Official website for Linux User & Developer
FOLLOW US ON:
Apr
18

Pogoplug Safeplug review – anonymous browsing instantly

by Gareth Halfacree

Can a cheap, Linux-powered black box from a cloud storage specialist offer the reassurance of privacy in a post-Snowden world of paranoia?

Created by once and former private-cloud-turned-moretraditional-cloud-provider Pogoplug, the Safeplug reimagines the company’s Linux-powered and ARM-based embedded hardware platforms as access points to
The Onion Router (TOR).

Originally created by the US Navy, TOR allows users to access the internet by routing their traffi c across an encrypted mesh of other systems, eventually popping out of the other side on a completely different IP address.

TOR is already used by a wide variety of people, but Pogoplug is hoping to extend its appeal even further by making it as simple as possible to use.

The low-power ARM chip inside requires no active cooling
The low-power ARM chip inside requires no active cooling

Unboxing the Safeplug, it’s easy to see how Pogoplug was able to get its device to market so quickly: it’s the same hardware as the fourthgeneration Pogoplug storage device, with a different logo on its face. The same ARMv5 embedded processor is present, the same 128MB of RAM, and there’s even a USB port and a SD card slot from its original incarnation as a storage gateway – neither of which, sadly, are actually usable on the Safeplug.

Getting started with the device is quick and easy: visit the Safeplug website, click the ‘Activate my Safeplug’ button, and follow the instructions to plug the device into the power socket and network port. Wait a few seconds for a fi rmware update, and a new screen will appear, allowing you to confi gure the Safeplug’s settings.

It’s here that installation becomes a manual process: the Safeplug doesn’t act as router, but instead sits behind your existing router and offers proxy services. Using its selfserved file, browsers – or entire systems – can be configured to route their traffi c over the Safeplug and, as a result, via TOR. Individual sites can also be confi gured, bypassing the TOR connection and traversing the plain internet as normal. Traffic that does route via TOR is encrypted until it reaches an exit node – a portion of the network known to include devices for sniffing non-HTTPS traffic, something Pogoplug fails to warn users of in its documentation.

The Safeplug has an extra trick up its sleeve: a built-in advert blocker. Switched off by default, turning the setting on will block access to known advertising hosts, making for a leaner and cleaner browsing experience, but cutting off a vital income stream for the sites that are affected. It’s a bit of a thorny moral issue, but for those that would like to use it, the option is there.

Sadly, while the Safeplug certainly makes connecting disparate devices to TOR as simple as possible, it also loses something along the way. Using the TOR Browser Bundle attacks two areas of concern: the connection itself and the browser, which in the Bundle is a locked-down port of Firefox that comes with JavaScript disabled by default. When configuring an existing browser to use the Safeplug, however, that extra layer of security isn’t included – and if you don’t disable JavaScript, either manually or using an add-on like NoScript, you can still be easily tracked.

The box itself is also running a relatively outdated kernel based on the 2.6 branch, which could raise security questions of their own – mitigated, thankfully, by the fact the device is by default only accessible to your internal network.

For those who are only looking to evade the Great Firewall of Britain, or who would like to run their own low-power TOR relay to improve the performance of the network, the Safeplug is easier to recommend. For those who value true security, a roll-your-own solution – which would also provide the opportunity to validate the source code – based on something like a Raspberry Pi would be a better option.

Verdict

3/5

The Safeplug is far from a security panacea. Users should be warned that unencrypted traffic can be captured by TOR exit nodes, and a full copy of the firmware’s source should be provided to guarantee freedom from back doors. For those just looking to bypass regional filters, however, the Safeplug is certainly easy to use.

Tags: , ,
  • Tell a Friend
  • Follow our Twitter to find out about all the latest Linux news, reviews, previews, interviews, features and a whole more.