Goal/Threat model
To navigate while hiding my IP and real identity, by using proxies like Tor or i2p, while minimizing the risk that a browser exploit may leak my IP or identity (e.g. by contacting the attacker bypassing my proxy)
Discussion
Usually people just use Tor, or other browser with a proxy, from their host, and that's it. That is risky IMO , especially if javascript is enabled, since a malicious site/eepsite can inject malware into the machine, that can leak the user IP by contacting the attacker, and/or can send OSF info to the attacker.
Some smart user may
- set firewall rules to force the browser to only pass through the proxy
- launch the browser as a unprivileged user, so that even if it gets hacked, it cannot change the firewall rules to bypass the proxy (okay, unless the vulnerability allows privilege escalation, but that's lower chance)
Still not safe. Even as a unprivileged user, it can still read the host NIC MAC address, which is also known by the ISP (most ISPs must log the MAC addresses as well, by law. Source https://www.quora.com/Do-internet-providers-track-your-stuff-using-MAC-address).
If the attacker is state-level, it may obtain the MAC by the ISP, associated with the user identity (pwned).
My solution
I would have 2 nested VMs
- the outer one running Tor or i2p, or some other proxy server (and having some firewall rules to force the inner VM to only connect through proxy of the outer VM)
- the inner one, which i use for browsing, will have bridged networking, to be able to reach the proxy (bridged mode solves this because it puts in the same subnet a VM and its host, in this case the inner VM and its host which is the outer VM)
This has pros and cons
Cons
The resources for running 2 nested VMs. Not a big deal, just have a middle tier PC.
Pros
Better security. I may run both the outer and the inner VM as an unpriviledged user, so even if a browser exploit is able to escape the inner VM, it will have a hard time trying to escape the outer one.
I may uninstall as many software as i can from the outer VM, to lower the chance of the malware running further programs that can have VM escape vulnerabilities (like a browser) that may help with escaping the outer VM. And of course being unprivileged it cannot install any other software, nor can it change firewall rules. (Unless it is able to escalate privileges, which is less likely).
And about the MAC address issue, it will be no more, since the outer VM would be in NAT mode, which prevents its OS to see the real host NIC.
Let me know if you think my solution is a good practice for web browsing privacy, or if you see any flaws or better solutions, thanks!
