TOR Wants You To Stop Using Windows, Disable JavaScript 341
itwbennett writes "The TOR Project is advising that people stop using Windows after the discovery of a startling vulnerability in Firefox that undermined the main advantages of the privacy-centered network. The zero-day vulnerability allowed as-yet-unknown interlopers to use a malicious piece of JavaScript to collect crucial identifying information on computers visiting some websites using The Onion Router (TOR) network. 'Really, switching away from Windows is probably a good security move for many reasons,' according to a security advisory posted Monday by The TOR Project."
Re:Proper Summary (Score:5, Interesting)
Re:Very poor advice (Score:4, Interesting)
Many of the people using Tor in restrictive countries won't have the luxury of switching away from Windows. Even if they don, they won't necessarily know how.
Secondly, it's poor advice. The vulnerability affects Firefox 17....and Firefox is up to 22 now I think. Wouldn't it make more sense for them to make sure the tor browser is hardened and recommend people to use that?
Finally, Using a more recent windows version is actually good for security. ASLR, DEP, a rudimentary MAC implementation, UAC...despite what people say, Windows is actually one of the better operating systems security wise these days. Not just because of the preventive technology that most other OS's don't have (OS X has a lacking and broken implementation, most linux distros are not as complete in their implementations..), but because Microsoft started taking security seriously and vulnerabilities are rare these days.
Whatever, bring on the irrational arguments and Microsoft hate. Is it really too much for a forum of tech nerds to be objective in their analysis?
http://www.zdnet.com/blog/btl/microsoft-certificate-used-to-sign-flame-malware-issues-warning/78980 [zdnet.com]
It would be interesting to know how the 'state' that developed Flame acquired the MS certificate in question.
- compromised using tech that the NSA has that we don't know about?
- bought off the black market after being stolen by some other entity?
- or just given by MS to the 'state'..?
Re:Security professionals generally missing the po (Score:5, Interesting)
If encryption is a "please investigate me" red flag, then we need to find ways to hide the encryption (i.e. steganography).
Re:Security professionals generally missing the po (Score:2, Interesting)
Re:Security professionals generally missing the po (Score:5, Interesting)
Wrong, it can be easily done (Score:4, Interesting)
Firefox not part of PRISM (Score:3, Interesting)
Mozilla were not listed as NSA PRISM aiding and abetting companies. Microsoft was listed as an active participant, helping NSA bypass the search warrant requirements on their outlook products and providing technical assistance on Skype.
One company picked sides, and its not the side with the Constitution on it.
So yes, he's probably right.
NSA broke TOR on the excuse of kiddy diddlers but they broke TOR mainly to prevent leakers from the NSA from using it to leak. Why else would they use their own IP address clearly and publicly in the breach??
It's to scare any potential NSA employees from leaking how far NSA has gone over the line.
The post-cryptography security world ... (Score:4, Interesting)
As Adi Shamir (the S in RSA) has been trying to point out [theregister.co.uk], cryptography is a method for transferring data between two trusted hosts. So the F-16 zooming above Washington can get some radar data from the airbase in Virginia and no one listening in can decrypt it. At the point where some luser picks up a USB drive [arstechnica.com] off the parking lot floor and plugs it into a computer inside the airbase, all the encryption in the world matters not one whit.
It's a massive change to the model we use to conceptualize the threat -- instead of Alice and Bob trying to communicate with each other and keep Charles from decrypting, we have Alice and Bob trying (a) to protect their machines from Charles compromising it and (b) trying to limit the data done if he does compromise it. This isn't your father's security any more.
What is also means is that we are going to need a lot fewer secrets that are really worth keeping or else spend much more time partitioning our virtual worlds. As BEAST/CRIME show, if you treat your Facebook login cookie as a secret, then you need to access it from a partitioned browser where a malicious page cannot make requests using it.
Re:NSA owned netblocks (Score:5, Interesting)
Sure.
Now, if instead of engaging in this selfdefeating every-man-to-himself canned-goods-and-ammo mentality users would actually stand up for their rights actively, which means, engaging in politics - that could work.