From: Christopher Lemmer Webber <cwebber@dustycloud.org>
To: Chris Marusich <cmmarusich@gmail.com>
Cc: Devan Carpenter <mail@dvn.me>, help-guix <help-guix@gnu.org>
Subject: Re: Recommendations for browsing via Tor pre tor-browser?
Date: Fri, 20 Jul 2018 12:11:49 -0400 [thread overview]
Message-ID: <877elp7upm.fsf@dustycloud.org> (raw)
In-Reply-To: <87d0viinjj.fsf@gmail.com>
Chris Marusich writes:
> I think you're right: the fact that a malicious actor can induce
> requests to your localhost endpoint is cause for concern, even if the
> exact methods of exploitation are not obvious.
>
> I looked into this. I learned that Firefox (and our IceCat) supports a
> SOCKS proxy using UNIX domain sockets [1]. If you've started TOR with a
> socks socket at /var/run/tor/socks-sock, you can tell IceCat (or
> Firefox) to use it by entering the socket path as your SOCKS proxy.
> Specifically, in the IceCat built by Guix, you would do this:
>
> * Click on the "hamburger menu" in the upper right (the icon looks like
> three fat lines stacked on top of one another).
> * Go to Preferences > Advanced > Connection > Settings.
> * Select "Manual proxy configuration".
> * Select SOCKS v5 (because v5, unlike v4, supports sending DNS queries
> through the SOCKS proxy).
> * Enter "file:///var/run/tor/socks-sock" in the SOCKS Host field (no
> quotes required). The UI still makes it seem like you need to enter a
> port, but you can put any value in here, and it won't matter, since
> UNIX domain sockets don't use ports.
> * Scroll to the bottom and make sure "Proxy DNS when using SOCKS v5" is
> checked.
> * Click OK.
>
> Assuming that TOR is running and the permissions on its SOCKS socket
> allow you access, you can browse to https://check.torproject.org/ and it
> should tell you that you're connected over TOR. You can also check the
> TOR messages sent to /var/log/messages to confirm that stuff is
> happening.
Heck yeah! This is awesome!
> Since using a UNIX domain socket for TOR is probably better than using a
> localhost endpoint, we should make it easy to run a configuration like
> this via the tor-service. Currently, it's a little awkward to do, since
> to set it up, you need to arrange for the directory that contains the
> socket to have certain permissions, or else TOR refuses to start. If
> nobody beats me to it, I could try my hand at this in a few days' time.
Please do.
While you're taking a crack at it, it might be cool if the
tor-hidden-services stuff could also accept unix domain sockets? What
do you think?
next prev parent reply other threads:[~2018-07-20 16:11 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-07-12 17:03 Recommendations for browsing via Tor pre tor-browser? Christopher Lemmer Webber
2018-07-12 17:46 ` Arun Isaac
2018-07-13 10:56 ` Ricardo Wurmus
2018-07-13 11:02 ` Arun Isaac
2018-07-13 9:41 ` Ludovic Courtès
2018-07-13 12:57 ` Christopher Lemmer Webber
2018-07-19 6:52 ` Chris Marusich
2018-07-19 16:23 ` Christopher Lemmer Webber
2018-07-20 3:38 ` Chris Marusich
2018-07-20 16:11 ` Christopher Lemmer Webber [this message]
2018-07-21 14:53 ` Pierre Neidhardt
2018-07-26 15:16 ` Ludovic Courtès
2018-07-27 2:12 ` Christopher Lemmer Webber
2018-07-16 22:06 ` Nils Gillmann
2018-07-19 9:08 ` Devan Carpenter
2018-07-19 16:24 ` Christopher Lemmer Webber
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=877elp7upm.fsf@dustycloud.org \
--to=cwebber@dustycloud.org \
--cc=cmmarusich@gmail.com \
--cc=help-guix@gnu.org \
--cc=mail@dvn.me \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/guix.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.