mirror of
https://github.com/privacyguides/i18n.git
synced 2025-06-29 05:42:36 +00:00
New Crowdin translations by GitHub Action
This commit is contained in:
Crowdin Bot
@ -6,6 +6,86 @@ description: Tor è una rete decentralizzata e libera, progettata per utilizzare
|
||||
|
||||
Tor è una rete decentralizzata e libera, progettata per utilizzare Internet con quanta più privacy possibile. Se utilizzata adeguatamente, la rete consente navigazione e comunicazioni private e anonime.
|
||||
|
||||
## Safely Connecting to Tor
|
||||
|
||||
Before connecting to [Tor](../tor.md), you should carefully consider what you're looking to accomplish by using Tor in the first place, and who you're trying to hide your network activity from.
|
||||
|
||||
If you live in a free country, are accessing mundane content via Tor, aren't worried about your ISP or local network administrators having the knowledge that you're using Tor, and want to help [de-stigmatize](https://2019.www.torproject.org/about/torusers.html.en) Tor usage, you can likely connect to Tor directly via standard means like [Tor Browser](../tor.md) without worry.
|
||||
|
||||
If you have the ability to access a trusted VPN provider and **any** of the following are true, you almost certainly should connect to Tor through a VPN:
|
||||
|
||||
- You already use a [trusted VPN provider](../vpn.md)
|
||||
- Your threat model includes an adversary which is capable of extracting information from your ISP
|
||||
- Your threat model includes your ISP itself as an adversary
|
||||
- Your threat model includes local network administrators before your ISP as an adversary
|
||||
|
||||
Because we already [generally recommend](../basics/vpn-overview.md) that the vast majority of people use a trusted VPN provider for a variety of reasons, the following recommendation about connecting to Tor via a VPN likely applies to you. <mark>There is no need to disable your VPN before connecting to Tor</mark>, as some online resources would lead you to believe.
|
||||
|
||||
Connecting directly to Tor will make your connection stand out to any local network administrators or your ISP. Detecting and correlating this traffic [has been done](https://edition.cnn.com/2013/12/17/justice/massachusetts-harvard-hoax/) in the past by network administrators to identify and deanonymize specific Tor users on their network. On the other hand, connecting to a VPN is almost always less suspicious, because commercial VPN providers are used by everyday consumers for a variety of mundane tasks like bypassing geo-restrictions, even in countries with heavy internet restrictions.
|
||||
|
||||
Therefore, you should make an effort to hide your IP address **before** connecting to the Tor network. You can do this by simply connecting to a VPN (through a client installed on your computer) and then accessing [Tor](../tor.md) as normal, through Tor Browser for example. This creates a connection chain like:
|
||||
|
||||
- [x] You → VPN → Tor → Internet
|
||||
|
||||
From your ISP's perspective, it looks like you're accessing a VPN normally (with the associated cover that provides you). From your VPN's perspective, they can see that you are connecting to the Tor network, but nothing about what websites you're accessing. From Tor's perspective, you're connecting normally, but in the unlikely event of some sort of Tor network compromise, only your VPN's IP would be exposed, and your VPN would *additionally* have to be compromised to deanonymize you.
|
||||
|
||||
This is **not** censorship circumvention advice, because if Tor is blocked entirely by your ISP, your VPN likely is as well. Rather, this recommendation aims to make your traffic blend in better with commonplace VPN user traffic, and provide you with some level of plausible deniability by obscuring the fact that you're connecting to Tor from your ISP.
|
||||
|
||||
---
|
||||
|
||||
We **very strongly discourage** combining Tor with a VPN in any other manner. Do not configure your connection in a way which resembles any of the following:
|
||||
|
||||
- You → Tor → VPN → Internet
|
||||
- You → VPN → Tor → VPN → Internet
|
||||
- Any other configuration
|
||||
|
||||
Some VPN providers and other publications will occasionally recommend these **bad** configurations to evade Tor bans (exit nodes being blocked by websites) in some places. [Normally](https://support.torproject.org/#about_change-paths), Tor frequently changes your circuit path through the network. When you choose a permanent *destination* VPN (connecting to a VPN server *after* Tor), you're eliminating this advantage and drastically harming your anonymity.
|
||||
|
||||
Setting up bad configurations like these is difficult to do accidentally, because it usually involves either setting up custom proxy settings inside Tor Browser, or setting up custom proxy settings inside your VPN client which routes your VPN traffic through the Tor Browser. As long as you avoid these non-default configurations, you're probably fine.
|
||||
|
||||
---
|
||||
|
||||
!!! info "VPN/SSH Fingerprinting"
|
||||
|
||||
The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns.
|
||||
|
||||
Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind.
|
||||
|
||||
If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction.
|
||||
|
||||
Determining whether you should first use a VPN to connect to the Tor network will require some common sense and knowledge of your own government's and ISP's policies relating to what you're connecting to. However, again in most cases you will be better off being seen as connecting to a commercial VPN network than directly to the Tor network. If VPN providers are censored in your area, then you can also consider using Tor pluggable transports (e.g. Snowflake or meek bridges) as an alternative, but using these bridges may arouse more suspicion than standard WireGuard/OpenVPN tunnels.
|
||||
|
||||
## What Tor is Not
|
||||
|
||||
The Tor network is not the perfect privacy protection tool in all cases, and has a number of drawbacks which should be carefully considered. These things should not discourage you from using Tor if it is appropriate for your needs, but they are still things to think about when deciding which solution is most appropriate for you.
|
||||
|
||||
### Tor is not a free VPN
|
||||
|
||||
The release of the *Orbot* mobile app has lead many people to describe Tor as a "free VPN" for all of your device traffic. However, treating Tor like this poses some dangers compared to a typical VPN.
|
||||
|
||||
Unlike Tor exit nodes, VPN providers are usually not *actively* [malicious](#caveats). Because Tor exit nodes can be created by anybody, they are hotspots for network logging and modification. In 2020, many Tor exit nodes were documented to be downgrading HTTPS traffic to HTTP in order to [hijack cryptocurrency transactions](https://therecord.media/thousands-of-tor-exit-nodes-attacked-cryptocurrency-users-over-the-past-year). Other exit node attacks such as replacing downloads via unencrypted channels with malware have also been observed. HTTPS does mitigate these threats to an extent.
|
||||
|
||||
As we've alluded to already, Tor is also easily identifiable on the network. Unlike an actual VPN provider, using Tor will make you stick out as a person likely attempting to evade authorities. In a perfect world, Tor would be seen by network administrators and authorities as a tool with many uses (like how VPNs are viewed), but in reality the perception of Tor is still far less legitimate than the perception of commercial VPNs, so using a real VPN provides you with plausible deniability, e.g. "I was just using it to watch Netflix," etc.
|
||||
|
||||
### Tor usage is not undetectable
|
||||
|
||||
**Even if you use bridges and pluggable transports,** the Tor Project provides no tools to hide the fact that you are using Tor from your ISP. Even using obfuscated "pluggable transports" or non-public bridges do not hide the fact that you are using a private communications channel. The most popular pluggable transports like obfs4 (which obfuscates your traffic to "look like nothing") and meek (which uses domain fronting to camouflage your traffic) can be [detected](https://www.hackerfactor.com/blog/index.php?/archives/889-Tor-0day-Burning-Bridges.html) with fairly standard traffic analysis techniques. Snowflake has similar issues, and can be [easily detected](https://www.hackerfactor.com/blog/index.php?/archives/944-Tor-0day-Snowflake.html) *before* a Tor connection is even established.
|
||||
|
||||
Pluggable transports other than these three do exist, but typically rely on security through obscurity to evade detection. They aren't impossible to detect, they are just used by so few people that it's not worth the effort building detectors for them. They shouldn't be relied upon if you specifically are being monitored.
|
||||
|
||||
It is critical to understand the difference between bypassing censorship and evading detection. It is easier to accomplish the former because of the many real-world limitations on what network censors can realistically do en masse, but these techniques do not hide the fact that you—*specifically* you—are using Tor from an interested party monitoring your network.
|
||||
|
||||
### Tor Browser is not the most *secure* browser
|
||||
|
||||
Anonymity can often be at odds with security: Tor's anonymity requires every user to be identical, which creates a monoculture (the same bugs are present across all Tor Browser users). As a cybersecurity rule of thumb, monocultures are generally regarded as bad: Security through diversity (which Tor lacks) provides natural segmentation by limiting vulnerabilities to smaller groups, and is therefore usually desirable, but this diversity is also less good for anonymity.
|
||||
|
||||
Additionally, Tor Browser is based on Firefox's Extended Support Release builds, which only receives patches for vulnerabilities considered *Critical* and *High* (not *Medium* and *Low*). This means that attackers could (for example):
|
||||
|
||||
1. Look for new Critical/High vulnerabilities in Firefox nightly or beta builds, then check if they are exploitable in Tor Browser (this vulnerability period can last weeks).
|
||||
2. Chain *multiple* Medium/Low vulnerabilities together until they get the level of access they're looking for (this vulnerability period can last months or longer).
|
||||
|
||||
Those at risk of browser vulnerabilities should consider additional protections to defend against Tor Browser exploits, such as using Whonix in [Qubes](../os/qubes-overview.md) to contain your Tor browsing in a secure VM and protect against leaks.
|
||||
|
||||
## Costruzione del percorso verso i servizi Clearnet
|
||||
|
||||
I "servizi Clearnet" sono siti web accessibili da qualsiasi browser, come [privacyguides.org](https://www.privacyguides.org). Tor ti consente di collegarti anonimamente a questi siti web indirizzando il tuo traffico attraverso una rete composta da migliaia di server gestiti da volontari, detti nodi (o relay).
|
||||
@ -76,13 +156,34 @@ Tor consente di connetterci a un server senza che alcuna signola parte conosca l
|
||||
|
||||
Sebbene Tor fornisca forti garanzie per la privacy, devi essere consapevole che Tor non è perfetto:
|
||||
|
||||
- Gli avversari ben finanziati, capaci di osservare passivamente gran parte del traffico di rete nel globo, sono capaci di deanonimizzare gli utenti di Tor, tramite l'analisi avanzata del traffico. Tor non ti protegge nemmeno dal rischio di esporti per errore, ad esempio, se condividi troppe informazioni sulla tua vera identità.
|
||||
- I nodi d'uscita di Tor, inoltre, possono monitorare il traffico che li attraversa. Ciò significa che il traffico non crittografato, come quello in HTTP semplice, è registrabile e monitorabile. Se tale traffico contiene informazioni personali identificative, può deanonimizzarti a quel nodo d'uscita. Pertanto, consigliamo di utilizzare HTTPS su Tor, laddove possibile.
|
||||
- Tor never protects you from exposing yourself by mistake, such as if you share too much information about your real identity.
|
||||
- Tor exit nodes can **modify** unencrypted traffic which passes through them. This means traffic which is not encrypted, such as plain HTTP traffic, can be changed by a malicious exit node. **Never** download files from an unencrypted `http://` website over Tor, and ensure your browser is set to always upgrade HTTP traffic to HTTPS.
|
||||
- I nodi d'uscita di Tor, inoltre, possono monitorare il traffico che li attraversa. Unencrypted traffic which contains personally identifiable information can deanonymize you to that exit node. Again, we recommend only using HTTPS over Tor.
|
||||
- Powerful adversaries with the capability to passively watch *all* network traffic around the globe ("Global Passive Adversaries") are **not** something that Tor protects you against (and using Tor [with a VPN](#safely-connecting-to-tor) doesn't change this fact).
|
||||
- Well-funded adversaries with the capability to passively watch *most* network traffic around the globe still have a *chance* of deanonymizing Tor users by means of advanced traffic analysis.
|
||||
|
||||
Se desideri utilizzare Tor per navigare sul web, consigliamo soltanto il Tor Browser **ufficiale**, progettato per evitare il fingerprinting.
|
||||
|
||||
- [Tor Browser :material-arrow-right-drop-circle:](../tor.md#tor-browser)
|
||||
|
||||
### Protections provided by bridges
|
||||
|
||||
Tor bridges are commonly touted as an alternative method to hiding Tor usage from an ISP, instead of a VPN (as we suggest using if possible). Something to consider is that while bridges may provide adequate censorship circumvention, this is only a *transient* benefit. They do not adequately protect you from your ISP discovering you connected to Tor in the *past* with historical traffic log analysis.
|
||||
|
||||
To illustrate this point, consider the following scenario: You connect to Tor via a bridge, and your ISP doesn’t detect it because they are not doing sophisticated analysis of your traffic, so things are working as intended. Now, 4 months go by, and the IP of your bridge has been made public. This is a very common occurrence with bridges, they are discovered and blocked relatively frequently, just not immediately.
|
||||
|
||||
Your ISP wants to identify Tor users 4 months ago, and with their limited metadata logging they can see that you connected to an IP address which was later revealed to be a Tor bridge. You have virtually no other excuse to be making such a connection, so the ISP can say with very high confidence that you were a Tor user at that time.
|
||||
|
||||
Contrast this with our recommended scenario, where you connect to Tor via a VPN. Say that 4 months later your ISP again wants to identify anybody who used Tor 4 months ago. Their logs almost certainly can identify your traffic 4 months ago, but all they would likely be able to see is that you connected to a VPN’s IP address. This is because most ISPs only retain metadata over long periods of time, not the full contents of the traffic you request. Storing the entirety of your traffic data would require a massive quantity of storage which nearly all threat actors wouldn't possess.
|
||||
|
||||
Because your ISP almost certainly is not capturing all packet-level data and storing it forever, they have no way of determining what you connected to with that VPN *after* the fact with an advanced technique like deep packet inspection, and therefore you have plausible deniability.
|
||||
|
||||
Therefore, bridges provide the most benefit when circumventing internet censorship *in the moment*, but they are not an adequate substitute for **all** the benefits that using a VPN alongside Tor can provide. Again, this is not advice *against* using Tor bridges, you should just be aware of these limitations while making your decision. In some cases bridges may be the *only* option (if all VPN providers are blocked, for instance), so you can still use them in those circumstances with this limitation in mind.
|
||||
|
||||
If you think that a bridge can aid in defending against fingerprinting or other advanced network analysis more than a VPN's encrypted tunnel already can, you always have the option to use a bridge in conjunction with a VPN as well. That way you are still protected by the pluggable transport's obfuscation techniques even if an adversary gains some level of visibility into your VPN tunnel. If you decide to go this route, we recommend connecting to an obfs4 bridge behind your VPN for optimal fingerprinting protection, rather than meek or Snowflake.
|
||||
|
||||
It is [possible](https://discuss.privacyguides.net/t/clarify-tors-weaknesses-with-respect-to-observability/3676/16) that the [WebTunnel](https://forum.torproject.org/t/tor-relays-announcement-webtunnel-a-new-pluggable-transport-for-bridges-now-available-for-deployment/8180) pluggable transport currently being trialed may mitigate some of these concerns. We will continue to keep an eye on that technology as it develops.
|
||||
|
||||
## Risorse aggiuntive
|
||||
|
||||
- [Manuale Utente del Tor Browser](https://tb-manual.torproject.org)
|
||||
|
||||
@ -215,39 +215,6 @@ Consigliamo un'ampia gamma di app di Android, tramite questo sito. Le app qui el
|
||||
|
||||
Utilizzando Shelter, ti affidi interamente al suo sviluppatore, poiché Shelter agisce da [Admin del Dispositivo](https://developer.android.com/guide/topics/admin/device-admin?hl=it) per creare il Profilo di Lavoro, e ha ampio accesso ai dati memorizzati nel Profilo di Lavoro.
|
||||
|
||||
### Auditor
|
||||
|
||||
!!! recommendation
|
||||
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Auditor * * è un'app che sfrutta le funzionalità di sicurezza hardware per fornire il monitoraggio dell'integrità del dispositivo, convalidando attivamente l'identità di un dispositivo e l'integrità del suo sistema operativo. Al momento, funziona soltanto con GrapheneOS o con il sistema operativo di fabbrica per i [dispositivi supportati](https://attestation.app/about#device-support).
|
||||
|
||||
[:octicons-home-16: Home](https://attestation.app){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://attestation.app/privacy-policy){ .card-link title="Politica sulla Privacy" }
|
||||
[:octicons-info-16:](https://attestation.app/about){ .card-link title=Documentazione}
|
||||
[:octicons-code-16:](https://attestation.app/source){ .card-link title="Codice Sorgente" }
|
||||
[:octicons-heart-16:](https://attestation.app/donate){ .card-link title=Contribuisci }
|
||||
|
||||
??? downloads
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=app.attestation.auditor.play)
|
||||
- [:simple-github: GitHub](https://github.com/GrapheneOS/Auditor/releases)
|
||||
- [:material-cube-outline: GrapheneOS App Store](https://github.com/GrapheneOS/Apps/releases)
|
||||
|
||||
Auditor esegue l'attestazione e il rilevamento delle intrusioni:
|
||||
|
||||
- Utilizzando un modello di [Fiducia Al Primo Utilizzo (TOFU)](https://en.wikipedia.org/wiki/Trust_on_first_use) tra un *revisore* e un *revisionato*, la coppia stabilisce una chiave privata nel [keystore del hardware](https://source.android.com/security/keystore/) del *Revisore*.
|
||||
- Il *revisore* può essere un'altra istanza dell'app Auditor o del [Servizio di Attestazione Remoto](https://attestation.app).
|
||||
- Il *revisore* registra lo stato corrente e la configurazione del *revisionato*.
|
||||
- In caso di manomissione del sistema operativo del *revisore* in seguito al completamento dell'associazione, il revisore sarà a conoscenza della modifica allo stato e le configurazioni del dispositivo.
|
||||
- Sarai avvisato della modifica.
|
||||
|
||||
Nessun'informazione personalmente identificabile è inviata al servizio d'attestazione. Ti consigliamo di iscriverti con un profilo anonimo e di consentire l'attestazione da remoto per il monitoraggio continuo.
|
||||
|
||||
Se il tuo [modello di minaccia](basics/threat-modeling.md) richiede la privacy, potresti considerare l'utilizzo di [Orbot](tor.md#orbot) o di una VPN per nascondere il tuo indirizzo IP dal servizio d'attestazione. Per assicurarti che il tuo hardware e sistema operativo siano autentici, [esegui l'attestazione locale](https://grapheneos.org/install/web#verifying-installation) immediatamente dopo l'installazione del dispositivo e prima di qualsiasi connessione a Internet.
|
||||
|
||||
### Fotocamera Sicura
|
||||
|
||||
!!! recommendation
|
||||
@ -329,7 +296,7 @@ L'app store di GrapheneOS è disponibile su [GitHub](https://github.com/Graphene
|
||||
|
||||
Il Google Play Store richiede un profilo Google per l'accesso, il che non è un bene per la privacy. Puoi aggirare tale problema utilizzando un client alternativo, come Aurora Store.
|
||||
|
||||
!!! consiglio
|
||||
!!! recommendation
|
||||
|
||||
{ align=right }
|
||||
|
||||
@ -347,7 +314,7 @@ Aurora Store non consente di scaricare app a pagamento con la propria funzione d
|
||||
|
||||
### Manualmente con le notifiche RSS
|
||||
|
||||
Per le app rilasciate sulle piattaforme come GitHub e GitLab, potresti aggiungere un feed SS al tuo [aggregatore di notizie](/news-aggregators), che ti aiuterà a tenere traccia delle nuove versioni.
|
||||
For apps that are released on platforms like GitHub and GitLab, you may be able to add an RSS feed to your [news aggregator](news-aggregators.md) that will help you keep track of new releases.
|
||||
|
||||
   
|
||||
|
||||
|
||||
@ -39,7 +39,7 @@ Per minimizzare i danni che un software malevolo *potrebbe* causare, dovresti ut
|
||||
|
||||
I sistemi operativi per mobile, generalmente, presentano un migliore sandboxing delle applicazioni, rispetto ai sistemi operativi per desktop: le app possono ottenere l'accesso di root e richiedono l'autorizzazione per accedere alle risorse di sistema.
|
||||
|
||||
Generalmente, i sistemi operativi per desktop sono in ritardo, per l'adeguato sandboxing. ChromeOS ha funzionalità di sandboxing simili ad Android e macOS ha il pieno controllo delle autorizzazioni di sistema (e gli sviluppatori possono optare per il sandboxing delle applicazioni). Tuttavia, questi sistemi operativi trasmettono le informazioni identificativi ai rispettivi OEM. Linux tende a non inviare le informazioni ai fornitori del sistema, ma presenta una scarsa protezione da exploit e applicazioni dannose. Ciò è mitigabile con distribuzioni specializzate, che fanno un utilizzo significativo delle macchine virtuali o contenitori, come [Qubes OS](../../desktop/#qubes-os).
|
||||
Generalmente, i sistemi operativi per desktop sono in ritardo, per l'adeguato sandboxing. ChromeOS ha funzionalità di sandboxing simili ad Android e macOS ha il pieno controllo delle autorizzazioni di sistema (e gli sviluppatori possono optare per il sandboxing delle applicazioni). Tuttavia, questi sistemi operativi trasmettono le informazioni identificativi ai rispettivi OEM. Linux tende a non inviare le informazioni ai fornitori del sistema, ma presenta una scarsa protezione da exploit e applicazioni dannose. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os).
|
||||
|
||||
<span class="pg-red">:material-target-account: Attacchi mirati</span>
|
||||
|
||||
|
||||
@ -5,70 +5,106 @@ icon: material/vpn
|
||||
description: Le reti virtuali private spostano il rischio dal vostro ISP a una terza parte di cui vi fidate. Dovresti tenere a mente questi aspetti.
|
||||
---
|
||||
|
||||
Le reti private virtuali sono un modo per estendere l'estremità della vostra rete all'uscita di un'altra parte del mondo. Un ISP può vedere il flusso del traffico Internet che entra ed esce dal dispositivo di terminazione della rete (ad esempio, il modem).
|
||||
Virtual Private Networks are a way of extending the end of your network to exit somewhere else in the world.
|
||||
|
||||
I protocolli di crittografia come l'HTTPS sono comunemente utilizzati su Internet, quindi potrebbero non essere in grado di vedere esattamente ciò che state postando o leggendo, ma possono farsi un'idea dei domini [che utilizzate](../advanced/dns-overview.md#why-shouldnt-i-use-encrypted-dns).
|
||||
Normally, an ISP can see the flow of internet traffic entering and exiting your network termination device (i.e. modem). Encryption protocols such as HTTPS are commonly used on the internet, so they may not be able to see exactly what you're posting or reading, but they can get an idea of the [domains you request](../advanced/dns-overview.md#why-shouldnt-i-use-encrypted-dns).
|
||||
|
||||
Una VPN può essere d'aiuto in quanto può spostare la fiducia su un server in un'altra parte del mondo. Di conseguenza, l'ISP vede solo che sei connesso a una VPN e non vede nulla dell'attività che stai trasmettendo.
|
||||
Using a VPN hides even this information from your ISP, by shifting the trust you place in your network to a server somewhere else in the world. As a result, the ISP then only sees that you are connected to a VPN and nothing about the activity that you're passing through it.
|
||||
|
||||
!!! note "Nota"
|
||||
|
||||
When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection.
|
||||
|
||||
## How does a VPN work?
|
||||
|
||||
VPNs encrypt your traffic between your device and a server owned by your VPN provider. From the perspective of anyone between you and the VPN server, it looks like you're connecting to the VPN server. From the perspective of anyone between the VPN server and your destination site, all they can see is the VPN server connecting to the website.
|
||||
|
||||
``` mermaid
|
||||
flowchart LR
|
||||
763931["Your Device<div>(with VPN Client)</div>"] ===|"VPN Encryption"| 404512{"VPN Server"}
|
||||
404512 -.-|"No VPN Encryption"| 593753((("The Internet\n(Your Destination)")))
|
||||
subgraph 763931["Your Device<div>(with VPN Client)</div>"]
|
||||
end
|
||||
```
|
||||
|
||||
Note that a VPN does not add any security or encryption to your traffic between the VPN server and your destination on the internet. To access a website securely you **must** still ensure HTTPS is in use regardless of whether you use a VPN.
|
||||
|
||||
## Dovrei utilizzare una VPN?
|
||||
|
||||
**Sì**, a meno che tu non stia già utilizzando Tor. Una VPN svolge due funzioni: spostare i rischi dall'Internet Service Provider a se stesso e nascondere l'IP da un servizio di terze parti.
|
||||
|
||||
Le VPN non possono criptare i dati al di fuori della connessione tra il dispositivo e il server VPN. I fornitori di VPN possono vedere e modificare il tuo traffico proprio come il tuo ISP. E non c'è modo di verificare in alcun modo le politiche di "no logging" di un provider VPN.
|
||||
|
||||
Tuttavia, nascondono il tuo IP reale da un servizio di terze parti, a condizione che non ci siano fughe dell'IP. Aiutano a confonderti con gli altri e ad attenuare il tracciamento basato sull'IP.
|
||||
|
||||
## Quando non dovrei usare una VPN?
|
||||
|
||||
È inutile utilizzare una VPN nei casi in cui stai utilizzando la tua [identità conosciuta](common-misconceptions.md#complicated-is-better).
|
||||
|
||||
In questo modo si possono attivare sistemi di spam e di rilevamento delle frodi, come nel caso in cui si acceda al sito web della propria banca.
|
||||
|
||||
## E la crittografia?
|
||||
|
||||
La crittografia offerta dai fornitori di VPN avviene tra i propri dispositivi e i loro server. Garantisce che questo specifico collegamento è sicuro. Si tratta di un passo avanti rispetto all'uso di proxy non criptati, dove un avversario sulla rete può intercettare le comunicazioni tra i tuoi dispositivi e tali proxy e modificarle. Tuttavia, la crittografia tra le tue app o browser con i fornitori di servizi non è gestita da questa crittografia.
|
||||
|
||||
Per garantire la riservatezza e la sicurezza di ciò che fai sui siti web che visiti, devi utilizzare il protocollo HTTPS. In questo modo le tue password, i token di sessione e le query saranno al sicuro dal fornitore VPN. Considera di abilitare "HTTPS ovunque" nel browser per mitigare gli attacchi di downgrade come [SSL Strip](https://www.blackhat.com/presentations/bh-dc-09/Marlinspike/BlackHat-DC-09-Marlinspike-Defeating-SSL.pdf).
|
||||
|
||||
## Dovrei utilizzare un DNS criptato con una VPN?
|
||||
|
||||
A meno che il provider VPN non ospiti i server DNS criptati, **no**. L'utilizzo di DOH/DOT (o di qualsiasi altra forma di DNS crittografato) con server di terze parti aggiungerà semplicemente altre entità di cui fidarsi e non farà **assolutamente nulla** per migliorare la privacy o la sicurezza. Il tuo fornitore VPN può comunque vedere quali siti web visiti in base agli indirizzi IP e ad altri metodi. Invece di fidarti solo del provider VPN, ora ti fidi sia del provider VPN che del provider DNS.
|
||||
|
||||
Un motivo comune per raccomandare il DNS crittografato è che aiuta a contrastare lo spoofing DNS. Tuttavia, il browser dovrebbe già verificare la presenza di [certificati TLS](https://en.wikipedia.org/wiki/Transport_Layer_Security#Digital_certificates) con **HTTPS** e avvisare l'utente. Se non stai utilizzando **HTTPS**, un avversario può comunque modificare qualsiasi cosa oltre alle query DNS e il risultato finale sarà poco diverso.
|
||||
|
||||
Inutile dire che **non si dovrebbero usare DNS criptati con Tor**. Questo indirizzerebbe tutte le vostre richieste DNS attraverso un unico circuito e permetterebbe al provider DNS criptato di deanonimizzarvi.
|
||||
|
||||
## Dovrei usare Tor *e* una VPN?
|
||||
|
||||
Utilizzando una VPN con Tor, si crea essenzialmente un nodo di ingresso permanente, spesso con una traccia di denaro. Questo non fornisce alcun vantaggio aggiuntivo all'utente, mentre aumenta drasticamente la superficie di attacco della connessione. Se desideri nascondere l'utilizzo di Tor all'ISP o al governo, Tor ha una soluzione integrata per questo: i Tor bridges. [Per saperne di più sui Tor bridges e sul perché non è necessario utilizzare una VPN](../advanced/tor-overview.md).
|
||||
|
||||
## E se ho bisogno di anonimato?
|
||||
|
||||
Le VPN non possono garantire l'anonimato. Il tuo provider VPN vedrà comunque il tuo vero indirizzo IP e spesso ha una traccia di denaro che può essere collegata direttamente a te. Non si può fare affidamento sulle politiche di "no logging" per proteggere i dati. In tal caso utilizza [Tor](https://www.torproject.org/).
|
||||
|
||||
## E i fornitori di VPN che forniscono nodi Tor?
|
||||
|
||||
Non usare questa funzione. Il punto di forza dell'utilizzo di Tor è che non ti devi fidare del provider VPN. Attualmente Tor supporta solo il protocollo [TCP](https://en.wikipedia.org/wiki/Transmission_Control_Protocol). [UDP](https://en.wikipedia.org/wiki/User_Datagram_Protocol) (utilizzato in [WebRTC](https://en.wikipedia.org/wiki/WebRTC) per la condivisione di voce e video, il nuovo protocollo [HTTP3/QUIC](https://en.wikipedia.org/wiki/HTTP/3), ecc.), [ICMP](https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol) e altri pacchetti saranno eliminati. Per compensare questa situazione, i fornitori di VPN di solito instradano tutti i pacchetti non-TCP attraverso il loro server VPN (il primo hop). Questo è il caso di [ProtonVPN](https://protonvpn.com/support/tor-vpn/). Inoltre, quando si utilizza questa configurazione di Tor su VPN, non si ha il controllo su altre importanti funzionalità di Tor come [Isolated Destination Address](https://www.whonix.org/wiki/Stream_Isolation) (utilizzo di un circuito Tor diverso per ogni dominio visitato).
|
||||
|
||||
La funzione deve essere vista come un modo comodo per accedere alla rete Tor, non per rimanere anonimi. Per un corretto anonimato, utilizza Tor Browser, TorSocks o un gateway Tor.
|
||||
|
||||
## Quando sono utili le VPN?
|
||||
|
||||
Una VPN può comunque essere utile in diversi scenari, ad esempio:
|
||||
**Yes**, almost certainly. A VPN has many advantages, including:
|
||||
|
||||
1. Nascondere il proprio traffico **solo** al proprio Internet Service Provider.
|
||||
1. Nascondere i propri download (come i torrent) al proprio ISP e alle organizzazioni antipirateria.
|
||||
1. Nascondere il proprio IP da siti e servizi di terze parti, impedendone il tracciamento.
|
||||
1. Hiding your IP from third-party websites and services, helping you blend in and preventing IP based tracking.
|
||||
1. Allowing you to bypass geo-restrictions on certain content.
|
||||
|
||||
Per situazioni come queste, o se hai un altro motivo valido, i provider VPN che abbiamo elencato sopra sono quelli che riteniamo più affidabili. Tuttavia, utilizzare un provider VPN significa comunque *fidarsi* del provider. In quasi tutti gli altri scenari si dovrebbe utilizzare uno strumento progettato con la **sicurezza come obiettivo** come Tor.
|
||||
VPNs can provide *some* of the same benefits Tor provides, such as hiding your IP from the websites you visit and geographically shifting your network traffic, and good VPN providers will not cooperate with e.g. legal authorities from oppressive regimes, especially if you choose a VPN provider outside your own jurisdiction.
|
||||
|
||||
## Fonti e approfondimenti
|
||||
VPNs cannot encrypt data outside the connection between your device and the VPN server. VPN providers can also see and modify your traffic the same way your ISP could, so there is still a level of trust you are placing in them. E non c'è modo di verificare in alcun modo le politiche di "no logging" di un provider VPN.
|
||||
|
||||
1. [VPN - a Very Precarious Narrative (VPN - una narrazione molto precaria)](https://schub.io/blog/2019/04/08/very-precarious-narrative.html) di Dennis Schubert
|
||||
1. [Panoramica della rete Tor](../advanced/tor-overview.md)
|
||||
1. [Guide alla privacy di IVPN](https://www.ivpn.net/privacy-guides)
|
||||
1. ["Do I need a VPN?" ("Ho bisogno di una VPN?")](https://www.doineedavpn.com), uno strumento sviluppato da IVPN per sfidare il marketing aggressivo delle VPN, aiutando le persone a decidere se una VPN è adatta a loro.
|
||||
## When isn't a VPN suitable?
|
||||
|
||||
Using a VPN in cases where you're using your [real-life or well-known identity](common-misconceptions.md#complicated-is-better) online is unlikely be useful. In questo modo si possono attivare sistemi di spam e di rilevamento delle frodi, come nel caso in cui si acceda al sito web della propria banca.
|
||||
|
||||
It's important to remember that a VPN will not provide you with absolute anonymity, because the VPN provider itself will still see your real IP address, destination website information, and often has a money trail that can be linked directly back to you. You can't rely on "no logging" policies to protect your data from anyone who is able to protect. If you need complete safety from the network itself, consider using [Tor](../advanced/tor-overview.md) in addition to or instead of a VPN.
|
||||
|
||||
You also should not trust a VPN to secure your connection to an unencrypted, HTTP destination. Per garantire la riservatezza e la sicurezza di ciò che fai sui siti web che visiti, devi utilizzare il protocollo HTTPS. This will keep your passwords, session tokens, and queries safe from the VPN provider and other potential adversaries in between the VPN server and your destination. You should enable HTTPS-only mode in your browser (if it's supported) to mitigate attacks which try to downgrade your connection from HTTPS to HTTP.
|
||||
|
||||
## Dovrei utilizzare un DNS criptato con una VPN?
|
||||
|
||||
Unless your VPN provider hosts the encrypted DNS servers themselves, **probably not**. Using DOH/DOT (or any other form of encrypted DNS) with third-party servers will simply add more entities to trust. Il tuo fornitore VPN può comunque vedere quali siti web visiti in base agli indirizzi IP e ad altri metodi. All this being said, there may be some advantages to enabling encrypted DNS in order to enable other security features in your browser, such as ECH. Browser technologies which are reliant on in-browser encrypted DNS are relatively new and not yet widespread, so whether they are relevant to you in particular is an exercise we will leave to you to research independently.
|
||||
|
||||
Another common reason encrypted DNS is recommended is that it prevents DNS spoofing. Tuttavia, il browser dovrebbe già verificare la presenza di [certificati TLS](https://en.wikipedia.org/wiki/Transport_Layer_Security#Digital_certificates) con **HTTPS** e avvisare l'utente. Se non stai utilizzando **HTTPS**, un avversario può comunque modificare qualsiasi cosa oltre alle query DNS e il risultato finale sarà poco diverso.
|
||||
|
||||
## Dovrei usare Tor *e* una VPN?
|
||||
|
||||
Maybe, Tor is not necessarily suitable for everybody in the first place. Consider your [threat model](threat-modeling.md), because if your adversary is not capable of extracting information from your VPN provider, using a VPN alone may provide enough protection.
|
||||
|
||||
If you do use Tor then you are *probably* best off connecting to the Tor network via a commercial VPN provider. However, this is a complex subject which we've written more about on our [Tor overview](../advanced/tor-overview.md) page.
|
||||
|
||||
## Should I access Tor through VPN providers that provide "Tor nodes"?
|
||||
|
||||
You should not use that feature: The primary advantage of using Tor is that you do not trust your VPN provider, which is negated when you use Tor nodes hosted by your VPN instead of connecting directly to Tor from your computer.
|
||||
|
||||
Currently, Tor only supports the TCP protocol. UDP (used by [WebRTC](https://en.wikipedia.org/wiki/WebRTC), [HTTP3/QUIC](https://en.wikipedia.org/wiki/HTTP/3), and other protocols), [ICMP](https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol), and other packets will be dropped. Per compensare questa situazione, i fornitori di VPN di solito instradano tutti i pacchetti non-TCP attraverso il loro server VPN (il primo hop). Questo è il caso di [ProtonVPN](https://protonvpn.com/support/tor-vpn/). Inoltre, quando si utilizza questa configurazione di Tor su VPN, non si ha il controllo su altre importanti funzionalità di Tor come [Isolated Destination Address](https://www.whonix.org/wiki/Stream_Isolation) (utilizzo di un circuito Tor diverso per ogni dominio visitato).
|
||||
|
||||
The feature should be viewed as a *convenient* way to access hidden services on Tor, not to stay anonymous. For proper anonymity, use the actual [Tor Browser](../tor.md).
|
||||
|
||||
## Commercial VPN Ownership
|
||||
|
||||
Most VPN services are owned by the same [few companies](https://vpnpro.com/blog/hidden-vpn-owners-unveiled-97-vpns-23-companies/). These shady companies run lots of smaller VPN services to create the illusion that you have more choice than you actually do and to maximize profit. Typically, these providers that feed into their shell company have terrible privacy policies and shouldn't be trusted with your internet traffic. You should be very strict about which provider you decide to use.
|
||||
|
||||
You should also be wary that many VPN review sites are merely advertising vehicles open to the highest bidder. ==Privacy Guides does not make money from recommending external products, and never uses affiliate programs.==
|
||||
|
||||
[Our VPN Recommendations](../vpn.md ""){.md-button}
|
||||
|
||||
## Modern VPN Alternatives
|
||||
|
||||
Recently, some attempts have been made by various organizations to address some issues which centralized VPNs have. These technologies are relatively new, but worth keeping an eye on as the field develops.
|
||||
|
||||
### Multi-Party Relays
|
||||
|
||||
Multi-Party Relays (MPRs) use multiple nodes owned by different parties, such that no individual party knows both who you are and what you're connecting to. This is the basic idea behind Tor, but now there are some paid services that try to emulate this model.
|
||||
|
||||
MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them completely. They accomplish this goal by segmenting the responsibilities between two or more different companies. For example, Apple's iCloud+ Private Relay routes your traffic through two servers:
|
||||
|
||||
1. Firstly, a server operated by Apple.
|
||||
|
||||
This server is able to see your device's IP when you connect to it, and has knowledge of your payment information and Apple ID tied to your iCloud subscription. However, it is unable to see what website you are connecting to.
|
||||
|
||||
2. Secondly, a server operated by a partner CDN, such as Cloudflare or Fastly.
|
||||
|
||||
This server actually makes the connection to your destination website, but has no knowledge of your device. The only IP address it knows about is Apple's server's.
|
||||
|
||||
Other MPRs run by different companies like Google or INVISV operate in a very similar manner. This protection by segmentation only exists if you trust the two companies to not collude with each other to deanonymize you.
|
||||
|
||||
### Decentralized VPNs
|
||||
|
||||
Another attempt at solving the issues with centralized VPN services are dVPNs. These are based on blockchain technology and claim to eliminate trust in a single party by distributing the nodes across lots of different people. However, many times a dVPN will default to a single node, meaning you need to trust that node completely, just like a traditional VPN. Unlike a traditional VPN, this one node that can see all your traffic is a random person instead of your VPN provider that can be audited and has legal responsibilities to uphold their privacy policy. Multi-hop is needed to solve this, but that comes with a stability and performance cost.
|
||||
|
||||
Another consideration is legal liability. The exit node will need to deal with legal problems from misuse of the network, an issue that the Tor network has contended with for its entire existence. This discourages regular people from running nodes and makes it more attractive for a malicious actor with lots of resources to host one. This is a big problem if the service is single-node, as the potentially malicious exit node can see who you are and what you're connecting to.
|
||||
|
||||
Many dVPNs are used to push a cryptocurrency rather than to make the best service. They also tend to be smaller networks with fewer nodes, making them more vulnerable to [Sybil attacks](https://en.wikipedia.org/wiki/Sybil_attack).
|
||||
|
||||
## Informazioni correlate alle VPN
|
||||
|
||||
@ -76,3 +112,4 @@ Per situazioni come queste, o se hai un altro motivo valido, i provider VPN che
|
||||
- [Free VPN App Investigation (Indagine sulle app di VPN gratuite)](https://www.top10vpn.com/free-vpn-app-investigation/)
|
||||
- [Hidden VPN owners unveiled: 101 VPN products run by just 23 companies (Svelati i proprietari segreti delle VPN: 101 prodotti per VPN gestiti da sole 23 aziende)](https://vpnpro.com/blog/hidden-vpn-owners-unveiled-97-vpns-23-companies/)
|
||||
- [This Chinese company is secretly behind 24 popular apps seeking dangerous permissions (Questa azienda cinese è segretamente dietro 24 app popolari che cercano autorizzazioni pericolose)](https://vpnpro.com/blog/chinese-company-secretly-behind-popular-apps-seeking-dangerous-permissions/)
|
||||
- [VPN - a Very Precarious Narrative (VPN - una narrazione molto precaria)](https://schub.io/blog/2019/04/08/very-precarious-narrative.html) di Dennis Schubert
|
||||
|
||||
@ -120,11 +120,9 @@ Nix è un gestore di pacchetti basato sul codice sorgente; se non ne esiste alcu
|
||||
|
||||
Whonix è pensato per operare come due macchine virtuali: una "Workstation" e un "Gateway" di Tor. Tutte le comunicazioni dalla Workstation devono passare per il gateway di Tor. Ciò significa che, anche se la Workstation fosse compromessa da un malware di qualche tipo, il vero indirizzo IP rimarrebbe nascosto.
|
||||
|
||||
Alcune delle sue funzionalità includono l'Isolamento del Flusso di Tor, l'[anonimato di battitura](https://www.whonix.org/wiki/Keystroke_Deanonymization#Kloak), lo [swap crittografato](https://github.com/Whonix/swap-file-creator) e un allocatore di memoria rafforzato.
|
||||
Some of its features include Tor Stream Isolation, [keystroke anonymization](https://www.whonix.org/wiki/Keystroke_Deanonymization#Kloak), [encrypted swap](https://github.com/Whonix/swap-file-creator), and a hardened memory allocator. Future versions of Whonix will likely include [full system AppArmor policies](https://github.com/Whonix/apparmor-profile-everything) and a [sandbox app launcher](https://www.whonix.org/wiki/Sandbox-app-launcher) to fully confine all processes on the system.
|
||||
|
||||
Le versioni future di Whonix potrebbero includere [politiche di sistema complete di AppArmor](https://github.com/Whonix/apparmor-profile-everything) e un [launcher di app sandbox](https://www.whonix.org/wiki/Sandbox-app-launcher), per confinare completamente tutti i processi sul sistema.
|
||||
|
||||
Whonix è meglio utilizzato [insieme a Qubes](https://www.whonix.org/wiki/Qubes/Why_use_Qubes_over_other_Virtualizers), Qubes-Whonix presenta svariati [svantaggi](https://forums.whonix.org/t/qubes-whonix-security-disadvantages-help-wanted/8581) rispetto ad altri hypervisor.
|
||||
Whonix is best used [in conjunction with Qubes](https://www.whonix.org/wiki/Qubes/Why_use_Qubes_over_other_Virtualizers). We have a [recommended guide](os/qubes-overview.md#connecting-to-tor-via-a-vpn) on configuring Whonix in conjunction with a VPN ProxyVM in Qubes to hide your Tor activities from your ISP.
|
||||
|
||||
### Tails
|
||||
|
||||
|
||||
223
i18n/it/device-integrity.md
Normal file
223
i18n/it/device-integrity.md
Normal file
@ -0,0 +1,223 @@
|
||||
---
|
||||
title: Device Integrity
|
||||
icon: material/security
|
||||
description: These tools can be used to check your devices for compromise.
|
||||
cover: device-integrity.webp
|
||||
---
|
||||
|
||||
These tools can be used to validate the integrity of your mobile devices and check them for indicators of compromise by spyware and malware such as Pegasus, Predator, or KingsPawn. This page focuses on **mobile security**, because mobile devices typically have read-only systems with well-known configurations, so detecting malicious modifications is easier than on traditional desktop systems. We may expand the focus of this page in the future.
|
||||
|
||||
!!! note "This is an advanced topic"
|
||||
|
||||
```
|
||||
These tools may provide utility for certain individuals. They provide functionality which most people do not need to worry about, and often require more in-depth technical knowledge to use effectively.
|
||||
```
|
||||
|
||||
It is **critical** to understand that scanning your device for public indicators of compromise is **not sufficient** to determine that a device is "clean", and not targeted with a particular spyware tool. Reliance on these publicly-available scanning tools can miss recent security developments and give you a false sense of security.
|
||||
|
||||
## General Advice
|
||||
|
||||
The majority of system-level exploits on modern mobile devices—especially zero-click compromises—are non-persistent, meaning they will not remain or run automatically after a reboot. For this reason, we highly recommend rebooting your device regularly. We recommend everybody reboot their devices once a week at minimum, but if non-persistent malware is of particular concern for you, we and many security experts recommend a daily reboot schedule.
|
||||
|
||||
This means an attacker would have to regularly re-infect your device to retain access, although we'll note this is not impossible. Rebooting your device also will not protect you against _persistent_ malware, but this is less common on mobile devices due to modern security features like secure/verified boot.
|
||||
|
||||
## Post-Compromise Information & Disclaimer
|
||||
|
||||
If any of the following tools indicate a potential compromise by spyware such as Pegasus, Predator, or KingsPawn, we advise that you contact:
|
||||
|
||||
- If you are a human rights defender, journalist, or from a civil society organization: [Amnesty International's Security Lab](https://securitylab.amnesty.org/contact-us/)
|
||||
- If a business or government device is compromised: Contact the appropriate security liason at your enterprise, department, or agency
|
||||
- Local law enforcement
|
||||
|
||||
**We are unable to help you directly beyond this.** We are happy to discuss your specific situation or circumstances and review your results in our [community](https://discuss.privacyguides.net) spaces, but it is unlikely we can assist you beyond what is written on this page.
|
||||
|
||||
The tools on this page are only capable of detecting indicators of compromise, not removing them. If you are concerned about having been compromised, we advise that you:
|
||||
|
||||
- Consider replacing the device completely
|
||||
- Consider changing your SIM/eSIM number
|
||||
- Not restore from a backup, because that backup may be compromised
|
||||
|
||||
These tools provide analysis based on the information they have the ability to access from your device, and publicly-accessible indicators of compromise. It is important to keep in mind two things:
|
||||
|
||||
1. Indicators of compromise are just that: _indicators_. They are not a definitive finding, and may occasionally be **false positives**. If an indicator of compromise is detected, it means you should do additional research into the _potential_ threat.
|
||||
2. The indicators of compromise these tools look for are published by threat research organizations, but not all indicators are made available to the public! This means that these tools can present a **false negative**, if your device is infected with spyware which is not detected by any of the public indicators. Reliable and comprehensive digital forensic support and triage requires access to non-public indicators, research and threat intelligence.
|
||||
|
||||
## External Verification Tools
|
||||
|
||||
External verification tools run on your computer and scan your mobile device for forensic traces which are helpful to identify potential compromise.
|
||||
|
||||
!!! danger "Attenzione"
|
||||
|
||||
```
|
||||
Public indicators of compromise are insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. Reliance on public indicators alone can miss recent forensic traces and give a false sense of security.
|
||||
|
||||
Reliable and comprehensive digital forensic support and triage requires access to non-public indicators, research and threat intelligence.
|
||||
|
||||
Such support is available to civil society through [Amnesty International's Security Lab](https://www.amnesty.org/en/tech/) or [Access Now’s Digital Security Helpline](https://www.accessnow.org/help/).
|
||||
```
|
||||
|
||||
These tools can trigger false-positives. If any of these tools finds indicators of compromise, you need to dig deeper to determine your actual risk. Some reports may be false positives based on websites you've visited in the past, and findings which are many years old are likely either false-positives or indicate previous (and no longer active) compromise.
|
||||
|
||||
### Mobile Verification Toolkit
|
||||
|
||||
!!! recommendation
|
||||
|
||||
```
|
||||
{ align=right }
|
||||
|
||||
**Mobile Verification Toolkit** (**MVT**) is a collection of utilities which simplifies and automates the process of scanning mobile devices for potential traces of targeting or infection by known spyware campaigns. MVT was developed by Amnesty International and released in 2021 in the context of the [Pegasus Project](https://forbiddenstories.org/about-the-pegasus-project/).
|
||||
|
||||
[:octicons-home-16: Homepage](https://mvt.re/){ .md-button .md-button--primary }
|
||||
[:octicons-code-16:](https://github.com/mvt-project/mvt){ .card-link title="Source Code" }
|
||||
|
||||
??? downloads
|
||||
|
||||
- [:simple-apple: macOS](https://docs.mvt.re/en/latest/install/)
|
||||
- [:simple-linux: Linux](https://docs.mvt.re/en/latest/install/)
|
||||
```
|
||||
|
||||
!!! warning "Attenzione"
|
||||
|
||||
```
|
||||
Using MVT is insufficient to determine that a device is "clean", and not targeted with a particular spyware tool.
|
||||
```
|
||||
|
||||
MVT is _most_ useful for scanning iOS devices. Android stores very little diagnostic information useful to triage potential compromises, and because of this `mvt-android` capabilities are limited as well. On the other hand, encrypted iOS iTunes backups provide a large enough subset of files stored on the device to detect suspicious artifacts in many cases. This being said, MVT does still provide fairly useful tools for both iOS and Android analysis.
|
||||
|
||||
If you use iOS and are at high-risk, we have three additional suggestions for you:
|
||||
|
||||
1. Create and keep regular (monthly) iTunes backups. This allows you to find and diagnose past infections later with MVT, if new threats are discovered in the future.
|
||||
|
||||
2. Trigger _sysdiagnose_ logs often and back them up externally. These logs can provide invaluable data to future forensic investigators if need be.
|
||||
|
||||
The process to do so varies by model, but you can trigger it on newer phones by holding down _Power_ + _Volume Up_ + _Volume Down_ until you feel a brief vibration. After a few minutes, the timestamped _sysdiagnose_ log will appear in **Settings** > **Privacy & Security** > **Analytics & Improvements** > **Analytics Data**.
|
||||
|
||||
3. Enable [Lockdown Mode](https://blog.privacyguides.org/2022/10/27/macos-ventura-privacy-security-updates/#lockdown-mode).
|
||||
|
||||
MVT allows you to perform deeper scans/analysis if your device is jailbroken. Unless you know what you are doing, **do not jailbreak or root your device.** Jailbreaking your device exposes it to considerable security risks.
|
||||
|
||||
### iMazing (iOS)
|
||||
|
||||
!!! recommendation
|
||||
|
||||
```
|
||||
{ align=right }
|
||||
|
||||
**iMazing** provides a free spyware analyzer tool for iOS devices which acts as a GUI-wrapper for [MVT](#mobile-verification-toolkit). This can be much easier to run compared to MVT itself, which is a command-line tool designed for technologists and forensic investigators.
|
||||
|
||||
[:octicons-home-16: Homepage](https://imazing.com/){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://imazing.com/privacy-policy){ .card-link title="Privacy Policy" }
|
||||
[:octicons-info-16:](https://imazing.com/spyware-analyzer){ .card-link title=Documentation}
|
||||
|
||||
??? downloads
|
||||
|
||||
- [:simple-windows11: Windows](https://imazing.com/download)
|
||||
- [:simple-apple: macOS](https://imazing.com/download)
|
||||
```
|
||||
|
||||
iMazing automates and interactively guides you through the process of using [MVT](#mobile-verification-toolkit) to scan your device for publicly-accessible indicators of compromise published by various threat researchers. All of the information and warnings which apply to MVT apply to this tool as well, so we suggest you also familiarize yourself with the notes on MVT in the sections above.
|
||||
|
||||
## On-Device Verification
|
||||
|
||||
These are apps you can install which check your device and operating system for signs of tampering, and validate the identity of your device.
|
||||
|
||||
!!! warning "Attenzione"
|
||||
|
||||
```
|
||||
Using these apps is insufficient to determine that a device is "clean", and not targeted with a particular spyware tool.
|
||||
```
|
||||
|
||||
### Auditor (Android)
|
||||
|
||||
!!! recommendation
|
||||
|
||||
```
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Auditor** is an app which leverages hardware security features to provide device integrity monitoring by actively validating the identity of a device and the integrity of its operating system. Currently, it only works with GrapheneOS or the stock operating system for [supported devices](https://attestation.app/about#device-support).
|
||||
|
||||
[:octicons-home-16: Homepage](https://attestation.app){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://attestation.app/privacy-policy){ .card-link title="Privacy Policy" }
|
||||
[:octicons-info-16:](https://attestation.app/about){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://attestation.app/source){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://attestation.app/donate){ .card-link title=Contribute }
|
||||
|
||||
??? downloads
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=app.attestation.auditor.play)
|
||||
- [:simple-github: GitHub](https://github.com/GrapheneOS/Auditor/releases)
|
||||
- [:material-cube-outline: GrapheneOS App Store](https://github.com/GrapheneOS/Apps/releases)
|
||||
```
|
||||
|
||||
Auditor is not a scanning/analysis tool like some other tools on this page, rather it uses your device's hardware-backed keystore to allow you to verify the identity of your device and gain assurance that the operating system itself hasn't been tampered with or downgraded via verified boot. This provides a very robust integrity check of your device itself, but doesn't necessarily check whether the user-level apps running on your device are malicious.
|
||||
|
||||
Auditor performs attestation and intrusion detection with **two** devices, an _auditee_ (the device being verified) and an _auditor_ (the device performing the verification). The auditor can be any Android 10+ device (or a remote web service operated by [GrapheneOS](android.md#grapheneos)), while the auditee must be a specifically [supported device](https://attestation.app/about#device-support). Auditor works by:
|
||||
|
||||
- Using a [Trust On First Use (TOFU)](https://en.wikipedia.org/wiki/Trust_on_first_use) model between an _auditor_ and _auditee_, the pair establish a private key in the [hardware-backed keystore](https://source.android.com/security/keystore/) of the _Auditor_.
|
||||
- The _auditor_ can either be another instance of the Auditor app or the [Remote Attestation Service](https://attestation.app).
|
||||
- The _auditor_ records the current state and configuration of the _auditee_.
|
||||
- Should tampering with the operating system of the _auditee_ happen after the pairing is complete, the auditor will be aware of the change in the device state and configurations.
|
||||
- You will be alerted to the change.
|
||||
|
||||
It is important to note that Auditor can only effectively detect changes **after** the initial pairing, not necessarily during or before due to its TOFU model. To make sure that your hardware and operating system is genuine, [perform local attestation](https://grapheneos.org/install/web#verifying-installation) immediately after the device has been installed and prior to any internet connection.
|
||||
|
||||
No personally identifiable information is submitted to the attestation service. We recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring.
|
||||
|
||||
If your [threat model](basics/threat-modeling.md) requires privacy, you could consider using [Orbot](tor.md#orbot) or a VPN to hide your IP address from the attestation service.
|
||||
|
||||
## On-Device Scanners
|
||||
|
||||
These are apps you can install on your device which scan your device for signs of compromise.
|
||||
|
||||
!!! warning "Attenzione"
|
||||
|
||||
```
|
||||
Using these apps is insufficient to determine that a device is "clean", and not targeted with a particular spyware tool.
|
||||
```
|
||||
|
||||
### Hypatia (Android)
|
||||
|
||||
!!! recommendation
|
||||
|
||||
```
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Hypatia** is an open source real-time malware scanner for Android, from the developer of [DivestOS](android.md#divestos). It accesses the internet to download signature database updates, but does not upload your files or any metadata to the cloud (scans are performed entirely locally).
|
||||
|
||||
[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#hypatia){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://divestos.org/pages/privacy_policy#hypatia){ .card-link title="Privacy Policy" }
|
||||
[:octicons-code-16:](https://github.com/divested-mobile/hypatia){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title=Contribute }
|
||||
|
||||
??? downloads
|
||||
|
||||
- [:simple-android: F-Droid](https://f-droid.org/packages/us.spotco.malwarescanner/)
|
||||
```
|
||||
|
||||
Hypatia is particularly good at detecting common stalkerware: If you suspect you are a victim of stalkerware, you should [visit this page](https://stopstalkerware.org/information-for-survivors/) for advice.
|
||||
|
||||
### iVerify (iOS)
|
||||
|
||||
!!! recommendation
|
||||
|
||||
```
|
||||
{ align=right }
|
||||
|
||||
**iVerify** is an iOS app which automatically scans your device to check configuration settings, patch level, and other areas of security. It also checks your device for indicators of compromise by jailbreak tools or spyware such as Pegasus.
|
||||
|
||||
[:octicons-home-16: Homepage](https://www.iverify.io/consumer){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://www.iverify.io/privacy-policy){ .card-link title="Privacy Policy" }
|
||||
[:octicons-info-16:](https://www.iverify.io/frequently-asked-questions#iVerify-General){ .card-link title=Documentation}
|
||||
|
||||
??? downloads
|
||||
|
||||
- [:simple-appstore: App Store](https://apps.apple.com/us/app/iverify/id1466120520)
|
||||
```
|
||||
|
||||
Like all iOS apps, iVerify is restricted to what it can observe about your device from within the iOS App Sandbox. It will not provide nearly as robust analysis as a full-system analysis tool like [MVT](#mobile-verification-toolkit). Its primary function is to detect whether your device is jailbroken, which it is effective at, however a hypothetical threat which is _specifically_ designed to bypass iVerify's checks would likely succeed at doing so.
|
||||
|
||||
iVerify is **not** an "antivirus" tool, and will not detect non-system-level malware such as malicious custom keyboards or malicious Wi-Fi Sync configurations, for example.
|
||||
|
||||
In addition to device scanning, iVerify also includes a number of additional security utilities which you may find useful, including device reboot reminders, iOS update notifications (which are often faster than Apple's staggered update notification rollout), some basic privacy and security guides, and a DNS over HTTPS tool which can connect your device's [DNS](dns.md) queries securely to Quad9, Cloudflare, or Google.
|
||||
@ -49,6 +49,22 @@ Per copiare e incollare file e cartelle da una *qube* a un'altra, puoi usare l'o
|
||||
|
||||
Il [framework qrexec](https://www.qubes-os.org/doc/qrexec/) è una parte fondamentale di Qubes che consente la comunicazione tra i domini. Si basa sulla libreria di Xen *vchan*, che facilita l'[isolamento tramite politiche](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
|
||||
## Connecting to Tor via a VPN
|
||||
|
||||
We [recommend](../advanced/tor-overview.md) connecting to the Tor network via a [VPN](../vpn.md) provider, and luckily Qubes makes this easy to do with a combination of ProxyVMs and Whonix.
|
||||
|
||||
After [creating a new ProxyVM](https://github.com/Qubes-Community/Contents/blob/master/docs/configuration/vpn.md) which connects to the VPN of your choice, you can chain your Whonix qubes to that ProxyVM **before** they connect to the Tor network, by setting the NetVM of your Whonix **Gateway** (`sys-whonix`) to the newly-created ProxyVM.
|
||||
|
||||
Your qubes should be configured in a manner similar to this:
|
||||
|
||||
| Qube name | Qube description | NetVM |
|
||||
| --------------- | ---------------------------------------------------------------------------------------------------------------- | --------------- |
|
||||
| sys-net | *Your default network qube (pre-installed)* | *n/a* |
|
||||
| sys-firewall | *Your default firewall qube (pre-installed)* | sys-net |
|
||||
| ==sys-proxyvm== | The VPN ProxyVM you [created](https://github.com/Qubes-Community/Contents/blob/master/docs/configuration/vpn.md) | sys-firewall |
|
||||
| sys-whonix | Your Whonix Gateway VM | ==sys-proxyvm== |
|
||||
| anon-whonix | Your Whonix Workstation VM | sys-whonix |
|
||||
|
||||
## Risorse aggiuntive
|
||||
|
||||
Per ulteriori informazioni si consiglia di consultare le ampie pagine di documentazione di Qubes OS presenti sul [sito web di Qubes OS](https://www.qubes-os.org/doc/). Le copie offline sono scaricabili dal [repository della documentazione](https://github.com/QubesOS/qubes-doc) di Qubes OS.
|
||||
|
||||
@ -157,6 +157,7 @@ Per ulteriori dettagli su ogni progetto, perché è stato scelto e ulteriori con
|
||||
|
||||
- { .twemoji }{ .twemoji } [Privacy.com](financial-services.md#privacycom-us)
|
||||
- { .twemoji }{ .twemoji } [MySudo](financial-services.md#mysudo-us-paid)
|
||||
|
||||
</div>
|
||||
|
||||
[Scopri di più :material-arrow-right-drop-circle:](financial-services.md#payment-masking-services)
|
||||
@ -429,12 +430,11 @@ Per ulteriori dettagli su ogni progetto, perché è stato scelto e ulteriori con
|
||||
|
||||
<div class="grid cards" markdown>
|
||||
|
||||
- { .twemoji } [Obtainium (Gestore di app)](android.md#obtainium)
|
||||
- { .twemoji } [Aurora Store (Client di Google Play)](android.md#aurora-store)
|
||||
- { .twemoji } [Shelter (Profili di lavoro)](android.md#shelter)
|
||||
- { .twemoji }{ .twemoji } [Auditor (Dispositivi Supportati)](android.md#auditor)
|
||||
- { .twemoji }{ .twemoji } [Secure Camera](android.md#secure-camera)
|
||||
- { .twemoji }{ .twemoji } [Secure PDF Viewer](android.md#secure-pdf-viewer)
|
||||
- { .twemoji } [Obtainium (App Manager)](android.md#obtainium)
|
||||
- { .twemoji } [Aurora Store (Google Play Client)](android.md#aurora-store)
|
||||
- { .twemoji } [Shelter (Work Profiles)](android.md#shelter)
|
||||
- { .twemoji }{ .twemoji } [Secure Camera](android.md#secure-camera)
|
||||
- { .twemoji }{ .twemoji } [Secure PDF Viewer](android.md#secure-pdf-viewer)
|
||||
|
||||
</div>
|
||||
|
||||
@ -468,3 +468,21 @@ Per ulteriori dettagli su ogni progetto, perché è stato scelto e ulteriori con
|
||||
</div>
|
||||
|
||||
[Scopri di più :material-arrow-right-drop-circle:](router.md)
|
||||
|
||||
## Advanced Tools
|
||||
|
||||
These tools may provide utility for certain individuals. They provide functionality which most people do not need to worry about, and often require more in-depth technical knowledge to utilize effectively.
|
||||
|
||||
### Device Integrity Verification
|
||||
|
||||
<div class="grid cards" markdown>
|
||||
|
||||
- { .twemoji } [Mobile Verification Toolkit](device-integrity.md#mobile-verification-toolkit)
|
||||
- { .twemoji } [iMazing (iOS)](device-integrity.md#imazing-ios)
|
||||
- { .twemoji }{ .twemoji } [Auditor (Android)](device-integrity.md#auditor-android)
|
||||
- { .twemoji }{ .twemoji } [Hypatia (Android)](device-integrity.md#hypatia-android)
|
||||
- { .twemoji } [iVerify (iOS)](device-integrity.md#iverify-ios)
|
||||
|
||||
</div>
|
||||
|
||||
[Scopri di più :material-arrow-right-drop-circle:](device-integrity.md)
|
||||
|
||||
@ -39,7 +39,15 @@ Tor funziona instradando il traffico tramite questi server gestiti da volontari,
|
||||
|
||||
## Connessione a Tor
|
||||
|
||||
Esistono svariati modi per connettersi alla rete di Tor dal tuo dispositivo, il più comunemente utilizzato dei quali è **Tor Browser**, una biforcazione di Firefox progettata per la navigazione anonima per i computer desktop e per Android. Oltre alle seguenti app, esistono inoltre dei sistemi operativi progettati specificamente per connettersi alla rete di Tor, come [Whonix](desktop.md#whonix) su [Qubes OS](desktop.md#qubes-os), che forniscono sicurezza e protezioni persino maggiori del Tor Browser standard.
|
||||
!!! tip "Suggerimento"
|
||||
|
||||
Before connecting to Tor, please ensure you've read our [overview](advanced/tor-overview.md) on what Tor is and how to connect to it safely. We often recommend connecting to Tor through a trusted [VPN provider](vpn.md), but you have to do so **properly** to avoid decreasing your anonymity.
|
||||
|
||||
Esistono svariati modi per connettersi alla rete di Tor dal tuo dispositivo, il più comunemente utilizzato dei quali è **Tor Browser**, una biforcazione di Firefox progettata per la navigazione anonima per i computer desktop e per Android.
|
||||
|
||||
Some of these apps are better than others, and again making a determination comes down to your threat model. If you are a casual Tor user who is not worried about your ISP collecting evidence against you, using apps like [Orbot](#orbot) or mobile browser apps to access the Tor network is probably fine. Increasing the number of people who use Tor on an everyday basis helps reduce the bad stigma of Tor, and lowers the quality of "lists of Tor users" that ISPs and governments may compile.
|
||||
|
||||
If more complete anonymity is paramount to your situation, you should **only** be using the desktop Tor Browser client, ideally in a [Whonix](desktop.md#whonix) + [Qubes](desktop.md#qubes-os) configuration. Mobile browsers are less common on Tor (and more fingerprintable as a result), and other configurations are not as rigorously tested against deanonymization.
|
||||
|
||||
### Tor Browser
|
||||
|
||||
@ -69,6 +77,8 @@ Esistono svariati modi per connettersi alla rete di Tor dal tuo dispositivo, il
|
||||
|
||||
Tor Browser è progettato per impedire il fingerprinting, o la tua identificazione secondo la configurazione del tuo browser. Dunque, è indispensabile che tu **non** modifichi il browser oltre ai [livelli di sicurezza](https://tb-manual.torproject.org/security-settings/) predefiniti.
|
||||
|
||||
In addition to installing Tor Browser on your computer directly, there are also operating systems designed specifically to connect to the Tor network such as [Whonix](desktop.md#whonix) on [Qubes OS](desktop.md#qubes-os), which provide even greater security and protections than the standard Tor Browser alone.
|
||||
|
||||
### Orbot
|
||||
|
||||
!!! recommendation
|
||||
|
||||
Reference in New Issue
Block a user