[Tor www-team] Tor Project website should recommend DEDICATED Tor router and browser across 2 machines

Dan Michaels danmichaels8876 at gmail.com
Sat Oct 29 00:10:15 UTC 2016

Tor is really secure, and the Firefox browser is really INSECURE.

Every single month, new Firefox exploits are documented on the Mozilla
"Security Advisories" page.

For this reason, the most secure way to use Tor is to split up the Tor
router and browser into 2 separate computers.

The Tor Project website needs to list this as a recommendation.

Tails is still just using Tor and Firefox all on 1 machine. A hacked Tails
could reveal your real IP just like any other machine.

I have created a script which shares a Tor connection from 1 machine to the
other using Ethernet crossover cable.


Home router from ISP => WiFi => Tor router machine => Ethernet crossover
cable => Machine with Firefox browser

The Tor router machine connects to your home WiFi, and then shares a
Tor-only connection to the 2nd machine.

No setup is required on the 2nd machine, other than plugging in the
Ethernet crossover cable.

Hence, even if the 2nd browser machine is hacked, you cannot turn off the
Tor connection, because the Tor connection is all set up on the router

On the router machine, you should wipe it clean, re-install the OS from
scratch and then only run the Tor script from the very first start up.

Never use a web browser even once, or the machine could get hacked.
Internal NSA docs say "one page load" is all it takes to hack a machine.

It is recommended to run this Tor router on a "dumb computing" device, such
as the Raspberry Pi, because the Pi does not hold state.

Therefore, if you wipe the SD card, you can truly be sure that it is wiped

If you don't like the Pi, then use an open source alternative like Novena
or Beagle, but be sure that it can truly be wiped clean.

This is the one main advantage of the Pi, that it holds ZERO state. Wiping
the SD card truly wipes a Pi fully clean.

It may also be recommended on the router machine, to use "wondershaper" or
similar bandwidth-limiting tool to prevent timing attacks from a global

Limit the upload speed, and then flood loads of data through to prevent
timing attacks.

It's best to link them with Ethernet crossover cable, due to the 2nd
machine with Firefox getting hacked, and then using WiFi to reveal the
names of nearby WiFi hotspots, thus giving you away.

If you use Ethernet crossover, then there is no way to leak anything about
the surroundings of the machine, especially if you use normal computer host
names like "comp", and perhaps spoof the MAC address on every boot up.

You can download (and improve if you want) this script here:


To run the script, run this:

sudo su
chmod +x anon-connection-final
./anon-connection-final start


In any event.. even if you find a problem with my particular script.. this
CONCEPT needs to be OPENLY RECOMMENDED on the Tor Project website.

The Tor Browser Bundle is LUDICROUSLY INSECURE, with the FBI using zero-day
attacks on the browser to reveal THOUSANDS of people's IP addresses.

And now the FBI wants mass Tor hacking, to hack potentially MILLIONS of Tor
users at once.

The only solution is to use Tor across 2 physical machines.

Qubes tries to achieve isolation through software VMs, but Qubes fails due
to exploits in the Xen hypervisor.

The only secure way to do it right now is across 2 machines with Ethernet
crossover cable.

Let me know what you think.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.torproject.org/pipermail/www-team/attachments/20161029/e2cb7e5f/attachment.html>

More information about the www-team mailing list