February 2023 - anti-censorship-team

Mac app / Safari extension for Snowflake
by David Fifield 02 Oct '25

02 Oct '25

Browsing through some search results, I found: https://apps.apple.com/us/app/torproject-snowflake/id1597501940 (https://web.archive.org/web/20220222083316/https://apps.apple.com/us/app/to…) https://github.com/jayluxferro/snowflake It looks like a repackaging of the Snowflake JavaScript proxy code for Mac and Safari environments. Maybe we could get in touch with the developer and find a way to adopt it into the main repository?

3 2

Microsoft announces shutting down domain fronting attempts in Azure
by Cecylia Bocovich 18 Nov '24

18 Nov '24

It looks like Azure is going to shutdown domain fronting: https://www.microsoft.com/security/blog/2021/03/26/securing-our-approach-to… There isn't a time frame listed in the article, and I haven't gotten any notifications through my Azure account yet. Cecylia

7 9

Re: [anti-censorship-team] anti-censorship-team Digest, Vol 43, Issue 1
by ut0znfpg＠duck.com 25 Feb '23

25 Feb '23

Hi! I was wondering if ANY of the dark or deep web browsers featured on the Chrome/Google Play store are trustworthy in and of themselves, and if Tor can be accessed with them, or if any use Tor automatically. I have a Chromebook, and I know that Tor does not work with it as you have yet to develop a version for it. Why is it that I think that it will be impossible to have Tor work safely with Chrome/Chromebooks; because Google is EVIL?! :-) Who do you trust for DNS? What is the world's most private and secure computer? I remember Australia having some cool guys build a n independent computer system, but these would not be available outside of Oz. Comments? On Feb 24, 2023 at 7:00 AM, "anti-censorship-team-request(a)lists.torproject.org " <> wrote: --------------------------IronVest--------------------------- Preview: Send anti-censorship-team mailing list submissions to anti-ce --> SPAM? CLICK to BLOCK: https://ironvest.com/app/0/#emails/r8196gs9ev5p@opayq.com/toggle This email is Masked using Ironvest - it was sent from duck.com to r8196gs9ev5p(a)opayq.com (your reply stays Masked). To protect your privacy, do not forward this message, or add new recipients like CCs or BCCs. Thanks for being an IronVest customer! --------------------------IronVest--------------------------- Send anti-censorship-team mailing list submissions to anti-censorship-team(a)lists.torproject.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.torproject.org/cgi-bin/mailman/listinfo/anti-censorship-team or, via email, send a message with subject or body 'help' to anti-censorship-team-request(a)lists.torproject.org You can reach the person managing the list at anti-censorship-team-owner(a)lists.torproject.org When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-censorship-team digest..." Today's Topics: 1. onbasca and rdsys (meskio) ---------------------------------------------------------------------- Message: 1 Date: Fri, 24 Feb 2023 12:47:19 +0100 From: meskio <meskio(a)torproject.org> To: anti-censorship-team <anti-censorship-team(a)lists.torproject.org> Subject: [anti-censorship-team] onbasca and rdsys Message-ID: <167723923930.1535.1605523355422205109@localhost> Content-Type: text/plain; charset="utf-8" Hello, Onbasca[0], a relay bandwidth, has just added support for testing bridges. I have modified rdsys to use it[1]. onbasca produces a bandwidth ratio, on how fast is a bridge compared to the rest of bridges (1 is the median), and rdsys decides if distribute a bridge if the ratio is higher than a configured threshold (right now 0.75) or if is jet untested. rdsys does ignore the onbasca results if there is less then 50% of bridges with high enough ratio to be distributed. As this was needed by a sponsor I have already deployed it in production. I wrote a survival guide: https://gitlab.torproject.org/tpo/anti-censorship/team/-/wikis/Onbasca-Surv… I tested it and I don't expect much problems, but as I will be AFK next week if rdsys gives any problem is easy to roll back to the previous version of rdsys without onbasca support. I left the previous binary of rdsys backend in ~/bin/rdsys-backend.old, so rolling back will be running as rdsys user in polyanthum: systemctl --user stop rdsys-backend mv ~/bin/rdsys-backend.old ~/bin/rdsys-backend systemdl --user start rdsys-backend [0] https://gitlab.torproject.org/tpo/network-health/onbasca/ [1] https://gitlab.torproject.org/tpo/anti-censorship/rdsys/-/merge_requests/76 -- meskio | https://meskio.net/ -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- My contact info: https://meskio.net/crypto.txt -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Nos vamos a Croatan.

1 0

WebRTC Encoded Transform (or Insertable Streams) for media channels in Snowflake?
by David Fifield 25 Feb '23

25 Feb '23

We have discussed how Snowflake uses WebRTC data channels (DTLS), while some other WebRTC apps use media channels (DTLS-STRP), and how that could be used in a classifier. See for example Section 2 of https://censorbib.nymity.ch/#Fifield2016b. We have also entertained the possibility of encoding Snowflake data into an audio/video stream, à la FreeWave (https://censorbib.nymity.ch/#Houmansadr2013a) or CovertCast (https://censorbib.nymity.ch/#McPherson2016a) in order to use media channels in Snowflake. I came across an API that may permit us to use media channel, without the trouble of an audio/video codec. WebRTC Encoded Transform (formerly Insertable Streams, I think) provides a way to get at and manipulate the raw bytes of media frames. https://w3c.github.io/webrtc-encoded-transform/ > This API defines an API surface for manipulating the bits on > MediaStreamTracks being sent via an RTCPeerConnection. The API defines RTCEncodedVideoFrame and RTCEncodedAudioFrame types that give you an ArrayBuffer of the encoded media data: https://w3c.github.io/webrtc-encoded-transform/#RTCEncodedVideoFrame-interf… // New interfaces to define encoded video and audio frames. Will eventually // re-use or extend the equivalent defined in WebCodecs. [Exposed=(Window,DedicatedWorker)] interface RTCEncodedVideoFrame { readonly attribute RTCEncodedVideoFrameType type; readonly attribute unsigned long timestamp; attribute ArrayBuffer data; RTCEncodedVideoFrameMetadata getMetadata(); }; https://w3c.github.io/webrtc-encoded-transform/#RTCEncodedAudioFrame-interf… [Exposed=(Window,DedicatedWorker)] interface RTCEncodedAudioFrame { readonly attribute unsigned long timestamp; attribute ArrayBuffer data; RTCEncodedAudioFrameMetadata getMetadata(); }; One of the intended use cases of Encoded Transform is a end-to-end encryption when then media streams pass through a middlebox that removes and re-adds hop-by-hop DTLS-STRP layers: https://webrtchacks.com/true-end-to-end-encryption-with-webrtc-insertable-s… https://jitsi.org/security/ > You can turn on end-to-end encryption (e2ee) as long as you are using > Jitsi Meet on a browser with support for insertable streams. The explainer document has a sample of inverting all the bits in an encoded media frame: https://github.com/w3c/webrtc-encoded-transform/blob/5c7ab84f4ce338f299172f… // Receiver transform function createReceiverTransform() { return new TransformStream({ start() {}, flush() {}, async transform(encodedFrame, controller) { // Reconstruct the original frame. const view = new DataView(encodedFrame.data); // Ignore the last 4 bytes const newData = new ArrayBuffer(encodedFrame.data.byteLength - 4); const newView = new DataView(newData); // Negate all bits in the incoming frame, ignoring the // last 4 bytes for (let i = 0; i < encodedFrame.data.byteLength - 4; ++i) newView.setInt8(i, ~view.getInt8(i)); encodedFrame.data = newData; controller.enqueue(encodedFrame); } }); } I am not clear on the difference between Encoded Transform, Insertable Streams, and WebCodecs, but here are some possible browser support tables: https://chromestatus.com/feature/6321945865879552 https://caniuse.com/?search=webcodec https://developer.mozilla.org/en-US/docs/Web/API/WebCodecs_API

1 0

onbasca and rdsys
by meskio 24 Feb '23

24 Feb '23

Hello, Onbasca[0], a relay bandwidth, has just added support for testing bridges. I have modified rdsys to use it[1]. onbasca produces a bandwidth ratio, on how fast is a bridge compared to the rest of bridges (1 is the median), and rdsys decides if distribute a bridge if the ratio is higher than a configured threshold (right now 0.75) or if is jet untested. rdsys does ignore the onbasca results if there is less then 50% of bridges with high enough ratio to be distributed. As this was needed by a sponsor I have already deployed it in production. I wrote a survival guide: https://gitlab.torproject.org/tpo/anti-censorship/team/-/wikis/Onbasca-Surv… I tested it and I don't expect much problems, but as I will be AFK next week if rdsys gives any problem is easy to roll back to the previous version of rdsys without onbasca support. I left the previous binary of rdsys backend in ~/bin/rdsys-backend.old, so rolling back will be running as rdsys user in polyanthum: systemctl --user stop rdsys-backend mv ~/bin/rdsys-backend.old ~/bin/rdsys-backend systemdl --user start rdsys-backend [0] https://gitlab.torproject.org/tpo/network-health/onbasca/ [1] https://gitlab.torproject.org/tpo/anti-censorship/rdsys/-/merge_requests/76 -- meskio | https://meskio.net/ -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- My contact info: https://meskio.net/crypto.txt -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Nos vamos a Croatan.

1 0