break off some questions into a new tbb faq section (fbdf7a2d2)

docs/en/faq.wml

@@ -48,26 +48,26 @@
     <li><a href="#LiveCD">Is there a LiveCD or other bundle that includes Tor?</a></li>
     </ul>
 
-    <p>Running Tor:</p>
+    <p>Tor Browser Bundle:</p>
+    <ul>
+    <li><a href="#GoogleCaptcha">Google makes me solve a Captcha or tells
+    me I have spyware installed.</a></li>
+    <li><a href="#GmailWarning">Gmail warns me that my account may have
+    been compromised.</a></li>
+    </ul>
+
+    <p>Advanced Tor usage:</p>
     <ul>
     <li><a href="#torrc">I'm supposed to "edit my torrc". What does
     that mean?</a></li>
     <li><a href="#Logs">How do I set up logging, or see Tor's
     logs?</a></li>
-    </ul>
-
-    <p>Running a Tor client:</p>
-    <ul>
     <li><a href="#DoesntWork">I installed Tor and Polipo but it's not
     working.</a></li>
     <li><a href="#VidaliaPassword">Tor/Vidalia prompts for a password at
     start.</a></li>
     <li><a href="#ChooseEntryExit">Can I control which nodes (or country)
     are used for entry/exit?</a></li>
-    <li><a href="#GoogleCaptcha">Google makes me solve a Captcha or tells
-    me I have spyware installed.</a></li>
-    <li><a href="#GmailWarning">Gmail warns me that my account may have
-    been compromised.</a></li>
     <li><a href="#FirewallPorts">My firewall only allows a few outgoing
     ports.</a></li>
     </ul>
@@ -727,6 +727,90 @@ other than our official HTTPS website.
 
 <hr>
 
+<a id="GoogleCaptcha"></a>
+<h3><a class="anchor" href="#GoogleCaptcha">Google makes me solve a Captcha or tells me I have spyware installed.</a></h3>
+
+<p>
+This is a known and intermittent problem; it does not mean that Google
+considers Tor to be spyware.
+</p>
+
+<p>
+When you use Tor, you are sending queries through exit relays that are also
+shared by thousands of other users. Tor users typically see this message
+when many Tor users are querying Google in a short period of time. Google
+interprets the high volume of traffic from a single IP address (the exit
+relay you happened to pick) as somebody trying to "crawl" their website,
+so it slows down traffic from that IP address for a short time.
+</p>
+<p>
+An alternate explanation is that Google tries to detect certain
+kinds of spyware or viruses that send distinctive queries to Google
+Search. It notes the IP addresses from which those queries are received
+(not realizing that they are Tor exit relays), and tries to warn any
+connections coming from those IP addresses that recent queries indicate
+an infection.
+</p>
+
+<p>
+To our knowledge, Google is not doing anything intentionally specifically
+to deter or block Tor use. The error message about an infected machine
+should clear up again after a short time.
+</p>
+
+<p>
+Torbutton 1.2.5 (released in mid 2010) detects Google captchas and can
+automatically redirect you to a more Tor-friendly search engine such as
+Ixquick or Bing.
+</p>
+
+<hr />
+
+<a id="GmailWarning"></a>
+<h3><a class="anchor" href="#GmailWarning">Gmail warns me that my account may have been compromised.</a></h3>
+
+<p>
+Sometimes, after you've used Gmail over Tor, Google presents a
+pop-up notification that your account may have been compromised.
+The notification window lists a series of IP addresses and locations
+throughout the world recently used to access your account.
+</p>
+
+<p>
+In general this is a false alarm: Google saw a bunch of logins from
+different places, as a result of running the service via Tor, and decided
+it was a good idea to confirm the account was being accessed by it's
+rightful owner.
+</p>
+
+<p>
+Even though this may be a biproduct of using the service via tor,
+that doesn't mean you can entirely ignore the warning. It is
+<i>probably</i> a false positive, but it might not be since it is
+possible for someone to hijack your Google cookie.
+</p>
+
+<p>
+Cookie hijacking is possible by either physical access to your computer
+or by watching your network traffic.  In theory only physical access
+should compromise your system because Gmail and similar services
+should only send the cookie over an SSL link. In practice, alas, it's <a
+href="http://fscked.org/blog/fully-automated-active-https-cookie-hijacking">
+way more complex than that</a>.
+</p>
+
+<p>
+And if somebody <i>did</i> steal your google cookie, they might end
+up logging in from unusual places (though of course they also might
+not). So the summary is that since you're using Tor, this security
+measure that Google uses isn't so useful for you, because it's full of
+false positives. You'll have to use other approaches, like seeing if
+anything looks weird on the account, or looking at the timestamps for
+recent logins and wondering if you actually logged in at those times.
+</p>
+
+<hr>
+
 <a id="torrc"></a>
 <h3><a class="anchor" href="#torrc">I'm supposed to "edit my torrc". What does that mean?</a></h3>
 
@@ -1045,90 +1129,6 @@ for more information on how to remove the Tor service.
 
     <hr>
 
-<a id="GoogleCaptcha"></a>
-<h3><a class="anchor" href="#GoogleCaptcha">Google makes me solve a Captcha or tells me I have spyware installed.</a></h3>
-
-<p>
-This is a known and intermittent problem; it does not mean that Google
-considers Tor to be spyware.
-</p>
-
-<p>
-When you use Tor, you are sending queries through exit relays that are also
-shared by thousands of other users. Tor users typically see this message
-when many Tor users are querying Google in a short period of time. Google
-interprets the high volume of traffic from a single IP address (the exit
-relay you happened to pick) as somebody trying to "crawl" their website,
-so it slows down traffic from that IP address for a short time.
-</p>
-<p>
-An alternate explanation is that Google tries to detect certain
-kinds of spyware or viruses that send distinctive queries to Google
-Search. It notes the IP addresses from which those queries are received
-(not realizing that they are Tor exit relays), and tries to warn any
-connections coming from those IP addresses that recent queries indicate
-an infection.
-</p>
-
-<p>
-To our knowledge, Google is not doing anything intentionally specifically
-to deter or block Tor use. The error message about an infected machine
-should clear up again after a short time.
-</p>
-
-<p>
-Torbutton 1.2.5 (released in mid 2010) detects Google captchas and can
-automatically redirect you to a more Tor-friendly search engine such as
-Ixquick or Bing.
-</p>
-
-<hr />
-
-<a id="GmailWarning"></a>
-<h3><a class="anchor" href="#GmailWarning">Gmail warns me that my account may have been compromised.</a></h3>
-
-<p>
-Sometimes, after you've used Gmail over Tor, Google presents a
-pop-up notification that your account may have been compromised.
-The notification window lists a series of IP addresses and locations
-throughout the world recently used to access your account.
-</p>
-
-<p>
-In general this is a false alarm: Google saw a bunch of logins from
-different places, as a result of running the service via Tor, and decided
-it was a good idea to confirm the account was being accessed by it's
-rightful owner.
-</p>
-
-<p>
-Even though this may be a biproduct of using the service via tor,
-that doesn't mean you can entirely ignore the warning. It is
-<i>probably</i> a false positive, but it might not be since it is
-possible for someone to hijack your Google cookie.
-</p>
-
-<p>
-Cookie hijacking is possible by either physical access to your computer
-or by watching your network traffic.  In theory only physical access
-should compromise your system because Gmail and similar services
-should only send the cookie over an SSL link. In practice, alas, it's <a
-href="http://fscked.org/blog/fully-automated-active-https-cookie-hijacking">
-way more complex than that</a>.
-</p>
-
-<p>
-And if somebody <i>did</i> steal your google cookie, they might end
-up logging in from unusual places (though of course they also might
-not). So the summary is that since you're using Tor, this security
-measure that Google uses isn't so useful for you, because it's full of
-false positives. You'll have to use other approaches, like seeing if
-anything looks weird on the account, or looking at the timestamps for
-recent logins and wondering if you actually logged in at those times.
-</p>
-
-<hr>
-
 <a id="FirewallPorts"></a>
 <h3><a class="anchor" href="#FirewallPorts">My firewall only allows a few outgoing ports.</a></h3>
 


...	...	@@ -48,26 +48,26 @@
48	48	<li><a href="#LiveCD">Is there a LiveCD or other bundle that includes Tor?</a></li>
49	49	</ul>
50	50
51		- <p>Running Tor:</p>
	51	+ <p>Tor Browser Bundle:</p>
	52	+ <ul>
	53	+ <li><a href="#GoogleCaptcha">Google makes me solve a Captcha or tells
	54	+ me I have spyware installed.</a></li>
	55	+ <li><a href="#GmailWarning">Gmail warns me that my account may have
	56	+ been compromised.</a></li>
	57	+ </ul>
	58	+
	59	+ <p>Advanced Tor usage:</p>
52	60	<ul>
53	61	<li><a href="#torrc">I'm supposed to "edit my torrc". What does
54	62	that mean?</a></li>
55	63	<li><a href="#Logs">How do I set up logging, or see Tor's
56	64	logs?</a></li>
57		- </ul>
58		-
59		- <p>Running a Tor client:</p>
60		- <ul>
61	65	<li><a href="#DoesntWork">I installed Tor and Polipo but it's not
62	66	working.</a></li>
63	67	<li><a href="#VidaliaPassword">Tor/Vidalia prompts for a password at
64	68	start.</a></li>
65	69	<li><a href="#ChooseEntryExit">Can I control which nodes (or country)
66	70	are used for entry/exit?</a></li>
67		- <li><a href="#GoogleCaptcha">Google makes me solve a Captcha or tells
68		- me I have spyware installed.</a></li>
69		- <li><a href="#GmailWarning">Gmail warns me that my account may have
70		- been compromised.</a></li>
71	71	<li><a href="#FirewallPorts">My firewall only allows a few outgoing
72	72	ports.</a></li>
73	73	</ul>
...	...	@@ -727,6 +727,90 @@ other than our official HTTPS website.
727	727
728	728	<hr>
729	729
	730	+<a id="GoogleCaptcha"></a>
	731	+<h3><a class="anchor" href="#GoogleCaptcha">Google makes me solve a Captcha or tells me I have spyware installed.</a></h3>
	732	+
	733	+<p>
	734	+This is a known and intermittent problem; it does not mean that Google
	735	+considers Tor to be spyware.
	736	+</p>
	737	+
	738	+<p>
	739	+When you use Tor, you are sending queries through exit relays that are also
	740	+shared by thousands of other users. Tor users typically see this message
	741	+when many Tor users are querying Google in a short period of time. Google
	742	+interprets the high volume of traffic from a single IP address (the exit
	743	+relay you happened to pick) as somebody trying to "crawl" their website,
	744	+so it slows down traffic from that IP address for a short time.
	745	+</p>
	746	+<p>
	747	+An alternate explanation is that Google tries to detect certain
	748	+kinds of spyware or viruses that send distinctive queries to Google
	749	+Search. It notes the IP addresses from which those queries are received
	750	+(not realizing that they are Tor exit relays), and tries to warn any
	751	+connections coming from those IP addresses that recent queries indicate
	752	+an infection.
	753	+</p>
	754	+
	755	+<p>
	756	+To our knowledge, Google is not doing anything intentionally specifically
	757	+to deter or block Tor use. The error message about an infected machine
	758	+should clear up again after a short time.
	759	+</p>
	760	+
	761	+<p>
	762	+Torbutton 1.2.5 (released in mid 2010) detects Google captchas and can
	763	+automatically redirect you to a more Tor-friendly search engine such as
	764	+Ixquick or Bing.
	765	+</p>
	766	+
	767	+<hr />
	768	+
	769	+<a id="GmailWarning"></a>
	770	+<h3><a class="anchor" href="#GmailWarning">Gmail warns me that my account may have been compromised.</a></h3>
	771	+
	772	+<p>
	773	+Sometimes, after you've used Gmail over Tor, Google presents a
	774	+pop-up notification that your account may have been compromised.
	775	+The notification window lists a series of IP addresses and locations
	776	+throughout the world recently used to access your account.
	777	+</p>
	778	+
	779	+<p>
	780	+In general this is a false alarm: Google saw a bunch of logins from
	781	+different places, as a result of running the service via Tor, and decided
	782	+it was a good idea to confirm the account was being accessed by it's
	783	+rightful owner.
	784	+</p>
	785	+
	786	+<p>
	787	+Even though this may be a biproduct of using the service via tor,
	788	+that doesn't mean you can entirely ignore the warning. It is
	789	+<i>probably</i> a false positive, but it might not be since it is
	790	+possible for someone to hijack your Google cookie.
	791	+</p>
	792	+
	793	+<p>
	794	+Cookie hijacking is possible by either physical access to your computer
	795	+or by watching your network traffic. In theory only physical access
	796	+should compromise your system because Gmail and similar services
	797	+should only send the cookie over an SSL link. In practice, alas, it's <a
	798	+href="http://fscked.org/blog/fully-automated-active-https-cookie-hijacking">
	799	+way more complex than that</a>.
	800	+</p>
	801	+
	802	+<p>
	803	+And if somebody <i>did</i> steal your google cookie, they might end
	804	+up logging in from unusual places (though of course they also might
	805	+not). So the summary is that since you're using Tor, this security
	806	+measure that Google uses isn't so useful for you, because it's full of
	807	+false positives. You'll have to use other approaches, like seeing if
	808	+anything looks weird on the account, or looking at the timestamps for
	809	+recent logins and wondering if you actually logged in at those times.
	810	+</p>
	811	+
	812	+<hr>
	813	+
730	814	<a id="torrc"></a>
731	815	<h3><a class="anchor" href="#torrc">I'm supposed to "edit my torrc". What does that mean?</a></h3>
732	816
...	...	@@ -1045,90 +1129,6 @@ for more information on how to remove the Tor service.
1045	1129
1046	1130	<hr>
1047	1131
1048		-<a id="GoogleCaptcha"></a>
1049		-<h3><a class="anchor" href="#GoogleCaptcha">Google makes me solve a Captcha or tells me I have spyware installed.</a></h3>
1050		-
1051		-<p>
1052		-This is a known and intermittent problem; it does not mean that Google
1053		-considers Tor to be spyware.
1054		-</p>
1055		-
1056		-<p>
1057		-When you use Tor, you are sending queries through exit relays that are also
1058		-shared by thousands of other users. Tor users typically see this message
1059		-when many Tor users are querying Google in a short period of time. Google
1060		-interprets the high volume of traffic from a single IP address (the exit
1061		-relay you happened to pick) as somebody trying to "crawl" their website,
1062		-so it slows down traffic from that IP address for a short time.
1063		-</p>
1064		-<p>
1065		-An alternate explanation is that Google tries to detect certain
1066		-kinds of spyware or viruses that send distinctive queries to Google
1067		-Search. It notes the IP addresses from which those queries are received
1068		-(not realizing that they are Tor exit relays), and tries to warn any
1069		-connections coming from those IP addresses that recent queries indicate
1070		-an infection.
1071		-</p>
1072		-
1073		-<p>
1074		-To our knowledge, Google is not doing anything intentionally specifically
1075		-to deter or block Tor use. The error message about an infected machine
1076		-should clear up again after a short time.
1077		-</p>
1078		-
1079		-<p>
1080		-Torbutton 1.2.5 (released in mid 2010) detects Google captchas and can
1081		-automatically redirect you to a more Tor-friendly search engine such as
1082		-Ixquick or Bing.
1083		-</p>
1084		-
1085		-<hr />
1086		-
1087		-<a id="GmailWarning"></a>
1088		-<h3><a class="anchor" href="#GmailWarning">Gmail warns me that my account may have been compromised.</a></h3>
1089		-
1090		-<p>
1091		-Sometimes, after you've used Gmail over Tor, Google presents a
1092		-pop-up notification that your account may have been compromised.
1093		-The notification window lists a series of IP addresses and locations
1094		-throughout the world recently used to access your account.
1095		-</p>
1096		-
1097		-<p>
1098		-In general this is a false alarm: Google saw a bunch of logins from
1099		-different places, as a result of running the service via Tor, and decided
1100		-it was a good idea to confirm the account was being accessed by it's
1101		-rightful owner.
1102		-</p>
1103		-
1104		-<p>
1105		-Even though this may be a biproduct of using the service via tor,
1106		-that doesn't mean you can entirely ignore the warning. It is
1107		-<i>probably</i> a false positive, but it might not be since it is
1108		-possible for someone to hijack your Google cookie.
1109		-</p>
1110		-
1111		-<p>
1112		-Cookie hijacking is possible by either physical access to your computer
1113		-or by watching your network traffic. In theory only physical access
1114		-should compromise your system because Gmail and similar services
1115		-should only send the cookie over an SSL link. In practice, alas, it's <a
1116		-href="http://fscked.org/blog/fully-automated-active-https-cookie-hijacking">
1117		-way more complex than that</a>.
1118		-</p>
1119		-
1120		-<p>
1121		-And if somebody <i>did</i> steal your google cookie, they might end
1122		-up logging in from unusual places (though of course they also might
1123		-not). So the summary is that since you're using Tor, this security
1124		-measure that Google uses isn't so useful for you, because it's full of
1125		-false positives. You'll have to use other approaches, like seeing if
1126		-anything looks weird on the account, or looking at the timestamps for
1127		-recent logins and wondering if you actually logged in at those times.
1128		-</p>
1129		-
1130		-<hr>
1131		-
1132	1132	<a id="FirewallPorts"></a>
1133	1133	<h3><a class="anchor" href="#FirewallPorts">My firewall only allows a few outgoing ports.</a></h3>
1134	1134
1135	1135

tor-webwml.git