October 2016 - tor-commits - lists.torproject.org

[onionoo/master] Upgrade metrics-lib and Jetty versions.
by karsten＠torproject.org 08 Oct '16

08 Oct '16

commit f191927eb0c8cc1c53cecd21fedbc0f25be3691e Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Sat Oct 8 22:19:01 2016 +0200 Upgrade metrics-lib and Jetty versions. --- build.xml | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/build.xml b/build.xml index d1cc58b..bb6580d 100644 --- a/build.xml +++ b/build.xml @@ -3,7 +3,7 @@ <property name="onionoo.protocol.version" value="3.1"/> <property name="release.version" value="${onionoo.protocol.version}.0"/> - <property name="descriptorversion" value="1.3.0"/> + <property name="descriptorversion" value="1.4.0"/> <property name="javasources" value="src/main/java"/> <property name="testsources" value="src/test/java"/> <property name="generated" value="generated"/> @@ -37,16 +37,16 @@ <patternset id="web" > <include name="servlet-api-3.0.jar"/> - <include name="jetty8-server-8.1.3.v20120416.jar"/> - <include name="jetty8-servlets-8.1.3.v20120416.jar"/> - <include name="jetty8-servlet-8.1.3.v20120416.jar"/> - <include name="jetty8-util-8.1.3.v20120416.jar"/> - <include name="jetty8-http-8.1.3.v20120416.jar"/> - <include name="jetty8-io-8.1.3.v20120416.jar"/> - <include name="jetty8-xml-8.1.3.v20120416.jar"/> - <include name="jetty8-webapp-8.1.3.v20120416.jar"/> - <include name="jetty8-continuation-8.1.3.v20120416.jar"/> - <include name="jetty8-security-8.1.3.v20120416.jar"/> + <include name="jetty8-server-8.1.16.v20140903.jar"/> + <include name="jetty8-servlets-8.1.16.v20140903.jar"/> + <include name="jetty8-servlet-8.1.16.v20140903.jar"/> + <include name="jetty8-util-8.1.16.v20140903.jar"/> + <include name="jetty8-http-8.1.16.v20140903.jar"/> + <include name="jetty8-io-8.1.16.v20140903.jar"/> + <include name="jetty8-xml-8.1.16.v20140903.jar"/> + <include name="jetty8-webapp-8.1.16.v20140903.jar"/> + <include name="jetty8-continuation-8.1.16.v20140903.jar"/> + <include name="jetty8-security-8.1.16.v20140903.jar"/> </patternset> <patternset id="test" >

1 0

[exonerator/master] Make two build improvements.
by karsten＠torproject.org 08 Oct '16

08 Oct '16

commit 4b013a1c1ccd290afc68f39ab1fbfc8fe483a5b7 Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Sat Oct 8 22:07:38 2016 +0200 Make two build improvements. Upgrade to metrics-lib 1.4.0 and include newly required logging .jar files. Include PostgreSQL .jar file in the .war file rather than relying on Tomcat to provide it. --- build.xml | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/build.xml b/build.xml index dfb7c2e..42c0ee0 100644 --- a/build.xml +++ b/build.xml @@ -16,11 +16,14 @@ <path id="classpath"> <pathelement path="${classes}"/> <fileset dir="${libs}"> - <include name="descriptor-1.3.1.jar"/> + <include name="descriptor-1.4.0.jar"/> <include name="commons-codec-1.9.jar"/> <include name="postgresql-jdbc4-9.2.jar"/> <include name="servlet-api-3.0.jar"/> <include name="commons-lang-2.6.jar"/> + <include name="logback-core-1.1.2.jar" /> + <include name="logback-classic-1.1.2.jar" /> + <include name="slf4j-api-1.7.7.jar"/> </fileset> </path> <path id="checkstyle.classpath" > @@ -93,9 +96,10 @@ <war destfile="${warfile}" webxml="${webxmlfile}"> <fileset dir="web"/> - <lib dir="/usr/share/java"> - <include name="commons-codec-1.9.jar"/> - <include name="commons-lang-2.6.jar"/> + <lib dir="${libs}"> + <include name="commons-codec-1.9.jar"/> + <include name="commons-lang-2.6.jar"/> + <include name="postgresql-jdbc4-9.2.jar"/> </lib> <classes dir="${classes}"/> <zipfileset dir="${resources}"

1 0

[translation/torbutton-torbuttondtd] Update translations for torbutton-torbuttondtd
by translation＠torproject.org 08 Oct '16

08 Oct '16

commit 3cefcabc4b4f05e3419b8ea77f51a93b104a9b04 Author: Translation commit bot <translation(a)torproject.org> Date: Sat Oct 8 18:16:36 2016 +0000 Update translations for torbutton-torbuttondtd --- zh_CN/torbutton.dtd | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/zh_CN/torbutton.dtd b/zh_CN/torbutton.dtd index 7bb89e1..9c1b573 100644 --- a/zh_CN/torbutton.dtd +++ b/zh_CN/torbutton.dtd @@ -25,15 +25,15 @@ <!ENTITY torbutton.cookiedialog.saveAllCookies "保护新的 Cookie"> <!ENTITY torbutton.cookiedialog.doNotSaveAllCookies "不保护新的 Cookie"> <!ENTITY torbutton.prefs.priv_caption "隐私设置"> -<!ENTITY torbutton.prefs.priv_caption_tooltip "选中后以下设置可用于保护身份和浏览历史隐私。通常情况下，强烈推荐在使用 Tor 浏览器时选中全部隐私选项。"> +<!ENTITY torbutton.prefs.priv_caption_tooltip "选中后以下设置可用于保护身份信息和浏览历史隐私。通常情况下，强烈建议在使用 Tor 浏览器时选中全部隐私选项。"> <!ENTITY torbutton.prefs.block_disk "禁止记录浏览历史或网站数据（启用隐私浏览模式）"> <!ENTITY torbutton.prefs.block_disk_tooltip "选中该选项可避免在硬盘上保存敏感数据，包括浏览器缓存，浏览历史，cookie 数据库，下载记录，中间 TLS 证书，以及用户网站授权。"> <!ENTITY torbutton.prefs.restrict_thirdparty "限制第三方 cookie 和其他数据跟踪程序"> <!ENTITY torbutton.prefs.restrict_thirdparty_tooltip "该选项用于防止滥用浏览器功能跟踪用户。修改的功能包括：blob 网址，广播通道，浏览器缓存，cookie，收藏夹图标，HTTP 验证头部，预连接，localStorage，mediaSource 网址，OCSP 请求，SharedWorker 和 TLS 会话票证。"> <!ENTITY torbutton.prefs.block_plugins "禁用浏览器插件（比如 Flash）"> -<!ENTITY torbutton.prefs.block_plugins_tooltip "该选项可阻止加载所有二进制插件。插件可泄漏浏览历史或导致用户更易被跟踪，因此插件对隐私是一种严重威胁。"> +<!ENTITY torbutton.prefs.block_plugins_tooltip "该选项可阻止加载所有二进制插件。插件可泄漏浏览历史记录或导致用户更易被跟踪，因此插件对隐私是一种严重威胁。"> <!ENTITY torbutton.prefs.resist_fingerprinting "修改 Tor 浏览器中可区分你与其他 Tor 用户的细节信息"> -<!ENTITY torbutton.prefs.resist_fingerprinting_tooltip "该选项可防止参看可识别用户的信息，包括电池状态，计算机性能，键盘布局，区域，插件安装位置，插件列表，网络状态，屏幕方向和大小，特定网站缩放比例，支持文件类型，系统颜色，以及 WebGL 功能。 "> +<!ENTITY torbutton.prefs.resist_fingerprinting_tooltip "该选项可防止网站参看可识别用户的信息，包括电池状态，计算机性能，键盘布局，区域，插件安装位置，插件列表，网络状态，屏幕方向和大小，特定网站缩放比例，支持文件类型，系统颜色，以及 WebGL 功能。 "> <!ENTITY torbutton.prefs.sec_caption "安全等级"> <!ENTITY torbutton.prefs.sec_caption_tooltip "安全滑块可禁用某些浏览器功能，避免因这些功能导致的漏洞而受到攻击。"> <!ENTITY torbutton.prefs.sec_low "低（默认）">

1 0

[translation/torbutton-torbuttondtd] Update translations for torbutton-torbuttondtd
by translation＠torproject.org 08 Oct '16

08 Oct '16

commit 9c65329ca42d6e3eff9efddae3ea9ae9f7b5858f Author: Translation commit bot <translation(a)torproject.org> Date: Sat Oct 8 17:16:37 2016 +0000 Update translations for torbutton-torbuttondtd --- zh_CN/torbutton.dtd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/zh_CN/torbutton.dtd b/zh_CN/torbutton.dtd index 2b973e7..7bb89e1 100644 --- a/zh_CN/torbutton.dtd +++ b/zh_CN/torbutton.dtd @@ -35,7 +35,7 @@ <!ENTITY torbutton.prefs.resist_fingerprinting "修改 Tor 浏览器中可区分你与其他 Tor 用户的细节信息"> <!ENTITY torbutton.prefs.resist_fingerprinting_tooltip "该选项可防止参看可识别用户的信息，包括电池状态，计算机性能，键盘布局，区域，插件安装位置，插件列表，网络状态，屏幕方向和大小，特定网站缩放比例，支持文件类型，系统颜色，以及 WebGL 功能。 "> <!ENTITY torbutton.prefs.sec_caption "安全等级"> -<!ENTITY torbutton.prefs.sec_caption_tooltip "The Security Slider lets you disable certain browser features that may make your browser more vulnerable to hacking attempts."> +<!ENTITY torbutton.prefs.sec_caption_tooltip "安全滑块可禁用某些浏览器功能，避免因这些功能导致的漏洞而受到攻击。"> <!ENTITY torbutton.prefs.sec_low "低（默认）"> <!ENTITY torbutton.prefs.sec_low_usable_desc "该选项可提供最佳的用户体验。"> <!ENTITY torbutton.prefs.sec_low_desc "该安全级别将启用所有浏览器功能。">

1 0

[translation/torbutton-torbuttondtd] Update translations for torbutton-torbuttondtd
by translation＠torproject.org 08 Oct '16

08 Oct '16

commit 91da9f4001d62a3a71ae06838b20e69afc448be8 Author: Translation commit bot <translation(a)torproject.org> Date: Sat Oct 8 16:46:36 2016 +0000 Update translations for torbutton-torbuttondtd --- zh_CN/torbutton.dtd | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/zh_CN/torbutton.dtd b/zh_CN/torbutton.dtd index 92c9edf..2b973e7 100644 --- a/zh_CN/torbutton.dtd +++ b/zh_CN/torbutton.dtd @@ -29,11 +29,11 @@ <!ENTITY torbutton.prefs.block_disk "禁止记录浏览历史或网站数据（启用隐私浏览模式）"> <!ENTITY torbutton.prefs.block_disk_tooltip "选中该选项可避免在硬盘上保存敏感数据，包括浏览器缓存，浏览历史，cookie 数据库，下载记录，中间 TLS 证书，以及用户网站授权。"> <!ENTITY torbutton.prefs.restrict_thirdparty "限制第三方 cookie 和其他数据跟踪程序"> -<!ENTITY torbutton.prefs.restrict_thirdparty_tooltip "Keep this box checked to prevent various browser features from being abused to track you as you browse the web. Modified features include blob URLs, broadcast channels, the browser cache, cookies, favicons, HTTP Auth headers, link preconnects, localStorage, mediaSource URLs, OCSP requests, SharedWorkers, and TLS session tickets."> +<!ENTITY torbutton.prefs.restrict_thirdparty_tooltip "该选项用于防止滥用浏览器功能跟踪用户。修改的功能包括：blob 网址，广播通道，浏览器缓存，cookie，收藏夹图标，HTTP 验证头部，预连接，localStorage，mediaSource 网址，OCSP 请求，SharedWorker 和 TLS 会话票证。"> <!ENTITY torbutton.prefs.block_plugins "禁用浏览器插件（比如 Flash）"> -<!ENTITY torbutton.prefs.block_plugins_tooltip "Keep this box checked to stop all binary plugins from being loaded. Plugins are a serious privacy risk because they can leak your browsing history or otherwise make you easy to track."> +<!ENTITY torbutton.prefs.block_plugins_tooltip "该选项可阻止加载所有二进制插件。插件可泄漏浏览历史或导致用户更易被跟踪，因此插件对隐私是一种严重威胁。"> <!ENTITY torbutton.prefs.resist_fingerprinting "修改 Tor 浏览器中可区分你与其他 Tor 用户的细节信息"> -<!ENTITY torbutton.prefs.resist_fingerprinting_tooltip "Keep this box checked to hide things from websites that could be unique about you, including your battery status, computer performance, keyboard layout, locale, the location of installed plugins, the list of installed plugins, your network status, screen orientation, screen size, site-specific zoom levels, supported file types, system colors, and WebGL capabilities."> +<!ENTITY torbutton.prefs.resist_fingerprinting_tooltip "该选项可防止参看可识别用户的信息，包括电池状态，计算机性能，键盘布局，区域，插件安装位置，插件列表，网络状态，屏幕方向和大小，特定网站缩放比例，支持文件类型，系统颜色，以及 WebGL 功能。 "> <!ENTITY torbutton.prefs.sec_caption "安全等级"> <!ENTITY torbutton.prefs.sec_caption_tooltip "The Security Slider lets you disable certain browser features that may make your browser more vulnerable to hacking attempts."> <!ENTITY torbutton.prefs.sec_low "低（默认）">

1 0

[translation/torbutton-torbuttondtd] Update translations for torbutton-torbuttondtd
by translation＠torproject.org 08 Oct '16

08 Oct '16

commit 9d56df0493ab03589337b16ffbe65056ca3502a3 Author: Translation commit bot <translation(a)torproject.org> Date: Sat Oct 8 14:46:35 2016 +0000 Update translations for torbutton-torbuttondtd --- zh_CN/torbutton.dtd | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/zh_CN/torbutton.dtd b/zh_CN/torbutton.dtd index 459cca4..92c9edf 100644 --- a/zh_CN/torbutton.dtd +++ b/zh_CN/torbutton.dtd @@ -25,9 +25,9 @@ <!ENTITY torbutton.cookiedialog.saveAllCookies "保护新的 Cookie"> <!ENTITY torbutton.cookiedialog.doNotSaveAllCookies "不保护新的 Cookie"> <!ENTITY torbutton.prefs.priv_caption "隐私设置"> -<!ENTITY torbutton.prefs.priv_caption_tooltip "When checked, the following settings help to keep your identity and browsing history private. We strongly recommend that you keep all privacy boxes checked for normal Tor Browser use."> +<!ENTITY torbutton.prefs.priv_caption_tooltip "选中后以下设置可用于保护身份和浏览历史隐私。通常情况下，强烈推荐在使用 Tor 浏览器时选中全部隐私选项。"> <!ENTITY torbutton.prefs.block_disk "禁止记录浏览历史或网站数据（启用隐私浏览模式）"> -<!ENTITY torbutton.prefs.block_disk_tooltip "Keep this box checked to avoid saving sensitive data to disk, including the browser cache, your browsing history, the cookie database, your download history, intermediate TLS certificates, and permissions you have granted to websites."> +<!ENTITY torbutton.prefs.block_disk_tooltip "选中该选项可避免在硬盘上保存敏感数据，包括浏览器缓存，浏览历史，cookie 数据库，下载记录，中间 TLS 证书，以及用户网站授权。"> <!ENTITY torbutton.prefs.restrict_thirdparty "限制第三方 cookie 和其他数据跟踪程序"> <!ENTITY torbutton.prefs.restrict_thirdparty_tooltip "Keep this box checked to prevent various browser features from being abused to track you as you browse the web. Modified features include blob URLs, broadcast channels, the browser cache, cookies, favicons, HTTP Auth headers, link preconnects, localStorage, mediaSource URLs, OCSP requests, SharedWorkers, and TLS session tickets."> <!ENTITY torbutton.prefs.block_plugins "禁用浏览器插件（比如 Flash）">

1 0

[torspec/master] Add draft prop273 from Phillipp Winter et al.
by nickm＠torproject.org 07 Oct '16

07 Oct '16

commit c7c1bf18f4ea5c06f8c57ce8d5a2fd27f8ed7998 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Oct 7 12:21:49 2016 -0400 Add draft prop273 from Phillipp Winter et al. --- proposals/000-index.txt | 2 + proposals/273-exit-relay-pinning.txt | 223 +++++++++++++++++++++++++++++++++++ 2 files changed, 225 insertions(+) diff --git a/proposals/000-index.txt b/proposals/000-index.txt index cf2102d..ebe00eb 100644 --- a/proposals/000-index.txt +++ b/proposals/000-index.txt @@ -193,6 +193,7 @@ Proposals by number: 270 RebelAlliance: A Post-Quantum Secure Hybrid Handshake Based on NewHope [DRAFT] 271 Another algorithm for guard selection [OPEN] 272 Listed routers should be Valid, Running, and treated as such [FINISHED] +273 Exit relay pinning for web services [DRAFT] Proposals by status: @@ -221,6 +222,7 @@ Proposals by status: 268 New Guard Selection Behaviour 269 Transitionally secure hybrid handshakes 270 RebelAlliance: A Post-Quantum Secure Hybrid Handshake Based on NewHope + 273 Exit relay pinning for web services [for n/a] NEEDS-REVISION: 190 Bridge Client Authorization Based on a Shared Secret NEEDS-RESEARCH: diff --git a/proposals/273-exit-relay-pinning.txt b/proposals/273-exit-relay-pinning.txt new file mode 100644 index 0000000..91c3763 --- /dev/null +++ b/proposals/273-exit-relay-pinning.txt @@ -0,0 +1,223 @@ +Filename: 273-exit-relay-pinning.txt +Title: Exit relay pinning for web services +Author: Philipp Winter, Tobias Pulls, Roya Ensafi, and Nick Feamster +Created: 2016-09-22 +Status: Draft +Target: n/a + +0. Overview + + To mitigate the harm caused by malicious exit relays, this proposal + presents a novel scheme -- exit relay pinning -- to allow web sites + to express that Tor connections should preferably originate from a + set of predefined exit relays. This proposal is currently in draft + state. Any feedback is appreciated. + +1. Motivation + + Malicious exit relays are increasingly becoming a problem. We have + been witnessing numerous opportunistic attacks, but also highly + sophisticated, targeted attacks that are financially motivated. So + far, we have been looking for malicious exit relays using active + probing and a number of heuristics, but since it is inexpensive to + keep setting up new exit relays, we are facing an uphill battle. + + Similar to the now-obsolete concept of exit enclaves, this proposal + enables web services to express that Tor clients should prefer a + predefined set of exit relays when connecting to the service. We + encourage sensitive sites to set up their own exit relays and have + Tor clients prefer these relays, thus greatly mitigating the risk of + man-in-the-middle attacks. + +2. Design + +2.1 Overview + + A simple analogy helps in explaining the concept behind exit relay + pinning: HTTP Public Key Pinning (HPKP) allows web servers to express + that browsers should pin certificates for a given time interval. + Similarly, exit relay pinning (ERP) allows web servers to express + that Tor Browser should prefer a predefined set of exit relays. This + makes it harder for malicious exit relays to be selected as last hop + for a given website. + + Web servers advertise support for ERP in a new HTTP header that + points to an ERP policy. This policy contains one or more exit + relays, and is signed by the respective relay's master identity key. + Once Tor Browser obtained a website's ERP policy, it will try to + select the site's preferred exit relays for subsequent connections. + The following subsections discuss this mechanism in greater detail. + +2.2 Exit relay pinning header + + Web servers support ERP by advertising it in the "Tor-Exit-Pins" HTTP + header. The header contains two directives, "url" and "max-age": + + Tor-Exit-Pins: url="https://example.com/pins.txt"; max-age=2678400 + + The "url" directive points to the full policy, which MUST be HTTPS. + Tor Browser MUST NOT fetch the policy if it is not reachable over + HTTPS. Also, Tor Browser MUST abort the ERP procedure if the HTTPS + certificate is not signed by a trusted authority. The "max-age" + directive determines the time in seconds for how long Tor Browser + SHOULD cache the ERP policy. + + After seeing a Tor-Exit-Pins header in an HTTP response, Tor Browser + MUST fetch and interpret the policy unless it already has it cached + and the cached policy has not yet expired. + +2.3 Exit relay pinning policy + + An exit relay pinning policy MUST be formatted in JSON. The root + element is called "erp-policy" and it points to a list of pinned exit + relays. Each list element MUST contain two elements, "fingerprint" + and "signature". The "fingerprint" element points to the + hex-encoded, uppercase, 40-digit fingerprint of an exit relay, e.g., + 9B94CD0B7B8057EAF21BA7F023B7A1C8CA9CE645. The "signature" element + points to an Ed25519 signature, uppercase and hex-encoded. The + following JSON shows a conceptual example: + + { + "erp-policy": [ + "start-policy", + { + "fingerprint": Fpr1, + "signature": Sig_K1("erp-signature" || "example.com" || Fpr1) + }, + { + "fingerprint": Fpr2, + "signature": Sig_K2("erp-signature" || "example.com" || Fpr2) + }, + ... + { + "fingerprint": Fprn, + "signature": Sig_Kn("erp-signature" || "example.com" || Fprn) + }, + "end-policy" + ] + } + + Fpr refers to a relay's fingerprint as discussed above. In the + signature, K refers to a relay's master private identity key. The || + operator refers to string concatenation, i.e., "foo" || "bar" results + in "foobar". "erp-signature" is a constant and denotes the purpose + of the signature. "start-policy" and "end-policy" are both constants + and meant to prevent an adversary from serving a client only a + partial list of pins. + + The signatures over fingerprint and domain are necessary to prove + that an exit relay agrees to being pinned. The website's domain -- + in this case example.com -- is part of the signature, so third + parties such as evil.com cannot coerce exit relays they don't own to + serve as their pinned exit relays. + + After having fetched an ERP policy, Tor Browser MUST first verify + that the two constants "start-policy" and "end-policy" are present, + and then validate the signature over all list elements. If any + element does not validate, Tor Browser MUST abort the ERP procedure. + + If an ERP policy contains more than one exit relay, Tor Browser MUST + select one at random, weighted by its bandwidth. That way, we can + balance load across all pinned exit relays. + + Tor Browser could enforce the mapping from domain to exit relay by + adding the following directive to its configuration file: + + MapAddress example.com example.com.Fpr_n.exit + +2.4 Defending against malicious websites + + The purpose of exit relay pinning is to protect a website's users + from malicious exit relays. We must further protect the same users + from the website, however, because it could abuse ERP to reduce a + user's anonymity set. The website could group users into + arbitrarily-sized buckets by serving them different ERP policies on + their first visit. For example, the first Tor user could be pinned + to exit relay A, the second user could be pinned to exit relay B, + etc. This would allow the website to link together the sessions of + anonymous users. + + We cannot prevent websites from serving client-specific policies, but + we can detect it by having Tor Browser fetch a website's ERP policy + over multiple independent exit relays. If the policies are not + identical, Tor Browser MUST ignore the ERP policies. + + If Tor Browser would attempt to fetch the ERP policy over n circuits + as quickly as possible, the website would receive n connections + within a narrow time interval, suggesting that all these connections + originated from the same client. To impede such time-based + correlation attacks, Tor Browser MUST wait for a randomly determined + time span before fetching the ERP policy. Tor Browser SHOULD + randomly sample a delay from an exponential distribution. The + disadvantage of this defence is that it can take a while until Tor + Browser knows that it can trust an ERP policy. + +2.5 Design trade-offs + + We now briefly discuss alternative design decisions, and why we + defined ERP the way we did. + + Instead of having a web server *tell* Tor Browser about pinned exit + relays, we could have Tor Browser *ask* the web server, e.g., by + making it fetch a predefined URL, similar to robots.txt. We believe + that this would involve too much overhead because only a tiny + fraction of sites that Tor users visit will have an ERP policy. + + ERP implies that adversaries get to learn all the exit relays from + which all users of a pinned site come from. These exit relays could + then become a target for traffic analysis or compromise. Therefore, + websites that pin exit relays SHOULD have a proper HTTPS setup and + host their exit relays topologically close to the content servers, to + mitigate the threat of network-level adversaries. + + It's possible to work around the bootstrapping problem (i.e., the + very first website visit cannot use pinned exits) by having an + infrastructure that allows us to pin exits out-of-band, e.g., by + hard-coding them in Tor Browser, or by providing a lookup service + prior to connecting to a site, but the additional complexity does not + seem to justify the added security or reduced overhead. + +2.6 Open questions + + o How should we deal with selective DoS or otherwise unavailable exit + relays? That is, what if an adversary takes offline pinned exit + relays? Should Tor Browser give up, or fall back to non-pinned + exit relays that are potentially malicious? Should we give site + operators an option to express a fallback if they care more about + availability than security? + + o Are there any aspects that are unnecessarily tricky to implement in + Tor Browser? If so, let's figure out how to make it easier to + build. + + o Is a domain-level pinning granularity sufficient? + + o Should we use the Ed25519 master or signing key? + + o Can cached ERP policies survive a Tor Browser restart? After all, + we are not supposed to write to disk, and ERP policies are + basically like a browsing history. + + o Should we have some notion of "freshness" in an ERP policy? The + problem is that an adversary could save my ERP policy for + example.com, and if I ever give up example.com, the adversary could + register it, and use my relays for pinning. This could easily be + mitigated by rotating my relay identity keys, and might not be that + big a problem. + + o Should we support non-HTTP services? For example, do we want to + support, say, SSH? And if so, how would we go about it? + + o HPKP also defines a "report-uri" directive to which errors should + be reported. Do we want something similar, so site operators can + detect issues such as attempted DoS attacks? + + o It is wasteful to send a 60-70 byte header to all browsers while + only a tiny fraction of them will want it. Web servers could send + the header only to IP addresses that run an exit relay, but that + adds quite a bit of extra complexity. + + o We currently defend against malicious websites by fetching the ERP + policy over several exit relays, spread over time. In doing so, we + are making assumptions on the number of visits the website sees. + Is there a better solution that isn't significantly more complex?

1 0

[collector/master] Bump version to 1.1.0-dev, yet once more.
by karsten＠torproject.org 07 Oct '16

07 Oct '16

commit 4f15d8896ceaa7e24f69f24d5a470aa97d4d555b Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Fri Oct 7 14:26:33 2016 +0200 Bump version to 1.1.0-dev, yet once more. --- build.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build.xml b/build.xml index ac6d8e0..7266e2d 100644 --- a/build.xml +++ b/build.xml @@ -1,5 +1,5 @@ <project default="compile" name="CollecTor" basedir="."> - <property name="release.version" value="1.0.2" /> + <property name="release.version" value="1.1.0-dev" /> <property name="name" value="CollecTor"/> <property name="descriptorversion" value="1.4.0" /> <property name="source-and-target-java-version" value="1.7" />

1 0

[collector/master] Prepare for 1.0.2 release.
by karsten＠torproject.org 07 Oct '16

07 Oct '16

commit c43d0ad995e78f6e94b013cedc72ed0fbe922f4b Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Fri Oct 7 10:42:00 2016 +0200 Prepare for 1.0.2 release. --- .gitignore | 5 +++-- CHANGELOG.md | 2 +- build.xml | 4 ++-- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index e4e7512..a3acc9a 100644 --- a/.gitignore +++ b/.gitignore @@ -1,12 +1,12 @@ /.classpath /.project /classes/ -/config +/collector.properties /data/ /in/ /out/ /log/ -/rsync/ +/recent/ /stats/ /tarballs/ /generated @@ -14,4 +14,5 @@ cobertura.ser *~ build.properties +/index.json* diff --git a/CHANGELOG.md b/CHANGELOG.md index a75a1fd..33e77f6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,4 +1,4 @@ -# Changes in version 1.1.0 - 2016-09-xx +# Changes in version 1.0.2 - 2016-10-07 * Medium changes - Add support for Bifroest's bridge descriptor tarballs. diff --git a/build.xml b/build.xml index 83f2907..ac6d8e0 100644 --- a/build.xml +++ b/build.xml @@ -1,7 +1,7 @@ <project default="compile" name="CollecTor" basedir="."> - <property name="release.version" value="1.1.0-dev" /> + <property name="release.version" value="1.0.2" /> <property name="name" value="CollecTor"/> - <property name="descriptorversion" value="1.3.1" /> + <property name="descriptorversion" value="1.4.0" /> <property name="source-and-target-java-version" value="1.7" /> <property name="sources" value="src/main/java"/> <property name="resources" value="src/main/resources/"/>

1 0

[collector/master] More text for the redirect page.
by karsten＠torproject.org 07 Oct '16

07 Oct '16

commit e2f0bef10bcc4902c3dd58563717ffc3a574d8d7 Author: iwakeh <iwakeh(a)torproject.org> Date: Thu Oct 6 17:38:11 2016 +0200 More text for the redirect page. Including some tweaks by Karsten. --- src/main/webapp/formats.html | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/main/webapp/formats.html b/src/main/webapp/formats.html index f2f42d4..c000202 100644 --- a/src/main/webapp/formats.html +++ b/src/main/webapp/formats.html @@ -13,8 +13,13 @@ <div class="row"> <div class="col-xs-12"> <div class="page-header"> - <p>Sorry, but the content on this page has moved to the -<a href="/"><img src="/images/collector-wordmark-small.png" width="132" height="25" alt="CollecTor"> start page.</a></p> + <h2>The page you requested doesn't exist anymore</h2> + <p>Sorry, but the content on this page was moved to the + <a href="/"><img src="/images/collector-wordmark-small.png" width="132" height="25" alt="CollecTor"> start page.</a></p> + <p>Please update your bookmarks to point to + <a href="/">https://collector.torproject.org/</a>. + </p> + <p>This page will be removed after October 31, 2016.</p> </div> </div> </div>

1 0