Chinese intelligence agency nodes, with a nice 'log traffic to disk' function added.

      Tor is a service for browsing anonymously, not securely. Security is handled by SSL.

      • by HTH NE1 (675604)

        Anonymity and security are generally incompatible concepts. I.e. to be anonymous you have to be anybody, but to be secure you have to be someone in particular.

        And if you OK with being identified, then the only thing you have that remains secret in Tor is your locality. So logging in somewhere with something that is geo-aware and thus can leak your location over Tor is especially foolish (like logging into your pedophile-ring's server and uploading live the geo-tagged video you're making with your cellphone'

        • by arevos (659374)

          Anonymity and security are generally incompatible concepts. I.e. to be anonymous you have to be anybody, but to be secure you have to be someone in particular.

          No you don't. You're confusing security with authentication.

    • Re: (Score:3, Interesting)

      by AHuxley (892839)
      not hacked NSA?
      The NSA could set up front companies ie telcos or cut out political rights groups, students, uni profs boxes and just connect the dots in the USA.
      As the NSA is every telco, ips in the USA, getting a entry IP and tracing back to the exit ect. is not hard with their budget.
      As the NSA now faces inward, TOR in the USA is now another fun computer project at best.
      Sneaker net people or meet and greet with an understanding of one-time pads :)
      • > Sneaker net people or meet and greet with an understanding of one-time pads :)

        I am still hoping for some bright person to come up with public key encryption that does not involve a computer and its math power, but can be done with pencil and paper...

  • I'm sure cell companies will be thrilled to hear this, with Tor and other onion routing systems using several times the bandwidth of a typical direct connection.
    • by sopssa (1498795) *

      I'm pretty sure they dont really care, this isn't going to be in that widespread use anyway.

  • by zoloto (586738) on Sunday October 25, 2009 @10:43AM (#29864869)
    I use TOR mostly for browsing .onion sites, inaccessible without it. Also, if you set up your connection/system properly, you *can* browse anonymously. The idea is that your ISP and external website (and exit node) can't identify who you are. This is a VERY good thing. I would, however, not log into any service that could identify me as "me" online through tor. Ever.

    As a personal opinion, many of the .onion services (forums etc) are more interesting than what's on the rest of the public internet anyways. It's amusing and interesting to see what people have to say on forums when they are really able to be anonymous (trolling aside).
    • > It's amusing and interesting to see what people have to say on forums when
      > they are really able to be anonymous (trolling aside).

      I CAN HAZ CHEEZBURGER?!

  • Um, I'm actually quite sure that the cellphone companies can still track your surfing based on your phone number, chip, and hardware. If you mean anonymous browsing via wifi, that might be a different story.
  • Wonderful, now we can route our already-pokey 3G connections through a whole bunch of nodes to make them feel like old 2G connections.

    Is retro back in style?

    • by Tumbleweed (3706)

      Wonderful, now we can route our already-pokey 3G connections through a whole bunch of nodes to make them feel like old 2G connections.

      Is retro back in style?

      I just spoke with kibo; he says yes.

    • Not to mention the localization issues. The one time I used tor, loading up google gave me a brief scare when it appeared in Cyrillic. For a split second I though I had somehow accessed some secret KGB google.

      Subsequent split seconds were spent laughing at that first though.

  • As an iPhone user I prefer just using the built-in L2TP over IPSec. Surely the android phones can do the same thing.
    • That doesn't do the same thing. It actually does something more useful; preventing the owner of the random WiFi hotspot you're using from snooping on your traffic. Tor, on the other hand, prevents the remote site identifying you. If you connect to Slashdot, for example, through Tor then you will connect to a Tor peer and it may then relay your connection via other Tor peers, and eventually it will be bounced out and Slashdot will think your connection comes from a random Tor exit node. In theory, the To
    • by fustar (593000)
      Both LT2P and IPSEC (preshared and certificate) are supported by the OS
  • Tor is useless. It's a neat idea but doesn't work in practice due to bandwidth problems. Every time I have tried it, connections almost always time out without receiving data. The few times I do receive data it can take minutes for a web page to appear, say nothing of the images which would still need to load.

    • So help the project. Write some code that speeds it up a little. Fix bugs in the source tree. Run a middleman (or better yet, exit) node with a decent allocation of bandwidth. Rent a VM someplace and run a Tor node. Advocate for the project to get more people to run middleman and exit nodes.
  • Speed (Score:4, Funny)

    by YourExperiment (1081089) on Sunday October 25, 2009 @02:58PM (#29866733)
    Tor is a wonderful piece of software, but browsing with it can be somewhat slow at times. Mobile internet is also a great invention, but can be frustratingly slow. Thank heavens that no-one is proposing using these two technologies in combination!
  • What the heck happend here ? .. there was a story on Tor, and then a story about AT&T and somehow the Tor replies are in here ?
  • May we have an iphone version of it plz...

Loose bits sink chips.

Working...