Delivery-Date: Sun, 10 Jan 2016 16:46:40 -0500
Return-Path: <tor-talk-bounces@lists.torproject.org>
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on moria.seul.org
X-Spam-Level: 
X-Spam-Status: No, score=-1.3 required=5.0 tests=BAYES_00,FREEMAIL_FROM,
	RCVD_IN_DNSWL_MED,RCVD_NUMERIC_HELO,T_RP_MATCHES_RCVD,URIBL_BLACK
	autolearn=no version=3.3.1
X-Original-To: archiver@seul.org
Delivered-To: archiver@seul.org
Received: from eugeni.torproject.org (eugeni.torproject.org [38.229.72.13])
	(using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by khazad-dum.seul.org (Postfix) with ESMTPS id 5F0901E038B;
	Sun, 10 Jan 2016 16:46:38 -0500 (EST)
Received: from eugeni.torproject.org (localhost [127.0.0.1])
	by eugeni.torproject.org (Postfix) with ESMTP id A47A920EFB;
	Sun, 10 Jan 2016 21:46:34 +0000 (UTC)
Received: from localhost (localhost [127.0.0.1])
 by eugeni.torproject.org (Postfix) with ESMTP id 994E820EE6
 for <tor-talk@lists.torproject.org>; Sun, 10 Jan 2016 21:46:30 +0000 (UTC)
X-Virus-Scanned: Debian amavisd-new at 
Received: from eugeni.torproject.org ([127.0.0.1])
 by localhost (eugeni.torproject.org [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id HMGW1Xo0kkxK for <tor-talk@lists.torproject.org>;
 Sun, 10 Jan 2016 21:46:30 +0000 (UTC)
Received: from plane.gmane.org (plane.gmane.org [80.91.229.3])
 (using TLSv1 with cipher AES256-SHA (256/256 bits))
 (Client did not present a certificate)
 by eugeni.torproject.org (Postfix) with ESMTPS id 671D620ED7
 for <tor-talk@lists.torproject.org>; Sun, 10 Jan 2016 21:46:30 +0000 (UTC)
Received: from list by plane.gmane.org with local (Exim 4.69)
 (envelope-from <gno-or-talk-2@m.gmane.org>) id 1aINog-0001HA-DP
 for tor-talk@lists.torproject.org; Sun, 10 Jan 2016 22:46:26 +0100
Received: from 66.230.230.230 ([66.230.230.230])
 by main.gmane.org with esmtp (Gmexim 0.1 (Debian))
 id 1AlnuQ-0007hv-00
 for <tor-talk@lists.torproject.org>; Sun, 10 Jan 2016 22:46:26 +0100
Received: from o.wendel by 66.230.230.230 with local (Gmexim 0.1 (Debian))
 id 1AlnuQ-0007hv-00
 for <tor-talk@lists.torproject.org>; Sun, 10 Jan 2016 22:46:26 +0100
X-Injected-Via-Gmane: http://gmane.org/
To: tor-talk@lists.torproject.org
From: Oskar Wendel <o.wendel@wp.pl>
Date: Sun, 10 Jan 2016 21:46:21 +0000 (UTC)
Lines: 88
Message-ID: <n6ujfc$ief$1@ger.gmane.org>
References: <n6u1bd$lk2$1@ger.gmane.org> <n6u6mt$341$1@ger.gmane.org>
 <5692A207.5080309@sky-ip.org>
X-Complaints-To: usenet@ger.gmane.org
X-Gmane-NNTP-Posting-Host: 66.230.230.230
Subject: Re: [tor-talk] Help me secure my setup
X-BeenThere: tor-talk@lists.torproject.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: tor-talk@lists.torproject.org
List-Id: "all discussion about theory, design,
 and development of Onion Routing" <tor-talk.lists.torproject.org>
List-Unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-talk>, 
 <mailto:tor-talk-request@lists.torproject.org?subject=unsubscribe>
List-Archive: <http://lists.torproject.org/pipermail/tor-talk/>
List-Post: <mailto:tor-talk@lists.torproject.org>
List-Help: <mailto:tor-talk-request@lists.torproject.org?subject=help>
List-Subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk>, 
 <mailto:tor-talk-request@lists.torproject.org?subject=subscribe>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: tor-talk-bounces@lists.torproject.org
Sender: "tor-talk" <tor-talk-bounces@lists.torproject.org>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

s7r <s7r@sky-ip.org>:

> Periodic consensus downloads, as well as keeping always some fresh
> circuits on the list in order to attach streams to when requested via
> the SocksPort. In other words, not much traffic but not 0 traffic as well.

And what about a client that connects only with a bridge? Does a client 
connect anywhere else besides the bridge (or bridges) that are configured 
in this client?

> Related to your other questions, you might be using too much
> complexity which is in most of cases not desired. To be frank I didn't
> understand your goals and threat model...

My threat model is law enforcement, government and my ISP. I don't care if 
ISP at my datacentre sees that I'm using Tor, but I don't want my home ISP 
to see it. Also, if I have an option, I'd prefer my datacentre server to 
be seized in case of anything rather than my home equipment.

Of course I don't want anything to be seized at all.

> If I were you I would just configure a good vpn on the server in the
> datacenter (say openvpn for example with my own certs and everything)
> and connect to the vpn first, then normally (no bridges) to Tor. This
> will probably obfuscate some adversaries in learning that you are
> using Tor from home.

So option 2 from my list...

Another question is if it would be better to run a client only when I'm 
active on Tor, or use a client that is constantly connected. I feel that 
activity done after client startup (downloading consensus, building 
circuits) could be correlated with my Tor usage timeframe somehow, that's 
why I have a client running constantly now.

> Connecting to the VPN after you connect to Tor will provide you an
> unique static exit point from the Tor network which will make you very
> very distinguishable so I would not do that if I were you.

You mean routing VPN traffic through Tor? I didn't even consider it, as 
it would give no anonymity anyway...

Aeris <aeris+tor@imirhil.fr>:

> Why do you absolutely want to route all your traffic through your VPN ?
> You want to hide to your ISP the fact you use Tor ?

Yes.

> From my point of view, << secure >> (no security possible without clean
> specification of your threat model) network will be gateway of your 
> network with strong firewall allowing only output to known Tor node (with 
> iptables and ipset for example),

So you recommend manually specifying an entry guard, instead of letting 
Tor choose? Why?

> If you want to hide Tor to your ISP, just forward all Tor connection 
> from your gateway through your VPN

So you're opting for option 2 from my list, too.

Thanks, I think I'll do it this way then.

> (I don't take time to study the security of doing this, perhaps other 
> people here will find troubles).

If there are any troubles in this setup, I hope they will...

Thank you both for your input!

- -- 
Oskar Wendel, o.wendel@wp.pl.REMOVE.THIS
Pubkey: https://pgp.mit.edu/pks/lookup?search=0x6690CC52318DB84C
Fingerprint: C8C4 B75C BB72 36FB 94B4 925C 6690 CC52 318D B84C
-----BEGIN PGP SIGNATURE-----

iQEcBAEBAgAGBQJWktEmAAoJEGaQzFIxjbhMG4wH/2i1mjuL5WG94bHkH+U3vPSq
krEoiVP/vU+VfucFu+ltNXH+DEj7duKP/tSu6dEiQ+1oSK8cpd2cr75zbFlEDZeu
ccE6qj3JXfUb/dF+SB6Xd46Uit8U/rAXwHhG/hJgnpIWkQbRUWtuJqPALChpAeEn
r/B/jOCgfwm4ClWiGtkVUBwntjVFFHngFodrnv4D6FLTAkNuuc9xVet3/T7ZR91j
gLVkqN1KLhDsBAfgjiy8PdZXX1k9Fd5dU+LXi/f3+pDGWfAoIO61HQJpnbzR4Bzx
myCnpdXcSXoQqG9kSyBqfWY417bWBQ7alXU6eePl9RrJ1peQyQokh8DHgEULyYM=
=QpUc
-----END PGP SIGNATURE-----

-- 
tor-talk mailing list - tor-talk@lists.torproject.org
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

