While reading advice like those in the article, they seem to always leave out the most central aspect of security - the threat model. Doing some guessing, the following threats are mitigated by the article:
• An attacker has access to zero-day vulnerabilities to the software running on your device¹.
• You are storing non-Tor files on your device that can be used to build a profile against you. That or you are running OSX².
• That Flash and Java are horrible messes of software, and will break your security³.
• That Online tracking of your anonymous activities can later be used to connect your real identity with an anonymous session of tor usage. Deanonymization is a big research area but with rather little known results in the real world. Search data, social network profiles and large written texts have all been subject of deanonymization research.
• That Correlation attacks are practical if an attacker knows the entry node traffic and the exit node traffic. This is also a hot research subject, and the threat model can be created by for example reading the linked research on the tor blog⁴.
• Mixing you real identity with anonymous identity can cause harm.
• If you rent time at virtual hardware, the real hardware owners can see everything you do.
• An attack, presented in a 2013 research paper⁵, to verify if a hidden service is using a guard node owned by the attacker. It then assumes that a hidden service will randomly pick at least one of of 23 tor nodes with a probability of 90% if run under a period of 8 months for the cost of 60 USD per node per month.
I could not guess a threat model for "Your workstation must be a laptop". As a last line of defense, my workstation hard drive is equally easy to destroy with a hammer as my laptop. The cell phone advice is also quite bad - see SamReidHughes comment.
Comments
While reading advice like those in the article, they seem to always leave out the most central aspect of security - the threat model. Doing some guessing, the following threats are mitigated by the article:
• An attacker has access to zero-day vulnerabilities to the software running on your device¹.
• You are storing non-Tor files on your device that can be used to build a profile against you. That or you are running OSX².
• That Flash and Java are horrible messes of software, and will break your security³.
• That Online tracking of your anonymous activities can later be used to connect your real identity with an anonymous session of tor usage. Deanonymization is a big research area but with rather little known results in the real world. Search data, social network profiles and large written texts have all been subject of deanonymization research.
• That Correlation attacks are practical if an attacker knows the entry node traffic and the exit node traffic. This is also a hot research subject, and the threat model can be created by for example reading the linked research on the tor blog⁴.
• Mixing you real identity with anonymous identity can cause harm.
• If you rent time at virtual hardware, the real hardware owners can see everything you do.
• An attack, presented in a 2013 research paper⁵, to verify if a hidden service is using a guard node owned by the attacker. It then assumes that a hidden service will randomly pick at least one of of 23 tor nodes with a probability of 90% if run under a period of 8 months for the cost of 60 USD per node per month.
I could not guess a threat model for "Your workstation must be a laptop". As a last line of defense, my workstation hard drive is equally easy to destroy with a hammer as my laptop. The cell phone advice is also quite bad - see SamReidHughes comment.
1: http://security.stackexchange.com/questions/40072/could-some...
2: https://research.torproject.org/techreports/tbb-forensic-ana...
3: https://www.torproject.org/docs/faq.html.en#UseTorWithJava and https://www.torproject.org/docs/faq.html.en#TBBFlash
4: https://blog.torproject.org/category/tags/entry-guards
5: http://www.ieee-security.org/TC/SP2013/papers/4977a080.pdf
• If you rent time at virtual hardware, the real hardware owners can see everything you do.
Reminder: the same goes for all your favorite hosted-because-we're-too-lazy-or-inept-to-run-it-ourselves services too.
It still amazes me thousands of high profile companies just give all their communications to Google for free.
No, they even pay for it.
At the very least it looks like it is now essential to manually secure your router from firmware backdoors:
http://cryptome.org/2013/12/Full-Disclosure.pdf
Here here and right on.