Topic: How using Tor Browser increases bitcoin theft? (Read 563 times)

Malicious exit nodes mounting MITM attacks is a vector I hadn't considered before. I had been thinking of them mainly as surveillance adversaries. I'm not actually sure this is a legitimate concern, though. It seems like attackers could do more effective analysis on regular clearnet usage to mount more effective generalized attacks on a bigger population.

Maybe DaveF could elaborate on how targeted routing analysis would make such attacks more likely. My initial reaction is that users running NoScript and/or disabling JS should be much better protected against MITM attacks than average web users too, so that's another reason why average TOR browser users should be safer.

Be careful when using Tor. Operators maintain a registry of TOR users. That is, just downloading the browser, you get into the list. Files are sent through several servers to confuse those who want to track traffic. The last server in rare cases may be yours. If you're not lucky, "they may be accused of drug trafficking. Most of the Tor traffic comes from the Darknet. Your security and anonymity are at risk on sites without an SSL certificate. It’s better to avoid sites on http and only go where there is https.

Tor browser doesn't increase Bitcoin theft, It's either you are using the wrong localbitcoin site or they are trying to stop their users from hiding their ip address.

tor will not increase nor decrease the possibility of bitcoin theft.
technically, I don't see how this can be true, and here is why:

1) Say some user choose to send traffic traverse thru Tor (via socks proxy localhost then transit its way on port 443 to LBC) via SSL engine embedded in Tor Browser
2) in some instance, this TLS session traffic enters into a monitoring exit node that logs and decrypts well known certs for meta-data extractions (like google services and other deep state firms)
3) since the private key generated x.509 cert request remained unknown, signed by CA, there is insufficient believe that 3rd party can decrypt the traffic on your LBC browing session on an Tor exit node.

However, if an website like LBC DO uses CDN service like akamia or cloudflare,etc; then things can go WRONG. This is true even for user NOT browsing with Tor:

4) Tor exit node output IP obfuscated traffic to CDN protecting or increase service capacity.  Any data you GET thru one of those CDN is not encrypted, (automatic MITM and with CDN SSL and NOT origin SSL Certs) in order for CDN to analysis and to provide filtered service. Reason being your traffic entering and exiting these node with non LBC SSL Certs.  And the session cache can be scrubbed to reveal your wallet, data, recovery seeds, password, as many other goodies with sensitive information like IP and other site you've sited (i.e blockchain.info, coinbase, any many others which also uses CDN like cloudflare).

5) CDN Exfiltrate this meta-data relating to your browsing session to a 3rd party, and re-encrypt to clear txt data to deliver the origin server that hosts actual LBC https://  content via public LBC web SSL Certs.  3rd party pays royalty to CDN like cloudflare, and in term they bragg and offers free unlimited protection for any web site.

Analysis
---------
a) 3rd party can be analytics or big data entities with deep fed banking darknet infrastructure as part of data "source" for on-going dragnet surveillance on it activity.
b) in 3, CDN most likely host origin server's authoritative resolver (acting as LBC DNS for example) and it keep logs and this statistics are normally packaged and for sale to CDN's associates and other interested 3rd Party ($$$)
c) Being existential, LBC may trade in your privacy for free LBC protection.  But since it needs to comply with BTCKYCBTC anyways to prevent being shut down, this is somewhat of a m00t point.

Now, do you see a pattern?

Genuinely curious, what do you think the average person using Tor should set up to avoid getting attacked? Anyway, I agree with you that they're covering their ass, but more from regulatory pressure than anything else.

I find such a warning just bullshit probably just away of trying to make Tor browser less popular. LocalBitcoins just recently started to become strict on KYC so what i think they are trying to do is discourage people from using Tor so that their Online presence is easily traceable.
Some People lose bitcoins to scammers anyways so long as they are connected to the web and are so careless.
- "No one is safe"
- "No system is safe"

   b) And I think this is the bigger issue. People not setting stuff up properly and getting bitten by that.

Indeed this browser is merely Firefox with Tor bundled and some default settings changed.

I didn't use this Tor browser anymore. So I don't have better idea about this one. If this one is good enough I will surely try for it.

Is there not a possibility of man in the middle stuff by the exit node? I've only ever used Tor once and found it so slow I started to blub. Good job I'm not a paedophile or drug dealer as I'd have to quit those peccadilloes if my outlets had to use it.

Any idea?

On Tuesday the Localbitcoins published a warning on its website. The notice dedicated to Tor users stated that the use of a Tor Browser exposed them to risks of Bitcoin theft. It is unknown whether the message was visible to only Tor users or others as well. The executives have not made any statements regarding the matter, and the reason behind it remains unknown.

it doesn't---no more than using firefox does.

i suspect localbitcoins is feeling very pressured by regulators (european commission, finnish government) regarding AML enforcement. i'm not sure if regulators are specifically telling them to clamp down on TOR (or VPN) usage, or if they are just trying to be proactive to please them. but this seems like an underhanded attempt to discourage IP address obfuscation techniques.

No one is safe and we know that, but now I'm curious to see what's happening and why localbitcoins are acusing tor browser, for me it's doens't make any sense, I can't find a reason that tor is riskier than another browsers 

This isn't true,

If this was for the benefit of their users would it not be helpful to tell them why it's unsafe? One doomy sentence is not really enlightening enough.

It's been weird watching Localbitcoins slowly lose it. They have a super established brand that they're slowly strangling. If I were them I'd split into one operation that still does custodial stuff and another that advertises trades but nothing else.