OSNews

There was a similar thing called Metropipe that came out a good number of months ago. They had a free download of their linux distro a while back (based off of DSL), and was still useable around a month, month and a half ago. I put it on my Linux install with an updated version of QEMU and the KQEMU accelerator - much better with KQEMU Important thing was to edit the .bat launcher to use more ram.

The article writer mentioned 'totally secure.' How exactly do you achieve this? Suppose I'm running off a wireless network, unsecured, at my local internet cafe, and I'm jonesin' to check my e-mail, man, *THROBBING* to check my e-mail. But my e-mail doesn't do HTTPS://.

Won't the plain-jane transmission have to be sent through my wifi AP, or will it be encrypted before it even hits the airwaves?

How does this stop key stroke loggers, screen grabbers, etc. from working? It isn't booting into Linux, it's just running a virtual machine on the (potentially spyware infested) untrusted machine.

You must always assume that any public workstation (especially internet cafes and libraries) has keystoke logging software installed. This isn't a good idea for secure connections in anyway. (Also the data goes throught tor proxies. Do you trust them too?)

"This provides a totally secure way to access your data, even when using an internet cafe PC or an untrusted network."

Using this on an untrusted computer can't be "totally secure." It won't prevent key logging, etc...

DSL rocks! I usually just download the embedded version and run that from Windows and try it that way. It's probbably not secure this way, but for me it works fine. If this runs on a 128 stick, imagine what I can do with the extra space on my 1 gig stick

You are correct in punching holes in my Cybercafe scenario. If you're on an untrusted computer, a keystroke logger or screen grabber would be a potential weak spot. And "totally secure" is probably too strong a term to use when describing anything computer-related.

in the local public library in my hometown a user can not get access to the public computer's perifrials, all you can access is mouse & keyboard and monitor...

not sure about other internet cafes as there are none here...

Tor isn't about securing your data, it's about making sure not one single proxy (or eavesdropper) is able to trace it back to your specific IP address. The packets are still perfectly readable on both the tor nodes and beyond the exit points. If you need to also protect the contents of the packets, use end to end encryption.

Either way, it's virtually impossible (or should be anyway) to both trace a single data stream and to capture enough of it to make sense from it. Single packets, or even a couple in a row don't pose much of a threat unless your password happens to be in them in cleartext..in which case you did something wrong anyway.

Either way, the EFF can explain it a lot better than I can, so please read http://tor.eff.org/ for more information on tor and how it works. And please do use SSL for everything you do :-)

Good review David, I'll deffo be looking at something similair.

Thom

I have no beef with the review - I think it was good for such an unbelievably bad product.

Linux on the net today is like what search engines/directories were back in 96 - linux is everywhere and people are customizing it to such extents where you've got at least 500 distributions available. Now why someone would pay $45 for this product is beyond me. The makes obviously wants to make some dough, but why should we (the users) buy this?

It does not offer protection against key logging, it does not boot from the flash drive, and it offers no guarantee that it will be usable when the admins of the computer disable the USB ports not to mention that there could be free alternatives out there.

I agree it was a decent review. I do not see what justifies the price, from what I can gather the jump drive is not included in the $45.00 price. The only thing that makes this any different than other live distro's is the novelty of TOR coupled with privoxy, which are both very easy to setup and are lightweight anyway.

If you're worried about keylogging then couldn't you just install an onscreen keyboard program on the virtual machine? You could just use it when typing passwords or sensitive e-mails or whatever. As for packet sniffing, you should already be using encryption for anything you wouldn't want seen (like e-mail) so that seems like it'd be a fairly useful produce so long as you have access to a USB port. Of course, if the contents of the virtual RAM found their way into the paging file that could be a problem, as would an admin using VNC or a video recorder on the monitor to watch the screen, so it's not for the uber-paranoid. It does, however, seem like a decent solution for the porn-seeking student or minor activists in repressive societies though.

I forgot to mention that all in all it was a decent review of an interesting product. Of course the whole idea of booting a linux VM from an USB key just to use tor is a bit over the top. I can imagine a couple of other mechanisms which could be used to achieve the same effect, but without forcing users to change to using a linux VM. And $40 for such a device, well, you can argue about price, but IMO it's not that much for something which has obviously cost a lot of effort to put together.

Anyway, this review is a nice change from all the news bites and the inflamatory editorials :-)

A nice progression from the livecd distro. But it need to go further by for example integrating with the home host (if linux) and allow the reconciliation of some documents and some apps configs.

But 512MB would be a lot more appropriate for that matter and still pretty cheap.

If you know about Tor, you know there are a two main weaknesses. Application leaks and DNS leaks. Tor Desktop solves both of these problems.

An application leak is when a client connects to a server and sends information that can identify the client. Most important to protect is the LOCAL IP address. If you're on a LAN it will be some private address such as 192.168.1.100, but if you are directly connected to the internet your LOCAL IP address is your real IP address and you don't want that leaking out to the internet. If you boot directly from USB then it is possible you are using your real IP address. However, by running inside of Qemu, it provides a virtual IP address in the 10.*.*.* range. Any applications that run will only know about this address and this address is safe to leak.

DNS leaks are more simple. This is when you resolve a domain name to an IP address directly without proxying it. If you send DNS queries directly then it is obvious to eavesdroppers what addresses you are interested in. Tor Desktop overcomes this with a DNS server that routes all queries through Tor using Tor's resolve protocol.

Anything you do through Tor can be spied upon by the proxy at the end of the chain. They won't be able to tell *who* requested the information, but they can read it. This means that it is a dangerous idea for you to use Tor to access sites that require passwords like your webmail/pop3/imap/telnet. You just have to trust that the last proxy in the chain is run by an honest person.

It would be safer to use something like SSH over Tor, where the password is not sent as plaintext.

Just like in Mother Russia, when the Communists moved in, we had to develop a thriving underground economy to serve the interests of the people.

Now that the industrio-socialists have seized America, well, it is good that the TOR is there. It is a beginning.

When all of an American's tax dollars go to the mighty war machine and to the bankers, there must be a way for people to get bread and vodka.

Bravo, EFF for making TOR.

Metropipe has something called the "Portable Virtual Privacy Machine" (likely the same thing as this uses) available as a free download at their website. It does use a demo of the "Metropipe Tunneler" though, rather than normal ol' Tor, but I'm sure there's a way to install the more desirable option.

http://www.metropipe.net/ProductsPVPM.shtml

using one time passwords is a way to perfectly circumvent that problem

I thought it was a GREAT concept - so great I bought one. (where I live, a 128 Jumpdrive would have cost $30 US by itself) and Tor isn't the easiest thing to set up -especially for someone as "geek-challenged" as I. It works pretty much like the reviewer said - of course, when "running" it on a PII 400, which is well above the requirements for DSL, it was more like crawling, as the host system used most of the resources before QEMU even loaded. Then I found ELE ("Everything Leaves Encrypted") http://www.northernsecurity.net/download/ele/ which is essentially the same idea - except it has a virtual keyboard (for the keylogger moments), is a free download, and burns to a bootable ISO or USB Stick and which doesn't seem to suffer from "DNS leaks"

I still think it's a great concept, and I believe in supporting the F/LOSS community - but while Virtual Privacy Machines doesn't offer a refund on their product, ELE doesn't need one.