- anti-censorship-team - lists.torproject.org

Relative usage of snowflake-01 and snowflake-02 bridges, October 2024
by David Fifield 04 Nov '24

04 Nov '24

This is just a note to observe that the usage of snowflake-01 and snowflake-02 appears to have reached an equilibrium in recent months, though the usage is still unequal. The users and especially bandwidth are recently highly correlated. But the country distribution still differs a lot. snowflake-01 is Iran first, Russia second; while snowflake-02 is Russia first, Iran second.

1 0

Vanilla bridges not available from bridges.torproject.org web interface
by Michael Rogers 04 Nov '24

04 Nov '24

Hi all, It seems that bridges.torproject.org is no longer serving vanilla bridges via the web interface. The following page (reached by selecting "none" in the transport dropdown) has no content: https://bridges.torproject.org/bridges?transport=0 Cheers, Michael

2 1

[eclips.is] The future of eclips.is
by David Fifield 31 Oct '24

31 Oct '24

The Snowflake broker is currently hosted on Greenhost's subsidized eclips.is platform. Their funding has ended, and they are moving to a partial user-pays model. For the next year Greenhost will self-fund up to 50 EUR per month per user. I am not sure whether we fit under that threshold. ----- Forwarded message from Greenhost <support(a)greenhost.nl> ----- Date: Thu, 31 Oct 2024 14:43:05 +0000 From: Greenhost <support(a)greenhost.nl> To: david(a)bamsoftware.com Subject: [eclips.is] The future of eclips.is Hello david(a)bamsoftware.com, Hope you’re doing well! We’re happy to inform you that all VPSs have been successfully migrated from our Miami data center to Amsterdam. Please take a moment to check that your VPS is functioning as expected, and let us know if you encounter any issues. As mentioned earlier this year, funding support from the Open Technology Fund (OTF) will conclude on October 31st, 2024 (today). However, Greenhost is committed to ensuring continued service and will fully support eclips.is through December 31st, 2024. Starting January 1st, 2025, Greenhost will migrate eclips.is to a hybrid model. We will provide every account with a free tier of up to EUR 50 per month. Based on usage data, this will cover about 90% of current accounts. As a result, for the majority of accounts/users, nothing will change. For accounts using more resources, the portion above EUR 50 per month will be charged, with a discount of 25% applied. This model will be in place until at least October 31st, 2025. During the year, we will assess this model and determine if it is sustainable long-term. With this approach, Greenhost has found a good balance between continuing to fully support grassroots and small organizations, and providing heavy users with an affordable service. This sponsorship represents approximately €120,000 per year, and Greenhost is proud to be able to provide this service to the community without funding. However, we are dedicated to exploring extra funding options to further support the community and broaden our user base. For users who can fully cover their service costs, we encourage you to purchase directly through the Greenhost website. Direct purchases strengthen our ability to support the community in the long term. Thank you for being part of this journey! The Greenhost Team -- Voor vragen of opmerkingen kunt u contact opnemen via info(a)greenhost.nl Volg ons / Follow us: Website: https://greenhost.net/blog Twitter: https://twitter.com/greenhost ----- End forwarded message -----

1 0

Reminder: mailman 3 upgrade imminent (TPA-RFC-71)
by Antoine Beaupré 29 Oct '24

29 Oct '24

Hi, As mentioned in early October, we're in the process of upgrading our main mail server, which includes upgrading to the shiny new Mailman 3 platform. We have, right now, a prototype mailman 3 server available at: https://lists-01.torproject.org/ It's hidden behind the usual "trivial" authentication (ask us on IRC if you don't remember what it is), but should otherwise work normally. I'm going to start by migrating the TPA mailing list and we'll be testing this for a couple of days, but, next week, I'll start migrating the other mailing lists (including this one!). If people want to jump in front of that train early and be part of the beta testers, then by all means I'm happy to have your mailing list be part of the early adopters. Be warned that Mailman 3 is a significant upgrade from Mailman 2. There are some great things (like unified authentication), and some less great things (like a more complex design and "shinier" web interface that might not be everyone's taste). As a reminder, we're doing this upgrade a little rushed because the main mail server is now unsupported for security upgrades. See the details of the proposal here: https://gitlab.torproject.org/tpo/tpa/team/-/wikis/policy/tpa-rfc-71-emerge… ... with the milestone tracking actual work issues in: https://gitlab.torproject.org/groups/tpo/tpa/-/milestones/16 (Sorry for cross-posting this, but this seems like it warrants wider distribution. As a rule of thumb, I selected mailing lists with public archives that had posts in October 2024, removing duplicates like anti-censorship-team and -alerts. I also suspect many of those mailing lists will refuse my message because I'm not subscribed, but I will have tried. :)) Phew! a. -- Antoine Beaupré torproject.org system administration

1 0

Anyone have a copy of the v0.9.0 Snowflake WebExtension CRX file?
by David Fifield 21 Oct '24

21 Oct '24

I just archived v0.9.0 and v0.9.1 of the Snowflake WebExtension: https://archive.org/details/snowflake-webextension-0.9.0 https://archive.org/details/snowflake-webextension-0.9.1 However, I neglected to download v0.9.0 from the Google Play Store before it got updated to v0.9.1, and I don't know of a way to download older version from the Google Play Store. What I've done for v0.9.0 is uploaded Shelikhoo's submitted build-webext-chromium_v3.zip from https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow…. But ideally I'd like to have the CRX file that is digitally signed by Google. Does someone maybe have v0.9.0 still installed, or else know how to download an older version? What I do to download the current version is fetch the URL https://clients2.google.com/service/update2/crx?response=redirect&prodversi…

2 2

Significant ?? country users of snowflake-01 in August 2024
by David Fifield 06 Sep '24

06 Sep '24

Making some graphs for the August 2024 Snowflake bridge report, there are a couple of weird things to comment on. On August 22–23, there was a drop in users across both bridges that later almost evened out. (See first attachment.) It affected both bridges. >From August 16–31, the ?? country broke into the top 5 countries by user count, on the snowflake-01 bridge only. (See third attachment.) Because the country code comes from the proxy, which reports the remote IP address of the client, a country code of ?? means that either the proxy did not report an IP address (no client_ip WebSocket URL parameter), or the IP address was not found in a geolocation lookup. Here's a past case where a bug in the WebExtension was resulting in ?? countries: https://bugs.torproject.org/tpo/anti-censorship/pluggable-transports/snowfl… The snowflake server logs daily the fraction N/D of connections that had client_ip set. In the case before, N decreased while D remained constant. In this case, it looks like N is remaining constant while D is greatly increasing. See in the listing below how N/D suddenly drops from 99% to 41% on 2024-08-13. In the last couple of days, ⅔ to ¾ of connections have been missing the client_ip parameter. The client_ip-less connections must not represent very many user-hours, otherwise they would completely dominate the user graphs. Did something happen on 2024-08-13? Is this a new source of proxies with an implementation bug? Some kind of attack? (Against the bridge?) $ grep 'connections had client_ip$' /var/log/snowflake-server/snowflake-server.log | perl -ane '$F[7] =~ m#^(.*)/(.*)$#; printf("%s %s %8d/%-8d %6.2f%%\n", $F[0], $F[1], $1, $2, 100 * ($2 == 0 ? 0.0 : $1/$2));' 2024/08/06 08:57:22 463234/464597 99.71% 2024/08/07 08:57:22 462398/463581 99.74% 2024/08/08 08:57:22 453003/454165 99.74% 2024/08/09 08:57:22 450344/451707 99.70% 2024/08/10 08:57:22 450057/452228 99.52% 2024/08/11 08:57:22 449782/452296 99.44% 2024/08/12 08:57:22 452387/475006 95.24% 2024/08/13 08:57:22 450993/1089806 41.38% 2024/08/14 08:57:22 455701/828402 55.01% 2024/08/15 08:57:22 449159/886577 50.66% 2024/08/16 08:57:22 430698/1061690 40.57% 2024/08/17 08:57:22 426891/1240861 34.40% 2024/08/18 08:57:22 428010/1139078 37.58% 2024/08/19 08:57:22 425667/1363289 31.22% 2024/08/20 08:57:22 427042/1181316 36.15% 2024/08/21 08:57:22 422347/1407363 30.01% 2024/08/22 08:57:22 418760/1437024 29.14% 2024/08/23 08:57:22 271142/1217897 22.26% 2024/08/24 08:57:22 353388/1291375 27.37% 2024/08/25 08:57:22 366323/1117172 32.79% 2024/08/26 08:57:22 382452/1107561 34.53% 2024/08/27 08:57:22 416759/1451520 28.71% 2024/08/28 08:57:22 413329/1445703 28.59% 2024/08/29 08:57:22 403754/1490629 27.09% 2024/08/30 08:57:22 388147/1490993 26.03% 2024/08/31 08:57:22 395311/1377168 28.70% 2024/09/01 08:57:22 389361/1344726 28.95% 2024/09/02 08:57:22 377702/1169902 32.28% 2024/09/03 08:57:22 369956/1272026 29.08% 2024/09/04 08:57:22 368266/1330355 27.68% 2024/09/05 08:57:22 371429/1260571 29.47%

2 3

obfs4/lyrebird terminology
by David Fifield 22 Aug '24

22 Aug '24

A coupld of forthcoming papers are using "Lyrebird" as if it were the name of a protocol, a synonym for obfs4: https://arxiv.org/abs/2405.13310 > Obfs4/Lyrebird is based on Scramblesuit [56]. https://eprint.iacr.org/2024/1086 > The obfs4/lyrebird protocol, specified in [60], is separated into two > distinct phases: This, to me, seems like an incorrect use of terminology. I am planning to tell the authors so. But I just want to check that my understanding matches the consensus opinion, which I would summarize thus: There is no such thing as a "lyrebird" protocol. Lyrebird is a program that implements several protocols, including obfs3, obfs4, and meek. Lyrebird is a fork of obfs4proxy, which likewise is a program, not a protocol. Just as there is no "lyrebird" protocol, there is no "obfs4proxy" protocol; these are names of programs that both happen to implement an identical protocol, which protocol is called obfs4. Do you agree? Tor renaming its fork of obfs4proxy Lyrebird was an effort to reduce confusion. I worry that we will have years of confusion to deal with if the mistaken assumption lyrebird ≈ obfs4 (rather than lyrebird ≈ obfs4proxy) gets consecrated in print.

2 2

covertDTLS: reducing distinguishability of DTLS for usage in Snowflake
by Theodor Midtlien 14 Aug '24

14 Aug '24

Hi! I have talked with some of you in the IRC meetings this year, but I have not updated the mailing list on my work. A little over a month ago I completed my Master's thesis on "Reducing distinguishability of DTLS for usage in Snowflake", at the Norwegian University of Science (NTNU) in the Department of Information Security and Communication Technology, supervised by David Palma. The thesis can be found on my website: https://theodorsm.net/thesis Here is a trimmed abstract: " [...] We have seen that censors have been able to do so [blocking Snowflake] by fingerprinting the DTLS implementation that is produced by the Pion library used by Snowflake. The aim of this thesis is to reduce the distinguisability of said DTLS library. We developed a tool named, dfind [1] for analyzing and finding passive field-based fingerprints of DTLS. This tool was validated using a data set with known fingerprints, and found that the extensions field was especially vulnerable for identification. To combat such fingerprints, we implemented covertDTLS [2], a Go library inspired by uTLS. Our module extends the Pion DTLS library with handshake hooking to offer mimicry and randomization features. To ensure that mimicking remains up-to-date, we developed a novel continuous delivery workflow for generating fresh DTLS-WebRTC handshakes from popular browsers. Using covertDTLS with Snowflake resulted in us not being able to find any fingerprints." [1]: https://github.com/theodorsm/dfind [2]: https://github.com/theodorsm/covert-dtls I have only tested covertDTLS in a messy fork of Snowflake, which had promising results. I am currently working on upgrading the Pion DTLS and WebRTC version used by Snowflake to the most recent version to integrate covertDTLS properly. In addition, I plan to condense my thesis into a paper, thus making the work more accessible. I would greatly appreciate any feedback on the thesis so that I can address those in the paper. I am also open to collaborating on the paper, feel free to reach out if you have some ideas to be explored. Cheers, Theodor Signebøen Midtlien

1 0

Fwd: Clear, 10min_cpu_usage (was warning for 5 hours and 32 minutes), on snowflake-01
by Linus Nordberg 04 Aug '24

04 Aug '24

Hi, snowflake-01 has lately been seeing more traffic than usual and yesterday was really odd. Since the beginning of July this year CPU utilisation has usually been exceeding 85% for between one and two hours, ending about midnight CEST. Yesterday we saw that for five and a half hours ending around 18:00 CEST. Any idea why this is happening? I did see something about snowflake-02 moving somewhere. Can this be related? Is the move done? How did it go? 2 Aug 2024 18:05:53 netdata(a)snowflake-01.torproject.net: snowflake-01 recovered 10min cpu usage (was warning for 5 hours and 32 minutes) average CPU utilization over the last 10 minutes (excluding iowait, nice and steal) (was warning for 5 hours and 32 minutes) Chart : system.cpu Family : cpu Severity: Recovered from WARNING URL : https://api.netdata.cloud/alarms/redirect?agentId=47d61784-c899-11ec-b119-3… Source : 4(a)/usr/lib/netdata/conf.d/health.d/cpu.conf Date : 2024-08-02T15:50:50+0000 Notification generated on snowflake-01 Evaluated Expression : $this > (($status >= $WARNING) ? (75) : (85)) Expression Variables : [ $this = 74.9016704 ] [ $status = 1 ] [ $WARNING = 3 ] The host has 0 WARNING and 0 CRITICAL alarm(s) raised.

2 2

PDF of "Bridging Barriers" for reading group
by David Fifield 01 Aug '24

01 Aug '24

The authors sent me a copy of the paper scheduled for the 2024-08-22 reading group. Cf. https://lists.torproject.org/pipermail/tor-project/2024-August/003842.html https://meetbot.debian.net/tor-meeting/2024/tor-meeting.2024-08-01-16.00.ht…

1 0

2024

2023

2022

2021

2020

2019

anti-censorship-team