This restriction prevents malware from downloading past the corporate anti-virus scanners and deters someone from potentially leaking company-confidential information. My 'Tor 0day' blog series focused on one specific scenario: Can someone watching the network traffic determine if you (specifically you) were using Tor?įor example, many companies do not permit Tor within the corporate network. Snowflake introduces another connection option, but it has its own serious limitations and is far too detectable. Some of my 'Tor 0day' blog entries mentioned a lack of good pluggable transports for when someone blocks direct and indirect (bridge) connections. The main Tor-specific changes were the deprecation and removal of onion v2 support (replaced by v3 addresses) and the formal release of snowflake as a pluggable transport. There were also over a dozen updates to the Tor Browser (from version 10.0.8 to 11.0.3), but most of these were basically incorporating updates from Firefox. Over the past year, there were over a dozen updates for the Tor daemon (and that's not counting the pre-releases). Of all of the vulnerabilities and concerns that I raised in 2020, the Tor Project didn't address any of them. (The last blog entry begins with a summary of the vulnerabilities.) Other issues were brand new and first disclosed on my blog. Many of them were well-known to the Tor Project (some nearly a decade old!) but had never been addressed and had no viable mitigation options or alternatives.

Back in 2020, I wrote nine blog entries about Tor that covered a wide range of vulnerabilities.

Tor onion toolkit twitter