- anti-censorship-team - lists.torproject.org

Meek config for TM
by Michael Rogers 05 Feb '25

05 Feb '25

Hi all, While updating Briar's built-in bridge config from Moat I noticed that Moat's still listing the Azure front for Meek in TM - is it still working? Cheers, Michael

3 3

Meek/Snowflake/Moat fronts for older Android devices?
by Michael Rogers 05 Feb '25

05 Feb '25

Hi all, Devices running versions of Android older than 7.1.1 can't verify certificates signed with Let's Encrypt's ISRG Root X1 root certificate, so they can't connect to domain fronts that use such certificates. [1] These devices (released in 2016 or earlier) still make up nearly 5% of active Android devices. [2] There was a workaround in place at one point -- cross-signing Let's Encrypt certificates with a different, expired root certificate and relying on Android not to check the expiry date -- but I believe the cross-signature expired in early 2024. [3] With the loss of Fastly and Azure, the only remaining fronts for Meek and Snowflake in the default config served by Moat will be cdn77.com and phpmyadmin.net, both of which use Let's Encrypt certificates that are signed with ISRG Root X1 and don't appear to be cross-signed. It looks like there's some work in progress to address this issue in Lyrebird by adding the relevant certificates, so hopefully Meek and Snowflake will work in a future Lyrebird release. But what about the initial connection to Moat? Orbot has moved from Fastly to CDN77 for its Moat front [4]. Are there any plans underway to make another front available, or should we move to CDN77 and plan for Moat being unavailable on older Android devices? Thanks, Michael [1] https://letsencrypt.org/2020/11/06/own-two-feet/ [2] https://apilevels.com/ [3] https://arstechnica.com/gadgets/2020/12/lets-encrypt-comes-up-with-workarou… [4] https://github.com/guardianproject/orbot/pull/1191/files

4 10

Anyone have a copy of the v0.9.0 Snowflake WebExtension CRX file?
by David Fifield 12 Dec '24

12 Dec '24

I just archived v0.9.0 and v0.9.1 of the Snowflake WebExtension: https://archive.org/details/snowflake-webextension-0.9.0 https://archive.org/details/snowflake-webextension-0.9.1 However, I neglected to download v0.9.0 from the Google Play Store before it got updated to v0.9.1, and I don't know of a way to download older version from the Google Play Store. What I've done for v0.9.0 is uploaded Shelikhoo's submitted build-webext-chromium_v3.zip from https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow…. But ideally I'd like to have the CRX file that is digitally signed by Google. Does someone maybe have v0.9.0 still installed, or else know how to download an older version? What I do to download the current version is fetch the URL https://clients2.google.com/service/update2/crx?response=redirect&prodversi…

2 3

Status of snowflake covert-dtls-test?
by David Fifield 09 Dec '24

09 Dec '24

Recently there have been problems with Snowflake connectivity in Russia. WebRTC data connections are being established, but then stop working after some amount of traffic is exchanged. cohosh has investigated and whatever the cause is, it's not straightforward DTLS fingerprinting. https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… Theodor, what's the status of your covertDTLS patch to Snowflake? https://gitlab.torproject.org/theodorsm/snowflake/-/tree/covert-dtls-test Is it ready to be run as a test client? If so, can you provide brief instructions on how to do it? Snowflake recently updated to pion/webrtc/v4, which I seem to recall was a blocker for covertDTLS integration. https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… Here's where we discussed this topic in the team meeting today. https://meetbot.debian.net/tor-meeting/2024/tor-meeting.2024-11-21-16.00.lo… https://lists.torproject.org/mailman3/hyperkitty/list/tor-project@lists.tor… P.S. I Cced the anti-censorship-team(a)lists.torproject.org mailing list.

2 2

Microsoft announces shutting down domain fronting attempts in Azure
by Cecylia Bocovich 18 Nov '24

18 Nov '24

It looks like Azure is going to shutdown domain fronting: https://www.microsoft.com/security/blog/2021/03/26/securing-our-approach-to… There isn't a time frame listed in the article, and I haven't gotten any notifications through my Azure account yet. Cecylia

7 9

goptlib v1.6.0
by David Fifield 14 Nov '24

14 Nov '24

I tagged v1.6.0 of goptlib. It has a bug fix (panic in DialOr) and a corrected test case. https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/gopt… > == v1.6.0 > > Fixed a type assertion panic in DialOr that occurred when the network dial > failed. Patch by Rob Jansen. > https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/gopt… > > Enhanced the TestGetServerBindaddrs test to compare not only MethodName and > Addr, but also Options, and fixed a test case that expected the wrong Options. > Patch by Jack Wampler. > https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/gopt…

1 0

Relative usage of snowflake-01 and snowflake-02 bridges, October 2024
by David Fifield 04 Nov '24

04 Nov '24

This is just a note to observe that the usage of snowflake-01 and snowflake-02 appears to have reached an equilibrium in recent months, though the usage is still unequal. The users and especially bandwidth are recently highly correlated. But the country distribution still differs a lot. snowflake-01 is Iran first, Russia second; while snowflake-02 is Russia first, Iran second.

1 0

Vanilla bridges not available from bridges.torproject.org web interface
by Michael Rogers 04 Nov '24

04 Nov '24

Hi all, It seems that bridges.torproject.org is no longer serving vanilla bridges via the web interface. The following page (reached by selecting "none" in the transport dropdown) has no content: https://bridges.torproject.org/bridges?transport=0 Cheers, Michael

2 1

Reminder: mailman 3 upgrade imminent (TPA-RFC-71)
by Antoine Beaupré 30 Oct '24

30 Oct '24

Hi, As mentioned in early October, we're in the process of upgrading our main mail server, which includes upgrading to the shiny new Mailman 3 platform. We have, right now, a prototype mailman 3 server available at: https://lists-01.torproject.org/ It's hidden behind the usual "trivial" authentication (ask us on IRC if you don't remember what it is), but should otherwise work normally. I'm going to start by migrating the TPA mailing list and we'll be testing this for a couple of days, but, next week, I'll start migrating the other mailing lists (including this one!). If people want to jump in front of that train early and be part of the beta testers, then by all means I'm happy to have your mailing list be part of the early adopters. Be warned that Mailman 3 is a significant upgrade from Mailman 2. There are some great things (like unified authentication), and some less great things (like a more complex design and "shinier" web interface that might not be everyone's taste). As a reminder, we're doing this upgrade a little rushed because the main mail server is now unsupported for security upgrades. See the details of the proposal here: https://gitlab.torproject.org/tpo/tpa/team/-/wikis/policy/tpa-rfc-71-emerge… ... with the milestone tracking actual work issues in: https://gitlab.torproject.org/groups/tpo/tpa/-/milestones/16 (Sorry for cross-posting this, but this seems like it warrants wider distribution. As a rule of thumb, I selected mailing lists with public archives that had posts in October 2024, removing duplicates like anti-censorship-team and -alerts. I also suspect many of those mailing lists will refuse my message because I'm not subscribed, but I will have tried. :)) Phew! a. -- Antoine Beaupré torproject.org system administration

1 0

Significant ?? country users of snowflake-01 in August 2024
by David Fifield 06 Sep '24

06 Sep '24

Making some graphs for the August 2024 Snowflake bridge report, there are a couple of weird things to comment on. On August 22–23, there was a drop in users across both bridges that later almost evened out. (See first attachment.) It affected both bridges. >From August 16–31, the ?? country broke into the top 5 countries by user count, on the snowflake-01 bridge only. (See third attachment.) Because the country code comes from the proxy, which reports the remote IP address of the client, a country code of ?? means that either the proxy did not report an IP address (no client_ip WebSocket URL parameter), or the IP address was not found in a geolocation lookup. Here's a past case where a bug in the WebExtension was resulting in ?? countries: https://bugs.torproject.org/tpo/anti-censorship/pluggable-transports/snowfl… The snowflake server logs daily the fraction N/D of connections that had client_ip set. In the case before, N decreased while D remained constant. In this case, it looks like N is remaining constant while D is greatly increasing. See in the listing below how N/D suddenly drops from 99% to 41% on 2024-08-13. In the last couple of days, ⅔ to ¾ of connections have been missing the client_ip parameter. The client_ip-less connections must not represent very many user-hours, otherwise they would completely dominate the user graphs. Did something happen on 2024-08-13? Is this a new source of proxies with an implementation bug? Some kind of attack? (Against the bridge?) $ grep 'connections had client_ip$' /var/log/snowflake-server/snowflake-server.log | perl -ane '$F[7] =~ m#^(.*)/(.*)$#; printf("%s %s %8d/%-8d %6.2f%%\n", $F[0], $F[1], $1, $2, 100 * ($2 == 0 ? 0.0 : $1/$2));' 2024/08/06 08:57:22 463234/464597 99.71% 2024/08/07 08:57:22 462398/463581 99.74% 2024/08/08 08:57:22 453003/454165 99.74% 2024/08/09 08:57:22 450344/451707 99.70% 2024/08/10 08:57:22 450057/452228 99.52% 2024/08/11 08:57:22 449782/452296 99.44% 2024/08/12 08:57:22 452387/475006 95.24% 2024/08/13 08:57:22 450993/1089806 41.38% 2024/08/14 08:57:22 455701/828402 55.01% 2024/08/15 08:57:22 449159/886577 50.66% 2024/08/16 08:57:22 430698/1061690 40.57% 2024/08/17 08:57:22 426891/1240861 34.40% 2024/08/18 08:57:22 428010/1139078 37.58% 2024/08/19 08:57:22 425667/1363289 31.22% 2024/08/20 08:57:22 427042/1181316 36.15% 2024/08/21 08:57:22 422347/1407363 30.01% 2024/08/22 08:57:22 418760/1437024 29.14% 2024/08/23 08:57:22 271142/1217897 22.26% 2024/08/24 08:57:22 353388/1291375 27.37% 2024/08/25 08:57:22 366323/1117172 32.79% 2024/08/26 08:57:22 382452/1107561 34.53% 2024/08/27 08:57:22 416759/1451520 28.71% 2024/08/28 08:57:22 413329/1445703 28.59% 2024/08/29 08:57:22 403754/1490629 27.09% 2024/08/30 08:57:22 388147/1490993 26.03% 2024/08/31 08:57:22 395311/1377168 28.70% 2024/09/01 08:57:22 389361/1344726 28.95% 2024/09/02 08:57:22 377702/1169902 32.28% 2024/09/03 08:57:22 369956/1272026 29.08% 2024/09/04 08:57:22 368266/1330355 27.68% 2024/09/05 08:57:22 371429/1260571 29.47%

2 3