[OTR-users] Using OTR with Tor on a Mac?

[Daniel Perelman]

Replies inline.

On Thu, Mar 10, 2011 at 16:56, Katharine Krauss <Katie at critpath.org> wrote:
> Hi,
> I'm moving along better thanks to Kat's help; I appreciate the help of other
> members of the group as well.
> My goal is to use OTR chat with Tor.
> I've never used Tor as a user, only making a relay & bridge.
>
> So, is this correct?
> I open up Tor,
> Click on "run as a client only" (do I need to configure anything else to use
> Tor as a user & not a relay or bridge?)

I have not used Tor on OS X, so I cannot comment on the details of the
interface. In my experience, Tor offers a SOCKS proxy that other
applications can use by going into each application's network settings
and putting in the proxy location which should be your computer
("localhost") and whatever port number Tor is using. Then all of the
application's traffic except DNS requests (see:
https://trac.torproject.org/projects/tor/wiki/TheOnionRouter/TorFAQ#IkeepseeingthesewarningsaboutSOCKSandDNSandinformationleaks.ShouldIworry
) will travel through Tor. I believe on OS X there is a global proxy
settings option in the network settings that you could also use (which
your Tor client may already be setting for you).

>
> a browser (?) named Namoroka opens In Tor.

Namoroka is just the development codename for Firefox 3.6, as Firefox
3.6 was released a while ago, I am not sure why your browser would be
identifying itself as a development build.

> Is it OK to allow a few scripts:
>
> www.google.com, www.ig.gmodules.com ?
>
> Is it ok for me to allow Javascript?
That's a complicated question. Tor hides only which computer you are
sitting at. Your browser (even without Javascript) may be giving
enough information to identify you by. See:
https://www.eff.org/deeplinks/2010/01/help-eff-research-web-browser-tracking
. Truly anonymous web browsing is not an easy problem.

> I can't actually see how, though.
> Browser preferences says it's already available, but it doesn't show up in
> Namoroka so no Gmail, no Google chat.
Sorry, I cannot help you there without more information. Try the
Firefox's help / discussion boards.

>
> Then I go to Adium, and chat in Google Chat through Adium.
>
> Here's the thing: I don't understand the relationship between Adium and Tor.
> Exactly how do should use Adium under Tor?
I believe I answered this above. Basically, Adium's proxy settings
have to be set to use the proxy Tor is providing.

> If you can help--thank you.  Plain, plain English works best.
>
> I have a Mac & use 10.6.6
> Firefox 3.6.15 plus this Namoroka thingy (browser?).
>
> Many thanks,
>
> Kate

I am not entirely sure what you are trying to gain by using OTR over
Tor. I suspect most IM protocols already used SSL between the client
and the IM server (I know Google Talk and AIM do, at least), so all
Tor adds there is that an eavesdropper won't be able to tell you are
on Google Talk (although they will probably be able to guess that you
are using some IM protocol by noticing that you are sending small
messages at irregular intervals that look vaguely like the response
time in a conversation). Google will, of course, still know you are on
Google Talk, but will not know what computer you are using (so they
will not be able to, for example, guess your physical location).

  - Daniel