<div dir="ltr"><div style="line-height:17.7273px"><span style="line-height:17.7273px">> Are we still trying to hide TBB users in the Mozilla browser crowd?</span><br></div><div style="line-height:17.7273px">My understanding of this, because we make the exit relays public, that the answer is "no".  Correct me if I'm wrong.</div><div style="line-height:17.7273px"><br></div><div style="line-height:17.7273px">> Are we making it even easier to identify and block TBB users?</div><div style="line-height:17.7273px">Mildly so.  But if an operator wants to block TBB users they don't need to have much trouble using ExitRelay list or the MaxMind anonymous proxy list.</div><div style="line-height:17.7273px"><br></div><div style="line-height:17.7273px">For what it's worth we had a similar discussion in tor2web over whether to add the "x-tor2web" request header.  We eventually decided to add it.</div><div style="line-height:17.7273px"><br></div><div style="line-height:17.7273px">-V</div><div style="line-height:17.7273px"><br></div></div><br><div class="gmail_quote"><div dir="ltr">On Sat, Oct 3, 2015 at 2:13 PM Tim Wilson-Brown - teor <<a href="mailto:teor2345@gmail.com">teor2345@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><br><div><blockquote type="cite"><div>On 3 Oct 2015, at 14:10, Virgil Griffith <<a href="mailto:i@virgil.gr" target="_blank">i@virgil.gr</a>> wrote:</div><br><div><div style="font-family:Helvetica;font-size:13px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px">(2) If we (Tor Project) is going to ask MaxMind to do something special to distinguish TBB users, it seems reasonable we should make the same effort.  I know in the past it's been proposed for TBB to include a special HTTP header, e.g.,</div><div style="font-family:Helvetica;font-size:13px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px"><br></div><div style="font-family:Helvetica;font-size:13px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px">Tor-Browser-Bundle: true</div><div style="font-family:Helvetica;font-size:13px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px"><br></div><div style="font-family:Helvetica;font-size:13px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px">to distinguish TBB users.  If this header existed, I could detect it at the CDN-level and do the appropriate redirect.  Alternatively, We could do something equivalent with the "Via": HTTP header, but that seems overkill.</div><div style="font-family:Helvetica;font-size:13px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px"><br></div><div style="font-family:Helvetica;font-size:13px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px">Between these two options, I personally opt for (2) because it seems inappropriate to request MaxMind to help us do X when we have not done what we can do to achieve X.</div><div style="font-family:Helvetica;font-size:13px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px"><br></div><div style="font-family:Helvetica;font-size:13px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px">Q: Does anyone (especially Mike Perry) have any objections to (2)?  If not, I will write the proposal.</div></div></blockquote><br></div></div><div style="word-wrap:break-word"><div>I think this kind of tagging has security implications, but I’m not sure what the tradeoffs are.</div><div><br></div><div>Are we still trying to hide TBB users in the Mozilla browser crowd?</div><div>Are we making it even easier to identify and block TBB users?</div><div><br></div><div>Tim</div><br><div>
<div style="color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="text-align:start;text-indent:0px;word-wrap:break-word"><div style="text-align:start;text-indent:0px;word-wrap:break-word"><div style="text-align:start;text-indent:0px;word-wrap:break-word"><div style="text-align:start;text-indent:0px;word-wrap:break-word"><div style="text-align:start;text-indent:0px;word-wrap:break-word"><div style="text-align:start;text-indent:0px;word-wrap:break-word"><div style="text-align:start;text-indent:0px;word-wrap:break-word"><div style="text-align:start;text-indent:0px;word-wrap:break-word"><div style="text-align:start;text-indent:0px;word-wrap:break-word"><div style="text-align:start;text-indent:0px;word-wrap:break-word"><div style="text-align:start;text-indent:0px;word-wrap:break-word"><div style="color:rgb(0,0,0);letter-spacing:normal;text-transform:none;white-space:normal;word-spacing:0px;text-align:start;text-indent:0px;word-wrap:break-word">Tim Wilson-Brown (teor)</div><div style="color:rgb(0,0,0);letter-spacing:normal;text-transform:none;white-space:normal;word-spacing:0px;text-align:start;text-indent:0px;word-wrap:break-word"><br></div><div style="text-align:start;text-indent:0px;word-wrap:break-word">teor2345 at gmail dot com<br>PGP 968F094B<br><br>teor at blah dot im<br>OTR CAD08081 9755866D 89E2A06F E3558B7F B5A9D14F</div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
</div>
<br></div>_______________________________________________<br>
tor-dev mailing list<br>
<a href="mailto:tor-dev@lists.torproject.org" target="_blank">tor-dev@lists.torproject.org</a><br>
<a href="https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev" rel="noreferrer" target="_blank">https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev</a><br>
</blockquote></div>