-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 s7r <s...@sky-ip.org>:
> Periodic consensus downloads, as well as keeping always some fresh > circuits on the list in order to attach streams to when requested via > the SocksPort. In other words, not much traffic but not 0 traffic as well. And what about a client that connects only with a bridge? Does a client connect anywhere else besides the bridge (or bridges) that are configured in this client? > Related to your other questions, you might be using too much > complexity which is in most of cases not desired. To be frank I didn't > understand your goals and threat model... My threat model is law enforcement, government and my ISP. I don't care if ISP at my datacentre sees that I'm using Tor, but I don't want my home ISP to see it. Also, if I have an option, I'd prefer my datacentre server to be seized in case of anything rather than my home equipment. Of course I don't want anything to be seized at all. > If I were you I would just configure a good vpn on the server in the > datacenter (say openvpn for example with my own certs and everything) > and connect to the vpn first, then normally (no bridges) to Tor. This > will probably obfuscate some adversaries in learning that you are > using Tor from home. So option 2 from my list... Another question is if it would be better to run a client only when I'm active on Tor, or use a client that is constantly connected. I feel that activity done after client startup (downloading consensus, building circuits) could be correlated with my Tor usage timeframe somehow, that's why I have a client running constantly now. > Connecting to the VPN after you connect to Tor will provide you an > unique static exit point from the Tor network which will make you very > very distinguishable so I would not do that if I were you. You mean routing VPN traffic through Tor? I didn't even consider it, as it would give no anonymity anyway... Aeris <aeris+...@imirhil.fr>: > Why do you absolutely want to route all your traffic through your VPN ? > You want to hide to your ISP the fact you use Tor ? Yes. > From my point of view, << secure >> (no security possible without clean > specification of your threat model) network will be gateway of your > network with strong firewall allowing only output to known Tor node (with > iptables and ipset for example), So you recommend manually specifying an entry guard, instead of letting Tor choose? Why? > If you want to hide Tor to your ISP, just forward all Tor connection > from your gateway through your VPN So you're opting for option 2 from my list, too. Thanks, I think I'll do it this way then. > (I don't take time to study the security of doing this, perhaps other > people here will find troubles). If there are any troubles in this setup, I hope they will... Thank you both for your input! - -- Oskar Wendel, o.wen...@wp.pl.remove.this Pubkey: https://pgp.mit.edu/pks/lookup?search=0x6690CC52318DB84C Fingerprint: C8C4 B75C BB72 36FB 94B4 925C 6690 CC52 318D B84C -----BEGIN PGP SIGNATURE----- iQEcBAEBAgAGBQJWktEmAAoJEGaQzFIxjbhMG4wH/2i1mjuL5WG94bHkH+U3vPSq krEoiVP/vU+VfucFu+ltNXH+DEj7duKP/tSu6dEiQ+1oSK8cpd2cr75zbFlEDZeu ccE6qj3JXfUb/dF+SB6Xd46Uit8U/rAXwHhG/hJgnpIWkQbRUWtuJqPALChpAeEn r/B/jOCgfwm4ClWiGtkVUBwntjVFFHngFodrnv4D6FLTAkNuuc9xVet3/T7ZR91j gLVkqN1KLhDsBAfgjiy8PdZXX1k9Fd5dU+LXi/f3+pDGWfAoIO61HQJpnbzR4Bzx myCnpdXcSXoQqG9kSyBqfWY417bWBQ7alXU6eePl9RrJ1peQyQokh8DHgEULyYM= =QpUc -----END PGP SIGNATURE----- -- tor-talk mailing list - tor-talk@lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
