This post briefly explains what WebRTC is and why you should be aware of the WebRTC leak. Also, it presents how to fix the problem.

What is WebRTC?

WebRTC (Web Real-Time Communication) provides RTC (Real-Time Communications) capabilities to browsers and mobile applications. WebRTC APIs use Javascript to enable peer-to-peer audio, video, and data sharing web applications, running in browsers without any external plugins.

At this time, WebRTC is supported by the following browsers, and it is enabled by default:

• Desktop PC – Google Chrome 23+, Mozilla Firefox 22+. Opera 18+, Microsoft Edge 12+.
• Android – Google Chrome 28+, Mozilla Firefox 24+. Opera Mobile 12+.
• Chrome OS.
• Firefox OS.

What is WebRTC leak?

In January 2015, TorrentFreak reported that users were facing a massive security flaw as websites can easily see their real and local IP-addresses through WebRTC.

More than that WebRTC can be tricked into revealing your real IP address, even if you are connected to VPN! It is called WebRTC leak (a.k.a. WebRTC IP leak, WebRTC flaw, or WebRTC vulnerability), and it is seen as a critical security hole.

If you are interested in more technical details, here is how WebRTC may reveal your IP address. WebRTC relies on Javascript, and a website can insert some Javascript code to send a UDP packet to a STUN Server (Session Traversal Utilities for NAT). That server sends merely back a package containing the IP address from which the request originated. It is simple to implement as Firefox provides a default STUN server that can also be used with Google Chrome.

How to check if you are exposed: WebRTC leak test

Don’t panic! It is simple to detect if your browser may leak your IP address through WebRTC and it is also simple to fix the problem.

Go to a leak checker or IP checker site that performs a WebRTC leak test, like IPLeak.net (it also performs a DNS leak test) or XMyIP WebRTC test.

• If you are not connected to VPN, and you see your local IP and the visible IP then the WebRTC is enabled and you may be exposed to the WebRTC leak.
• Are you connected to a VPN? If you see your public IP address (provided by the ISP), it means that your VPN does not correctly handle the leak. If you see the IP of the VPN server, then you are safe.

How to block WebRTC leaks

The simplest way to fix the WebRTC leak is by disabling WebRTC from Firefox and Chrome and prevent IP from being seen. Thus, you will not rely on your VPN to handle the WebRTC leak.

Disable WebRTC in Mozilla Firefox:

In Firefox you may stop WebRTC by changing the browser settings. In the address bar enter about:config. Next, find media.peerconnection.enabled. Set the value to false and check again!

Further, according to this Reddit thread, there are additional settings you may set:

• media.peerconnection.enabled;false // VPN cannot bypassed anymore
• media.peerconnection.turn.disable;true // makes sure WebRTC is really disabled
• media.peerconnection.use_document_iceservers;false // makes sure WebRTC is disabled
• media.peerconnection.video.enabled;false // makes sure WebRTC is really disabled
• media.peerconnection.identity.timeout;1 // makes sure WebRTC is disabled

Disable WebRTC in Google Chrome:

In Google Chrome, for blocking WebRTC you need to install the WebRTC Network Limiter Chrome extension and select the Disable non-proxied UDP (force proxy) option.

Disable WebRTC in Opera:

In Opera, to implement the WebRTC block you need to install the WebRTC Network Limiter Opera extension and select the Disable non-proxied UDP (force proxy) option. It will prevent the WebRTC IP leaking problem.

Disable WebRTC on Android for Chrome users:

In the address bar, enter the Chrome browser: chrome://flags/#disable-webrtc. It sets the value of enable.

After you disable the WebRTC and reload IPLeak.net you should see the “No leak” message:

Are there VPN services that offer protection against WebRTC leaks?

Yes, there are. Such VPN providers route the WebRTC STUN requests through their servers. Thus, even though the WebRTC is enabled in the browsers, the security flaw is handled by the VPN server.

Here are several VPN services that I have tested and seemed to handle the leak properly (including other possible leaks like DNS leak or IPv6 leak):

• ibVPN – According to the latest ibVPN news, it prevents WebRTC leaks for all VPN apps (Windows, Mac OS, Android, iOS) and web browser extensions.
• HideMyAss
• NordVPN
• ExpressVPN

Conclusion

To sum up, WebRTC is a great tool that enriches web applications, but it encapsulates a security flaw that may expose your real IP address (resulting in IP address leaks) even when connected to a VPN.

The fix for the WebRTC vulnerability is simple, and you should use it if you are concerned about your online privacy and security. Also, check the list of VPNs that correctly handle the leak.

What do you think about WebRTC leak? Do you disable WebRTC while connected to a VPN? Feel free to share your thoughts in the comments below.

Recommended read: How to check if your VPN is working and how to test it for data leaks.

You have probably heard about the recently discovered vulnerability (referred to as the Heartbleed bug) within the OpenSSL cryptographic software library, a worldwide standard used by most web servers. Learn about Heartbleed vulnerability.

What exactly is Heartbleed vulnerability and why is everybody so worried?

Watch the below video made by Zulfikar Ramzan, CTO of cloud security company Elastica.

To sum up, the OpenSSL protocol that secures a lot of websites can be tricked to provide data (personal info, credit card info, passwords, encryption keys) that should otherwise not be accessible. Further, if a hacker gets the encryption keys of a particular site, he/she would be able, at least in theory, to access all the secured info passed to that site. Just imagine what would that means if the target is a popular shopping site.

Should I change my passwords?

Back to the subject title: should you change your passwords and, more specific, the password to your VPN account or password used to secure the VPN connections.

As far as I understand, the chances that your passwords be compromised are slim, but “better safe than sorry.” It is possible that your VPN provider uses OpenSSL to secure its connections and at some point, a hacker might have access to specific private data including your password. As I said, it is not very likely, but you should change the password or passwords anyway. In case you have distinct passwords for the Client Area and the VPN connection you should replace them both.

VPN Providers Response to the Heartbleed Vulnerability

Heartbleed Reports – You probably heard about the recently discovered Heartbleed problem. If you are using a VPN to secure your internet connection and unblock restricted websites, you probably wonder whether your VPN provider was affected. VPN services that implement PFS (Perfect Forward Secrecy) may not be affected.

Find out how VPN providers reacted to this crisis and how they are handling it.

April 8, 2014, Heartbleed Reports

AirVPN replaced on every part of the infrastructure the vulnerable OpenSSL versions and updated the internal SSL certificates. The official announcement is here.

BolehVPN patched the GUI versions and updated the BolehVPN-GUI to remove the threat. Read more here.

VikingVPN performed emergency patching to all VPN servers. More details here.

12vpn tweeted: “We’ve patched our web servers already. The VPN methods we use are not affected.“

GetCloak: “Key portions of the Cloak service were vulnerable to this bug. We have now patched all of our systems”. 

iVPN tweeted: “We’ve patched OpenSSL and reissued new 4096 bit RSA certificates across all servers.” – Recommended reading: Why is OpenVPN handshake key important?

April 9, 2014, Heartbleed Reports

5% of the TorGuard server clusters were found to be using the compromised version of OpenSSL. Read more here.

Identity Cloaker is safe. See more here.

SecureTunnel tweeted: “VPN servers & software are being evaluated and up updated where needed.”

HideMyAss site looks vulnerable.

Mulvad advises you to upgrade to the new client immediately.

LiquidVPN states that: “All of our OpenVPN servers have been patched and new private keys generated.“

TunnelBear on Twitter: “TunnelBear won’t let your #Heartbleed, we’ve updated OpenSSL, revoked and replaced our TLS certificates.”

IPVanish announced that they were not affected by the Heartbleed exploit. You may find more details here.

VyprVPN stated that it used OpenSSL 1.0.1e, which is vulnerable to the Heartbleed Bug, for OpenVPN connections. Hence, they are preparing updated versions of the apps that use non-vulnerable versions of OpenSSL.

April 10, 2014, Heartbleed Reports

PrivateInternetAcces announced that they had applied a patch to their servers in order update the OpenSSL. Proceed for more details here.

ibVPN updated its server network yesterday. However, the website is not affected. Find more info here.

blackVPN on Reddit: “Unfortunately we did find some servers that were vulnerable, so we updated all servers on April 8th as soon as we find out about the bug.“

HideIpVPN announced that is not affected by Heartbleed vulnerability.

StrongVPN patched all of our OpenVPN servers with an updated version of OpenSSL that fixed this vulnerability. Find more details here.

April 11, 2014, Heartbleed Reports

PureVPN remains secured from Heartbleed bug. Find more details here.

iPhone and iPad keep time-stamped track

As I did some “research” on the internet for some facts about it, I stumbled on this one-year-old story that actually demonstrates that iPhone (as well as iPad) keep time-stamped track of every places the iPhone has been to. Well, this, IMHO, is quite interesting (or horrifying, depending on how private your movements should be).

If you read the article above, you’ll see that once someone gets access to specific files stored on your iPhone (or iPad) then they can plot it on some kind of map (here, the example refers to Open Street Map). So, you can get a nice set of points plotted on actual maps showing where the iPhone has been, at what specific time. Duh? I can see you now doing a rewind of all the “lies” you may have said about the location you should be.  You are not that kind of person who says that you’re already “on the way and should be there soon “while you’ve just put your pants and shoes on and locking the door – aren’t you?

But how does phone tracking work?

In fact, if you are a happy owner of an iPhone or an iPad (and gosh, there’s a lot of them out there), I suggest you install this opensource app that will plot your movements into a nice map.  Install it and then see how phone tracking works. Under normal circumstances, this app should draw a nice map of the places where your iPhone (or iPad) have been. You may wonder what’s the point here of this game?

Well, first of all, I just want to get some feedback from actual users if the same thing applies one year after this story has made the front page. Heck, if this has made such a huge coverage last April, won’t it be great to know if things have changed (or not) one year later? And one of the ways to verify it is to test it by yourself. Isn’t it? I have put this article into the “funny” category since the result for each one of How-to-hide-ip readers may be funny (hey, I’d love to hear from your results in the comment section).

I’m pretty sure most of our readers won’t find it funny once their phone (or the app) actually plot correct locations on a nicely Open Street Map. I suggest you view the results alone first since there may be someplace you don’t want your friends to know- if you know what I mean.

What to do?

So why don’t you go ahead and download the app, then check if the map still shows the correct result? One caution though, I haven’t checked if there have been some updates at Apple’s side since that one-year article. So chances are that result may vary depending on if your phone has been updated, or if some privacy settings have been modified on your iPhone/iPad since then. But I bet it’s always interesting to be fixed on that point by actually testing it out.

Hey, in case you’re still too amazed by this “discovery”, just don’t let these results hang around as they may be used against you. And, remember, How-To-Hide-IP readers are eager to know some excerpts of your results: is it still tracking your movements? Is it showing something else?

If you’re still wondering why it’s a bad idea, this means that either you have nothing sensitive stored on your computer (can it be?), or you are not conscious about the “danger” hanging around. And, gosh, locking your screen will do no harm: depending on your operating system, it’s just a matter of simple combinations of the key pressed and then you can go away with peace in mind- so why don’t you do that?

Things you are leaving behind

Now, let’s consider that you think you have nothing sensitive on your computer and see what another user can see if he take the time to seat in front of your computer and “play” with it. Let’s see the usual things you’re leaving behind when letting access to your computer:

• the open documents: this is the most obvious one. You’ve left some documents open, it’s easy to have a look at them. But even if they aren’t open, you know that most software now comes with the “recently opened document”. So now, you know that you’re leaving some traces behind. Let’s just hope you didn’t watch some “forbidden” movies at work and that your media player “remembers” it, nor have you read some confidential documents,
• the files stored on your hard drive: you surely have photos, music or videos laying around that can be “interesting”.Do you know that some of the guys who repair your computer check for those “hidden treasures” while trying to remove that virus from your computer whenever you ask for their help? Have you ever been suggested something like “we need to bring your computer to our lab for repairing?”.Just think about it: how badly do you want some of the files you keep on your computer unfound? We all have something stored on our computer that we don’t want other to know: either it is the usual ones (adult photos and movies usually), or that photo of you drunk and trying to climb the police’s fences while you’re almost naked on a TGIF night that your best friend sent you (ok, this probably didn’t happen, but you get the idea),
• your browser’s hidden treasure: unless you’re following some of the tips I left for browsing incognito, your browser reveals a lot about your online history. Whether your browser keeps some credentials for accessing some online sites (have you noticed those “remember me” features on most websites?), or your browsing history (oops, you’ve been surfing on some “people news” website while your boss was expecting that important report for … yesterday?).In fact, if it’s only for checking what you did, you can still find a way to “minimize” it. But let’s say that your browser automatically connects you to Facebook (or whatever website), if someone really wants to harm you, it’s very simple to post something on your behalf while you are away. And remember, anything posted online is hard to remove.

Is anyone having access to your computer? Are you comfortable to let someone browsing your private data? Let us know your thoughts in the comments below.

Subscriptions are everywhere nowadays whenever you go to some random internet sites: whether it is for subscribing to newsletters and offer, opening an account on any websites and community sites. Learn about disposable e-mail.

As if it weren’t enough, they even politely invite you to “find your friends” by asking to access your address book so that they check if some of your friends are already using that same network.

Most of the time, the lambda user doesn’t even think about it and, without even considering the consequences of his act, he innocently gives away his e-mail address so as to be able to subscribe to one online service, then …. then he ends up receiving a lot of e-mails that don’t necessarily pertain to his interest. So he ends up deleting (or ignoring) more emails than he reads in one day.

Use a dummy email address for subscriptions

Some more clever user has just created some free internet-based e-mails (from Yahoo, Gmail, …) for all those subscriptions. I, for example, have one e-mail address that is solely used for subscription purposes: whenever I want to create an account on one online service (or I want to get a sneak preview that needs some subscription), I use that e-mail account. In fact, the scenario is almost always the same:

• the online site asks you to fill some information about you (at least an e-mail address and a password),
• then it sends you an e-mail with a link to click on it so as to confirm that it actually is a working e-mail address
• once you activated your account by clicking the activation link, there usually is no critical need to check that e-mail address anymore since you would be able to do everything from inside the online site

So, my dummy address is only used for activation purposes. I recently checked that e-mail address, and I found out that sites I subscribed for keeps on sending me multiple e-mails even though I didn’t check it for a long time.

Better: disposable e-mails

But then I stumbled upon some new services that even get things easier: disposable e-mails. Well, I don’t know what’s the business model for those kind of services, but they are great for testing out those sites: in case you really want to stick with one online site, I guess you can always change the official e-mail address associated with it so that you get the notifications and any other communications.

Disposable e-mail services

If you google for “disposable e-mails” you’ll find plenty of solutions that go from “10-minute mail” (that is actually only available for 10 minutes, which is plenty of times to receive the activation link), to “My trash mail” that is only available for three days.

If we take the SpamGourmet example, it’s quite interesting since you can create temporary and automatically checked for spam e-mail addresses similar to “someonlinesite.3.myaccount@spamgourmet.com” that you can “give” to the site “someonlinesite.com”. It will only handle 3 e-mails from that site (and eventually forward it to your actual address depending on how you configured it)

Frankly, this can be useful, especially for bargain hunters that give away their e-mail address to every site that give them some discount in exchange for some personal information.

What do you think about those solutions?

Do you think they are worth using? or do you think your native anti-spam solution that comes with your current e-mail system is doing fine?

How can hackers use URL shortening sites

Most email anti-spam counter agents were created even before the use of embedded URLs in emails, not to mention shortened ones. Most current anti-spam programs trace back the URL to see if the site it originates from is dangerous. However, a shortened URL can be used by hackers in two distinct ways.

Hide a site under a trusted shortened URL

The first way is simple. They connect the site they want you to get directed to into one of the known and trusted URL shortening sites accessible for free to the public. Because the URL shortening site itself is trusted, the link is trusted. However, the link does not take you to the URL shortening site; it takes you where it was initially focused.

Fake URL shortening sites

Secondly, hackers can get even more creative. Once the email program’s anti-spam filters discover the misuse of the URL shortening sites, as some have already done, hackers generate their own URL shortening sites. Basically, they shorten a site that’s already shortened. So, when you click on the link, you get redirected not once, but twice. The first redirection is safe, the next is a hacker.

This was “yet another example of cyber-criminals adopting new technology to bypass traditional security measures,” said Bradley Anstis, vice-president of technical strategy at M86.

“A lot of the traditional anti-spam engines were developed before Twitter, so they are not geared up to recognize embedded URLs as seen in blended email threats in spam, let alone shortened URLs that link to malicious or compromised Web pages,” Anstis said.

Some frightening statistics:

In May 2011, the global ratio of spam in email traffic from new and previously unknown bad sources increased by 2.9 percentage points since April 2011 to 75.8% (1 in 1.32 emails).

The global ratio of email-borne viruses in email traffic from new and previously unknown bad sources was one in 222.3 emails (0.450 percent) in May, a decrease of 0.143 percentage points since April. (From Net-security.org)

What can you do to defend yourself?

For one, never click on an email link if you do not trust the sender. Two, even if you do have confidence the sender, try to get to the link organically, meaning follow the standard method. If you are checking on a delivery, go to the main website instead of clicking on the link. These simple actions will help to keep your computer, and the information it holds, safe from hackers.

Author Bio:

This is a guest post from Laura Backes, she enjoys writing about all kinds of subjects and also topics related to internet providers in my area.  You can reach her at laurabackes8 [@] gmail.com.

Note: This post isn’t about inviting you to do censored things on the Internet. It is about an open source, though publicly available, a solution that is used by most citizen media activists around the world.

Your Right to Anonymity

Article 12 of The United Nations Universal Declaration of Human Rights states, “No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honor and reputation. Everyone has the right to the protection of the law against such interference or attacks.“

Your right to anonymity means you can have free will over surfing the internet under any connection, whether it be yours or a fake portal. Anyone is allowed to do this as well, and already a lot of people do so. Primarily you would think that only intruders and people trying to hide something would want to have a right to anonymity but since times are changing and more people are using the internet for online purchases and things it’s essential to know your information is kept private.

Now more and more people are hiding their IP addresses and using Proxies to surf the web, and it’s your right to do so as well. Everyone from homeowners to politicians have their reasons for wanting to keep anonymous while surfing the internet, and it’s their right to do so. With your private details all over your computer, you need to make sure you are prepared to protect yourself.

TOR is not illegal

The very nature of this post is to open readers’ eye to an existing technology geared toward people who desperately look for a way to anonymize their online activity, to work around some local internet censorship that they may have. By the way, at this time of writing, and according to TOR’s FAQ, “Tor is not illegal anywhere in the world, so using Tor by itself is fine.”

What is TOR?

So what is TOR: in fact, it is a kind of “peer-to-peer” concept but used for security purposes. It is a distributed network and an anonymous network. It is particularly helpful to people who don’t want their Internet traffic to be tracked since the packets are distributed over the whole TOR network. To quote TOR’s website, “The idea is similar to using a twisty, hard-to-follow route to throw off somebody who is tailing you — and then periodically erasing your footprints.”

How TOR works?

Let us first explain (roughly) how TOR network works. Before we start, you need to know how information gets in and out your computer. Let say you want to open a website “X.” In the typical case request for that would go from your computer to your ISP server and then directly (or almost instantly but in an entirely unencrypted and traceable way) to this website.

It is why your ISP knows exactly what you do on the internet; this is any government agency will know where and when you were connected. Furthermore, by checking data on those computers, you were connected, they will know what you did. Also, if you (for example with the use of P2P network) will connect to a “hoax server,” these are set up by different agencies with parts of software or movies for you to download to trace your IP.

So, you think you are just downloading a film (in P2P your computer connects to many different machines without your control) while in reality, you download a movie and also you sand data to those you don’t want to know about it.

What can you do with TOR?

So instead of rewriting a summary of what can be done with TOR service, I’d instead link you to the necessary materials, then you take whatever fits your needs.

Let’s say that you want to organize a secret online meeting so secure that even the participants can’t yet be tracked. You may want to consider establishing a “Rendez-Vous” point within the TOR network via their hidden services.

Be careful, though, as it is the case with other security packages, there are some warnings you need to be aware of. Check them here.

The good thing about joining the TOR network is that it is available for multiple platforms (Linux, Mac, Windows, …), if you want to give it a try, you may want to check the installation guides.

How to use TOR

The first step is to download Tor.

Now, we will tell you how that changes with the use of TOR (and VPN). In this case, information/request from your computer goes to your ISP server and then from there to the first node of TOR network (TOR client downloads a list of nodes/computer from TOR directory. You may even select the exit node.). That information flows between those nodes (selection of those servers always happens at random and they only “know” about nearest servers to them – not the whole route).

After going through a few of those computers (this is one of the reasons TOR is always slower than VPN) finally goes to the destination server with the website “X.” Every few minutes and every time you send new request path between you and destination changes at random and because of that (unless you are specifically targeted, and someone has lots of resources) you are practically invisible on the internet.

As we have said, because of this architecture of the TOR network, it is hard to get decent Internet connection speeds. If you watch a movie for 5 minutes, it can be great, but then route changes and your stream becomes unwatchable.

Tor Pros and Cons

Pros

• It’s completely free;
• Encrypts all traffic (incoming and outgoing) between his nodes;
• It is virtually unbeatable (if properly configured);
• There are plenty of applications that are based on TOR technology and make its use more comfortable, including a Tor browser;
• It hides your public IP address to browse the web anonymously.

Cons

• The configuration is not trivial;
• The performance is unpredictable as it depends on routes between the Tor network nodes;
• Not suitable for P2P applications such as Torrent (however, you may use a VPN for downloading torrents);
• It only protects applications that are configured to work through Tor. No automatic configuration.
• As written on Tor’s Downloading page: “While Tor blocks attackers on your local network from discovering or influencing your destination, it opens new risks: malicious or misconfigured Tor exit nodes can send you the wrong page, or even send you embedded Java applets disguised as domains you trust.”

TOR vs. VPN

Before we tell you the latest news regarding TOR anonymity, let us tell you a few words about VPN. As in the example above in the case of VPN service. Request from your computer gets encrypted, then goes to through ISP server (but since data you send and receive are as we said encrypted ISP could not easily see what is inside) to VPN server and from there to the destination.

It means that only your VPN provider holds all the data about you and your traffic. For the average, Joe VPN seems like a much better solution. As long as you do not do something considered (internationally) illegal, like child pornography, terrorism, etc. your VPN provider will never reveal your data (in many cases they do not even hold those data logs if local legislation does not require that). So, if you want to surf the web (use p3p/torrents), stream movies that are usually unavailable for you VPN should be the product of choice.

Lately, several VPN providers have exposed a mixt TOR and VPN solution called “Tor over VPN” or “Onion over VPN” that connects to the Tor network via a VPN server. This approach has several advantages.

Tor Project awarded for the role in Middle East Revolutions

Tor Project awarded! Tor project has received recognition from the Free Software Foundation as it helped the protesters and revolutionists in the Middle East and North Africa. The award called Award for Projects of Social Benefit highlights the software as a project which significantly benefited the society by collaborating and accomplishing a task of social importance.

This excellent free software, as well as other online anonymity tools, has changed the lives of millions of people who were previously living under the fear and suppression of the dictators. Governments in countries from North African and the Middle East tried to censor online applications like Twitter and Facebook, and for a while, they succeeded in doing so. But the Tor project was successfully used to bypass the blocks to let the revolutions continue and take a definite shape.

The latest news involving TOR anonymity

OK, now since we are past the differences between TOR, VPN, and regular connection to the internet we can tell you about the latest news involving TOR.

French scientists claim they have found a solution to trace user in the TOR network. Here is what they did. They build a small TOR network and then, using holes in the TOR software they have prepared a virus. The virus had infected 1/3 of TOR nodes. Remaining TOR servers were attacked using a different method for them to disconnect them from the network. Once they started to switch off, more and more information were send through still working nodes, most of them which were already infected with a virus. The primary field of this virus activity was to break data encryption.

This allowed them to create a map of the whole TOR network and method they used will aloe form much quicker identification of users using TOR servers. Here you can read TOR comment in this regard.

Since it is impossible to know exactly where the truth lies, we advise you to take extra precautions.

Do not use Tor servers with BitTorrent

Disturbing news regarding the “bombardment” of Tor servers with DMCA notices was published by TorrentFreak.com some time ago. The story is essential as may lead (at some point) to the service shut down. BitTorrent and Tor? Not the best idea.

For those that want to be protected while downloading with BitTorrent, there are plenty of solutions, like VPN services and proxies (Recommended reading: Tips to torrent safely.). The benefit of such services is that they allow users to browse and download anonymously at full speeds. The downside is that users have to pay a monthly fee (usually between $5 and $15) for these premium services.

BitTorrent and Tor?

To avoid this fee, many BitTorrent users anonymize their traffic with Tor. It is a big problem. Although one BitTorrent user taking this option is unlikely to prove problematic, a few thousand can cause some severe damage. Tor servers are also being monitored and notified by copyright holders (the DMCA notices) for facilitating “infringing” transfers.

The conclusion is that those who value anti-censorship tools should not abuse Tor by running their BitTorrent traffic over it. Aside from the fact that torrent traffic slows down the network, the massive amount of DMCA notices may lead to servers being disconnected and, finally, Tor would no longer be available to the people who it was built for.

Can you trust Tor’s security?

According to a report on Heise Online, the German IT security portal, two of the seven directory authority servers (moria1 and gabelmoo) that the Tor Project uses to run its anonymous browsing service have been compromised, along with a new server that the project uses to host metrics and graphs (metrics.torproject.org).

Tor team discovered the attack in early January and are advising users to upgrade to version 0.2.1.22 or 0.2.2.7-alpha of the client software – which acts as an interface between the custom version of Mozilla that the project recommends and the internet.

They said that there is no risk that the attackers could have matched Tor users to their browsing habits.

“By design, Tor requires a majority of directory authorities (four in this case) to generate a consensus; and like other relays in the Tor network, directory authorities don’t know enough to match a user and traffic or destination,” Roger Dingledine, the original developer of the Tor Project wrote in an email.

Unconfirmed indications suggest that the two servers were hacked to gain access to the high anonymous bandwidth they offered, but it is also possible that the goal was to set up some SSH keys and use the servers to launch other attacks.

Here is what Roger Dingledine says the Tor security: “We’ve taken steps to fix the weaknesses identified and to harden our systems further. Tor has a track record of openness and transparency, with its source code and specifications and also with its operations. Moreover, we’re disclosing breaches such as this so you can monitor our status. You shouldn’t assume those who don’t disclose security breaches never have any!”

Tor alternative – I2P Darknet

An alternative to Tor is the I2P Darknet network. It works similarly to Tor, but it is considered better when it comes to anonymizing your online presence, downloading torrents, and sending secure email. In the same time, Tor is an excellent tool for bypassing geo-restrictions.

To sum up

This blog is about “online anonymity guide,” and I thought TOR is in line with what we’re trying to show our users here. Indeed, TOR is an excellent anonymizer for online activists. We’d love to hear from you how you’d use TOR services for anonymizing your internet activity.

Share your views in the comment section.

EFF (The Electronic Frontier Foundation) compiled a list of the important trends in law, technology and business that would play an important role in shaping online rights in 2010, and companies that in the past year managed to infringe on the privacy of the individual. EFF plans to revisit these trends as the year progresses, as stated by its technology manager, Tim Jones. Learn about privacy threats in 2010.

1. Global Internet Censorship

Filtering initiatives in Australia and Europe that follow similar steps undertaken in China and Iran highlight the globalization of internet censorship and a battle for internet legitimacy. There are growing concerns about the ways in which restrictions in different countries reinforce each other, on the basis of child protection, cybersecurity and IP enforcement. Blocking of websites isn’t just for autocratic regimes now, as democracies follow suit.

2. Cyber-security Legislation  Stirring in U.S. Congress

As healthcare reforms occupied Washington, federal technology legislation took a back seat. It is, however, doubtful that the case would be the same in 2010. Key provisions of the Patriot Act are up for re-authorization before April 1 and The Snowe-Rockefeller Cyber-security Act, which would grant the president the power to disconnect the Internet, is likely to resurface sometime this year.

3. Net Neutrality

Most know Net Neutrality is an abstract idea. But what would be its implications when it makes the transition from idealistic principle into real-world policies, privacy threats 2010 would tell, as the FCC attempts to institute Net Neutrality this year. How much the FCC can be trusted is yet to be seen as it tends to lean towards the demands of corporate lobbyists and “public decency” advocates more than individual civil liberties and is already promising exceptions from net neutrality.

4. News Organisations Revolt Against Google

News Corp. and other bigwigs in the media zone were unhappy with Google and its effect on their businesses. They don’t appreciate a search engine selling advertisements regarding their content without getting money for it, even if their content is openly consumable online. The print world is expected to force changes to current copyright law, and apply pressure on intermediaries to stop functioning for search engines like Google.

5. Online Video 

Like print, the TV industry is slowly being taken over by the internet and radically disparate industries are engaged in a battle for dominance. Two initiatives that should be tabbed are TV Everywhere a new DRM-laden attempt by the mainstream TV industry to outsmart innovative technologies like Boxee and Selectable Output Control, Hollywood’s latest effort to decide what you can record on your DVR, rather than the viewers.

6. Cracking GSM, SSL 

Two very significant problems expected with cryptography implementations, concern cell phone security, and web browser security. Devices that intercept phone calls that use GSM technology are expected to get cheaper and an increase in public demonstrations of the ability to break GSM’s encryption are bound to increase. The mobile phone industry needs to urgently change its obsolete security systems. SSL is probably the best web security system available, but in the past year several flaws regarding its practical use have been highlighted and it needs to immediately aim to improve.

7. Hardware Hacking

An active electronic hobbyist community is becoming a threat to manufacturers who threaten them with legal action. EFF, on the other hand, has supported these hardware hackers. Phone jailbreaking and multiple uses of electronic devices are expected to increase in privacy threats 2010.

8. Web Browser Privacy

In the 1990s web browsers who wished to protect their privacy could simply de-activate or limit their browser’s use of cookies. This proved effective against the worst online tracking practices.

But in 2010 corporations are seeking to track individuals’ use of the web by unexpected methods of profiling. At the same time, awareness and scrutiny regarding them have also risen. Most major sites share ones web activity with several advertising networks. Technical or legal restrictions on the tracking of web activity are limited and allow even mail companies to profile an individual’s web usage and exploit accordingly.

9. Location, Location, Location

The government’s ability to track individuals using mobile phones and information on social networking sites and transportation systems is increasingly threatening freedom. Location privacy is becoming a big issue in courts across America, as organizations like EFF oppose such government control.

10. Social Networking Privacy

Networking sites like Facebook have more than 350 million users, with their personal information openly available. This is used by both law enforcers to convict and by lawbreakers and hackers to infringe upon privacy. It is yet to be seen in privacy threats 2010 is laws would be made stringent or would a scam only lead to networking sites taking their users seriously.

[Via eWeek]

The problem

Cached DNS Entries and Flash cookies

The big problems are the DNS cache and Flash cookies, neither of which are covered by browsers’ privacy controls. DNS, which is often described as the Internet equivalent of a phone book, translates Web site names (such as Switched.com) into IP addresses (e.g., 127.0.0.1). These IP addresses are saved locally to speed up access to those pages in the future. Private browsing modes don’t clear this cache, which means that somebody could tell what sites you’d been visiting just by looking at locally stored IP addresses, even if you’d cleared your browser history.

Cleaning these things up is as easy as typing “ipconfig /flushdns” into the command prompt (or ‘Run’ box, whichever you prefer), and deleting the contents of “%appdata%\Macromedia\Flash Player\#SharedObjects“.

The Solution

The best solution is to install CCleaner and create your own batch file to run after your browsing session, to make sure your browser cache, Flash cookie cache, and DNS entries are cleaned out.  Just create a new plain text file and save it as a .bat file (e.g., browserclean.bat), then add the following to the file, noting that the /AUTO switch tells CCleaner to run silently.

“C:\Program Files\CCleaner\CCleaner.exe” /AUTO
ipconfig /flushdns

Once you’ve created the file and saved it into some useful location, you can create a shortcut on your desktop, quick launch bar, or pin it to your start menu.

Visit Lifehacker for a more in-depth look at how ‘private browsing’ modes fail.

Important! You have to remember that private mode does not hide your IP address, it only erases your browsing history!

>> Via Lifehacker.com & Switched

Negotiations between ISP and copyright owners

According to the French PCINpact, some classified negotiations are being held with the support of European Commission between Internet Service Providers and copyright owners. It is possible that much stricter rules of internet usage will be introduced for all EU countries with the omission of all democracy rules. Companies like IFPI, ETNO, EuroIspa, Vivendi, Virgin Media, BT, Ofcom and also Amazon, Google, and Yahoo! are part of this action.

What do they want?

Apparently, copyrights holders wish for monitoring and filtering of internet traffic. All websites that will be marked to hold illegal material (or the ones that are a middleman) should be cut off (if they are in EU) or access to those sites will be denied.

Another plan is to closely watch every internet user, just in case illegal actions are performed. It is like in everyday life there would be a policeman following our every step and watching our every move. Just in case we would do something illegal.

The result?

Once the new law is introduced a lot of people in EU would receive letters with a warning (or bill) like French internet users because of their HADOPI initiative.

The Impact of Hadopi and MegaUpload Closure on VPNLifeguard Downloads

VPNLifeguard recently published some interesting stats that show an important increase of the application downloads related to the introduction of  Hadopi in 2010 and the recent MegaUpload closure.

What is VPNLifeguard

VPNLifeguard is a free application that makes sure your computer does not access the Internet when your VPN connection drops. Thus it prevents unsecured connections after your VPN disconnects. The application is very useful for browsing or goes behind a P2P VPN without being exposed during disconnection issues.

Advantages of VPNLifeguard

• It’s free!
• Blocks P2P traffic in case of disconnection of the VPN
• Protects browsers (and other apps) for possible disconnection of your VPN
• Supports VPN protocols (PPTP – L2TP) that appear in the “network connections” for Windows.
• Automatically reconnects the apps

VPNLifeguard stats

The stats published by VPN Lifeguard show that both Hadopi and the closure of Megaupload increased the number of downloads. This is the case for VPN Lifeguard and it’s probably the case for the major VPN services list.

All these anti-piracy actions are more and more driving the Internet users towards anonymity (hide IP) applications. Recently, TorrentFreak reported that 15% of US file-sharers are using a VPN or a proxy service. I’m sure that this number will heavily increase in the next months both in the US and Europe.

What do you think about the new possible law? Do you think it will be adopted? Do you use VPN to protect your privacy and anonymity from your ISP? Let us know your thoughts in the comments below.