TOR GUI Contest

TOR, the open source privacy software supported by the EFF, has just chosen winner for its GUI competition.

"The user interface designed by the CMU Usable Privacy and Security Laboratory took the "Best Overall" award, and the entry from April3rd scored the "Most Aesthetically Pleasing" award." ("Winners chosen in phase one of TOR GUI contest," NewsForge)

Phase two of the competition is beginning, this time with the focus being a working software implementation. This is a great project which will definitely help people who currently have troubling configuring this software.

Anonym.OS

This Saturday the Anonym.OS Live CD was released at the ShmooCon Hacker Conference. The CD runs Open BSD 3.8 with its network applications preconfigured to work in a secure way. Tor is a key part of the privacy promoting ability of this OS. The OS was designed for users who don't normally use high privacy configurations. The set up of these settings is therefore carried out at start up through a series of wizards. This approach to security was given a mixed review from the attendees of ShmooCon. Anonym.OS is available for download at Sourceforge and LinuxTracKer.



Another privacy solution that I recently learned about is TorPark. TorPark is a preconfigured setup of Tor and Firefox (the DearPark Alpha release)and the Portable Firefox Loader. The advantage of this is that it is easier to use on a public computer. TorPask runs off of a flash drive and unlike a Live CD the computer doesn't have to be rebooted into a new operating system. There a several mirror sites: for the CORAL English download go here.

Tor and Privoxy on Live CDs

After experimenting with these security applications (Tor & Privoxy) I am impressed with the anonymity that they offer. Two Live CDs running Linux distros are suggested on the Tor site: ELE and Phantomix. These CDs are set up to run Tor and Privoxy from start up. ELE is of particular interest to me because it is built on Damn Small Linux. Pretty much everything that can connect passes through Tor on this distro (VNC Viewer does not). This is a nice small option though some of their choices such as not installing Firefox might be a bit too extreme. Phantomix is much larger (700mb as compared to 61mb) but it uses the space to run the Knoppix KDE environment. The basic setup is that Firefox and Gaim are protected and Konquerer is set up for unprotected surfing. To explore more Linux Live CDs a good list has been posted to FrozenTech.

The Electronic Frontier Foundation is helping to promote an open source proxy client that was started by the US Navy, oddly enough. Tor is an application that protects against network surveillance. When used along with Privoxy the anonymity of web browsing is significantly increased. A fire fox plug-in (Tor switch Proxy) makes the switch between a direct connection and using Tor as a proxy. With this protection on, traffic analysis that allows the monitoring of Internet behavior is foiled. Tor works by using a network of what is known as onion routers. A client request is router through a series of virtual tunnels which are encrypted and passed through the distributed and anonymous network to their destination.

"Instead of taking a direct route from source to destination, data packets on the Tor network take a random pathway through several servers that cover your tracks so no observer at any single point can tell where the data came from or where it's going. To create a private network pathway with Tor, the user's software or client incrementally builds a circuit of encrypted connections through servers on the network. The circuit is extended one hop at a time, and each server along the way knows only which server gave it data and which server it is giving data to. No individual server ever knows the complete path that a data packet has taken. The client negotiates a separate set of encryption keys for each hop along the circuit to ensure that each hop can't trace these connections as they pass through." (EFF Overview)

The beauty of the set up is that it removes the ability of any node to be central to the process. The Tor system is dependent on its scale for its success.

"The security of the Tor service is proportional to the number of nodes in the system. Tor is slowly scaling and looking for tens of thousands of participants who can provide enough nodes to prevent the service from being compromised by what the project website describes as "curious telcos and brute-force attacks." ("Onion Routing Averts Prying Eyes," Wired News)

The Wired article points out a potential problem with this method. Since the current number of servers is low (about 35) it is possible someone could "compromise the network" by becoming a member who provides a server.(Wired News) The method of screening is the network's weak point but growth is the only way it can become stronger. Given that this is an open source project and the software is being given away for free, there is hope for increases in participation. The only issue that remains is making sure screening measures are adequate to maintain the high level of security desired by the clients of the system.

Related Articles Free Haven Project Publications