Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #206713 > unrolled thread

Advantages of downloading Debian packages over tor

Back to article view | Back to linux.debian.user

Contents

  Advantages of downloading Debian packages over tor André Rodier <andre@rodier.me> - 2019-03-28 08:20 +0100
    Re: Advantages of downloading Debian packages over tor ghe <ghe@slsware.net> - 2019-03-28 15:30 +0100
      Re: Advantages of downloading Debian packages over tor <tomas@tuxteam.de> - 2019-03-28 16:20 +0100
        Re: Advantages of downloading Debian packages over tor John Hasler <jhasler@newsguy.com> - 2019-03-28 17:20 +0100
          Re: Advantages of downloading Debian packages over tor André Rodier <andre@rodier.me> - 2019-03-28 18:30 +0100
            Re: Advantages of downloading Debian packages over tor Lee <ler762@gmail.com> - 2019-03-28 20:50 +0100
        Re: Advantages of downloading Debian packages over tor ghe <ghe@slsware.net> - 2019-03-28 23:20 +0100
    Re: Advantages of downloading Debian packages over tor Jonathan Sélea <jonathan@selea.se> - 2019-03-29 12:00 +0100

#206713 — Advantages of downloading Debian packages over tor

Hello everyone,

Is there any advantage, in terms of privacy, to download Debian packages 
over the Tor network?

Are you doing it yourself, and if yes, for what reason(s)?

Is using the Tor transport better than a standard http proxy (e.g. 
privoxy → tor) ?

Thanks for your insights.

André Rodier

-- 
https://github.com/progmaticltd/homebox

[toc] | [next] | [standalone]

#206736

On 3/28/19 1:18 AM, André Rodier wrote:

> Is there any advantage, in terms of privacy, to download Debian packages
> over the Tor network?

Tor's job is to keep the trackers away by bouncing your packets around
so Google starts tracking the wrong IP address. But the last hop is in
the clear, so its encryption is less than optimal -- not as thorough as GPG.

Privoxy is, as I understand it, a very competent ad blocker. The two do
different jobs. I used privoxy for a long time, before Tor came along,
but now just use the Firefox addon.

Debian and its mirrors don't do any of the nasty things, I think (hope).
So privoxy wouldn't help at all. And Tor wouldn't be much help unless
some mirrors started tracking people, so Tor might be of some help for
the truly paranoid.

> Are you doing it yourself, and if yes, for what reason(s)?

I don't. It'd never occurred to me. But I, as a true paranoid, will be
looking into it :-)

-- 
Glenn English

[toc] | [prev] | [next] | [standalone]

#206737

[Multipart message — attachments visible in raw view] — view raw

On Thu, Mar 28, 2019 at 08:27:08AM -0600, ghe wrote:
> On 3/28/19 1:18 AM, André Rodier wrote:
> 
> > Is there any advantage, in terms of privacy, to download Debian packages
> > over the Tor network?
> 
> Tor's job is to keep the trackers away by bouncing your packets around
> so Google starts tracking the wrong IP address.

No. Because the least Google track is your IP address. It is true that
Tor is meant to obscure your IP address, but "trackers", in your use
of the word, are mostly Javascript code snippets (sometimes invisible
images and things like that) made to convince your browser to betray
you. And it'll betray you even through Tor.

Cheers
-- t

[toc] | [prev] | [next] | [standalone]

#206741

tomas writes:
> No. Because the least Google track is your IP address. It is true that
> Tor is meant to obscure your IP address, but "trackers", in your use
> of the word, are mostly Javascript code snippets (sometimes invisible
> images and things like that) made to convince your browser to betray
> you. And it'll betray you even through Tor.

But JS trackers are easily blocked by simply disallowing JS.
-- 
John Hasler 
jhasler@newsguy.com
Elmwood, WI USA

[toc] | [prev] | [next] | [standalone]

#206748

On 2019-03-28 16:12, John Hasler wrote:
> tomas writes:
>> No. Because the least Google track is your IP address. It is true that
>> Tor is meant to obscure your IP address, but "trackers", in your use
>> of the word, are mostly Javascript code snippets (sometimes invisible
>> images and things like that) made to convince your browser to betray
>> you. And it'll betray you even through Tor.
> 
> But JS trackers are easily blocked by simply disallowing JS.

Thanks,

I have not seen any valid reason to download packages over tor, neither 
to use the apt-transport-tor package.

Kind regards,
André

[toc] | [prev] | [next] | [standalone]

#206757

On 3/28/19, André Rodier <andre@rodier.me> wrote:
> On 2019-03-28 16:12, John Hasler wrote:
>> tomas writes:
>>> No. Because the least Google track is your IP address. It is true that
>>> Tor is meant to obscure your IP address, but "trackers", in your use
>>> of the word, are mostly Javascript code snippets (sometimes invisible
>>> images and things like that) made to convince your browser to betray
>>> you. And it'll betray you even through Tor.
>>
>> But JS trackers are easily blocked by simply disallowing JS.
>
> I have not seen any valid reason to download packages over tor, neither
> to use the apt-transport-tor package.

If you get your packages from an .onion site you get end-to-end
encryption as well as hiding which packages you've downloaded from
whoever is watching your network traffic.

ref
https://bits.debian.org/2016/08/debian-and-tor-services-available-as-onion-services.html

Regards
Lee

[toc] | [prev] | [next] | [standalone]

#206764

On 3/28/19 9:17 AM, tomas@tuxteam.de wrote:

> No. Because the least Google track is your IP address. It is true that
> Tor is meant to obscure your IP address, but "trackers", in your use
> of the word, are mostly Javascript code snippets (sometimes invisible
> images and things like that) made to convince your browser to betray
> you. And it'll betray you even through Tor.

Rats. Got a fix for that?

-- 
Glenn English

[toc] | [prev] | [next] | [standalone]

#206780

[Multipart message — attachments visible in raw view] — view raw

I do it for machines that is accessible over Tor only.

And in some cases, just because I can do it.

-- 
Jonathan Sélea

PGP Key: 0x8B35B3C894B964DD
Fingerprint: 4AF2 10DE 996B 673C 0FD8  AFA0 8B35 B3C8 94B9 64DD 

On tor, 2019-03-28 at 07:18 +0000, André Rodier wrote:
> Hello everyone,
> 
> Is there any advantage, in terms of privacy, to download Debian
> packages 
> over the Tor network?
> 
> Are you doing it yourself, and if yes, for what reason(s)?
> 
> Is using the Tor transport better than a standard http proxy (e.g. 
> privoxy → tor) ?
> 
> Thanks for your insights.
> 
> André Rodier
> 

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web