I'm normally using DuckDuckGo as my search-engine, and for a time now
have noticed it returning, only on the first page and always at the
bottom, results that have to do with my (supposed) location, even
though I'm searching for technical information.
Just now I seached for "win32 bagMRU records" (yes, Windows registry
related >: -) ), and got entries back like "postal codes in {city}", "Genealogy in {area} - Trace your {country} roots" and "List of
cities, towns and villages in {area}", none of which seem to be even
remotely related to any combination of the keywords I supplied.
Does anyone have an idea what is going on here ? Mind you, the fact
that these results are, as mentioned, only returned on the first page
and at the bottom gives me the idea that its on purpose.
But what is that purpose ? Just to try to be creepy by letting me
know where they think I live ?
And by the way: I can't remember having *ever* searched for anything
related to those results.
Hello all,
I'm normally using DuckDuckGo as my search-engine, and for a time now have noticed it returning, only on the first page and always at the bottom, results that have to do with my (supposed) location, even though I'm searching for technical information.
Just now I seached for "win32 bagMRU records" (yes, Windows registry related :-) ), and got entries back like "postal codes in {city}", "Genealogy in {area} - Trace your {country} roots" and "List of cities, towns and villages in {area}", none of which seem to be even remotely related to any
combination of the keywords I supplied.
Does anyone have an idea what is going on here ? Mind you, the fact that these results are, as mentioned, only returned on the first page and at the bottom gives me the idea that its on purpose.
But what is that purpose ? Just to try to be creepy by letting me know
where they think I live ?
And by the way: I can't remember having *ever* searched for anything related to those results.
I'm normally using DuckDuckGo as my search-engine, and for a time now have >noticed it returning, only on the first page and always at the bottom, >results that have to do with my (supposed) location, even though I'm >searching for technical information.
Just now I seached for "win32 bagMRU records" (yes, Windows registry related >:-) ), and got entries back like "postal codes in {city}", "Genealogy in >{area} - Trace your {country} roots" and "List of cities, towns and villages >in {area}", none of which seem to be even remotely related to any
combination of the keywords I supplied.
Does anyone have an idea what is going on here ? Mind you, the fact that >these results are, as mentioned, only returned on the first page and at the >bottom gives me the idea that its on purpose.
But what is that purpose ? Just to try to be creepy by letting me know
where they think I live ?
And by the way: I can't remember having *ever* searched for anything related >to those results.
...(cf. any browser using Omnimix' built-in Tor)
https://coveryourtracks.eff.org/
Test your browser to see how well you are protected from tracking and >fingerprinting:
TEST YOUR BROWSER
https://coveryourtracks.eff.org/kcarter?aat=1
Test with a real tracking company ?
Our tests indicate that you have strong protection against Web tracking.
...
How does tracking technology follow your trail around the web, even if
you've taken protective measures? Cover Your Tracks shows you how trackers >see your browser. It provides you with an overview of your browser's most >unique and identifying characteristics.
Only anonymous data will be collected through this site.
Want to learn more about tracking? Read how it works with our guide:
LEARN MORE ABOUT FINGERPRINTING
https://coveryourtracks.eff.org/learn
...
Our tests indicate that you have strong protection against Web tracking.(cf. any browser not using Tor)
...
Our tests indicate that you are not protected against tracking on the Web. [end quoted excerpts]
Congratulations. This browser is configured to use Tor.(cf. any browser using Omnimix' built-in Tor)
Your IP address appears to be: ###.###.###.###
...
Congratulations. This browser is configured to use Tor.(cf. any browser not using Tor)
Your IP address appears to be: ###.###.###.###
However, it does not appear to be Tor Browser.
Click here to go to the download page
https://www.torproject.org/download/
...
Sorry. You are not using Tor.[end quoted excerpts]
Your IP address appears to be: ###.###.###.###
TorPlusVPN[end quote]
Last edited by Alexander Faeroy 4 years ago
TOC(depth=1)
Introduction
There are many discussions on the Tor Mailing list and spread over
many forums about combining Tor with a VPN, SSH and/or a proxy in
different variations. X in this article stands for, "either a VPN,
SSH or proxy". All different ways to combine Tor with X have
different pros and cons.
General
Anonymity and Privacy
You can very well decrease your anonymity by using VPN/SSH in addition
to Tor. (Proxies are covered in an extra chapter below.) If you know
what you are doing you can increase anonymity, security and privacy.
Most VPN/SSH provider log, there is a money trail, if you can't pay
really anonymously. (An adversary is always going to probe the weakest
link first...). A VPN/SSH acts either as a permanent entry or as a
permanent exit node. This can introduce new risks while solving others.
Who's your adversary? Against a global adversary with unlimited
resources more hops make passive attacks (slightly) harder but active
attacks easier as you are providing more attack surface and send out
more data that can be used. Against colluding Tor nodes you are safer, >against blackhat hackers who target Tor client code you are safer
(especially if Tor and VPN run on two different systems). If the VPN/
SSH server is adversary controlled you weaken the protection provided
by Tor. If the server is trustworthy you can increase the anonymity
and/or privacy (depending on set up) provided by Tor.
VPN/SSH can also be used to circumvent Tor censorship (on your end by
the ISP or on the service end by blocking known tor exits).
VPN/SSH versus Proxy
The connection between you and the VPN/SSH is (in most cases, not all) >encrypted.
On the other hand the connection between you and an OpenProxy is
unencrypted. An 'SSL proxy' is in most cases only a http proxy which
supports the connect method. The connect method was originally
designed to allow you to use to connect using SSL to webservers but
other fancy things such as connecting to IRC, SSH, etc. are possible
as well. Another disadvantage of http(s) proxies is, that some of them, >depending on your network setup, even leak your IP through the 'http >forwarded for' header. (Such proxies are also so called 'non-anonymous >proxies'. While the word anonymous has to be understood with care
anyway, a single OpenProxy is much worse than Tor).
Also read Aren't 10 proxies (proxychains) better than Tor with only 3
hops? - proxychains vs Tor.
VPN versus SSH or Proxy
VPN operates on network level. A SSH tunnel can offer a socks5 proxy.
Proxies operate on application level. These technical details
introduce their own challenges when combining them with Tor.
The problematic thing with many VPN users is, the complicated setup.
They connect to the VPN on a machine, which has direct access to the >internet.
the VPN user may forget to connect to the VPN first
without special precautions, when a VPN connection breaks down (VPN
server reboot, network problems, VPN process crash, etc.), direct
connections without VPN will be made.
To fix this issue you can try something like VPN-Firewall.
When operating on the application level (using SSH tunnel socks5 or
proxies), the problem is that many applications do not honor the proxy >settings. Have a look into the Torify HOWTO to get an idea.
The most secure solution to mitigate those issues is to use
transparent proxying, which is possible for VPN, SSH and proxies.
You -> X -> Tor
Some people under some circumstances (country, provider) are forced to
use a VPN or a proxy to connect to the internet. Other people want to
do that for other reasons, which we will also discuss.
You -> VPN/SSH -> Tor
You can route Tor through VPN/SSH services. That might prevent your
ISP etc from seeing that you're using Tor (VPN/SSH Fingerprinting
below). On one hand, VPNs are more popular than Tor, so you won't
stand out as much, on the other hand, in some countries replacing an >encrypted Tor connection with an encrypted VPN or SSH connection, will
be suspicious as well. SSH tunnels are not so popular.
Once the VPN client has connected, the VPN tunnel will be the
machine's default Internet connection, and TBB (Tor Browser Bundle)
(or Tor client) will route through it.
This can be a fine idea, assuming your VPN/SSH provider's network is
in fact sufficiently safer than your own network.
Another advantage here is that it prevents Tor from seeing who you are
behind the VPN/SSH. So if somebody does manage to break Tor and learn
the IP address your traffic is coming from, but your VPN/SSH was
actually following through on their promises (they won't watch, they
won't remember, and they will somehow magically make it so nobody else
is watching either), then you'll be better off.
You -> Proxy -> Tor
This does not prevent your ISP etc from seeing that you're using Tor
because the connection between your and the proxy is not encrypted.
Sometimes this prevents Tor from seeing who you are depending on the >configuration on the side of the proxy server. So if somebody does
manage to break Tor and learn the IP address your traffic is coming
from, but your proxy does not log an the attacker didn't see the
unencrypted connection between your and the proxy, then you'll be
better off.
You -> Tor -> X
This is generally a really poor plan.
Some people do this to evade Tor bans in many places. (When Tor exit
nodes are blacklisted by the remote server.)
(Read first for understanding: How often does Tor change its paths?.) >Normally Tor switches frequently its path through the network. When
you choose a permanent destination X, you give away this advantage,
which may have serious repercussions for your anonymity.
You -> Tor -> VPN/SSH
You can also route VPN/SSH services through Tor. That hides and
secures your Internet activity from Tor exit nodes. Although you are
exposed to VPN/SSH exit nodes, you at least get to choose them. If
you're using VPN/SSHs in this way, you'll want to pay for them
anonymously (cash in the mail [beware of your fingerprint and printer >fingerprint], Liberty Reserve, well-laundered Bitcoin, etc).
However, you can't readily do this without using virtual machines. And
you'll need to use TCP mode for the VPNs (to route through Tor). In
our experience, establishing VPN connections through Tor is chancy,
and requires much tweaking.
Even if you pay for them anonymously, you're making a bottleneck where
all your traffic goes -- the VPN/SSH can build a profile of everything
you do, and over time that will probably be really dangerous.
You -> Tor -> Proxy
You can also route proxy connections through Tor. That does not hide
and secure your Internet activity from Tor exit nodes because the
connection between the exit node to the proxy is not encrypted, not
one, but two parties may log and manipulate your clear traffic now. If
you're using proxies in this way, you'll want to pay for them
anonymously (cash in the mail [beware of your fingerprint and printer >fingerprint], Liberty Reserve, well-laundered Bitcoin, etc) or use
free proxies.
One way to do that is proxychains. Another way would be to use a
Transparent Proxy and then either proxify (set proxy settings) or
socksify (use helper applications to force your application to use a
proxy) the programs you want to chain inside your Transparent Proxy
client machine.
You -> X -> Tor -> X
No research whether this is technically possible. Remember that this
is likely a very poor plan because [#You-Tor-X you -> Tor -> X] is
already a really poor plan.
You -> your own (local) VPN server -> Tor
This is different from above. You do not have to pay a VPN provider
here as you host your own local VPN server. This won't protect you
from your ISP of seeing you connect to Tor and this also won't
protect you from spying Tor exit servers.
This is done to enforce, that all your traffic routes through Tor
without any leaks. Further read: TorVPN. If you want this, it may
unnecessary to use VPN, a simple Tor-Gateway may be easier, for
example Whonix.
VPN/SSH Fingerprinting
Using a VPN or SSH does not provide strong guarantees of hiding your
the fact you are using Tor from your ISP. VPN's and SSH's are
vulnerable to an attack called Website traffic fingerprinting ^1^. Very >briefly, it's a passive eavesdropping attack, although the adversary
only watches encrypted traffic from the VPN or SSH, the adversary can
still guess what website is being visited, because all websites have
specific traffic patterns. The content of the transmission is still
hidden, but to which website one connects to isn't secret anymore.
There are multiple research papers on that topic. ^2^ Once the premise
is accepted, that VPN's and SSH's can leak which website one is
visiting with a high accuracy, it's not difficult to imagine, that
also encrypted Tor traffic hidden by a VPN's or SSH's could be
classified. There are no research papers on that topic.
What about Proxy Fingerprinting? It has been said above already, that >connections to proxies are not encrypted, therefore this attack isn't
even required against proxies, since proxies can not hide the fact,
you're using Tor anyway.
,, ^1^ See Tor Browser Design for a general definition and
introduction into Website traffic fingerprinting.
^2^ See slides for Touching from a Distance: Website Fingerprinting
Attacks and Defenses. There is also a research paper from those
authors. Unfortunately, it's not free. However, you can find free ones
using search engines. Good search terms include "Website Fingerprinting
VPN". You'll find multiple research papers on that topic.
It's startling to see the links suddenly switch to how I can
find things related to my search in my town.
I assume they're just making a few bucks that way,
I delete all cookies/cache etc on close
and block tracking domains in HOSTS, so I know they're not
tracking me.
But they can get location from IP.
You could bypass that with VPN if you care.
I know. But why are they showing me that they can do that ? What is the purpose of it ? Mind you, the results have zero to do with my question,
and are otherwise also of zero value to me.
Does cleaning cookies help at all ?
You know, when any other site tries to track you.
Paul,
Does cleaning cookies help at all ?
What cookies ? :-)
My browser (FF) is configured to reject all third-party cookies, and to discard the remainder when I close it.
You know, when any other site tries to track you.
Also, I block third-party resources (FF add-on). That means that spy/beacon pixels/other do not get requested/loaded either. JS has been disabled too.
Are there any other "leaks" I should be aware of ?
Regards,
Rudy Wieser
Are there any other "leaks" I should be aware of ?
I usually search for "+++" using Agent Ransack
and remove toe DOM storage. The domain name is
part of the string.
Paul,
Are there any other "leaks" I should be aware of ?
I usually search for "+++" using Agent Ransack
and remove toe DOM storage. The domain name is
part of the string.
Ah yes, I forgot all about that one. AFAIK that is a JScript something (which I have disabled), but if you know and can tell me how its accesed otherwise than I would be much obliged (FF v52).
I just checked about:config and noticed I still had "dom.storage.enabled"
set to True. Though the "storage.sqlite" database* is .. as empty as it
will ever be (512 bytes):
* AFAIK that is where it goes, but if you have information otherwise I would like to hear that too.
Any thoughts about the DDG localized results ?
Regards,
Rudy Wieser
I didn't see any localized results here. But then, I do not DDG
with any regularity.
The thing is, if they want to shake your cage, all these companies
know exactly where you are.
Maybe usage of a VPN will erode that.
If you search for Joes Pizza, the search result includes an item
from your own town, not from a location half way around the world.
There's no DOH (DNS over HTTPS) in FF52. When FF52 looks up a site,
it's the old fashioned (regular) DNS that is used.
Paul wrote:
Didn't support for FF52 end for both standard and esr releases?
If you search for Joes Pizza, the search result includes an item
from your own town, not from a location half way around the world.
Maybe if your browser is using DOH, it's worse (closer to a MITM attack).
There's no DOH (DNS over HTTPS) in FF52. When FF52 looks up a site, it's
the old fashioned (regular) DNS that is used.
Paul
Even SeaMonkey has the relevant FF60.x security fixes
| Sysop: | Keyop |
|---|---|
| Location: | Huddersfield, West Yorkshire, UK |
| Users: | 508 |
| Nodes: | 16 (0 / 16) |
| Uptime: | 244:31:19 |
| Calls: | 9,988 |
| Calls today: | 6 |
| Files: | 13,836 |
| Messages: | 6,358,793 |
| Posted today: | 1 |