mirror of
https://github.com/privacyguides/i18n.git
synced 2025-08-22 14:39:15 +00:00
New Crowdin translations by GitHub Action
This commit is contained in:
Crowdin Bot
@@ -6,6 +6,86 @@ description: Tor - это бесплатная в использовании д
|
||||
|
||||
Tor - это бесплатная в использовании децентрализованная сеть, разработанная для использования интернета с максимально возможной степенью конфиденциальности. При правильном использовании сеть позволяет осуществлять частный и анонимный браузинг и общение.
|
||||
|
||||
## Safely Connecting to Tor
|
||||
|
||||
Before connecting to [Tor](../tor.md), you should carefully consider what you're looking to accomplish by using Tor in the first place, and who you're trying to hide your network activity from.
|
||||
|
||||
If you live in a free country, are accessing mundane content via Tor, aren't worried about your ISP or local network administrators having the knowledge that you're using Tor, and want to help [de-stigmatize](https://2019.www.torproject.org/about/torusers.html.en) Tor usage, you can likely connect to Tor directly via standard means like [Tor Browser](../tor.md) without worry.
|
||||
|
||||
If you have the ability to access a trusted VPN provider and **any** of the following are true, you almost certainly should connect to Tor through a VPN:
|
||||
|
||||
- You already use a [trusted VPN provider](../vpn.md)
|
||||
- Your threat model includes an adversary which is capable of extracting information from your ISP
|
||||
- Your threat model includes your ISP itself as an adversary
|
||||
- Your threat model includes local network administrators before your ISP as an adversary
|
||||
|
||||
Because we already [generally recommend](../basics/vpn-overview.md) that the vast majority of people use a trusted VPN provider for a variety of reasons, the following recommendation about connecting to Tor via a VPN likely applies to you. <mark>There is no need to disable your VPN before connecting to Tor</mark>, as some online resources would lead you to believe.
|
||||
|
||||
Connecting directly to Tor will make your connection stand out to any local network administrators or your ISP. Detecting and correlating this traffic [has been done](https://edition.cnn.com/2013/12/17/justice/massachusetts-harvard-hoax/) in the past by network administrators to identify and deanonymize specific Tor users on their network. On the other hand, connecting to a VPN is almost always less suspicious, because commercial VPN providers are used by everyday consumers for a variety of mundane tasks like bypassing geo-restrictions, even in countries with heavy internet restrictions.
|
||||
|
||||
Therefore, you should make an effort to hide your IP address **before** connecting to the Tor network. You can do this by simply connecting to a VPN (through a client installed on your computer) and then accessing [Tor](../tor.md) as normal, through Tor Browser for example. This creates a connection chain like:
|
||||
|
||||
- [x] You → VPN → Tor → Internet
|
||||
|
||||
From your ISP's perspective, it looks like you're accessing a VPN normally (with the associated cover that provides you). From your VPN's perspective, they can see that you are connecting to the Tor network, but nothing about what websites you're accessing. From Tor's perspective, you're connecting normally, but in the unlikely event of some sort of Tor network compromise, only your VPN's IP would be exposed, and your VPN would *additionally* have to be compromised to deanonymize you.
|
||||
|
||||
This is **not** censorship circumvention advice, because if Tor is blocked entirely by your ISP, your VPN likely is as well. Rather, this recommendation aims to make your traffic blend in better with commonplace VPN user traffic, and provide you with some level of plausible deniability by obscuring the fact that you're connecting to Tor from your ISP.
|
||||
|
||||
---
|
||||
|
||||
We **very strongly discourage** combining Tor with a VPN in any other manner. Do not configure your connection in a way which resembles any of the following:
|
||||
|
||||
- You → Tor → VPN → Internet
|
||||
- You → VPN → Tor → VPN → Internet
|
||||
- Any other configuration
|
||||
|
||||
Some VPN providers and other publications will occasionally recommend these **bad** configurations to evade Tor bans (exit nodes being blocked by websites) in some places. [Normally](https://support.torproject.org/#about_change-paths), Tor frequently changes your circuit path through the network. When you choose a permanent *destination* VPN (connecting to a VPN server *after* Tor), you're eliminating this advantage and drastically harming your anonymity.
|
||||
|
||||
Setting up bad configurations like these is difficult to do accidentally, because it usually involves either setting up custom proxy settings inside Tor Browser, or setting up custom proxy settings inside your VPN client which routes your VPN traffic through the Tor Browser. As long as you avoid these non-default configurations, you're probably fine.
|
||||
|
||||
---
|
||||
|
||||
!!! info "VPN/SSH Fingerprinting"
|
||||
|
||||
The Tor Project [notes](https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorPlusVPN#vpnssh-fingerprinting) that *theoretically* using a VPN to hide Tor activities from your ISP may not be foolproof. VPNs have been found to be vulnerable to website traffic fingerprinting, where an adversary can still guess what website is being visited, because all websites have specific traffic patterns.
|
||||
|
||||
Therefore, it's not unreasonable to believe that encrypted Tor traffic hidden by a VPN could also be detected via similar methods. There are no research papers on this subject, and we still consider the benefits of using a VPN to far outweigh these risks, but it is something to keep in mind.
|
||||
|
||||
If you still believe that pluggable transports (bridges) provide additional protection against website traffic fingerprinting that a VPN does not, you always have the option to use a bridge **and** a VPN in conjunction.
|
||||
|
||||
Determining whether you should first use a VPN to connect to the Tor network will require some common sense and knowledge of your own government's and ISP's policies relating to what you're connecting to. However, again in most cases you will be better off being seen as connecting to a commercial VPN network than directly to the Tor network. If VPN providers are censored in your area, then you can also consider using Tor pluggable transports (e.g. Snowflake or meek bridges) as an alternative, but using these bridges may arouse more suspicion than standard WireGuard/OpenVPN tunnels.
|
||||
|
||||
## What Tor is Not
|
||||
|
||||
The Tor network is not the perfect privacy protection tool in all cases, and has a number of drawbacks which should be carefully considered. These things should not discourage you from using Tor if it is appropriate for your needs, but they are still things to think about when deciding which solution is most appropriate for you.
|
||||
|
||||
### Tor is not a free VPN
|
||||
|
||||
The release of the *Orbot* mobile app has lead many people to describe Tor as a "free VPN" for all of your device traffic. However, treating Tor like this poses some dangers compared to a typical VPN.
|
||||
|
||||
Unlike Tor exit nodes, VPN providers are usually not *actively* [malicious](#caveats). Because Tor exit nodes can be created by anybody, they are hotspots for network logging and modification. In 2020, many Tor exit nodes were documented to be downgrading HTTPS traffic to HTTP in order to [hijack cryptocurrency transactions](https://therecord.media/thousands-of-tor-exit-nodes-attacked-cryptocurrency-users-over-the-past-year). Other exit node attacks such as replacing downloads via unencrypted channels with malware have also been observed. HTTPS does mitigate these threats to an extent.
|
||||
|
||||
As we've alluded to already, Tor is also easily identifiable on the network. Unlike an actual VPN provider, using Tor will make you stick out as a person likely attempting to evade authorities. In a perfect world, Tor would be seen by network administrators and authorities as a tool with many uses (like how VPNs are viewed), but in reality the perception of Tor is still far less legitimate than the perception of commercial VPNs, so using a real VPN provides you with plausible deniability, e.g. "I was just using it to watch Netflix," etc.
|
||||
|
||||
### Tor usage is not undetectable
|
||||
|
||||
**Even if you use bridges and pluggable transports,** the Tor Project provides no tools to hide the fact that you are using Tor from your ISP. Even using obfuscated "pluggable transports" or non-public bridges do not hide the fact that you are using a private communications channel. The most popular pluggable transports like obfs4 (which obfuscates your traffic to "look like nothing") and meek (which uses domain fronting to camouflage your traffic) can be [detected](https://www.hackerfactor.com/blog/index.php?/archives/889-Tor-0day-Burning-Bridges.html) with fairly standard traffic analysis techniques. Snowflake has similar issues, and can be [easily detected](https://www.hackerfactor.com/blog/index.php?/archives/944-Tor-0day-Snowflake.html) *before* a Tor connection is even established.
|
||||
|
||||
Pluggable transports other than these three do exist, but typically rely on security through obscurity to evade detection. They aren't impossible to detect, they are just used by so few people that it's not worth the effort building detectors for them. They shouldn't be relied upon if you specifically are being monitored.
|
||||
|
||||
It is critical to understand the difference between bypassing censorship and evading detection. It is easier to accomplish the former because of the many real-world limitations on what network censors can realistically do en masse, but these techniques do not hide the fact that you—*specifically* you—are using Tor from an interested party monitoring your network.
|
||||
|
||||
### Tor Browser is not the most *secure* browser
|
||||
|
||||
Anonymity can often be at odds with security: Tor's anonymity requires every user to be identical, which creates a monoculture (the same bugs are present across all Tor Browser users). As a cybersecurity rule of thumb, monocultures are generally regarded as bad: Security through diversity (which Tor lacks) provides natural segmentation by limiting vulnerabilities to smaller groups, and is therefore usually desirable, but this diversity is also less good for anonymity.
|
||||
|
||||
Additionally, Tor Browser is based on Firefox's Extended Support Release builds, which only receives patches for vulnerabilities considered *Critical* and *High* (not *Medium* and *Low*). This means that attackers could (for example):
|
||||
|
||||
1. Look for new Critical/High vulnerabilities in Firefox nightly or beta builds, then check if they are exploitable in Tor Browser (this vulnerability period can last weeks).
|
||||
2. Chain *multiple* Medium/Low vulnerabilities together until they get the level of access they're looking for (this vulnerability period can last months or longer).
|
||||
|
||||
Those at risk of browser vulnerabilities should consider additional protections to defend against Tor Browser exploits, such as using Whonix in [Qubes](../os/qubes-overview.md) to contain your Tor browsing in a secure VM and protect against leaks.
|
||||
|
||||
## Построение пути к сервисам Clearnet
|
||||
|
||||
"Сервисы Clearnet" - это веб-сайты, доступ к которым можно получить с помощью любого браузера, например [privacyguides.org](https://www.privacyguides.org). Tor позволяет вам анонимно подключаться к этим сайтам, направляя ваш трафик через сеть, состоящую из тысяч, управляемых волонтёрами, серверов, которые называются узлами (или ретрансляторами).
|
||||
@@ -76,13 +156,34 @@ Tor позволяет нам подключаться к серверу так,
|
||||
|
||||
Хотя Tor обеспечивает надежные гарантии конфиденциальности, следует помнить, что Tor не совершенен:
|
||||
|
||||
- Хорошо финансируемые противники, способные пассивно следить за большинством сетевого трафика по всему миру, имеют шанс деанонимизировать пользователей Tor с помощью продвинутого анализа трафика. Tor также не защищает вас от саморазоблачения по ошибке, например, если вы поделитесь слишком большой информацией о своей настоящей личности.
|
||||
- Выходные узлы Tor также могут отслеживать проходящий через них трафик. Это означает, что трафик, который не зашифрован, например, обычный трафик HTTP, можно записывать и отслеживать. Если такой трафик содержит персонально идентифицируемую информацию, то он может деанонимизировать вас для этого выходного узла. Таким образом, мы рекомендуем использовать HTTPS через Tor, где это возможно.
|
||||
- Tor never protects you from exposing yourself by mistake, such as if you share too much information about your real identity.
|
||||
- Tor exit nodes can **modify** unencrypted traffic which passes through them. This means traffic which is not encrypted, such as plain HTTP traffic, can be changed by a malicious exit node. **Never** download files from an unencrypted `http://` website over Tor, and ensure your browser is set to always upgrade HTTP traffic to HTTPS.
|
||||
- Выходные узлы Tor также могут отслеживать проходящий через них трафик. Unencrypted traffic which contains personally identifiable information can deanonymize you to that exit node. Again, we recommend only using HTTPS over Tor.
|
||||
- Powerful adversaries with the capability to passively watch *all* network traffic around the globe ("Global Passive Adversaries") are **not** something that Tor protects you against (and using Tor [with a VPN](#safely-connecting-to-tor) doesn't change this fact).
|
||||
- Well-funded adversaries with the capability to passively watch *most* network traffic around the globe still have a *chance* of deanonymizing Tor users by means of advanced traffic analysis.
|
||||
|
||||
Если вы хотите использовать Tor для просмотра веб-страниц, мы рекомендуем только **официальный ** Tor Browser - он разработан для предотвращения цифровых отпечатков.
|
||||
|
||||
- [Tor Browser :material-arrow-right-drop-circle:](../tor.md#tor-browser)
|
||||
|
||||
### Protections provided by bridges
|
||||
|
||||
Tor bridges are commonly touted as an alternative method to hiding Tor usage from an ISP, instead of a VPN (as we suggest using if possible). Something to consider is that while bridges may provide adequate censorship circumvention, this is only a *transient* benefit. They do not adequately protect you from your ISP discovering you connected to Tor in the *past* with historical traffic log analysis.
|
||||
|
||||
To illustrate this point, consider the following scenario: You connect to Tor via a bridge, and your ISP doesn’t detect it because they are not doing sophisticated analysis of your traffic, so things are working as intended. Now, 4 months go by, and the IP of your bridge has been made public. This is a very common occurrence with bridges, they are discovered and blocked relatively frequently, just not immediately.
|
||||
|
||||
Your ISP wants to identify Tor users 4 months ago, and with their limited metadata logging they can see that you connected to an IP address which was later revealed to be a Tor bridge. You have virtually no other excuse to be making such a connection, so the ISP can say with very high confidence that you were a Tor user at that time.
|
||||
|
||||
Contrast this with our recommended scenario, where you connect to Tor via a VPN. Say that 4 months later your ISP again wants to identify anybody who used Tor 4 months ago. Their logs almost certainly can identify your traffic 4 months ago, but all they would likely be able to see is that you connected to a VPN’s IP address. This is because most ISPs only retain metadata over long periods of time, not the full contents of the traffic you request. Storing the entirety of your traffic data would require a massive quantity of storage which nearly all threat actors wouldn't possess.
|
||||
|
||||
Because your ISP almost certainly is not capturing all packet-level data and storing it forever, they have no way of determining what you connected to with that VPN *after* the fact with an advanced technique like deep packet inspection, and therefore you have plausible deniability.
|
||||
|
||||
Therefore, bridges provide the most benefit when circumventing internet censorship *in the moment*, but they are not an adequate substitute for **all** the benefits that using a VPN alongside Tor can provide. Again, this is not advice *against* using Tor bridges, you should just be aware of these limitations while making your decision. In some cases bridges may be the *only* option (if all VPN providers are blocked, for instance), so you can still use them in those circumstances with this limitation in mind.
|
||||
|
||||
If you think that a bridge can aid in defending against fingerprinting or other advanced network analysis more than a VPN's encrypted tunnel already can, you always have the option to use a bridge in conjunction with a VPN as well. That way you are still protected by the pluggable transport's obfuscation techniques even if an adversary gains some level of visibility into your VPN tunnel. If you decide to go this route, we recommend connecting to an obfs4 bridge behind your VPN for optimal fingerprinting protection, rather than meek or Snowflake.
|
||||
|
||||
It is [possible](https://discuss.privacyguides.net/t/clarify-tors-weaknesses-with-respect-to-observability/3676/16) that the [WebTunnel](https://forum.torproject.org/t/tor-relays-announcement-webtunnel-a-new-pluggable-transport-for-bridges-now-available-for-deployment/8180) pluggable transport currently being trialed may mitigate some of these concerns. We will continue to keep an eye on that technology as it develops.
|
||||
|
||||
## Дополнительные советы
|
||||
|
||||
- [Руководство пользователя Tor Browser](https://tb-manual.torproject.org)
|
||||
|
||||
@@ -215,39 +215,6 @@ Google Pixel phones use a TEE OS called Trusty which is [open source](https://so
|
||||
|
||||
Используя Shelter, вы полностью доверяете его разработчику, поскольку Shelter действует как [администратор устройства](https://developer.android.com/guide/topics/admin/device-admin) для создания рабочего профиля и имеет широкий доступ к данным, хранящимся в рабочем профиле.
|
||||
|
||||
### Auditor
|
||||
|
||||
!!! recommendation
|
||||
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Auditor** - это приложение, использующее функции аппаратной безопасности для обеспечения контроля целостности устройства путем активного подтверждения личности устройства и целостности его операционной системы. В настоящее время оно работает только с GrapheneOS или стоковой операционной системой для [поддерживаемых устройств](https://attestation.app/about#device-support).
|
||||
|
||||
[:octicons-home-16: Домашняя страница](https://attestation.app){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://attestation.app/privacy-policy){ .card-link title="Политика конфиденциальности" }
|
||||
[:octicons-info-16:](https://attestation.app/about){ .card-link title=Документация}
|
||||
[:octicons-code-16:](https://attestation.app/source){ .card-link title="Исходный код" }
|
||||
[:octicons-heart-16:](https://attestation.app/donate){ .card-link title=Поддержать }
|
||||
|
||||
??? downloads "Скачать"
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=app.attestation.auditor.play)
|
||||
- [:simple-github: GitHub](https://github.com/GrapheneOS/Auditor/releases)
|
||||
- [:material-cube-outline: GrapheneOS App Store](https://github.com/GrapheneOS/Apps/releases)
|
||||
|
||||
Auditor осуществляет аттестацию и обнаружение вторжений путем:
|
||||
|
||||
- Использования модели [Trust On First Use (TOFU)](https://en.wikipedia.org/wiki/Trust_on_first_use) между *аудитором* и *аудируемым*, пара устанавливает приватныйключ в [аппаратное хранилище ключей](https://source.android.com/security/keystore/) *Auditor*.
|
||||
- *Аудитором* может быть либо другой экземпляр приложения Auditor, либо [Remote Attestation Service](https://attestation.app).
|
||||
- *Аудитор* записывает текущее состояние и конфигурацию *аудируемого* девайса.
|
||||
- Если операционная система *аудируемого* девайса изменяется после завершения сопряжения, аудитор заметит изменения в состоянии и конфигурации устройства.
|
||||
- Вы получите уведомление об изменении.
|
||||
|
||||
В службу аттестации не передается информация, позволяющая установить личность. Мы рекомендуем вам зарегистрироваться с анонимной учетной записью и включить удаленную аттестацию для постоянного мониторинга.
|
||||
|
||||
Если ваша [модель угроз](basics/threat-modeling.md) требует конфиденциальности, вы можете рассмотреть возможность использования [Orbot](tor.md#orbot) или VPN, чтобы скрыть свой IP-адрес от службы аттестации. Чтобы убедиться в подлинности оборудования и операционной системы, [проведите локальную аттестацию](https://grapheneos.org/install/web#verifying-installation) сразу после настройки устройства и до подключения к Интернету.
|
||||
|
||||
### Secure Camera
|
||||
|
||||
!!! recommendation
|
||||
@@ -347,7 +314,7 @@ Aurora Store не позволяет загружать платные прил
|
||||
|
||||
### Вручную с помощью уведомлений RSS
|
||||
|
||||
Для приложений, которые выпускаются на таких платформах, как GitHub и GitLab, вы можете добавить RSS-ленту в свой [агрегатор новостей](/news-aggregators), которая поможет вам отслеживать новые релизы.
|
||||
For apps that are released on platforms like GitHub and GitLab, you may be able to add an RSS feed to your [news aggregator](news-aggregators.md) that will help you keep track of new releases.
|
||||
|
||||
   
|
||||
|
||||
|
||||
@@ -39,7 +39,7 @@ description: Модель угрозы уникальна для каждого,
|
||||
|
||||
Мобильные операционные системы, как правило, имеют лучшую "песочницу" для приложений, чем настольные операционные системы: приложения не могут получить root-доступ и требуют разрешения на доступ к системным ресурсам.
|
||||
|
||||
Настольные операционные системы, как правило, отстают по части надлежащей "песочницы". ChromeOS имеет возможности "песочницы", аналогичные Android, а macOS имеет полный контроль системных разрешений (и разработчики могут отказаться от "песочницы" для приложений). Однако эти операционные системы передают идентифицирующую информацию своим соответствующим OEM-производителям. Linux, как правило, не предоставляет информацию поставщикам систем, но имеет слабую защиту от эксплойтов и вредоносных приложений. Это можно несколько смягчить с помощью специализированных дистрибутивов, которые в значительной степени используют виртуальные машины или контейнеры, например [Qubes OS](../../desktop/#qubes-os).
|
||||
Настольные операционные системы, как правило, отстают по части надлежащей "песочницы". ChromeOS имеет возможности "песочницы", аналогичные Android, а macOS имеет полный контроль системных разрешений (и разработчики могут отказаться от "песочницы" для приложений). Однако эти операционные системы передают идентифицирующую информацию своим соответствующим OEM-производителям. Linux, как правило, не предоставляет информацию поставщикам систем, но имеет слабую защиту от эксплойтов и вредоносных приложений. This can be mitigated somewhat with specialized distributions which make significant use of virtual machines or containers, such as [Qubes OS](../desktop.md#qubes-os).
|
||||
|
||||
<span class="pg-red">:material-target-account: Целевые атаки</span>
|
||||
|
||||
|
||||
@@ -5,70 +5,106 @@ icon: material/vpn
|
||||
description: Виртуальные частные сети переносят риск от вашего провайдера на третью сторону, которой вы доверяете. Вам следует помнить об этих вещах.
|
||||
---
|
||||
|
||||
Виртуальные частные сети - это способ перенести выход вашей сети куда-либо в мире. Провайдер может видеть поток интернет-трафика, входящего и выходящего сетевого устройства (т.е. модема).
|
||||
Virtual Private Networks are a way of extending the end of your network to exit somewhere else in the world.
|
||||
|
||||
В интернете широко используются протоколы шифрования, такие как HTTPS, поэтому интернет-провайдеры не могут видеть, что именно вы публикуете или читаете, но они могут получить представление о [посещаемых вами доменах](../advanced/dns-overview.md#why-shouldnt-i-use-encrypted-dns).
|
||||
Normally, an ISP can see the flow of internet traffic entering and exiting your network termination device (i.e. modem). Encryption protocols such as HTTPS are commonly used on the internet, so they may not be able to see exactly what you're posting or reading, but they can get an idea of the [domains you request](../advanced/dns-overview.md#why-shouldnt-i-use-encrypted-dns).
|
||||
|
||||
VPN может помочь, поскольку он может сместить доверие на сервер в другой точке мира. В результате провайдер видит только то, что вы подключены к VPN, и ничего о деятельности, которую вы проводите через VPN.
|
||||
Using a VPN hides even this information from your ISP, by shifting the trust you place in your network to a server somewhere else in the world. As a result, the ISP then only sees that you are connected to a VPN and nothing about the activity that you're passing through it.
|
||||
|
||||
!!! note "Примечание"
|
||||
|
||||
When we refer to "Virtual Private Networks" on this website, we are usually referring to **commercial** [VPN providers](../vpn.md), who you pay a monthly fee to in exchange for routing your internet traffic securely through their public servers. There are many other forms of VPN, such as ones you host yourself or ones operated by workplaces which allow you to securely connect to internal/employee network resources, however, these VPNs are usually designed for accessing remote networks securely, rather than protecting the privacy of your internet connection.
|
||||
|
||||
## How does a VPN work?
|
||||
|
||||
VPNs encrypt your traffic between your device and a server owned by your VPN provider. From the perspective of anyone between you and the VPN server, it looks like you're connecting to the VPN server. From the perspective of anyone between the VPN server and your destination site, all they can see is the VPN server connecting to the website.
|
||||
|
||||
``` mermaid
|
||||
flowchart LR
|
||||
763931["Your Device<div>(with VPN Client)</div>"] ===|"VPN Encryption"| 404512{"VPN Server"}
|
||||
404512 -.-|"No VPN Encryption"| 593753((("The Internet\n(Your Destination)")))
|
||||
subgraph 763931["Your Device<div>(with VPN Client)</div>"]
|
||||
end
|
||||
```
|
||||
|
||||
Note that a VPN does not add any security or encryption to your traffic between the VPN server and your destination on the internet. To access a website securely you **must** still ensure HTTPS is in use regardless of whether you use a VPN.
|
||||
|
||||
## Следует ли мне использовать VPN?
|
||||
|
||||
**Да**, если только вы уже не используете Tor. VPN делает две вещи: перенимает риски с вашего интернет-провайдера на себя и скрывает ваш IP от сторонних служб.
|
||||
|
||||
VPN не могут шифровать данные за пределами соединения между вашим устройством и VPN-сервером. Провайдеры VPN могут видеть и изменять ваш трафик так же, как и ваш интернет-провайдер. И нет никакого способа проверить политику VPN-провайдера "без ведения логов".
|
||||
|
||||
Однако они скрывают ваш реальный IP от сторонних служб, если нет утечки IP-адресов. Они помогают вам слиться с окружающими и смягчают отслеживание по IP-адресу.
|
||||
|
||||
## Когда мне не следует использовать VPN?
|
||||
|
||||
Using a VPN in cases where you're using your [known identity](common-misconceptions.md#complicated-is-better) is unlikely be useful.
|
||||
|
||||
Это может привести к срабатыванию систем обнаружения спама и мошенничества, например, если вы зашли на сайт своего банка.
|
||||
|
||||
## А как насчет шифрования?
|
||||
|
||||
Шифрование, предлагаемое провайдерами VPN, осуществляется между вашими устройствами и их серверами. Это гарантирует, что данная конкретная связь безопасна. Это шаг вперед от использования незашифрованных прокси-серверов, где сетевой противник может перехватить коммуникацию между вашими устройствами и указанными прокси-серверами и изменить её. Однако шифрование между вашими приложениями/браузерами и поставщиками услуг не обрабатывается этим шифрованием.
|
||||
|
||||
Чтобы сохранить конфиденциальность и безопасность того, что вы делаете на посещаемых вами сайтах, необходимо использовать HTTPS. Это позволит сохранить ваши пароли, токены сессии и запросы в безопасности от провайдера VPN. Рассмотрите возможность включения "только HTTPS" в вашем браузере для смягчения атак, таких как [SSL Strip](https://www.blackhat.com/presentations/bh-dc-09/Marlinspike/BlackHat-DC-09-Marlinspike-Defeating-SSL.pdf).
|
||||
|
||||
## Нужно ли мне использовать зашифрованный DNS вместе с VPN?
|
||||
|
||||
Если ваш VPN-провайдер не хостит собственные зашифрованные DNS-серверы, то **нет**. Использование DOH/DOT (или любой другой формы зашифрованного DNS) со сторонними серверами просто добавит еще больше объектов для доверия и не сделает **абсолютно ничего** для улучшения вашей конфиденциальности/безопасности. Ваш провайдер VPN все еще может видеть, какие сайты вы посещаете, основываясь на IP-адресах и других методах. Вместо того чтобы доверять только своему VPN-провайдеру, теперь вы доверяете и VPN-провайдеру, и DNS-провайдеру.
|
||||
|
||||
Распространенная причина для рекомендации зашифрованного DNS заключается в том, что он помогает противостоять подделке DNS. Однако ваш браузер уже должен проверять наличие [TLS сертификатов](https://en.wikipedia.org/wiki/Transport_Layer_Security#Digital_certificates) с **HTTPS** и предупреждать вас об этом. Если вы не используете **HTTPS**, то злоумышленник все равно может просто модифицировать что угодно, кроме ваших DNS-запросов, и конечный результат будет немного отличаться.
|
||||
|
||||
Само собой разумеется, **не следует использовать зашифрованные DNS с Tor**. Это позволит направить все ваши DNS-запросы через единую цепь и даст возможность провайдеру DNS с шифрованием деанонимизировать вас.
|
||||
|
||||
## Следует ли мне использовать Tor *и* VPN?
|
||||
|
||||
Используя VPN с Tor, вы создаете, по сути, постоянный входной узел, часто с привязкой к денежному следу. Это не дает вам никаких дополнительных преимуществ, но при этом значительно увеличивает поверхность атаки вашего соединения. Если вы хотите скрыть использование Tor от провайдера или правительства, в Tor есть встроенное решение для этого: мосты Tor. [Подробнее о мостах Tor и о том, почему использование VPN необязательно](../advanced/tor-overview.md).
|
||||
|
||||
## А если мне нужна анонимность?
|
||||
|
||||
VPN не могут обеспечить анонимность. Ваш VPN-провайдер все равно будет видеть ваш реальный IP-адрес, и часто у него есть денежный след, который может быть связан непосредственно с вами. Вы не можете полагаться на политику "никаких логов" для защиты своих данных. Вместо этого используйте [Tor](https://www.torproject.org/).
|
||||
|
||||
## Как насчет VPN-провайдеров, которые предоставляют узлы Tor?
|
||||
|
||||
Не используйте эту функцию. Смысл использования Tor заключается в том, что вы не доверяете своему VPN-провайдеру. В настоящее время Tor поддерживает только протокол [TCP](https://en.wikipedia.org/wiki/Transmission_Control_Protocol). [UDP](https://en.wikipedia.org/wiki/User_Datagram_Protocol) (используется в [WebRTC](https://en.wikipedia.org/wiki/WebRTC) для обмена голосом и видео, новом [HTTP3/QUIC](https://en.wikipedia.org/wiki/HTTP/3) протоколе и т.д.), [ICMP](https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol) и другие пакеты будут отброшены. Чтобы компенсировать это, провайдеры VPN обычно направляют все пакеты, не относящиеся к TCP, через свой VPN-сервер (первый путь вашего трафика). Это случай с [ProtonVPN](https://protonvpn.com/support/tor-vpn/). Кроме того, при использовании функции Tor через VPN вы не сможете контролировать другие важные функции Tor, например [Isolated Destination Address](https://www.whonix.org/wiki/Stream_Isolation) (использование отдельной цепи Tor для каждого посещаемого вами домена).
|
||||
|
||||
Эту функцию следует рассматривать как удобный способ доступа к сети Tor, а не для сохранения анонимности. Для обеспечения анонимности используйте браузер Tor, TorSocks или шлюз Tor.
|
||||
|
||||
## Когда VPN полезны?
|
||||
|
||||
VPN может оказаться полезным для вас в различных сценариях, например:
|
||||
**Yes**, almost certainly. A VPN has many advantages, including:
|
||||
|
||||
1. Скрывать ваш трафик **только** от вашего интернет-провайдера.
|
||||
1. Скрывать ваши загрузки (например, торренты) от провайдера и антипиратских организаций.
|
||||
1. Скрывать ваш IP от сторонних веб-сайтов и служб, предотвращение отслеживания на основе IP.
|
||||
1. Hiding your IP from third-party websites and services, helping you blend in and preventing IP based tracking.
|
||||
1. Allowing you to bypass geo-restrictions on certain content.
|
||||
|
||||
Для подобных ситуаций, или если у вас есть другая веская причина, VPN-провайдеры, перечисленные выше, по нашему мнению, являются наиболее надежными. Однако использование VPN-провайдера все равно означает, что вы *доверяете* провайдеру. В практически любом другом сценарии вы должны использовать безопасный**-по-дизайну** инструмент, такой как Tor.
|
||||
VPNs can provide *some* of the same benefits Tor provides, such as hiding your IP from the websites you visit and geographically shifting your network traffic, and good VPN providers will not cooperate with e.g. legal authorities from oppressive regimes, especially if you choose a VPN provider outside your own jurisdiction.
|
||||
|
||||
## Источники и дополнительное чтение
|
||||
VPNs cannot encrypt data outside the connection between your device and the VPN server. VPN providers can also see and modify your traffic the same way your ISP could, so there is still a level of trust you are placing in them. И нет никакого способа проверить политику VPN-провайдера "без ведения логов".
|
||||
|
||||
1. [VPN - a Very Precarious Narrative](https://schub.io/blog/2019/04/08/very-precarious-narrative.html) by Dennis Schubert
|
||||
1. [Tor Network Overview](../advanced/tor-overview.md)
|
||||
1. [IVPN Privacy Guides](https://www.ivpn.net/privacy-guides)
|
||||
1. ["Do I need a VPN?"](https://www.doineedavpn.com), a tool developed by IVPN to challenge aggressive VPN marketing by helping individuals decide if a VPN is right for them.
|
||||
## When isn't a VPN suitable?
|
||||
|
||||
Using a VPN in cases where you're using your [real-life or well-known identity](common-misconceptions.md#complicated-is-better) online is unlikely be useful. Это может привести к срабатыванию систем обнаружения спама и мошенничества, например, если вы зашли на сайт своего банка.
|
||||
|
||||
It's important to remember that a VPN will not provide you with absolute anonymity, because the VPN provider itself will still see your real IP address, destination website information, and often has a money trail that can be linked directly back to you. You can't rely on "no logging" policies to protect your data from anyone who is able to protect. If you need complete safety from the network itself, consider using [Tor](../advanced/tor-overview.md) in addition to or instead of a VPN.
|
||||
|
||||
You also should not trust a VPN to secure your connection to an unencrypted, HTTP destination. Чтобы сохранить конфиденциальность и безопасность того, что вы делаете на посещаемых вами сайтах, необходимо использовать HTTPS. This will keep your passwords, session tokens, and queries safe from the VPN provider and other potential adversaries in between the VPN server and your destination. You should enable HTTPS-only mode in your browser (if it's supported) to mitigate attacks which try to downgrade your connection from HTTPS to HTTP.
|
||||
|
||||
## Нужно ли мне использовать зашифрованный DNS вместе с VPN?
|
||||
|
||||
Unless your VPN provider hosts the encrypted DNS servers themselves, **probably not**. Using DOH/DOT (or any other form of encrypted DNS) with third-party servers will simply add more entities to trust. Ваш провайдер VPN все еще может видеть, какие сайты вы посещаете, основываясь на IP-адресах и других методах. All this being said, there may be some advantages to enabling encrypted DNS in order to enable other security features in your browser, such as ECH. Browser technologies which are reliant on in-browser encrypted DNS are relatively new and not yet widespread, so whether they are relevant to you in particular is an exercise we will leave to you to research independently.
|
||||
|
||||
Another common reason encrypted DNS is recommended is that it prevents DNS spoofing. Однако ваш браузер уже должен проверять наличие [TLS сертификатов](https://en.wikipedia.org/wiki/Transport_Layer_Security#Digital_certificates) с **HTTPS** и предупреждать вас об этом. Если вы не используете **HTTPS**, то злоумышленник все равно может просто модифицировать что угодно, кроме ваших DNS-запросов, и конечный результат будет немного отличаться.
|
||||
|
||||
## Следует ли мне использовать Tor *и* VPN?
|
||||
|
||||
Maybe, Tor is not necessarily suitable for everybody in the first place. Consider your [threat model](threat-modeling.md), because if your adversary is not capable of extracting information from your VPN provider, using a VPN alone may provide enough protection.
|
||||
|
||||
If you do use Tor then you are *probably* best off connecting to the Tor network via a commercial VPN provider. However, this is a complex subject which we've written more about on our [Tor overview](../advanced/tor-overview.md) page.
|
||||
|
||||
## Should I access Tor through VPN providers that provide "Tor nodes"?
|
||||
|
||||
You should not use that feature: The primary advantage of using Tor is that you do not trust your VPN provider, which is negated when you use Tor nodes hosted by your VPN instead of connecting directly to Tor from your computer.
|
||||
|
||||
Currently, Tor only supports the TCP protocol. UDP (used by [WebRTC](https://en.wikipedia.org/wiki/WebRTC), [HTTP3/QUIC](https://en.wikipedia.org/wiki/HTTP/3), and other protocols), [ICMP](https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol), and other packets will be dropped. Чтобы компенсировать это, провайдеры VPN обычно направляют все пакеты, не относящиеся к TCP, через свой VPN-сервер (первый путь вашего трафика). Это случай с [ProtonVPN](https://protonvpn.com/support/tor-vpn/). Кроме того, при использовании функции Tor через VPN вы не сможете контролировать другие важные функции Tor, например [Isolated Destination Address](https://www.whonix.org/wiki/Stream_Isolation) (использование отдельной цепи Tor для каждого посещаемого вами домена).
|
||||
|
||||
The feature should be viewed as a *convenient* way to access hidden services on Tor, not to stay anonymous. For proper anonymity, use the actual [Tor Browser](../tor.md).
|
||||
|
||||
## Commercial VPN Ownership
|
||||
|
||||
Most VPN services are owned by the same [few companies](https://vpnpro.com/blog/hidden-vpn-owners-unveiled-97-vpns-23-companies/). These shady companies run lots of smaller VPN services to create the illusion that you have more choice than you actually do and to maximize profit. Typically, these providers that feed into their shell company have terrible privacy policies and shouldn't be trusted with your internet traffic. You should be very strict about which provider you decide to use.
|
||||
|
||||
You should also be wary that many VPN review sites are merely advertising vehicles open to the highest bidder. ==Privacy Guides does not make money from recommending external products, and never uses affiliate programs.==
|
||||
|
||||
[Our VPN Recommendations](../vpn.md ""){.md-button}
|
||||
|
||||
## Modern VPN Alternatives
|
||||
|
||||
Recently, some attempts have been made by various organizations to address some issues which centralized VPNs have. These technologies are relatively new, but worth keeping an eye on as the field develops.
|
||||
|
||||
### Multi-Party Relays
|
||||
|
||||
Multi-Party Relays (MPRs) use multiple nodes owned by different parties, such that no individual party knows both who you are and what you're connecting to. This is the basic idea behind Tor, but now there are some paid services that try to emulate this model.
|
||||
|
||||
MPRs seek to solve a problem inherent to VPNs: the fact that you must trust them completely. They accomplish this goal by segmenting the responsibilities between two or more different companies. For example, Apple's iCloud+ Private Relay routes your traffic through two servers:
|
||||
|
||||
1. Firstly, a server operated by Apple.
|
||||
|
||||
This server is able to see your device's IP when you connect to it, and has knowledge of your payment information and Apple ID tied to your iCloud subscription. However, it is unable to see what website you are connecting to.
|
||||
|
||||
2. Secondly, a server operated by a partner CDN, such as Cloudflare or Fastly.
|
||||
|
||||
This server actually makes the connection to your destination website, but has no knowledge of your device. The only IP address it knows about is Apple's server's.
|
||||
|
||||
Other MPRs run by different companies like Google or INVISV operate in a very similar manner. This protection by segmentation only exists if you trust the two companies to not collude with each other to deanonymize you.
|
||||
|
||||
### Decentralized VPNs
|
||||
|
||||
Another attempt at solving the issues with centralized VPN services are dVPNs. These are based on blockchain technology and claim to eliminate trust in a single party by distributing the nodes across lots of different people. However, many times a dVPN will default to a single node, meaning you need to trust that node completely, just like a traditional VPN. Unlike a traditional VPN, this one node that can see all your traffic is a random person instead of your VPN provider that can be audited and has legal responsibilities to uphold their privacy policy. Multi-hop is needed to solve this, but that comes with a stability and performance cost.
|
||||
|
||||
Another consideration is legal liability. The exit node will need to deal with legal problems from misuse of the network, an issue that the Tor network has contended with for its entire existence. This discourages regular people from running nodes and makes it more attractive for a malicious actor with lots of resources to host one. This is a big problem if the service is single-node, as the potentially malicious exit node can see who you are and what you're connecting to.
|
||||
|
||||
Many dVPNs are used to push a cryptocurrency rather than to make the best service. They also tend to be smaller networks with fewer nodes, making them more vulnerable to [Sybil attacks](https://en.wikipedia.org/wiki/Sybil_attack).
|
||||
|
||||
## Связанная информация о VPN
|
||||
|
||||
@@ -76,3 +112,4 @@ VPN может оказаться полезным для вас в различ
|
||||
- [Free VPN App Investigation](https://www.top10vpn.com/free-vpn-app-investigation/)
|
||||
- [Hidden VPN owners unveiled: 101 VPN products run by just 23 companies](https://vpnpro.com/blog/hidden-vpn-owners-unveiled-97-vpns-23-companies/)
|
||||
- [This Chinese company is secretly behind 24 popular apps seeking dangerous permissions](https://vpnpro.com/blog/chinese-company-secretly-behind-popular-apps-seeking-dangerous-permissions/)
|
||||
- [VPN - a Very Precarious Narrative](https://schub.io/blog/2019/04/08/very-precarious-narrative.html) by Dennis Schubert
|
||||
|
||||
@@ -120,11 +120,9 @@ Nix - это менеджер пакетов на основе исходных
|
||||
|
||||
Whonix предназначен для запуска в виде двух виртуальных машин: "Рабочая" и "Шлюз Tor." Все соединения рабочей станции должны проходить через шлюз Tor. Это означает, даже если рабочая станция будет скомпрометирована каким-либо вредоносным ПО, настоящий IP-адрес останется скрытым.
|
||||
|
||||
Некоторые из его возможностей включают изоляцию потока Tor, [анонимизацию нажатия клавиш](https://www.whonix.org/wiki/Keystroke_Deanonymization#Kloak), [зашифрованный swap](https://github.com/Whonix/swap-file-creator), а также усиленный распределитель памяти.
|
||||
Some of its features include Tor Stream Isolation, [keystroke anonymization](https://www.whonix.org/wiki/Keystroke_Deanonymization#Kloak), [encrypted swap](https://github.com/Whonix/swap-file-creator), and a hardened memory allocator. Future versions of Whonix will likely include [full system AppArmor policies](https://github.com/Whonix/apparmor-profile-everything) and a [sandbox app launcher](https://www.whonix.org/wiki/Sandbox-app-launcher) to fully confine all processes on the system.
|
||||
|
||||
Будущие версии Whonix, вероятно, будут включать [полные системные политики AppArmor](https://github.com/Whonix/apparmor-profile-everything) и [программу запуска приложений в песочнице](https://www.whonix.org/wiki/Sandbox-app-launcher) для полного ограничения всех процессов в системе.
|
||||
|
||||
Whonix лучше всего использовать [в сочетании с Qubes](https://www.whonix.org/wiki/Qubes/Why_use_Qubes_over_other_Virtualizers), Qubes-Whonix имеет различные [недостатки](https://forums.whonix.org/t/qubes-whonix-security-disadvantages-help-wanted/8581) по сравнению с другими гипервизорами.
|
||||
Whonix is best used [in conjunction with Qubes](https://www.whonix.org/wiki/Qubes/Why_use_Qubes_over_other_Virtualizers). We have a [recommended guide](os/qubes-overview.md#connecting-to-tor-via-a-vpn) on configuring Whonix in conjunction with a VPN ProxyVM in Qubes to hide your Tor activities from your ISP.
|
||||
|
||||
### Tails
|
||||
|
||||
|
||||
223
i18n/ru/device-integrity.md
Normal file
223
i18n/ru/device-integrity.md
Normal file
@@ -0,0 +1,223 @@
|
||||
---
|
||||
title: Device Integrity
|
||||
icon: material/security
|
||||
description: These tools can be used to check your devices for compromise.
|
||||
cover: device-integrity.webp
|
||||
---
|
||||
|
||||
These tools can be used to validate the integrity of your mobile devices and check them for indicators of compromise by spyware and malware such as Pegasus, Predator, or KingsPawn. This page focuses on **mobile security**, because mobile devices typically have read-only systems with well-known configurations, so detecting malicious modifications is easier than on traditional desktop systems. We may expand the focus of this page in the future.
|
||||
|
||||
!!! note "This is an advanced topic"
|
||||
|
||||
```
|
||||
These tools may provide utility for certain individuals. They provide functionality which most people do not need to worry about, and often require more in-depth technical knowledge to use effectively.
|
||||
```
|
||||
|
||||
It is **critical** to understand that scanning your device for public indicators of compromise is **not sufficient** to determine that a device is "clean", and not targeted with a particular spyware tool. Reliance on these publicly-available scanning tools can miss recent security developments and give you a false sense of security.
|
||||
|
||||
## General Advice
|
||||
|
||||
The majority of system-level exploits on modern mobile devices—especially zero-click compromises—are non-persistent, meaning they will not remain or run automatically after a reboot. For this reason, we highly recommend rebooting your device regularly. We recommend everybody reboot their devices once a week at minimum, but if non-persistent malware is of particular concern for you, we and many security experts recommend a daily reboot schedule.
|
||||
|
||||
This means an attacker would have to regularly re-infect your device to retain access, although we'll note this is not impossible. Rebooting your device also will not protect you against _persistent_ malware, but this is less common on mobile devices due to modern security features like secure/verified boot.
|
||||
|
||||
## Post-Compromise Information & Disclaimer
|
||||
|
||||
If any of the following tools indicate a potential compromise by spyware such as Pegasus, Predator, or KingsPawn, we advise that you contact:
|
||||
|
||||
- If you are a human rights defender, journalist, or from a civil society organization: [Amnesty International's Security Lab](https://securitylab.amnesty.org/contact-us/)
|
||||
- If a business or government device is compromised: Contact the appropriate security liason at your enterprise, department, or agency
|
||||
- Local law enforcement
|
||||
|
||||
**We are unable to help you directly beyond this.** We are happy to discuss your specific situation or circumstances and review your results in our [community](https://discuss.privacyguides.net) spaces, but it is unlikely we can assist you beyond what is written on this page.
|
||||
|
||||
The tools on this page are only capable of detecting indicators of compromise, not removing them. If you are concerned about having been compromised, we advise that you:
|
||||
|
||||
- Consider replacing the device completely
|
||||
- Consider changing your SIM/eSIM number
|
||||
- Not restore from a backup, because that backup may be compromised
|
||||
|
||||
These tools provide analysis based on the information they have the ability to access from your device, and publicly-accessible indicators of compromise. It is important to keep in mind two things:
|
||||
|
||||
1. Indicators of compromise are just that: _indicators_. They are not a definitive finding, and may occasionally be **false positives**. If an indicator of compromise is detected, it means you should do additional research into the _potential_ threat.
|
||||
2. The indicators of compromise these tools look for are published by threat research organizations, but not all indicators are made available to the public! This means that these tools can present a **false negative**, if your device is infected with spyware which is not detected by any of the public indicators. Reliable and comprehensive digital forensic support and triage requires access to non-public indicators, research and threat intelligence.
|
||||
|
||||
## External Verification Tools
|
||||
|
||||
External verification tools run on your computer and scan your mobile device for forensic traces which are helpful to identify potential compromise.
|
||||
|
||||
!!! recommendation
|
||||
|
||||
```
|
||||
Public indicators of compromise are insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. Reliance on public indicators alone can miss recent forensic traces and give a false sense of security.
|
||||
|
||||
Reliable and comprehensive digital forensic support and triage requires access to non-public indicators, research and threat intelligence.
|
||||
|
||||
Such support is available to civil society through [Amnesty International's Security Lab](https://www.amnesty.org/en/tech/) or [Access Now’s Digital Security Helpline](https://www.accessnow.org/help/).
|
||||
```
|
||||
|
||||
These tools can trigger false-positives. If any of these tools finds indicators of compromise, you need to dig deeper to determine your actual risk. Some reports may be false positives based on websites you've visited in the past, and findings which are many years old are likely either false-positives or indicate previous (and no longer active) compromise.
|
||||
|
||||
### Mobile Verification Toolkit
|
||||
|
||||
!!! recommendation
|
||||
|
||||
```
|
||||
{ align=right }
|
||||
|
||||
**Mobile Verification Toolkit** (**MVT**) is a collection of utilities which simplifies and automates the process of scanning mobile devices for potential traces of targeting or infection by known spyware campaigns. MVT was developed by Amnesty International and released in 2021 in the context of the [Pegasus Project](https://forbiddenstories.org/about-the-pegasus-project/).
|
||||
|
||||
[:octicons-home-16: Homepage](https://mvt.re/){ .md-button .md-button--primary }
|
||||
[:octicons-code-16:](https://github.com/mvt-project/mvt){ .card-link title="Source Code" }
|
||||
|
||||
??? downloads
|
||||
|
||||
- [:simple-apple: macOS](https://docs.mvt.re/en/latest/install/)
|
||||
- [:simple-linux: Linux](https://docs.mvt.re/en/latest/install/)
|
||||
```
|
||||
|
||||
!!! warning "Осторожно"
|
||||
|
||||
```
|
||||
Using MVT is insufficient to determine that a device is "clean", and not targeted with a particular spyware tool.
|
||||
```
|
||||
|
||||
MVT is _most_ useful for scanning iOS devices. Android stores very little diagnostic information useful to triage potential compromises, and because of this `mvt-android` capabilities are limited as well. On the other hand, encrypted iOS iTunes backups provide a large enough subset of files stored on the device to detect suspicious artifacts in many cases. This being said, MVT does still provide fairly useful tools for both iOS and Android analysis.
|
||||
|
||||
If you use iOS and are at high-risk, we have three additional suggestions for you:
|
||||
|
||||
1. Create and keep regular (monthly) iTunes backups. This allows you to find and diagnose past infections later with MVT, if new threats are discovered in the future.
|
||||
|
||||
2. Trigger _sysdiagnose_ logs often and back them up externally. These logs can provide invaluable data to future forensic investigators if need be.
|
||||
|
||||
The process to do so varies by model, but you can trigger it on newer phones by holding down _Power_ + _Volume Up_ + _Volume Down_ until you feel a brief vibration. After a few minutes, the timestamped _sysdiagnose_ log will appear in **Settings** > **Privacy & Security** > **Analytics & Improvements** > **Analytics Data**.
|
||||
|
||||
3. Enable [Lockdown Mode](https://blog.privacyguides.org/2022/10/27/macos-ventura-privacy-security-updates/#lockdown-mode).
|
||||
|
||||
MVT allows you to perform deeper scans/analysis if your device is jailbroken. Unless you know what you are doing, **do not jailbreak or root your device.** Jailbreaking your device exposes it to considerable security risks.
|
||||
|
||||
### iMazing (iOS)
|
||||
|
||||
!!! recommendation
|
||||
|
||||
```
|
||||
{ align=right }
|
||||
|
||||
**iMazing** provides a free spyware analyzer tool for iOS devices which acts as a GUI-wrapper for [MVT](#mobile-verification-toolkit). This can be much easier to run compared to MVT itself, which is a command-line tool designed for technologists and forensic investigators.
|
||||
|
||||
[:octicons-home-16: Homepage](https://imazing.com/){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://imazing.com/privacy-policy){ .card-link title="Privacy Policy" }
|
||||
[:octicons-info-16:](https://imazing.com/spyware-analyzer){ .card-link title=Documentation}
|
||||
|
||||
??? downloads
|
||||
|
||||
- [:simple-windows11: Windows](https://imazing.com/download)
|
||||
- [:simple-apple: macOS](https://imazing.com/download)
|
||||
```
|
||||
|
||||
iMazing automates and interactively guides you through the process of using [MVT](#mobile-verification-toolkit) to scan your device for publicly-accessible indicators of compromise published by various threat researchers. All of the information and warnings which apply to MVT apply to this tool as well, so we suggest you also familiarize yourself with the notes on MVT in the sections above.
|
||||
|
||||
## On-Device Verification
|
||||
|
||||
These are apps you can install which check your device and operating system for signs of tampering, and validate the identity of your device.
|
||||
|
||||
!!! warning "Осторожно"
|
||||
|
||||
```
|
||||
Using these apps is insufficient to determine that a device is "clean", and not targeted with a particular spyware tool.
|
||||
```
|
||||
|
||||
### Auditor (Android)
|
||||
|
||||
!!! recommendation
|
||||
|
||||
```
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Auditor** is an app which leverages hardware security features to provide device integrity monitoring by actively validating the identity of a device and the integrity of its operating system. Currently, it only works with GrapheneOS or the stock operating system for [supported devices](https://attestation.app/about#device-support).
|
||||
|
||||
[:octicons-home-16: Homepage](https://attestation.app){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://attestation.app/privacy-policy){ .card-link title="Privacy Policy" }
|
||||
[:octicons-info-16:](https://attestation.app/about){ .card-link title=Documentation}
|
||||
[:octicons-code-16:](https://attestation.app/source){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://attestation.app/donate){ .card-link title=Contribute }
|
||||
|
||||
??? downloads
|
||||
|
||||
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=app.attestation.auditor.play)
|
||||
- [:simple-github: GitHub](https://github.com/GrapheneOS/Auditor/releases)
|
||||
- [:material-cube-outline: GrapheneOS App Store](https://github.com/GrapheneOS/Apps/releases)
|
||||
```
|
||||
|
||||
Auditor is not a scanning/analysis tool like some other tools on this page, rather it uses your device's hardware-backed keystore to allow you to verify the identity of your device and gain assurance that the operating system itself hasn't been tampered with or downgraded via verified boot. This provides a very robust integrity check of your device itself, but doesn't necessarily check whether the user-level apps running on your device are malicious.
|
||||
|
||||
Auditor performs attestation and intrusion detection with **two** devices, an _auditee_ (the device being verified) and an _auditor_ (the device performing the verification). The auditor can be any Android 10+ device (or a remote web service operated by [GrapheneOS](android.md#grapheneos)), while the auditee must be a specifically [supported device](https://attestation.app/about#device-support). Auditor works by:
|
||||
|
||||
- Using a [Trust On First Use (TOFU)](https://en.wikipedia.org/wiki/Trust_on_first_use) model between an _auditor_ and _auditee_, the pair establish a private key in the [hardware-backed keystore](https://source.android.com/security/keystore/) of the _Auditor_.
|
||||
- The _auditor_ can either be another instance of the Auditor app or the [Remote Attestation Service](https://attestation.app).
|
||||
- The _auditor_ records the current state and configuration of the _auditee_.
|
||||
- Should tampering with the operating system of the _auditee_ happen after the pairing is complete, the auditor will be aware of the change in the device state and configurations.
|
||||
- You will be alerted to the change.
|
||||
|
||||
It is important to note that Auditor can only effectively detect changes **after** the initial pairing, not necessarily during or before due to its TOFU model. To make sure that your hardware and operating system is genuine, [perform local attestation](https://grapheneos.org/install/web#verifying-installation) immediately after the device has been installed and prior to any internet connection.
|
||||
|
||||
No personally identifiable information is submitted to the attestation service. We recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring.
|
||||
|
||||
If your [threat model](basics/threat-modeling.md) requires privacy, you could consider using [Orbot](tor.md#orbot) or a VPN to hide your IP address from the attestation service.
|
||||
|
||||
## On-Device Scanners
|
||||
|
||||
These are apps you can install on your device which scan your device for signs of compromise.
|
||||
|
||||
!!! warning "Осторожно"
|
||||
|
||||
```
|
||||
Using these apps is insufficient to determine that a device is "clean", and not targeted with a particular spyware tool.
|
||||
```
|
||||
|
||||
### Hypatia (Android)
|
||||
|
||||
!!! recommendation
|
||||
|
||||
```
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Hypatia** is an open source real-time malware scanner for Android, from the developer of [DivestOS](android.md#divestos). It accesses the internet to download signature database updates, but does not upload your files or any metadata to the cloud (scans are performed entirely locally).
|
||||
|
||||
[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#hypatia){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://divestos.org/pages/privacy_policy#hypatia){ .card-link title="Privacy Policy" }
|
||||
[:octicons-code-16:](https://github.com/divested-mobile/hypatia){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://divested.dev/pages/donate){ .card-link title=Contribute }
|
||||
|
||||
??? downloads
|
||||
|
||||
- [:simple-android: F-Droid](https://f-droid.org/packages/us.spotco.malwarescanner/)
|
||||
```
|
||||
|
||||
Hypatia is particularly good at detecting common stalkerware: If you suspect you are a victim of stalkerware, you should [visit this page](https://stopstalkerware.org/information-for-survivors/) for advice.
|
||||
|
||||
### iVerify (iOS)
|
||||
|
||||
!!! recommendation
|
||||
|
||||
```
|
||||
{ align=right }
|
||||
|
||||
**iVerify** is an iOS app which automatically scans your device to check configuration settings, patch level, and other areas of security. It also checks your device for indicators of compromise by jailbreak tools or spyware such as Pegasus.
|
||||
|
||||
[:octicons-home-16: Homepage](https://www.iverify.io/consumer){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://www.iverify.io/privacy-policy){ .card-link title="Privacy Policy" }
|
||||
[:octicons-info-16:](https://www.iverify.io/frequently-asked-questions#iVerify-General){ .card-link title=Documentation}
|
||||
|
||||
??? downloads
|
||||
|
||||
- [:simple-appstore: App Store](https://apps.apple.com/us/app/iverify/id1466120520)
|
||||
```
|
||||
|
||||
Like all iOS apps, iVerify is restricted to what it can observe about your device from within the iOS App Sandbox. It will not provide nearly as robust analysis as a full-system analysis tool like [MVT](#mobile-verification-toolkit). Its primary function is to detect whether your device is jailbroken, which it is effective at, however a hypothetical threat which is _specifically_ designed to bypass iVerify's checks would likely succeed at doing so.
|
||||
|
||||
iVerify is **not** an "antivirus" tool, and will not detect non-system-level malware such as malicious custom keyboards or malicious Wi-Fi Sync configurations, for example.
|
||||
|
||||
In addition to device scanning, iVerify also includes a number of additional security utilities which you may find useful, including device reboot reminders, iOS update notifications (which are often faster than Apple's staggered update notification rollout), some basic privacy and security guides, and a DNS over HTTPS tool which can connect your device's [DNS](dns.md) queries securely to Quad9, Cloudflare, or Google.
|
||||
@@ -49,6 +49,22 @@ To copy and paste files and directories (folders) from one *qube* to another, yo
|
||||
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows communication between domains. Он построен на базе библиотеки Xen *vchan*, которая обеспечивает изоляцию [с помощью политик](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
|
||||
## Connecting to Tor via a VPN
|
||||
|
||||
We [recommend](../advanced/tor-overview.md) connecting to the Tor network via a [VPN](../vpn.md) provider, and luckily Qubes makes this easy to do with a combination of ProxyVMs and Whonix.
|
||||
|
||||
After [creating a new ProxyVM](https://github.com/Qubes-Community/Contents/blob/master/docs/configuration/vpn.md) which connects to the VPN of your choice, you can chain your Whonix qubes to that ProxyVM **before** they connect to the Tor network, by setting the NetVM of your Whonix **Gateway** (`sys-whonix`) to the newly-created ProxyVM.
|
||||
|
||||
Your qubes should be configured in a manner similar to this:
|
||||
|
||||
| Qube name | Qube description | NetVM |
|
||||
| --------------- | ---------------------------------------------------------------------------------------------------------------- | --------------- |
|
||||
| sys-net | *Your default network qube (pre-installed)* | *n/a* |
|
||||
| sys-firewall | *Your default firewall qube (pre-installed)* | sys-net |
|
||||
| ==sys-proxyvm== | The VPN ProxyVM you [created](https://github.com/Qubes-Community/Contents/blob/master/docs/configuration/vpn.md) | sys-firewall |
|
||||
| sys-whonix | Your Whonix Gateway VM | ==sys-proxyvm== |
|
||||
| anon-whonix | Your Whonix Workstation VM | sys-whonix |
|
||||
|
||||
## Дополнительные советы
|
||||
|
||||
Для получения дополнительной информации мы рекомендуем вам обратиться к обширной документации Qubes OS, расположенной на сайте [Qubes OS Website](https://www.qubes-os.org/doc/). Офлайн копии можно загрузить из [репозитория документации](https://github.com/QubesOS/qubes-doc) Qubes OS.
|
||||
|
||||
@@ -157,6 +157,7 @@ description: Privacy Guides - это самый прозрачный и наде
|
||||
|
||||
- { .twemoji }{ .twemoji } [Privacy.com](financial-services.md#privacycom-us)
|
||||
- { .twemoji }{ .twemoji } [MySudo](financial-services.md#mysudo-us-paid)
|
||||
|
||||
</div>
|
||||
|
||||
[Узнать больше :material-arrow-right-drop-circle:](financial-services.md#payment-masking-services)
|
||||
@@ -432,7 +433,6 @@ description: Privacy Guides - это самый прозрачный и наде
|
||||
- { .twemoji } [Obtainium (App Manager)](android.md#obtainium)
|
||||
- { .twemoji } [Aurora Store (Google Play Client)](android.md#aurora-store)
|
||||
- { .twemoji } [Shelter (Work Profiles)](android.md#shelter)
|
||||
- { .twemoji }{ .twemoji } [Auditor (Supported Devices)](android.md#auditor)
|
||||
- { .twemoji }{ .twemoji } [Secure Camera](android.md#secure-camera)
|
||||
- { .twemoji }{ .twemoji } [Secure PDF Viewer](android.md#secure-pdf-viewer)
|
||||
|
||||
@@ -468,3 +468,21 @@ description: Privacy Guides - это самый прозрачный и наде
|
||||
</div>
|
||||
|
||||
[Узнать больше :material-arrow-right-drop-circle:](router.md)
|
||||
|
||||
## Advanced Tools
|
||||
|
||||
These tools may provide utility for certain individuals. They provide functionality which most people do not need to worry about, and often require more in-depth technical knowledge to utilize effectively.
|
||||
|
||||
### Device Integrity Verification
|
||||
|
||||
<div class="grid cards" markdown>
|
||||
|
||||
- { .twemoji } [Mobile Verification Toolkit](device-integrity.md#mobile-verification-toolkit)
|
||||
- { .twemoji } [iMazing (iOS)](device-integrity.md#imazing-ios)
|
||||
- { .twemoji }{ .twemoji } [Auditor (Android)](device-integrity.md#auditor-android)
|
||||
- { .twemoji }{ .twemoji } [Hypatia (Android)](device-integrity.md#hypatia-android)
|
||||
- { .twemoji } [iVerify (iOS)](device-integrity.md#iverify-ios)
|
||||
|
||||
</div>
|
||||
|
||||
[Узнать больше :material-arrow-right-drop-circle:](device-integrity.md)
|
||||
|
||||
@@ -39,7 +39,15 @@ Tor работает, направляя твой трафик через эти
|
||||
|
||||
## Подключение к Tor
|
||||
|
||||
Существует множество способов подключения к сети Tor с твоего устройства, наиболее распространенным из которых является **Tor Browser**, форк Firefox, предназначенный для анонимного просмотра веб-страниц на настольных компьютерах и Android. Помимо перечисленных ниже приложений, существуют также операционные системы, разработанные специально для подключения к сети Tor, такие как [Whonix](desktop.md#whonix) или [Qubes OS](desktop.md#qubes-os), которые обеспечивают еще большую безопасность и защиту, чем стандартный Tor Browser.
|
||||
!!! tip "Совет"
|
||||
|
||||
Before connecting to Tor, please ensure you've read our [overview](advanced/tor-overview.md) on what Tor is and how to connect to it safely. We often recommend connecting to Tor through a trusted [VPN provider](vpn.md), but you have to do so **properly** to avoid decreasing your anonymity.
|
||||
|
||||
Существует множество способов подключения к сети Tor с твоего устройства, наиболее распространенным из которых является **Tor Browser**, форк Firefox, предназначенный для анонимного просмотра веб-страниц на настольных компьютерах и Android.
|
||||
|
||||
Some of these apps are better than others, and again making a determination comes down to your threat model. If you are a casual Tor user who is not worried about your ISP collecting evidence against you, using apps like [Orbot](#orbot) or mobile browser apps to access the Tor network is probably fine. Increasing the number of people who use Tor on an everyday basis helps reduce the bad stigma of Tor, and lowers the quality of "lists of Tor users" that ISPs and governments may compile.
|
||||
|
||||
If more complete anonymity is paramount to your situation, you should **only** be using the desktop Tor Browser client, ideally in a [Whonix](desktop.md#whonix) + [Qubes](desktop.md#qubes-os) configuration. Mobile browsers are less common on Tor (and more fingerprintable as a result), and other configurations are not as rigorously tested against deanonymization.
|
||||
|
||||
### Tor Browser
|
||||
|
||||
@@ -69,6 +77,8 @@ Tor работает, направляя твой трафик через эти
|
||||
|
||||
Браузер Tor предназначен для предотвращения "отпечатков браузера", или идентификации тебя на основе конфигурации твоего браузера. Поэтому крайне важно, чтобы ты **не** изменял браузер, помимо установленных по умолчанию [уровней безопасности](https://tb-manual.torproject.org/ru/security-settings/).
|
||||
|
||||
In addition to installing Tor Browser on your computer directly, there are also operating systems designed specifically to connect to the Tor network such as [Whonix](desktop.md#whonix) on [Qubes OS](desktop.md#qubes-os), which provide even greater security and protections than the standard Tor Browser alone.
|
||||
|
||||
### Orbot
|
||||
|
||||
!!! recommendation
|
||||
|
||||
Reference in New Issue
Block a user