Privacy Wipe Apps ?
in [Freeware]
|
Prev: u-tube
Next: "Progress" [was: Scanner driver]
From: JB on 14 Jan 2010 06:00 whome? wrote: > Your ISP logs your IP and the IP of the Tor Destination point. The > ISP for the Tor connections also logs the Source and Destination IPs > of all the Tor connections. Doesn't matter. They can log all day long, and still not be privy to which encrypted data stream belongs to what user. > >If one believes TOR security, you can surf anonymously. > > Wrong. Tor is only a VPN between your pc and the Tor exit connection. > You only hide various sites beyond the Tor exit point from your ISP. > Nothing more. Wrong. Tor is absolutely nothing like a VPN. It's technically a SOCKS proxy. But regardless of what label you put on the system, because of the layers of encryption and sequential stripping thereof, true anonymity is achieved.
From: JB on 14 Jan 2010 06:38 hummingbird wrote: > 'Spamblk' wrote thus: > > >Forgive me for poking my nose in this with my 2 cents worth. AFAIK the > >Internet has still the basic architecture based on packet switching as set > >out years ago by persons such as Vint Cerf and Robert Kahn. So when you > >send out information to TOR (or whatever) your packets at the first stage > >go to your local network. > > Packets going from your Tor browser to your ISP are encrypted. You're confused. There's no such thing as a "Tor browser". Tor is essentially a distributed SOCKS proxy. Packets traveling from your browser to the instance of Tor you're using are *not* encrypted. This is basically meaningless in practice because in most cases your running instance of Tor is on the same machine as your browser or other "Torified" client, but it's not *always* the case. And if you don't get the basics straight you'll never be able to comprehend and deal with any of it.
From: JB on 14 Jan 2010 07:31 Spamblk wrote: > whome? wrote in news:tbfsk5905v3d3s8celq1t2h6vcj3edveus(a)4ax.com: > > > > > The Tor server has an IP. Your ISP logs your > > IP and the Tor IP. Once your packets hit the tor server, the > > encryption is removed, and the packets continue to your desired web > > site. The Tor server has an ISP like you and I do. The Tor ISP logs > > all its traffic, including the Tor exit packets. The only thing Tor > > does is make your traffic BLIND to your ISP only. Any cop can unmask > > you with minimal effort, especially in the UK. Tor is not worth the > > time. > > Forgive me for poking my nose in this with my 2 cents worth. AFAIK the > Internet has still the basic architecture based on packet switching as set > out years ago by persons such as Vint Cerf and Robert Kahn. So when you > send out information to TOR (or whatever) your packets at the first stage > go to your local network. Actually, they do not. At least not in any way that anyone at that "first stage" can discern. Your original packets are encrypted multiple times before they ever leave your machine (assuming a typical setup here). Those packets remain completely hidden behind that encryption until they reach the other side of the Tor network. At that point they're in the clear again, but all information regarding who originated them has been lost. Back to the envelope analogy... You write a letter to "Dave" and put it in an envelope addressed to him. That's your "original packet". That letter goes in an envelope addressed to "Tom". That package goes in an envelope addressed to "Mary", and the whole mess goes once again in an envelope, addressed to "Bob". You now have a crafted "packet" with absolutely no distinguishing marks on it which say anything about the destination of your letter to Dave. It is in fact and practice a brand new packet, addressed to Bob. You mail this packet to Bob. The postal service (ISP) sees the letter as a packet to Bob. Because that's precisely what it is. They have exactly two pieces of information... the fact that you sent a letter, and the fact that it was delivered to Bob. Bob opens his letter and finds another addressed to Mary. Bob mails the letter. The postal service sees the letter. They have no clue that it was originally inside the letter to Bob. They see a letter going from Bob to Mary, still completely oblivious to the fact that inside a couple more layers of envelopes there exists a letter to Dave. They're now also oblivious to the fact that it originated from you. Mary gets her letter and opens it, finding a letter to Tom. Mary is *completely* clueless. All she knows is that she got a letter from Bob with a letter to Tom inside it. She can't know the real origin of the letter, she can't know the ultimate destination, and she certainly can't read the letter. She's the "key" to the whole thing. The point at which source and destination become strangers. :) Mary mails the letter to Tom, who opens it to *finally* find the original letter to Dave. Until that point in time nobody could have that information. It was hidden behind several layers of strong encryption "envelopes". Your "packet" has traveled from point 'A' to point 'B' without any of its real routing information exposed to the public. Tom, of course, learns that the ultimate destination is Dave. And he can read the letter if it's not also encrypted. But he can never know that the letter originated from you. He can't know it because the hop just before him can't know it. The letter still travels, and eventually does make it to Dave, but it's taken on a "side trip" and metaphorically blindfolded for the duration. ;) > I can't see a way you can hide your packets from > your ISP or Default Gateway which are on the first few network hops (which > you can view using a utility such as traceroute (TRACERT if using MSDOS). > It is possible to prevent the destination website from knowing and/or > logging your real IP address, that is a different matter. > > The original post was about privacy. You can have privacy on your local > computer (but not on the wider Network), but it requires you to re-organise You can have privacy on the WAN too. That's what things like SSL are for. That sort of end to end encryption is all about keeping your information between you and those who you chose to share it with. Casual observers, including your ISP, are rendered oblivious to the content of your communications. They know who you're talking to, but not what you're saying. It's very similar to the way you might tell someone you have a doctor's appointment, but not that it's to have the doctor look at that strange rash that seems to not want to go away. ;) > your affairs quite a bit. There is not only the issue of a browsers > history, but there are also "Local Shared Objects" used by internal and > external flash players, see There's all manner, shape, and form of threats out there. Simply caching images is a threat. It's what allows things like "web bugs". Typically they're tiny, transparent or even single pixel images with unique names, that web sites use to track your movements by way of watching which images are downloaded and which are refreshed from your cache as you move from page to page. And that sort of risk isn't mitigated by ram disks or sand boxes. The only way to fight it is to disallow the caching of images entirely. I'm not even sure most browsers can be configured that way with any sort of certainty. This is why it's vital that we understand the differences between privacy and anonymity, and how they overlap. If web bugs are a concern and you don't want to neuter your web browser entirely, a truly anonymous connection can maintain your privacy by forcing your "attacker" to track a nameless, faceless entity. :) > > http://en.wikipedia.org/wiki/Local_Shared_Object > http://en.wikipedia.org/wiki/Default_gateway > > Computers also open files in the directory indicated by the TEMP or TMP > environment variables. It would be an idea to assign these variables to a > ramdisk or directory you can wipe later if you are looking for privacy and > you are not operating inside a suitable sandbox. That addresses "forward privacy". What someone might discover in the future forensically, for lack of a better term. Immediate privacy is another matter all together. Keeping things to yourself in real time presents a different types of problems than keeping it safe after the fact.
From: JB on 14 Jan 2010 07:46 whome? wrote: > On Wed, 13 Jan 2010 11:56:29 -0500, JB <none(a)server.null> wrote: > > >whome? wrote: > > > >> Who said you could use the web anonymously? If you use Tor or > >> whatever, there is an IP address at each end. There is no such thing > >> as anonynous web usage. > > > >Wrong. > > > >Tor does indeed provide hard anonymity. > > > >That anonymity comes from it being mathematically unfeasible for > >*anyone* to collate an IP on one side of the Tor network with an IP > >on the other. Yes, both are visible to casual observers, but it's > >impossible to know that the IP on the exit side of Tor is being > >used by any given user at their IP address on the entry side. > >Multiple layers of strong, public key encryption see to that. > > Man, you are stubborn. I get that way when I'm right. Sorry. :) > The Tor server has an IP. Your ISP logs your > IP and the Tor IP. Once your packets hit the tor server, the > encryption is removed, Wrong. Wrong wrong wrong. Once the encrypted package "hits the Tor server" the *first* layer of encryption is removed. The first envelope is opened. At that point the operator of the first node sees nothing but another encrypted packet (envelope) with the address of the next Tor node on it. It's impossible for that operator to know the ultimate destination of the original packet because it's still hidden behind strong encryption. And it's also all mixed up with thousand and thousands of other, similarly encrypted packets. At the second node in the Tor network another layer of encryption is stripped away. That operator, agian, can only see another envelope with the address of another node on it. This "middle" operator can't even know where the encrypted packet originated from, let alone where it's going. NOTE: The "magic number" here is three. It's the bare minimum that places a node in the middle which is completely oblivious to all three of the things you need to collate traffic and users... source, destination, and content. > and the packets continue to your desired web > site. The Tor server has an ISP like you and I do. The Tor ISP logs Again, you're oblivious to how the Tor network functions. The envelope analogy is simple, and a good one. Consider it carefully and you'll (hopefully) begin to understand that while these nested envelopes are out there traveling around the system, the ultimate "inner envelope" is obfuscated to the point that real anonymity is achieved. > all its traffic, including the Tor exit packets. The only thing Tor > does is make your traffic BLIND to your ISP only. Wrong. SSL will blind your ISP (and others) to your traffic. That's what tools like that are for in essence. Tor will do this too, but that's merely a side effect of Tor's reason for being... to disassociate content, and originator. Tor, as an entity, does *not* privatize your data. Once it reaches an egress point it's in the public domain, so to speak. > Any cop can unmask > you with minimal effort, especially in the UK. Tor is not worth the > time. Nope. You're mistaken because you don't yet understand what it is that the Tor network does.
From: JB on 14 Jan 2010 08:04
hummingbird wrote: > 'JB' wrote thus: > > >hummingbird wrote: > > > >> >Private browsing is about keeping your information to yourself. > >> >Period. Part of that process *can* be housecleaning, but it's not > >> >inherently necessary. More to the point are things like filtering > >> >"super cookies" during a session, watching for script kiddie attacks > >> >like invasive JavaScript and such, and yes, even intercepting full > >> >blown malware before it can gain purchase on your machine. > >> > > >> >The whole concept is not disseminating information about yourself > >> >and your surfing habits beyond a certain well defined point, not > >> >keeping that information *from* yourself entirely. In truth, wiping > >> >everything is an inconvenience at best, and overkill in essence. > >> > >> All good stuff but it looks more like a recipe for good security, > >> rather than 'private browsing'. > > > >Wow. You really are confused. > > Actually I think you are. I'm sure you do. But then up until recently you also "thought" that privacy and anonymity were synonymous, and that security had nothing to do with privacy. > > >Privacy is all about security. > > Where did I say otherwise? Message-ID: <1df7e299a7fe65a2dcc7e961c203b521(a)aracari.org> "All good stuff but it looks more like a recipe for good security, rather than 'private browsing'." You can deny your own words all you want. And try to hide behind X-No-Archive. It won't change anything. You misspeak, I correct you, and when you realize how wrong you were and how excellent my explanations are, you lie and say that you really meant the same thing I said. > > >Privacy can't exist without > >effective security. Using the doctor analogy again, your doctor > >doesn't leave your medical records lying around in the waiting > >room. He keeps them in a file cabinet in some sort of "restricted > >area", and probably locked up when not being accessed. Physical > >security, plain and simple. Your doctor also most assuredly has a > >policy in place to deal with employees and such who break the > >doctor-patient confidence. The first line of defense is not hiring > >them. That means things like background checks and interviews. More > >forms of security. Information gathering and analysis. Threat > >assessment, if you will. > > We were debating our understanding of the terms 'security' > -vs- 'private browsing' in the context of the Internet. The > former is usually applied to system security and, well, we know What a load of baloney. Now you're just trying to cloud the issue with petty semantics quibbling. "Usually applied to..."? Puhlllllease... One more time the facts: Privacy and anonymity are two different things that can sometimes overlap in application. Neither privacy nor anonymity can exist without good security. 'nuf said. |