Short version:

An easy and secure way for anonymous internet usage:

1. Install and start Virtualbox (at least version 4).
2. Download two VM images: Tor gateway and Tor workstation
3. Import the images (in Virtualbox File->Import Appliance)

To start using the internet anonymously you just have to start both VMs Tor gateway VM and Tor workstation VM. As soon as they they finished booting, you can use the anonymous internet access through the Tor workstation. If you want to stop using the internet anonymously, just power down both VMs.

Long version:

The goal of this article is to provide a solution to use the internet anonymously in an easy and secure way. Anonymous as in no one but you must be able to tell that you are communication with a certain receiver (like browsing a website: No one must know that you are surfing that certain website). A way to use the internet anonymously is to use an internet connection that can not be tracked down to your person and a computer that has no information stored about you. Which means quite an effort every single time you want to use the internet anonymously. For an internet connection that can not be tracked down to your person, software like Tor has been developed to accomplish this also over a non-anonymous internet connection. Checking if the computer has no information stored about you, can not be handled by the Tor software and must be handled by the user! Currently there is one major problem if you want to use the internet anonymously: You really do have to understand the functioning of computer networks and the Tor software to a degree that is far away from being trivial – otherwise you might probably use the software in an insecure way. Let me give you some examples:

1. Install the Tor client to your Operating System and configure your browser to use the local TOR client through SOCKS-proxy functionality of Tor (or use extensions like Torbutton for Firefox to do that for you). While this is quite easy to accomplish, it has a major security drawback: If you use your everyday browser it has a lot of information stored about you and your browsing history and behavior which it might leak. Even if you use some other browser, you must turn of all plugins like Java or Flash and disable Javascript (or use a proxy like Privoxy to do that for you) so they can not leak information like which sites you visited or in which network or city you are, … But this breaks lots of websites nowadays. While this approach might be easy it is usable for browsers only and far from being “secure”.
2. If you use the tsocks/torify approach which allows non SOCKS aware applications (e.g telnet, ssh, ftp etc) to use SOCKS without any modification, you can use most applications. But they might still leak information about the local system themselves. Besides there is the risk of just forgetting to type the “torify” in front of the command that should be executed. Which is definitely not what one wants to happen. So this approach is neither “easy” nor “secure”.
3. The VM approach I already wrote about in an article earlier, puts the software you are using on the internet into an virtual machine (VM) which reduces the risk to leak information about you and the information within the VM. The drawback is that you have to configure a redirection with a packet filter or firewall on your host system and that you have to set up and configure a VM to use as an anonymous workstation. So this approach is still far from being “easy”.

Which is why I want to discuss a new approach that is at least as secure as the last one above (#3) but additionally should be quite easy to use:

1. Install and start Virtualbox (at least version 4).
2. Download two VM images: Tor gateway and Tor workstation
3. Import the images (in Virtualbox File->Import Appliance)

To start using the internet anonymously you just have to start both VMs Tor gateway VM and Tor workstation VM. As soon as they finished booting, you can use the anonymous internet access through the Tor workstation. If you want to stop using the internet anonymously, just power down both VMs. The task of routing traffic through the Tor network has been moved to the Tor gateway VM. So you do not have to modify your local system any more then installing Virtualbox and importing both VMs. You do have a preconfigured Tor workstation ready to use that boots within a minute and you can be sure to anonymously use the internet. The Tor gateway runs OpenWRT Linux using just about 8Mb of disk space and 32Mb of RAM. It boots in less then 3 seconds and transparently routes all traffic generated within the Tor gateway itself and every traffic coming on the virtual internal interface “tor” through the Tor network. You do not need to do anything but start when you want to use Tor and stop the VM when you finished. The Tor workstation runs Micro Core Linux using about 120Mb of disk space and 192Mb of RAM. It boots in less then a minute and has some browsers (Firefox, Chromium and Opera) and a terminal installed. It only stores information within a session. So if you shut it down and boot it again it does not have any information about the previous session. Of course you are not forced to use the Tor workstation. You can use any other VM (Linux, Windows, AmigaOS, just any TCP/IP capable Operating System). Just configure the network settings of the VM (in Virtualbox Settings->Network->Adapter attached to internal network “tor”). Please report, if you encounter any unwanted behavior or find any problems! Also do so if you have got any suggestions to improve the VMs or this approach as a whole. Side note: The content of the communication between you (Tor workstation VM) and any receiver (e.g. a website) is necessarily only encrypted within the Tor network. So if you open an unencrypted connection to any receiver the Tor exit node which in fact opens the connection to the receiver is able to see the content of the connection. So do not send any sensible information like passwords over unencrypted connections!

Information for developers

There is a git repository available for building the Tor gateway image from scratch. Feedback and patches are welcome.

Changelog

To use the fast gateway you need to change the internal network of workstation VM to “torfast”.

Macromedia/Adobe introduced something similar to cookies called “Local Shared Object” in Flash6. Unfortunately browsers (at least Firefox) currently do not handle Flash cookies easily. If you tell your browser to clear its cookies they simply persist.

I was very surprised by the vast amount of flash cookies located on my system. Take a look yourself “~/.macromedia/Flash_Player/#SharedObjects/” for Linux, “~/Library/Preferences/Macromedia/Flash Player/#SharedObjects/” for Mac OS X or “%APPDATA%\Macromedia\Flash Player\#SharedObjects\” for Windows XP/Vista.

Two Flash cookies on my system are related to a browser game all others were not needed and I deleted them. You can configure your flash preferences at Adobe. If you want to deny all Flash cookies you need to set the amount of disk space that can be used to “None” at the “Global Storage Settings”. You will then be asked everytime a Flash object wants to set a cookies unless you also enable “Never ask again”.

Some more information about Flash cookies.

• adblock plus: ad blocker
• cookiesafe: control cookie persmissions from within the statusbar.
• customizegoogle: enhance google search results by adding extra information and remove ads and spam.
• download statusbar: nice download manager
• tagsifter: tag your bookmarks. finally bookmarks become useable..
• update scanner: monitors webpages for updates which still don’t provide rss feeds
• mitm me: bypass the very annoying ssl errors introduced in firefox3 with a single click.
• gtranslate: translates the selected text via google translate
• keyconfig: nice key configuration. Personally I use it to configure the forward and back keys.
• noscript: allows JavaScript, Java, Flash and other plugins to be executed only by web sites of your choice.
• fasterfox: performance and network tweaks for firefox
• unplug: download flash movies easily (for firefox3 there is no “official” but a “modded” version which just alters the version check).
• add n edit cookies: cookie editor that allows you add and edit session and saved cookies
• bugmenot: bypass annoying web registrations with the context menu (input from ).
• refcontrol: control what gets sent as http referer on per-site basis.
• tab mix plus: has a very rich (not to say bloated) feature set. Currently I use the multi row tab feature and the closed tabs icon (which is way better than the default one).
• firebug: edit, debug, and monitor CSS, HTML, and JavaScript live
• safecache: defends against cache-based tracking techniques but is currently only available for firefox2.
• safehistory: defends against visited-link-based tracking techniques but is also only available for firefox2.
  

Source: http://roachfiend.com/archives/2005/02/07/bugmenot/
Direct installation link: http://extensions.roachfiend.com/bugmenot.xpi

The ideal solution is that logging out will not result in an improper shutdown of firefox, but I wrote a small patch that introduces the browser.sessionstore.resume_session_always setting which works for me.

I also updated Gentoo’s ebuild for firefox 2.0.0.6 to use this patch (just extract it to your /usr/local/portage directory).

Update: The above bug is fixed in firefox3. As a work around, you can create a new string preference “browser.sessionstore.restore_prompt_uri” and set it to “javascript:window.close();” (without the quotes).
Unfortunately I could not find a way to make this work with NoScript (yet).

Update #2:
Good news (:
Giorgio Maone kindly updated the NoScript plugin to allow the trick above. You currently have to use the development version (1.1.6.18).