Oniux: Kernel-level Tor network isolation for any Linux app

a year ago by TheTwelveYearOld to c/linux

Introducing oniux: Kernel-level Tor isolation for any Linux app. This torsocks alternative uses namespaces to isolate Linux applications over the Tor network and eliminate data leaks.

LainTrain 17 points a year ago

So it's basically to stop various glowware from calling home by detecting socks and bypassing it to use another network interface. Neat.

save

path: 0 17399474, hotness: undefined, score: 17, children: 5

TheTwelveYearOld 4 points a year ago

What's glowware?

save

path: 0 17399474 17400718, hotness: undefined, score: 4, children: 4

tomalley8342 13 points a year ago

When you describe something as "glowing", you are implying some sort of government or law enforcement interference. It was coined on 4chan's /g/ board and spread by /pol/ (as they often do) while they were in their infatuation phase with TempleOS creator Terry Davis, who was quoted as saying "The CIA n*****s glow in the dark, you can see them if you're driving. You just run them over, that's what you do".

save

path: 0 17399474 17400718 17404918, hotness: undefined, score: 13, children: 1

LainTrain 1 point a year ago

Yes

save

path: 0 17399474 17400718 17404918 17406849, hotness: undefined, score: 1, children: 0

billwashere 1 point a year ago

I’ve heard of ghostsocks but not glowware.

save

path: 0 17399474 17400718 17403496, hotness: undefined, score: 1, children: 0

liang -6 points a year ago

save

path: 0 17399474 17400718 17404647, hotness: undefined, score: -6, children: 0

pastermil 4 points a year ago

Honest question: hasn't the Tor network been proven to have been broken by the feds in that the anonimity of their users were no longer guaranteed?

save

path: 0 17408755, hotness: undefined, score: 4, children: 4

foremanguy92_ 6 points a year ago

I think that the Tor network is proven to be broken by feds if you are suspicious.

The Tor network was in fact used to reveal the identity of someone (https://www.techradar.com/...) but as we don't know the truth we cannot really make conclusion but we can act that :

(Tor is always more secure if you're opsec is great from the beginning)

For example you're one of the biggest drug dealer and you're doing 100 000 of deaths every say, for sure they will cramp up to you and find you, succeeding to deanonymize you.

But most of the time you are not that attractive so you will be mostly anonymous. They can target an entity to reveal it but cannot deanonynize the entire network

save

path: 0 17408755 17410139, hotness: undefined, score: 6, children: 2

theblips 1 point a year ago

Source on the first statement?

save

path: 0 17408755 17410139 17464489, hotness: undefined, score: 1, children: 1

foremanguy92_ 1 point a year ago

Gonna modify it a bit as sure it's not that true

save

path: 0 17408755 17410139 17464489 17473704, hotness: undefined, score: 1, children: 0

theblips 1 point a year ago

It hasn't, it's just that good opsec is impossible in the long run and everyone is bound to be deanonymized eventually. For example, if you're using a clean account on a CP sharing forum, it's possible to track your mannerisms and post history (content, timezone, etc) to get an estimate of where you live. Then they can subpoena the ISPs for IP traffic in that region and figure out who is using Tor. That subset of IPs may then be cross referenced with the time that suspect's account posted, that can be used as probable cause for a warrant... That sort of stuff. Sounds super complicated but most of it can be automated and bypassed these days (I don't think you actually need to subpoena for example).
Where did the suspect fail? He should have used multiple accounts, spaced out the interactions more randomly, used stolen WiFi, ran his comments through a translator and back, etc. At no point did Tor fail at securing his IP address end to end

save

path: 0 17408755 17464479, hotness: undefined, score: 1, children: 0

robotrono 1 point a year ago

This looks interesting and appears to be somewhat similar to vopono which allows any app to be run in a separate namespace via a VPN provider.

save

path: 0 17417417, hotness: undefined, score: 1, children: 0

fruitycoder 1 point a year ago

I wonder how hard this would be to run as sidecar container in k8s. Like is there a way to capture every process in a system cleanly with it?

save

path: 0 17435341, hotness: undefined, score: 1, children: 0

Rules

Related Communities

Rules

Related Communities