Blog TUVPN.COM

Finally, and as we promised some time ago , we will address this important question:

Why not use TOR, which is a free service, for providing anonymity and privacy online?

To the layman, TOR is defined as:

TOR is a free software and open network that helps protect you from all forms of online surveillance and threats to your personal freedom and privacy. Tor protects you by routing your communications through a network of servers distributed around the world and provided / managed by volunteers.

In this sense, the objective of TOR and a VPN service such as TUVPN.COM is the same. Protecting the security, privacy and anonymity of your communications. One of the differences, as you may have already noticed, is that there is usually a small fee attached to accessing a VPN service, while TOR is free. In this difference lies the core advantages / disadvantages of both options.

Let us now graphically look at the TOR network structure. It is important to emphasise again that this is a network created from servers offered and run by volunteers. Looking at the implications of this is point:

As we can see, our communication enters the TOR network through an entry node, then it tumbles from one server to another within the network and finally reaches a TOR exit node, and from there to our Internet destination. The communication is encrypted from your computer to the exit node that decrypts it before sending it to its destination.

Anyone can create a TOR node and add it to the network. This can be for honest and selfless reasons, or not. You can't choose whether your node will be an entry, exit, or intermediate node as this is random in each communication but it will probably go through all the roles at some point.

Imagine now that we are very bad and we decide to create our own TOR server node and add it to the network to serve our own purposes …  Let's see how much evil we can do depending on the role of our server in each communication. Lets use innocent "John" in this example. Remember, our server will go through all the server node roles according to TOR's random design:

1 - Our server acts as a TOR input node for John's communication.

As the communication we received from John is encrypted, the only thing we know is that John is connected to the TOR network (we can identify his IP). But knowledge of this alone is not important enough to feed our bad intentions.

2 - Our server acts as an intermediate node in John's communication on the TOR network.

Our evil intentions are not satisfied here either. The communication we recieve is encrypted and all we know is that it has come from a node on the TOR network before reaching us. Hopefully the next role our server can play on the TOR network will provide food for our evil appetite!

3 - Our server acts as a TOR exit node for John's communication.

Now things get interesting for our evil intent! Our mission here is to decipher the communication through our exit node and send it to your destination. In so doing, we can see all data communication. We cannot know who sent the now transparent communication, we only know that we received it from an intermediate TOR node.

We can argue that by protecting the communication with the target (eg our bank or our e-mail or …) with SSL, there is no way for us to get to know the contents of John's communications.

Wrong again. As security researcher Moxie Marlinspike showed at the last  BlackHat Europe, we can mount a man-in-the-middle attack from our beloved TOR exit server and crack John's SSL communications.

Moxie gave a real-time demonstration of this attack that obtained a large number of passwords for all kinds of services from many users whose traffic was going through his TOR node. For more complete information about this topic: http://blog.phishme.com/2009/02/moxie-marlinspike-un-masks-tor-users/.

So we can see that the very nature of decentralised and distributed communication on the TOR network brings some problems.

Another drawback, in our humble opinion, of TOR vs a VPN service, is speed. Anyone who has used TOR for something more than just reading emails will know what we are talking about. Unfortunately, bandwidth has a price. Free and open services like TOR just cannot deliver this bandwidth.

By contrast, a VPN provider such as TUVPN.COM, has the resources to secure and supply this bandwidth for their services, and allow its customers to enjoy streaming and other bandwidth intensive activities. Something that is unthinkable with TOR.

There is no doubt that TOR has its uses, if one is aware of its limitations. All the same, VPN services also have their uses and , most probably, their limitations. It is just a matter of being able to choose and with the right information come the right decisions !

PS: Not to add fuel to the fire, but this week has seen TOR in the news. It has asked its users to upgrade their software as a result of attacks on its servers that run TOR directory authorities. More information:  http://news.zdnet.co.uk/security/0,1000000189,40004185,00.htm

TUVPN.COM Team

Go to TUVPN.COM

Bien, finalmente y tal como prometimos ya hace un tiempo , vamos a abordar la crítica pregunta :

Y porqué no usar TOR para el anonimato y privacidad online, que además es gratis ?

Para los profanos en la materia, TOR se define como :

TOR es un software libre y red abierta, que ayuda a protegerte de toda forma de vigilancia online que limite y amenace tu libertad personal y privacidad. TOR te protege, enrutando tus comunicaciones a través de una red de servidores distribuida por todo el mundo y proporcionada/gestionada por voluntarios.

En este sentido, el objetivo de TOR o de un servicio VPN como TUVPN.COM, es el mismo. Proteger la privacidad y anonimato de tus comunicaciones. La diferencia principal, y de la que ya te habrás dado cuenta, es el hecho de que un servicio VPN generalmente es privado y de pago y TOR es libre y gratuito. En esta diferencia estriban las ventajas/inconvenientes de las dos opciones.

Centrémonos ahora gráficamente en la estructura de la red TOR, recordando que esta es una red creada a partir de servidores ofrecidos y administrados por voluntarios, y viendo las implicaciones de este punto :

Como podemos ver, nuestra comunicación entra en la red TOR a través de un nodo de entrada, luego va saltando de un servidor a otro dentro de la red y finalmente sale de TOR por un nodo de salida y de ahí a nuestro destino. La comunicación está cifrada desde nuestro ordenador hasta el nodo de salida que la desencripta antes de enviarla a nuestro destino.

Como también hemos dicho, CUALQUIERA puede crear un nodo TOR y agregarlo a la red, sea con fines honestos y desinteresados o no. No puede elegir si su nodo será de entrada, de salida o intermedio, esto es aleatorio en cada comunicación, pero probablemente pasará por todos los roles en algún momento.

Imaginemos ahora, que somos muy malos y hemos decidido crear nuestro propio servidor TOR para realizar nuestras maldades … lo creamos, instalamos software y se añade a la red TOR. Veamos cuanta maldad podemos hacer según el rol que le toque a nuestro servidor en cada comunicación de Juan (recordemos nuestro servidor pasará por todos los roles por el mismo diseño aleatorio de TOR!) :

1 - Nuestro servidor actúa como nodo TOR de entrada para la comunicación de Juan

Como la comunicación que recibimos de Juan está cifrada, lo único que podemos saber es que Juan se comunica con la red TOR (podemos identificar su IP), pero esto no lo consideraríamos una maldad suficientemente importante.

2- Nuestro servidor actúa como nodo TOR intermedio para la comunicación de Juan

Tampoco vamos bien por aquí. La comunicación que recibimos está cifrada y además solo podemos saber que viene del nodo TOR anterior. Esperemos tener más suerte con el próximo rol !

3 - Nuestro servidor actúa como nodo TOR de salida para la comunicación de Juan

El índice de maldad se pone interesante ! La misión de nuestro nodo aquí es descifrar la comunicación y enviarla a su destino. En este sentido podemos ver todos los datos de la comunicación. No podemos saber quién los envió (solo sabemos que nos llegó del nodo TOR anterior).

Podemos argumentar, que protegiendo la comunicación con el destino (p.e. nuestro banco o nuestro correo electrónico o …) con SSL, no habrá forma de que nos salgamos con la nuestra y podamos averiguar el contenido de la comunicación de Juan.

Falso de nuevo. Como el investigador de seguridad Moxie Marlinspike demostró en la pasada BlackHat Europe, podemos montar un ataque man-in-the-middle en nuestro querido servidor TOR de salida y romper las comunicaciones SSL de Juan.

Moxie hizo una demostración del ataque en tiempo real y consiguió una gran cantidad de passwords para todo tipo de servicios de muchos de los usuarios cuyo tráfico circuló por su especial nodo. Para información más completa sobre este tema: http://blog.phishme.com/2009/02/moxie-marlinspike-un-masks-tor-users/.

Así pues como vemos, la propia naturaleza distribuida y de control descentralizado de TOR acarrea sus problemas.

Otra de las desventajas, según nuestra humilde opinión, de TOR respecto a un servicio VPN es la velocidad. Cualquiera que haya usado TOR para algo más que leer correos … sabrá de que estamos hablando. El ancho de banda tiene un precio, y el hecho de usar un servicio libre y gratuito hace que las prestaciones del mismo sean limitadas.

En este sentido un proveedor VPN como TUVPN.COM, tiene más recursos económicos para contratar mayor ancho de banda para sus servidores y posibilitar p.e. su uso para streaming, cosa impensable de hacer con TOR.

TOR tiene sus usos, si se es consciente de sus limitaciones. Igualmente un servicio VPN tiene sus usos y muy probablemente limitaciones de otro tipo. En la oferta hay el gusto y con la información la elección acertada !.

P.D: No es para echar más leña al fuego, pero esta semana se ha descubierto un compromiso de los servidores de desarrollo de TOR, lo que podría haber comprometido la seguridad de sus usuarios si el software de TOR fué modificado. Mas información: http://informaniaticos.blogspot.com/2010/01/los-servidores-proyecto-tor-han-sido.html.

Equipo TUVPN.COM

Ir a TUVPN.COM

Go to TUVPN.COM

Go to TUVPN.COM

Go to TUVPN.COM

VPN or Virtual Private Network is an old concept in the world of computing. One possible definition is:

Safe communication method between two points through a public network

Security of your communication is ensured via encryption. Encryption algorithms are applied to the communication, making sure that nobody on the public network (Internet) can access the contents of your communication between two points. In effect it creates a private 'tunnel' between two points.

VPNs have many advantages and uses. Secure and low cost inter-office connection, secure remote access to systems, and private networking on the Internet to name just a few.

VPNs is becoming fashionable. VPN service providers such as TUVPN.COM , provide a solution to the growing concern the general public has about privacy and anonymity on the Internet.

Online privacy threats come from many fronts, starting with the Internet Service Providers (ISPs) that can analyze the traffic generated by users to create profiles of navigation and consumption. This information can then be sold to third parties for unsolicited marketing etc. Governments themselves create systems and organisations to collect and analyze massive amounts of Internet traffic. This is often argued to be done in the public interest, but where is the line drawn? How do we know where are information ends up? We can all remember cases of Government leakage of private information. There is a long string of companies and organizations who traffic our private data, collected through more or less transparent ways for all kinds of purposes. Do you wonder how spam emails end up getting to you?

VPN service providers such as TUVPN fit in this world? Generally we will put at your disposal one or more of our servers in different geographic locations to allow you to connect to the internet through our VPN client. ALL traffic between your computer and our VPN server that you are connecting to is encrypted and NOBODY can see or identify the content of that traffic. In this sense, the VPN service offers privacy between your computer and the VPN server chosen by you.

Your Anonymity is provided via the concealment of your IP (Internet Protocol address), which is that unique signature/number that identifies you and your location. TUVPN.COM, like many VPN service providers, has a non-logging policy which means we do not store any information on the networking activity of our clients.

Through the careful selection of your VPN server provider, you can be sure that only you hold information on your Internet traffic…..browsing, emails, messaging etc.

Obviously, the key to using these services is trusting the integrity of the VPN provider and being comfortable that they deliver guarantees of anonymity and privacy. This is why a careful choice is necessary and highly advisable.

Many would say that if you do nothing wrong you have nothing to hide. This hits upon the eternal discussion on individual liberties and the limits and boundaries governments, corporations, and lobbyists continually debate. Ask yourself this question; Do you lock the door of your house when you leave? You would say, 'yes', and yet do you have anything to hide in your house? Probably not, but you want to make sure that what is private to you is secure and cannot be accessed by anyone without your control. Why therefore would we not want to put a lock on a part of our lives that is becoming more and more important in our day-to-day activities….banking, communication etc etc

Good uses of a VPN service are many and we will be detailing these in the following posts. As with so many things in life, VPN services can be perverted by users to other undesirable purposes, but why should this limit the availablity of such a service to the general public with legitimate uses.

TUVPN.COM Team

Go to TUVPN.COM

Go to TUVPN.COM