[tor-dev] Best way to client-side detect Tor user without using check.tpo ?

Ian Goldberg iang at cs.uwaterloo.ca
Sun Feb 8 11:23:10 UTC 2015


On Sun, Feb 08, 2015 at 02:01:40AM -0500, Roger Dingledine wrote:
> In the distant past, we had a ".noconnect" special extension in Tor:
> https://gitweb.torproject.org/torspec.git/tree/address-spec.txt#n58
> and the idea was that you would connect to Tor's control port, induce a
> request for foo.noconnect, and see if you saw stream events for it. If
> you did, things were configured correctly. But we disabled .noconnect
> because we worried it could be used to notice Tor users in some way.
> And it sounds like that solution wouldn't work for you anyway, because
> if things *aren't* configured correctly, then your browser would
> generate a funny-looking request that everybody knows is a Globaleaks
> Tor check?

If you can connect to the control port, can't you just get the browser
to load "google.com", and see if the corresponding stream gets created?


More information about the tor-dev mailing list