March 2021 - tor-commits - lists.torproject.org

[community/staging] Add talk about onions. Fix #143
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit d1962b0732d00720cd30215c001580c48b3780bb Author: gus <gus(a)torproject.org> Date: Fri Dec 18 16:50:16 2020 -0500 Add talk about onions. Fix #143 --- content/onion-services/talk/contents.lr | 142 ++++++++++++++++++++++++++++++++ 1 file changed, 142 insertions(+) diff --git a/content/onion-services/talk/contents.lr b/content/onion-services/talk/contents.lr new file mode 100644 index 0000000..d22860d --- /dev/null +++ b/content/onion-services/talk/contents.lr @@ -0,0 +1,142 @@ +section: onion services +--- +section_id: onion-services +--- +color: primary +--- +_template: layout.html +--- +title: Talk about onions +--- +subtitle: Become an onion advocate and explain the importance of onion services. +--- +key: 0 +--- +html: two-columns-page.html +--- +body: + +Beyond myths and misperceptions, advocating for onion services and privacy enhancing technologies sometimes is challenging. +There are different use cases, and approaching potential adopters with a specific use case instead of another, can engage them and lead to new onions services being setup. + +These talking points will help to explain how onion services offer multiple privacy and security benefits in different contexts. + + * How Onion Services Work + * Freedom of Press and Censorship Circumvention + * Network sustainability + * Level up your service privacy + * Protect sources, whistleblowers, and journalists + * Decentralization + * Educate users about privacy by design + * Metadata obfuscation or elimination + +### How Onion Services Work + +A potential adopter has probably already heard about the Tor Project, the network and even Tor relays, and that's great! +[Tor relays](https://community.torproject.org/relay/types-of-relays/) are part of a [public infrastructure](https://metrics.torproject.org/rs.html#toprelays), where Tor users encrypted traffic is routed around to reach out the open internet. +Onion services aren't like a Tor relay in the network. + +An onion service on the Tor network behaves like any other Tor clients. +The Onion Service to become available on the network connects to rendezvous nodes. +A client that wants to access the onion service does the same. + +This means that connections from the client to the server never leave the Tor network. +In contrast to running a [Tor relay](https://community.torproject.org/relay), running a Tor Onion Service does not result in your IP address being publicly listed anywhere, nor does your service relay other Tor traffic. + +For a broader understanding, read [Onion Services overview](https://community.torproject.org/onion-services/overview/) and watch this talk: [DEF CON 25 - Next Generation Tor Onion Services](https://www.youtube.com/watch?v=Di7qAVidy1Y). + +### Freedom of Press and Censorship Circumvention + +Regular Tor connections already provide censorship circumvention, but only onion services can anonymize both parts of communication - users and provider -, creating a metadata free communication between the user of the service and the service itself. + +Censorship technologies are being deployed by different actors, like governments and Internet providers, worldwide to block access to free press and privacy tools. + +To protect freedom of speech and freedom of opinion in censored spaces, major media organizations have made their websites available over onion services in the last few years. + +That's the case of NY Times, ProPublica, Deutsche Welle, BBC, The Markup and other newsrooms. + +The project [Secure The News](https://securethe.news/), developed by [Freedom of the Press Foundation](https://freedom.press/news/onions-side-tracking-tor-availability-reader-privacy-major-news-sites/), tracks how secure news organizations’s websites are. One of its metrics is the adoption of onion services . + +Read the news organizations announcement about their onion site: + + * "We launched this in part because we do a lot of reporting, writing, and coding about issues like media censorship, digital privacy and surveillance, and breaches of private medical information. Readers use our interactive databases to see data that reveals a lot about themselves, such as whether their doctor receives payments from drug companies. Our readers should never need to worry that somebody else is watching what they’re doing on our site. So we made our site available as a Tor hidden service (onion service) to give readers a way to browse our site while leaving behind less of a digital trail." [ProPublica](https://www.propublica.org/nerds/a-more-secure-and-anonymous-pr… + + * "Some readers choose to use Tor to access our journalism because they're technically blocked from accessing our website; or because they worry about local network monitoring; or because they care about online privacy; or simply because that is the method that they prefer." [New York Times](https://open.nytimes.com/https-open-nytimes-com-the-new-york-times-a… + + * "DW is a global advocate for freedom of opinion and freedom of speech. […] It is therefore a logical step for us to also use Tor to reach people in censored markets who previously had limited or no access to free media." [Deutsche Welle](https://www.dw.com/en/dw-websites-accessible-via-tor-protocol/a-5133… + + * "The browser can obscure who is using it and what data is being accessed, which can help people avoid government surveillance and censorship. Countries including China, Iran and Vietnam are among those who have tried to block access to the BBC News website or programmes." [BBC](https://www.bbc.com/news/technology-50150981) + +### Network sustainability + +The traffic generated by onion services doesn't leave the Tor network, and therefore, these onion circuits free up exit relay bandwidth for others. +This is important because exit relays are a limited resource, making up 20% of the [7000 relays](https://metrics.torproject.org/networksize.html). +As they're a small fraction of the network, in general, exit relays are overloaded and represent a bottleneck for Tor users' browsing experience. + +Onion services don't use the same circuit path as regular Tor connections. +When a service is available over onion services, it adds diversity to the Tor network since it uses a different set of circuits on the network, avoiding exit relays completely. +As a result of this design, onion services and its users are immune to attacks related to [bad exit relays](https://blog.torproject.org/bad-exit-relays-may-june-2020). + +### Level up your service privacy + +Beyond websites and onion sites, it's possible to do many things with onion services, for example, email. +Even though privacy aware users can adopt tools to protect their communications like OpenPGP, there is plenty of metadata on encrypted emails: for example who is communicating with whom, when, how frequently, where, when it was sent and received, what type of computer it was generated, etc. + +As Edward Snowden points out in his book, **"Permanent Record"** (2019), + + "You know what you're saying during a phone call, or what you're writing in an email. But you have hardly any control over the metadata you produce, because it is generated automatically. [...] In sum, metadata can tell your surveillant virtually everything they'd ever want or need to know about you, except what's actually going on inside your head." + +[Onionmx](https://github.com/ehloonion/onionmx) is a software that allows the delivery of emails entirely over onion services, obfuscating the metadata of who is talking with whom. +E-mail providers like [Riseup](https://riseup.net/en/security/network-security/tor#riseups-tor-oni…, [Systemli](https://www.systemli.org/service/onion.html) and [many others](https://github.com/ehloonion/onionmx/blob/master/sources/map.yml) protect their users privacy using onionmx. + +Other providers like [ProtonMail](https://protonmail.com/blog/protonmail-tor-censorship/) allow users to read and send their e-mail securely and anonymously over their webclient that serves an onion site. + +### Protect sources, whistleblowers, and journalists + +Many journalists and media organizations use tools based on onion services to protect their sources. +They share and accept documents from anonymous sources using tools like SecureDrop, GlobaLeaks or OnionShare. + +Originally developed by Aaron Swartz, [SecureDrop](https://securedrop.org/) is an open source whistleblower submission system maintained by [Freedom of the Press Foundation](https://freedom.press) and deployed by many news organizations around the world. +With SecureDrop, sources can only submit documents in a secure and anonymous way, using Tor Browser. +Thus, a journalist won't know who the author is and can't put the source at risk. + +[GlobaLeaks](https://globaleaks.org) is an open source whistleblowing framework focused on portability and accessibility. +It is a web application running as an onion service that whistleblowers and journalists can anonymously exchange information and files. +Started in 2011 by a group of Italians, the project is now developed by the [Hermes Center for Transparency and Digital Human Rights](https://www.hermescenter.org/). + +[OnionShare](https://onionshare.org) is another tool based on onion services used to provide strong anonymity to transmit sensitive files between journalists safely. +It makes it possible to host files on your own computer and share (send and receive) using onion services. +All the recipients of this communication need to have Tor Browser installed on their computer to open the onion address. +OnionShare was developed after a human rights violation during the Snowden revelations in 2013, + + "I first saw the need for this tool when I learned about how David Miranda, the partner of my colleague Glenn Greenwald, got detained for nine hours at a London airport while he was trying to fly home to Brazil. + Working on a journalism assignment for the Guardian, Miranda was carrying a USB stick with sensitive documents. + I knew that he could have securely sent the documents over the internet using a Tor onion service, one of the most underappreciated technologies on the internet, and avoided the risk of physically traveling with them. + I developed OnionShare to make this file sharing process over the Tor network more accessible to everyone." [OnionShare 2 release](https://blog.torproject.org/new-release-onionshare-2) + +### Decentralization + +As explained in [Overview](https://community.torproject.org/onion-services/overview/), there's no central authority that approves or rejects onion services. +The address of an onion service is automatically generated. +Operators don't use the regular DNS infrastructure and do not need to purchase or register a domain name. + +A great example of this use case is the chat program [Ricochet Refresh](https://ricochetrefresh.net/). +Ricochet uses onion services to build secure communication with these features: metadata resistant, anonymous, and decentralized. +In Ricochet Refresh, each user is an onion service. +And because of that, there isn't a central server that can be compromised by an attacker. + +### Educate users about privacy by design + +Onion services are an excellent example of privacy by design technology, where one is secure and anonymous by default. +Making your service available over onion services is an opportunity to educate the general public about Tor and how a more secure way to access the internet looks like: easy as browsing a web page. +Get inspired by our campaign [#MoreOnionsPorFavor](https://blog.torproject.org/more-onions-porfavor) and teach others about the importance of anonymity. + +### Metadata obfuscation or elimination + +When you use the Tor network to browse the web you are not sending any information by default of who you are or where you are connecting from. +The Onion Services use the Tor network to eliminate information about where they are situated. +Using them eliminates all metadata that may be associated with the service otherwise. + +### One onion a day keeps the surveillance away + +Now that you know all the benefits of onion services, you may want to set up an [onion site](https://community.torproject.org/onion-services/setup/) and read about the [protocol overview](https://community.torproject.org/onion-services/overview/).

1 0

[community/staging] Add more featured onion sites. Fix #176
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 9bdf61fe93387bb5304e13527dcaef9f8e3ed390 Author: gus <gus(a)torproject.org> Date: Fri Dec 18 14:07:46 2020 -0500 Add more featured onion sites. Fix #176 --- assets/static/images/onions/png/bbc.png | Bin 0 -> 11312 bytes assets/static/images/onions/png/brave.png | Bin 0 -> 13285 bytes assets/static/images/onions/png/debian.png | Bin 0 -> 18153 bytes assets/static/images/onions/png/dw.png | Bin 0 -> 56986 bytes assets/static/images/onions/png/facebook.png | Bin 0 -> 96975 bytes assets/static/images/onions/png/fop.png | Bin 0 -> 4856 bytes .../images/onions/png/frontlinedefenders.png | Bin 0 -> 360818 bytes .../images/onions/png/privacyinternational.png | Bin 0 -> 532301 bytes assets/static/images/onions/png/qubesos.png | Bin 0 -> 30163 bytes assets/static/images/onions/png/riseup.png | Bin 0 -> 5141 bytes assets/static/images/onions/svg/fop.svg | 149 +++++++++++++++++++++ databags/onions.ini | 54 +++++++- 12 files changed, 201 insertions(+), 2 deletions(-) diff --git a/assets/static/images/onions/png/bbc.png b/assets/static/images/onions/png/bbc.png new file mode 100644 index 0000000..79b62a8 Binary files /dev/null and b/assets/static/images/onions/png/bbc.png differ diff --git a/assets/static/images/onions/png/brave.png b/assets/static/images/onions/png/brave.png new file mode 100644 index 0000000..448fe7b Binary files /dev/null and b/assets/static/images/onions/png/brave.png differ diff --git a/assets/static/images/onions/png/debian.png b/assets/static/images/onions/png/debian.png new file mode 100644 index 0000000..8696c4c Binary files /dev/null and b/assets/static/images/onions/png/debian.png differ diff --git a/assets/static/images/onions/png/dw.png b/assets/static/images/onions/png/dw.png new file mode 100644 index 0000000..777eade Binary files /dev/null and b/assets/static/images/onions/png/dw.png differ diff --git a/assets/static/images/onions/png/facebook.png b/assets/static/images/onions/png/facebook.png new file mode 100644 index 0000000..5dbdc75 Binary files /dev/null and b/assets/static/images/onions/png/facebook.png differ diff --git a/assets/static/images/onions/png/fop.png b/assets/static/images/onions/png/fop.png new file mode 100644 index 0000000..babf4f0 Binary files /dev/null and b/assets/static/images/onions/png/fop.png differ diff --git a/assets/static/images/onions/png/frontlinedefenders.png b/assets/static/images/onions/png/frontlinedefenders.png new file mode 100644 index 0000000..5523489 Binary files /dev/null and b/assets/static/images/onions/png/frontlinedefenders.png differ diff --git a/assets/static/images/onions/png/privacyinternational.png b/assets/static/images/onions/png/privacyinternational.png new file mode 100644 index 0000000..7d96a26 Binary files /dev/null and b/assets/static/images/onions/png/privacyinternational.png differ diff --git a/assets/static/images/onions/png/qubesos.png b/assets/static/images/onions/png/qubesos.png new file mode 100644 index 0000000..046c13a Binary files /dev/null and b/assets/static/images/onions/png/qubesos.png differ diff --git a/assets/static/images/onions/png/riseup.png b/assets/static/images/onions/png/riseup.png new file mode 100644 index 0000000..6f3ae3d Binary files /dev/null and b/assets/static/images/onions/png/riseup.png differ diff --git a/assets/static/images/onions/svg/fop.svg b/assets/static/images/onions/svg/fop.svg new file mode 100644 index 0000000..edd3b2d --- /dev/null +++ b/assets/static/images/onions/svg/fop.svg @@ -0,0 +1,149 @@ +<?xml version="1.0" encoding="UTF-8" standalone="no"?> +<svg + xmlns:dc="http://purl.org/dc/elements/1.1/" + xmlns:cc="http://creativecommons.org/ns#" + xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" + xmlns:svg="http://www.w3.org/2000/svg" + xmlns="http://www.w3.org/2000/svg" + xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd" + xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape" + version="1.1" + x="0px" + y="0px" + viewBox="0 0 563.7 85" + xml:space="preserve" + id="svg4547" + sodipodi:docname="Freedom of the Press Foundation logo.svg" + inkscape:version="0.92.1 r15371"><metadata + id="metadata4553"><rdf:RDF><cc:Work + rdf:about=""><dc:format>image/svg+xml</dc:format><dc:type + rdf:resource="http://purl.org/dc/dcmitype/StillImage" /><dc:title></dc:title></cc:Work></rdf:RDF></metadata><defs + id="defs4551" /><sodipodi:namedview + pagecolor="#ffffff" + bordercolor="#666666" + borderopacity="1" + objecttolerance="10" + gridtolerance="10" + guidetolerance="10" + inkscape:pageopacity="0" + inkscape:pageshadow="2" + inkscape:window-width="1920" + inkscape:window-height="1017" + id="namedview4549" + showgrid="false" + inkscape:showpageshadow="false" + borderlayer="true" + inkscape:zoom="2.5545502" + inkscape:cx="281.85001" + inkscape:cy="42.5" + inkscape:window-x="-8" + inkscape:window-y="-8" + inkscape:window-maximized="1" + inkscape:current-layer="svg4547" /><rect + class="logo-rect" + width="84" + height="23" + id="rect4485" /><rect + class="logo-rect logo-rect--red" + x="92" + width="23" + height="23" + id="rect4487" + style="fill:#c70000;fill-opacity:1" /><rect + class="logo-rect" + x="46" + y="31" + width="69" + height="23" + id="rect4489" /><rect + class="logo-rect" + y="62" + width="115" + height="23" + id="rect4491" /><path + class="logo-heading-text" + d="M156.7,5h-16.8v10.5h14.3v4.7h-14.3v14.6h-5.2V0.3h22V5z" + id="path4493" /><path + class="logo-heading-text" + d="M175.4,0.3c6.5,0,10.7,4.2,10.7,10.1c0,4.9-3,8.1-6.9,9.1l7.9,15.2H181l-7.3-14.5h-6.5v14.5H162V0.3H175.4z M167.2,5v10.8 h7.7c3.5,0,5.9-2,5.9-5.4S178.5,5,175,5H167.2z" + id="path4495" /><path + class="logo-heading-text" + d="M214.8,5H198V15h14.3v4.7H198V30h16.8v4.7h-22V0.3h22V5z" + id="path4497" /><path + class="logo-heading-text" + d="M243,5h-16.8V15h14.3v4.7h-14.3V30H243v4.7h-22V0.3h22V5z" + id="path4499" /><path + class="logo-heading-text" + d="M261.3,0.3c4.3,0,7.4,1.4,9.8,4.4c2.5,3.1,2.6,7.4,2.6,12.9s-0.1,9.8-2.6,12.9c-2.4,3-5.5,4.4-9.8,4.4h-12.1V0.3H261.3z M254.4,5V30h6.3c2.5,0,4.5-0.6,5.9-2.3c1.7-1.9,1.8-5.1,1.8-10.2c0-5.1-0.1-8.3-1.8-10.2c-1.4-1.7-3.4-2.3-5.9-2.3H254.4z" + id="path4501" /><path + class="logo-heading-text" + d="M300.5,3.5c3.4,3.4,3.5,6.8,3.5,14s-0.1,10.6-3.5,14c-2.2,2.2-5.1,3.5-8.9,3.5c-3.8,0-6.7-1.3-8.9-3.5 c-3.4-3.4-3.5-6.8-3.5-14s0.1-10.6,3.5-14c2.2-2.2,5.1-3.5,8.9-3.5C295.4,0,298.3,1.3,300.5,3.5z M286.5,6.8c-1.7,1.8-2,3.9-2,10.7 c0,6.8,0.3,8.9,2,10.7c1.3,1.4,3,2.1,5.1,2.1s3.8-0.8,5.1-2.1c1.7-1.8,2-3.9,2-10.7c0-6.8-0.3-9-2-10.7c-1.3-1.4-3-2.1-5.1-2.1 S287.8,5.4,286.5,6.8z" + id="path4503" /><path + class="logo-heading-text" + d="M341.2,34.7h-5.2v-23L328,28.5h-3.9L316,11.7v23h-5.2V0.3h5.2l10.1,21.4l9.9-21.4h5.2V34.7z" + id="path4505" /><path + class="logo-heading-text logo-heading-text--gray" + d="M379.9,3.5c3.4,3.4,3.5,6.8,3.5,14s-0.1,10.6-3.5,14c-2.2,2.2-5.1,3.5-8.9,3.5s-6.7-1.3-8.9-3.5 c-3.4-3.4-3.5-6.8-3.5-14s0.1-10.6,3.5-14c2.2-2.2,5.1-3.5,8.9-3.5S377.7,1.3,379.9,3.5z M365.9,6.8c-1.7,1.8-2,3.9-2,10.7 c0,6.8,0.3,8.9,2,10.7c1.3,1.4,3,2.1,5.1,2.1s3.8-0.8,5.1-2.1c1.7-1.8,2-3.9,2-10.7c0-6.8-0.3-9-2-10.7c-1.3-1.4-3-2.1-5.1-2.1 S367.2,5.4,365.9,6.8z" + id="path4507" + style="fill:#7c7c7c;fill-opacity:1" /><path + class="logo-heading-text logo-heading-text--gray" + d="M412.2,5h-16.8v10.5h14.3v4.7h-14.3v14.6h-5.2V0.3h22V5z" + id="path4509" + style="fill:#7c7c7c;fill-opacity:1" /><path + class="logo-heading-text logo-heading-text--gray" + d="M449.3,5h-9.5v29.8h-5.2V5h-9.5V0.3h24.2V5z" + id="path4511" + style="fill:#7c7c7c;fill-opacity:1" /><path + class="logo-heading-text logo-heading-text--gray" + d="M478.8,34.7h-5.2v-15h-14v15h-5.2V0.3h5.2V15h14V0.3h5.2V34.7z" + id="path4513" + style="fill:#7c7c7c;fill-opacity:1" /><path + class="logo-heading-text logo-heading-text--gray" + d="M508.8,5h-16.8V15h14.3v4.7h-14.3V30h16.8v4.7h-22V0.3h22V5z" + id="path4515" + style="fill:#7c7c7c;fill-opacity:1" /><path + class="logo-heading-text" + d="M147.7,50.1c6.7,0,11,4.5,11,10.5s-4.3,10.4-11,10.4h-7.8v13.6h-5.2V50.1H147.7z M139.9,54.8v11.5h7.5 c3.7,0,6.1-2.1,6.1-5.7c0-3.7-2.4-5.8-6.1-5.8H139.9z" + id="path4517" /><path + class="logo-heading-text" + d="M177.5,50.1c6.5,0,10.7,4.2,10.7,10.1c0,4.9-3,8.1-6.9,9.1l7.9,15.2h-6.1L175.9,70h-6.5v14.5h-5.2V50.1H177.5z M169.4,54.8 v10.8h7.7c3.5,0,5.9-2,5.9-5.4s-2.4-5.4-5.9-5.4H169.4z" + id="path4519" /><path + class="logo-heading-text" + d="M216.9,54.8h-16.8v10.1h14.3v4.7h-14.3v10.3h16.8v4.7h-22V50.1h22V54.8z" + id="path4521" /><path + class="logo-heading-text" + d="M243.4,53.7l-3.3,3.3c-2.1-2-4.6-2.7-7.6-2.7c-4.1,0-6.2,2.2-6.2,5.4c0,1.3,0.3,2.4,1.3,3.2c0.9,0.8,1.9,1.3,3.8,1.5 l4.1,0.6c3.1,0.5,4.9,1.2,6.4,2.6c1.8,1.7,2.8,4.1,2.8,7.1c0,6.3-5.1,10.1-12.4,10.1c-5.2,0-8.9-1.2-12.2-4.5l3.4-3.4 c2.5,2.5,5.4,3.3,8.9,3.3c4.5,0,7.1-1.9,7.1-5.3c0-1.5-0.4-2.8-1.4-3.6c-0.9-0.8-2-1.2-3.8-1.5l-4.1-0.6c-2.8-0.4-5-1.3-6.5-2.8 c-1.7-1.5-2.6-3.8-2.6-6.6c0-6,4.4-10.1,11.5-10.1C237.3,49.8,240.5,51,243.4,53.7z" + id="path4523" /><path + class="logo-heading-text" + d="M270.8,53.7l-3.3,3.3c-2.1-2-4.6-2.7-7.6-2.7c-4.1,0-6.2,2.2-6.2,5.4c0,1.3,0.3,2.4,1.3,3.2c0.9,0.8,1.9,1.3,3.8,1.5 l4.1,0.6c3.1,0.5,4.9,1.2,6.4,2.6c1.8,1.7,2.8,4.1,2.8,7.1c0,6.3-5.1,10.1-12.4,10.1c-5.2,0-8.9-1.2-12.2-4.5l3.4-3.4 c2.5,2.5,5.4,3.3,8.9,3.3c4.5,0,7.1-1.9,7.1-5.3c0-1.5-0.4-2.8-1.4-3.6c-0.9-0.8-2-1.2-3.8-1.5l-4.1-0.6c-2.8-0.4-5-1.3-6.5-2.8 c-1.7-1.5-2.6-3.8-2.6-6.6c0-6,4.4-10.1,11.5-10.1C264.7,49.8,267.8,51,270.8,53.7z" + id="path4525" /><path + class="logo-heading-text" + d="M310.7,54.8h-16.8v10.5h14.3V70h-14.3v14.6h-5.2V50.1h22V54.8z" + id="path4527" /><path + class="logo-heading-text" + d="M335.1,53.3c3.4,3.4,3.5,6.8,3.5,14s-0.1,10.6-3.5,14c-2.2,2.2-5.1,3.5-8.9,3.5c-3.8,0-6.7-1.3-8.9-3.5 c-3.4-3.4-3.5-6.8-3.5-14s0.1-10.6,3.5-14c2.2-2.2,5.1-3.5,8.9-3.5C330,49.8,332.9,51.1,335.1,53.3z M321.1,56.6 c-1.7,1.8-2,3.9-2,10.7c0,6.8,0.3,8.9,2,10.7c1.3,1.4,3,2.1,5.1,2.1c2.1,0,3.8-0.8,5.1-2.1c1.7-1.8,2-3.9,2-10.7c0-6.8-0.3-9-2-10.7 c-1.3-1.4-3-2.1-5.1-2.1C324.1,54.5,322.4,55.2,321.1,56.6z" + id="path4529" /><path + class="logo-heading-text" + d="M369.6,72.9c0,7.1-5.4,11.9-12.4,11.9c-7,0-12.3-4.8-12.3-11.9V50.1h5.2v22.6c0,4.6,2.8,7.5,7.1,7.5s7.2-2.9,7.2-7.5V50.1 h5.2V72.9z" + id="path4531" /><path + class="logo-heading-text" + d="M403.1,84.5h-4.8l-15.9-24.2v24.2h-5.2V50.1h4.8l15.9,24.2V50.1h5.2V84.5z" + id="path4533" /><path + class="logo-heading-text" + d="M423.2,50.1c4.3,0,7.4,1.4,9.8,4.4c2.5,3.1,2.6,7.4,2.6,12.9s-0.1,9.8-2.6,12.9c-2.4,3-5.5,4.4-9.8,4.4h-12.1V50.1H423.2z M416.3,54.8v25.1h6.3c2.5,0,4.5-0.6,5.9-2.3c1.7-1.9,1.8-5.1,1.8-10.2c0-5.1-0.1-8.3-1.8-10.2c-1.4-1.7-3.4-2.3-5.9-2.3H416.3z" + id="path4535" /><path + class="logo-heading-text" + d="M467.3,84.5h-5.6l-2.4-6.9h-13.6l-2.4,6.9h-5.6l12.6-34.5h4.2L467.3,84.5z M447.2,73.2h10.6l-5.3-15.3L447.2,73.2z" + id="path4537" /><path + class="logo-heading-text" + d="M489.2,54.8h-9.5v29.8h-5.2V54.8H465v-4.7h24.2V54.8z" + id="path4539" /><path + class="logo-heading-text" + d="M499.4,84.5h-5.2V50.1h5.2V84.5z" + id="path4541" /><path + class="logo-heading-text" + d="M527.5,53.3c3.4,3.4,3.5,6.8,3.5,14s-0.1,10.6-3.5,14c-2.2,2.2-5.1,3.5-8.9,3.5c-3.8,0-6.7-1.3-8.9-3.5 c-3.4-3.4-3.5-6.8-3.5-14s0.1-10.6,3.5-14c2.2-2.2,5.1-3.5,8.9-3.5C522.4,49.8,525.3,51.1,527.5,53.3z M513.4,56.6 c-1.7,1.8-2,3.9-2,10.7c0,6.8,0.3,8.9,2,10.7c1.3,1.4,3,2.1,5.1,2.1c2.1,0,3.8-0.8,5.1-2.1c1.7-1.8,2-3.9,2-10.7c0-6.8-0.3-9-2-10.7 c-1.3-1.4-3-2.1-5.1-2.1C516.5,54.5,514.8,55.2,513.4,56.6z" + id="path4543" /><path + class="logo-heading-text" + d="M563.7,84.5h-4.8L543,60.3v24.2h-5.2V50.1h4.8l15.9,24.2V50.1h5.2V84.5z" + id="path4545" /></svg> \ No newline at end of file diff --git a/databags/onions.ini b/databags/onions.ini index 10645a4..99c440c 100644 --- a/databags/onions.ini +++ b/databags/onions.ini @@ -1,9 +1,59 @@ [propublica] -link = http://www.propub3r6espa33w.onion/ +link = https://p53lf57qovyuvwsc6xnrppyply3vtqm7l6pcobkmyqsiofyeznfu5uqd.onion image = /static/images/onions/png/propublica.png label = ProPublica [nytimes] -link = http://www.nytimes3xbfgragh.onion/ +link = https://www.nytimes3xbfgragh.onion image = /static/images/onions/png/nytimes.png label = The New York Times + +[dw] +link = https://www.dwnewsvdyyiamwnp.onion +image = /static/images/onions/png/dw.png +label = Deutsche Welle + +[bbc] +link = https://www.bbcnewsv2vjtpsuy.onion +image = /static/images/onions/png/bbc.png +label = BBC + +[facebook] +link = https://facebookcorewwwi.onion +image = /static/images/onions/png/facebook.png +label = Facebook + +[frontlinedefenders] +link = http://3g2wfrenve2xcxiotthk4fcsnymzwfbttqbiwveoaox7wxkdh7voouqd.onion +image = /static/images/onions/png/frontlinedefenders.png +label = Frontline Defenders + +[fop] +link = http://fpfjxcrmw437h6z2xl3w4czl55kvkmxpapg37bbopsafdu7q454byxid.onion +image = /static/images/onions/svg/fop.svg +label = Freedom of Press Foundation + +[privacyinternational] +link = https://privacyintyqcroe.onion/ +image = /static/images/onions/png/privacyinternational.png +label = Privacy International + +[debian] +link = http://sejnfjrq6szgca7v.onion/ +image = /static/images/onions/png/debian.png +label = Debian + +[qubesos] +link = http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion +image = /static/images/onions/png/qubesos.png +label = Qubes OS + +[riseup] +link = http://vww6ybal4bd7szmgncyruucpgfkqahzddi37ktceo3ah7ngmcopnpyyd.onion +image = /static/images/onions/png/riseup.png +label = Riseup + +[brave] +link = https://brave5t5rjjg3s6k.onion +image = /static/images/onions/png/brave.png +label = Brave

1 0

[community/staging] Fix #173
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 7ad8087892283e1d05b975c80550e4c9fd06cd61 Author: gus <gus(a)torproject.org> Date: Mon Dec 14 16:59:13 2020 -0500 Fix #173 --- content/relay-operations/technical-setup/post-install/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/relay-operations/technical-setup/post-install/contents.lr b/content/relay-operations/technical-setup/post-install/contents.lr index 36a3c22..dbd00c6 100644 --- a/content/relay-operations/technical-setup/post-install/contents.lr +++ b/content/relay-operations/technical-setup/post-install/contents.lr @@ -91,7 +91,7 @@ ORPort [IPv6-address]:9001 ``` The location of that line in the configuration file does not matter. -You can simply add it next to the first ORPort lins in your torrc file. +You can simply add it next to the first ORPort lines in your torrc file. Note: You have to explicitly specify your IPv6 address in square brackets, you can not tell tor to bind to any IPv6 (like you do for IPv4). If you have a global IPv6 address you should be able to find it in the output of the following command:

1 0

[community/staging] Add terraform-onions and heroku. Fix #151
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit c9bc488589746935764b2d6b0a457a62032e9514 Author: gus <gus(a)torproject.org> Date: Mon Dec 21 14:39:13 2020 -0500 Add terraform-onions and heroku. Fix #151 --- content/onion-services/setup/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/onion-services/setup/contents.lr b/content/onion-services/setup/contents.lr index b872eaf..a95fe51 100644 --- a/content/onion-services/setup/contents.lr +++ b/content/onion-services/setup/contents.lr @@ -163,5 +163,5 @@ That is not an easy task, and these resources will help on how to make this poss Finally, if you plan to keep your service available for a long time, you might want to make a backup copy of the `private_key` file somewhere. -Now that you have an onion site working, you may want to deploy [Onion-Location](https://community.torproject.org/onion-services/advanced/on…, or use tools like Docker, [Ansible](https://galaxy.ansible.com/systemli/onion) or [stem](https://stem.torproject.org/tutorials/over_the_river.html) to automate the management of your onion services. +Now that you have an onion site working, you may want to deploy [Onion-Location](https://community.torproject.org/onion-services/advanced/on…, or use tools like Docker, [Heroku](https://gitlab.torproject.org/hiro/onions-on-heroku), [Terraform](https://gitlab.torproject.org/hiro/terraform-onions), [Ansible](https://galaxy.ansible.com/systemli/onion) or [stem](https://stem.torproject.org/tutorials/over_the_river.html) to automate the management of your onion services. If you have a static website, but never installed Nginx or Apache, another project to try is [OnionShare](https://onionshare.org), where running an onion site will be easier: guided with a graphic interface and with minimal configuration.

1 0

[community/staging] Update onion services topics order
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit f99b2e8c26735ea82acf9db0390f56286390718a Author: gus <gus(a)torproject.org> Date: Mon Dec 21 15:24:58 2020 -0500 Update onion services topics order --- content/onion-services/setup/contents.lr | 2 +- content/onion-services/talk/contents.lr | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/content/onion-services/setup/contents.lr b/content/onion-services/setup/contents.lr index a95fe51..e00cfd8 100644 --- a/content/onion-services/setup/contents.lr +++ b/content/onion-services/setup/contents.lr @@ -12,7 +12,7 @@ title: Set up Your Onion Service --- subtitle: Learn how to set up a .onion site of your very own. --- -key: 1 +key: 2 --- cta: Get Started --- diff --git a/content/onion-services/talk/contents.lr b/content/onion-services/talk/contents.lr index d22860d..6196620 100644 --- a/content/onion-services/talk/contents.lr +++ b/content/onion-services/talk/contents.lr @@ -10,7 +10,7 @@ title: Talk about onions --- subtitle: Become an onion advocate and explain the importance of onion services. --- -key: 0 +key: 1 --- html: two-columns-page.html ---

1 0

[community/staging] Add guideline document.
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 2d35ea1dc8e6db282e0e5232320fdd57547ac92e Author: gus <gus(a)torproject.org> Date: Mon Dec 21 09:55:39 2020 -0500 Add guideline document. --- content/onion-services/advanced/dos/contents.lr | 65 +++++++++++++++++++++++++ 1 file changed, 65 insertions(+) diff --git a/content/onion-services/advanced/dos/contents.lr b/content/onion-services/advanced/dos/contents.lr new file mode 100644 index 0000000..297e88b --- /dev/null +++ b/content/onion-services/advanced/dos/contents.lr @@ -0,0 +1,65 @@ +section: advanced configuration +--- +section_id: onion-services +--- +color: primary +--- +_template: layout.html +--- +title: Onion service DoS guidelines +--- +subtitle: Tips to help you keep afloat in turbulent times. +--- +key: 5 +--- +html: two-columns-page.html +--- +body: + +In this page we present a few ways to mitigate DoS attacks currently. +However there is no single one-size-fits-all solution for this problem at the moment. +Defending a site under attack requires creativity and a custom-tailored approach. +Here are a few tips: + +### Onionbalance + +[Onionbalance](https://onionbalance-v3.readthedocs.io/en/latest/v3/tutorial-v3.html) allows onion service operators to achieve the property of high availability by allowing multiple machines to handle requests for an onion service. +You can use Onionbalance to scale horizontally. +The more you scale, the harder it is for attackers to overwhelm you. +Onionbalance is available for [v3 onion services](https://blog.torproject.org/cooking-onions-reclaiming-onionbalanc…. + +### Client authorization or multiple onion addresses to compartmentalize your users + +If you have users you trust, give them dedicated onion service and client authorization credentials so that it can always be available. +For users you don't trust, split them into multiple addresses. +That said, having too many onion addresses is actually bad for your security (because of the use of many guard nodes), so try to use [client authorization](https://community.torproject.org/onion-services/advanced/cli… when possible. + +### Captchas and cookies + +If you need to further rate-limit users, split your infrastructure into layers and put Captchas near the frontend. +This way attackers will have to solve Captchas before they are able to attack deeper into your infrastructure. + +Captchas are a way to mitigate DDoS attacks. +When a request comes from a client checks if the client contains the correct secure cookie otherwise redirects to the recaptcha page. +The client inputs the captcha letters. +Nginx sends this input letters to recaptcha server for verification. + +The correct answer from recaptcha server with beginning of "true...", else it's beginning with "false...". +Add the secure cookie for the correct verified client, redirect the client to the page which he wants to view. + +It is possible to implement Captchas directly at your webserver with Nginx and OpenResty using [Lua to generate and verify the captcha images](https://github.com/openresty/lua-nginx-module). +This implementation isn't easy to configure. + +An alternative might be to just implement a test-cookie challenge. +At your webserver check that clients can set valid cookies, malicious clients often do not have this feature. +In Nginx, Cloudflare provide a [library](https://github.com/cloudflare/lua-resty-cookie) to interact with cookies. + +Other methods include making sure that clients connecting to your .onion have valid User-Agent header and the Referer header is not set to a value you can associate with the attack. + +### Webserver rate limiting + +If attackers are overwhelming you with aggressive circuits that perform too many queries, try to detect that overuse and kill them using the `HiddenServiceExportCircuitID` torrc option. +You can use your own heuristics or use your web server's [rate limiting module](https://www.nginx.com/blog/rate-limiting-nginx/). + +The above tips should help you keep afloat in turbulent times. +At the same time [we are working on more advanced defenses](https://blog.torproject.org/stop-the-onion-denial), so that less manual configuration and tinkering is needed by onion operators.

1 0

[community/staging] Merge branch 'onion-guide-dos'
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 6afc1945816178a49857b9386896a0dfa347e746 Merge: 08c7257 2d35ea1 Author: gus <gus(a)torproject.org> Date: Mon Dec 21 14:33:41 2020 -0500 Merge branch 'onion-guide-dos' content/onion-services/advanced/dos/contents.lr | 65 +++++++++++++++++++++++++ 1 file changed, 65 insertions(+)

1 0

[community/staging] Fix typos
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 2f66f498aafc2df826acaba85346e0c83f5e5eaf Author: Dimitris Apostolou <dimitris.apostolou(a)icloud.com> Date: Tue Dec 15 23:12:44 2020 +0200 Fix typos --- README.md | 4 ++-- content/gsoc/onion-toolbox/contents.lr | 4 ++-- content/gsoc/privacy-friendly-web/contents.lr | 2 +- content/localization/becoming-tor-translator/contents.lr | 2 +- content/onion-services/setup/install/contents.lr | 2 +- content/relay-operations/community-resources/bad-relays/contents.lr | 2 +- content/relay-operations/community-resources/contents.lr | 2 +- .../community-resources/eff-tor-legal-faq/contents.lr | 2 +- .../relay-operations/community-resources/good-bad-isps/contents.lr | 2 +- .../community-resources/tor-abuse-templates/contents.lr | 4 ++-- .../community-resources/tor-exit-guidelines/contents.lr | 4 ++-- .../community-resources/tor-relay-universities/contents.lr | 2 +- content/relay-operations/technical-setup/bridge/freebsd/contents.lr | 2 +- 13 files changed, 17 insertions(+), 17 deletions(-) diff --git a/README.md b/README.md index fc5b24c..d0d917a 100644 --- a/README.md +++ b/README.md @@ -41,7 +41,7 @@ You can click ```Edit this page``` and submit your content changes in a [Pull Re ```$ cd community/lego && git submodule update --init --recursive``` -5. Translations for the website are imported by Jenkins when bulding the page, but if you want to test them, download the correct branch of the translations repo to the ./i18n/ folder. +5. Translations for the website are imported by Jenkins when building the page, but if you want to test them, download the correct branch of the translations repo to the ./i18n/ folder. 6. Finally: @@ -75,7 +75,7 @@ This is the workflow that Tor Internal people should use when making changes on - Contents file, containing your changes where it would be located on the **reviewer's repo**, e.g. `https://gitlab.torproject.org/steph/community/blob/develop/content/onion-services/contents.lr`. - For the review workflow, please see (Reviewer Workflow). 5. Once the work has been reviewed and any necessary changes and merge request has been made, a repo maintainer or team members with write access to gitweb master will then merge or cherry-pick these changes to master, following the workflow outlined in [How to use our git flow](https://gitlab.torproject.org/web/tpo/wikis/Git-flow-and-merge-reques…. -6. Merger should then move the the ticket to the `Closed` column. +6. Merger should then move the ticket to the `Closed` column. ### Reviewer Workflow diff --git a/content/gsoc/onion-toolbox/contents.lr b/content/gsoc/onion-toolbox/contents.lr index 1d52e87..fa998f7 100644 --- a/content/gsoc/onion-toolbox/contents.lr +++ b/content/gsoc/onion-toolbox/contents.lr @@ -49,7 +49,7 @@ Ultimately myonion is about creating a better experience for onion services deve Myonion is a developer tool box, providing a command line interface and a GUI to configure and deploy existing services via .onion. A minimal prototype for myonion already [exists](https://github.com/hiromipaw/myonion). -Someone that may want to run an onion service can use the myonion wrapper app to start a .onion from their computer and sharea static website or a web application. +Someone that may want to run an onion service can use the myonion wrapper app to start a .onion from their computer and share a static website or a web application. Myonion can also be used to deploy the resulting configured app to a defined set of cloud providers. @@ -57,7 +57,7 @@ Myonion provides a way to build and deploy onion ready applications, allowing de The experience for developers will be similar to using other industry solutions, like the [Docker desktop app](https://www.docker.com/products/docker-desktop). -Developers using myonion are provided with pre-defined and customizable application templates, with corresponding configuration and a test set, eliminating error-prone manual setup and known onion service configuration mistakes. +Developers using myonion are provided with pre-defined and customizable application templates, with corresponding configuration and a test set, eliminating error-prone manual setup and known onion service configuration mistakes. The resulting application is therefore deployable via a set of endpoint management tools to known providers. Providing a way to deploy onion services at scale. diff --git a/content/gsoc/privacy-friendly-web/contents.lr b/content/gsoc/privacy-friendly-web/contents.lr index 7ab642b..36cdd00 100644 --- a/content/gsoc/privacy-friendly-web/contents.lr +++ b/content/gsoc/privacy-friendly-web/contents.lr @@ -49,7 +49,7 @@ Websites can work seamlessly with the Tor Browser and other privacy enhancing br The Tor Browser is in fact, based on Mozilla's Extended Support Release (ESR) Firefox branch. We have a series of patches against this browser to enhance privacy and security. Browser behavior is additionally augmented through the Torbutton extension, and we also change a number of Firefox preferences from their defaults. -The Tor Project has developed over the years a set of web development guidelines that allow websites to work with security enhanced browsers without causing any or minimal functionality destruption to their users. These guidelines have been shaped in an internal styleguide that has been adopted across all torproject.org websites. +The Tor Project has developed over the years a set of web development guidelines that allow websites to work with security enhanced browsers without causing any or minimal functionality disruption to their users. These guidelines have been shaped in an internal styleguide that has been adopted across all torproject.org websites. We are now formalizing these web development patterns and some security concerns that need to be considered when developing websites for users surfing the web with security enhanced browsers and tools. The scope of this project is creating a open-source community-driven browsable list of patterns and release a css/js framework that web developers can extend and use in their work. diff --git a/content/localization/becoming-tor-translator/contents.lr b/content/localization/becoming-tor-translator/contents.lr index 9f5e07b..362df91 100644 --- a/content/localization/becoming-tor-translator/contents.lr +++ b/content/localization/becoming-tor-translator/contents.lr @@ -20,7 +20,7 @@ Thank you for your interest in helping us with translations. # Localization mailing list <a name="tor-l10n" /> -To communicate with other translators, please join the [Tor localization mailing list](https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-l10n), where we organize translations, take decisions, report errors in source strings, etc. Please introduce yourself and ask any questions you may have after following up this instructions. +To communicate with other translators, please join the [Tor localization mailing list](https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-l10n), where we organize translations, take decisions, report errors in source strings, etc. Please introduce yourself and ask any questions you may have after following up these instructions. # Translation platform diff --git a/content/onion-services/setup/install/contents.lr b/content/onion-services/setup/install/contents.lr index 2796c55..6f12cc9 100644 --- a/content/onion-services/setup/install/contents.lr +++ b/content/onion-services/setup/install/contents.lr @@ -90,7 +90,7 @@ cost=100 ### Installing Tor from source -1. Download latest release and dependecies +1. Download latest release and dependencies The latest release of Tor can be found on the [download](https://www.torproject.org/download/tor/) page. diff --git a/content/relay-operations/community-resources/bad-relays/contents.lr b/content/relay-operations/community-resources/bad-relays/contents.lr index 520a40d..4de7718 100644 --- a/content/relay-operations/community-resources/bad-relays/contents.lr +++ b/content/relay-operations/community-resources/bad-relays/contents.lr @@ -49,7 +49,7 @@ We have three types of flags we can apply: Which we use depends on the severity of the issue, and if it can still be safely used in certain situations. -### My relays was given the BadExit flag. What's up? +### My relay was given the BadExit flag. What's up? In just about all cases we're unable to contact the operator to resolve the issue, so if your relay has been flagged as a BadExit then please let us know (see above for contact info) so we can work together to fix the issue. diff --git a/content/relay-operations/community-resources/contents.lr b/content/relay-operations/community-resources/contents.lr index f2e2f0e..392fbfa 100644 --- a/content/relay-operations/community-resources/contents.lr +++ b/content/relay-operations/community-resources/contents.lr @@ -33,7 +33,7 @@ Also see the [Tor Exit Guidelines](tor-exit-guidelines). Operators can put together their own abuse complaint template responses from one of many templates that Tor has created: [Tor Abuse Templates](tor-abuse-templates). -It is important to respond to abuse complaints in a timely manner (usually within 24 hours). If the hoster gets annoyed by the amount of abuse you can reduce the amount of ports allowed in your exit policy. +It is important to respond to abuse complaints in a timely manner (usually within 24 hours). If the hoster gets annoyed by the amount of abuse you can reduce the amount of ports allowed in your exit policy. Please document your experience with new hosters on the following page: [GoodBadISPs](good-bad-isps) Other docs we like: diff --git a/content/relay-operations/community-resources/eff-tor-legal-faq/contents.lr b/content/relay-operations/community-resources/eff-tor-legal-faq/contents.lr index 1a9ba2c..a50fdd8 100644 --- a/content/relay-operations/community-resources/eff-tor-legal-faq/contents.lr +++ b/content/relay-operations/community-resources/eff-tor-legal-faq/contents.lr @@ -136,7 +136,7 @@ For information on what to do if law enforcement seeks access to your digital de EFF has written a [short template](tor-dmca-response) to help you write a response to your ISP, university, etc., to let them know about the details of the Digital Millennium Copyright Act's safe harbor, and how Tor fits in. Note that template only refers to U.S. jurisdictions, and is intended only to address copyright complaints that are based on a relay of allegedly infringing material through the Tor node. -If you like, you should consider submitting a copy of your notice to the Lumen DatabaseThe email address for submissions is team(a)lumendatabase.org. +If you like, you should consider submitting a copy of your notice to the Lumen Database. The email address for submissions is team(a)lumendatabase.org. This will help us recognize trends and issues that the lawyers might want to focus on. Lumen encourages submissions from people outside the United States too. diff --git a/content/relay-operations/community-resources/good-bad-isps/contents.lr b/content/relay-operations/community-resources/good-bad-isps/contents.lr index 98eca4c..54e6759 100644 --- a/content/relay-operations/community-resources/good-bad-isps/contents.lr +++ b/content/relay-operations/community-resources/good-bad-isps/contents.lr @@ -32,7 +32,7 @@ For network diversity and stronger anonymity, you should avoid providers and cou |-------------------------|-------------|-----------------|--------------|-------------|---------------------|------------------------| | [UPC Austria GmbH](https://www.upc.at/) | - | - | Yes | Yes | (ISP) does not care what their customers do at all (unless you have a business connection) | 12/2011 | | [Silver Server GmbH](http://sil.at/) | - | -| Yes | Yes | Forwards abuse. Hosts already some big exit/entry nodes which seem to have no problems. Very expensive traffic. | 12/2011 | -| [Tele2 Austria GmbH](https://tele2.at/) | - | - | Yes | Yes | Forwards abuse at business connections, good quality traffic, does not like "proxys" on private lines. Cheap synchronous (SDSL) connections. | 12/2011 | +| [Tele2 Austria GmbH](https://tele2.at/) | - | - | Yes | Yes | Forwards abuse at business connections, good quality traffic, does not like "proxies" on private lines. Cheap synchronous (SDSL) connections. | 12/2011 | | [A1(former Telekom Austria)](http://a1.net) | - | - | Yes | No | Does not like Abuse (in any form) at all. Seems to give out customer data at alleged abuse. Not recommended but cheap. | 12/2011 | | [xpirio GmbH](http://xpirio.at) | - | - | Yes | ? | In general rather relaxed at all services, but better get in touch with their (very understanding) support when you expect abuse. | 12/2011 | diff --git a/content/relay-operations/community-resources/tor-abuse-templates/contents.lr b/content/relay-operations/community-resources/tor-abuse-templates/contents.lr index a590159..483cb2c 100644 --- a/content/relay-operations/community-resources/tor-abuse-templates/contents.lr +++ b/content/relay-operations/community-resources/tor-abuse-templates/contents.lr @@ -92,7 +92,7 @@ We're sorry your site is experiencing this heavy load from Tor. However, it is possible that your rate limiting alarms simply experienced a false positive due to the amount of traffic that flows through the router. We provide service to almost a gigabit of traffic per second, 98% of which is web traffic. -If the attack is real and ongoing, however, the Tor project provides an automated DNSRBL for you to query to block login attempts coming +If the attack is real and ongoing, however, the Tor project provides an automated DNSRBL for you to query to block login attempts coming from Tor nodes: https://www.torproject.org/projects/tordnsel.html.en It is also possible to download a list of all Tor exit IPs that will connect to your server port: @@ -103,7 +103,7 @@ In general however, we believe that problems like this are best solved by improv Scraping and robot activity can be reduced/slowed by captchas, which is the approach taken by Gmail for this same problem. In fact, Google provides a free captcha service, complete with code for easy inclusion in a number of systems to help other sites deal with this issue: https://code.google.com/apis/recaptcha/intro.html -Slow DoS attacks [aimed to consume the Apache MaxClients limit](http://www.guerilla-ciso.com/archives/2049) can be alleviated by reducing the httpd.conf TimeOut and KeepAliveTimeout config values to 15-30 and raising the ServerLimit and MaxClients values to omething like 3000. +Slow DoS attacks [aimed to consume the Apache MaxClients limit](http://www.guerilla-ciso.com/archives/2049) can be alleviated by reducing the httpd.conf TimeOut and KeepAliveTimeout config values to 15-30 and raising the ServerLimit and MaxClients values to something like 3000. If this fails, DoS attempts can also be solved with iptables-based rate limiting solutions, load balancers such as nginx, and also IPS devices, but be aware that Internet traffic is not always uniform in quantity by IP, due to large corporate and even national outproxies, NATs, and services like Tor. http://kevin.vanzonneveld.net/techblog/article/block_brute_force_attacks_wi… diff --git a/content/relay-operations/community-resources/tor-exit-guidelines/contents.lr b/content/relay-operations/community-resources/tor-exit-guidelines/contents.lr index 7ad8ffd..61e4084 100644 --- a/content/relay-operations/community-resources/tor-exit-guidelines/contents.lr +++ b/content/relay-operations/community-resources/tor-exit-guidelines/contents.lr @@ -39,7 +39,7 @@ Once you identified your ISP, you can follow the two-step advice of TorServers.n 2. If they come back positively, ask them if they are OK with an IP range reassignment. If not, you can still explain that you are a non-profit superb large organization filled with security professionals, and that all will be good, and why IP reassignment helps reduce their workload. -The two-step process usually helps in elevating your request to higher levels of support staff without scaring them off too early, even if you don't end up with your own IP range. Here is template you can use: [Inquiry](https://www.torservers.net/wiki/hoster/inquiry) +The two-step process usually helps in elevating your request to higher levels of support staff without scaring them off too early, even if you don't end up with your own IP range. Here is template you can use: [Inquiry](https://www.torservers.net/wiki/hoster/inquiry) ## Legal @@ -134,7 +134,7 @@ A simple notice can be published without a separate webserver using Tor's "DirPo * Disk encryption might be useful to protect your node keys, but on the other hand unencrypted machines are easier to "audit" if required. We feel it's best to be able to easily show that you do Tor exiting, and nothing else (on that IP or server). -* Set reverse DNS to something that signals its use, e.g. 'anonymous-relay', 'proxy', 'tor-proxy'. so when other people see the address in their web logs, they will more quickly understand what's going on. +* Set reverse DNS to something that signals its use, e.g. 'anonymous-relay', 'proxy', 'tor-proxy'. So when other people see the address in their web logs, they will more quickly understand what's going on. If you do, and if SMTP is allowed in your exit policy, consider configuring [SPF](https://en.wikipedia.org/wiki/Sender_Policy_Framework) on your domain: this will protect you from users using your exit node to forge e-mails which look like they come from you. --- html: two-columns-page.html diff --git a/content/relay-operations/community-resources/tor-relay-universities/contents.lr b/content/relay-operations/community-resources/tor-relay-universities/contents.lr index 5d57cac..6fa5dc9 100644 --- a/content/relay-operations/community-resources/tor-relay-universities/contents.lr +++ b/content/relay-operations/community-resources/tor-relay-universities/contents.lr @@ -19,7 +19,7 @@ Most likely it is ambiguously worded, to let them allow or deny things based on But it might be extremely restrictive ("no services of any kind"), in which case you're going to have a tough road ahead of you. * Second, learn about your local laws with respect to liability of traffic that exits from your Tor relay. -In the US, these appear to be mainly the [DMCA](/relay/community-resources/eff-tor-legal-faq/) and [CDA](/relay/community-resources/eff-tor-legal-faq/), and the good news is that many lawyers believe that Tor exit node operators are in the same boat as the ISPs themselves. +In the US, these appear to be mainly the [DMCA](/relay/community-resources/eff-tor-legal-faq/) and [CDA](/relay/community-resources/eff-tor-legal-faq/), and the good news is that many lawyers believe that Tor exit node operators are in the same boat as the ISPs themselves. Become familiar with [the EFF's template letter regarding DMCA notices for Tor](/relay/community-resources/eff-tor-legal-faq/tor-dmca-response/), which is quite clear about not putting liability on service providers. The CDA is less clear, because it was written before the modern Internet emerged, but EFF and ACLU are optimistic. Of course, you need to understand that without actual clear precedent (and even then), it's still possible that a given judge will not interpret things the way the lawyers expect. diff --git a/content/relay-operations/technical-setup/bridge/freebsd/contents.lr b/content/relay-operations/technical-setup/bridge/freebsd/contents.lr index 28ed6ba..e1cef75 100644 --- a/content/relay-operations/technical-setup/bridge/freebsd/contents.lr +++ b/content/relay-operations/technical-setup/bridge/freebsd/contents.lr @@ -85,7 +85,7 @@ To confirm your bridge is running with no issues, you should see something like ``` -### 6. To get the fastest package updates, switch from the "quarterly" package repo to the "latest" repo. +### 6. To get the fastest package updates, switch from the "quarterly" package repo to the "latest" repo. Create the following folder:

1 0

[community/staging] Rephrase onion services overview docs to make it more clear. Fix #179
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit 10bc0c9b88ddf50345e590d1ae05a8a49a6c63f2 Author: gus <gus(a)torproject.org> Date: Fri Jan 8 15:12:12 2021 -0500 Rephrase onion services overview docs to make it more clear. Fix #179 --- content/onion-services/overview/contents.lr | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/onion-services/overview/contents.lr b/content/onion-services/overview/contents.lr index 8d6be84..8895acd 100644 --- a/content/onion-services/overview/contents.lr +++ b/content/onion-services/overview/contents.lr @@ -64,7 +64,7 @@ Let's imagine that your local newspaper decides to set up an onion service (usin As the first step in the protocol, the onion service will contact a bunch of Tor relays and ask them to act as its _introduction points_ by establishing long-term circuits to them. These circuits are anonymized circuits, so the server does not reveal the service location to the introduction points. -The onion service will hide and protect itself behind the Tor network by only allowing access through three introduction points that it connects to through a three-hop Tor circuit. +The onion service will hide and protect itself behind the Tor network by only allowing access through three introduction points that it connects to through a two-hop Tor circuit. <img class="col-lg-8" src="../../static/images/onion-services/overview/onion-service-01.png" alt="Onion Services: Step 1"> @@ -122,10 +122,10 @@ The introduction point passes your details (secret string and rendezvous address ### Act 8: Where the rendezvous point verifies the client's secret The onion service connects to the rendezvous point (through an anonymized circuit) and sends the "one-time secret" to it. -The rendezvous point simply relays (end-to-end encrypted) messages from client to service and vice versa. - The rendezvous point makes one final verification to match the secret strings from you and service (the latter also comes from you but has been relayed through the service). +The rendezvous point simply relays (end-to-end encrypted) messages from client to service and vice versa. + <img class="col-lg-8" src="../../static/images/onion-services/overview/onion-service-08.png" alt="Onion Services: Step 8"> ### Act 9: Where the onion service rendezvous with the client

1 0

[community/staging] Merge branch 'onion-services-overview'
by hiro＠torproject.org 21 Mar '21

21 Mar '21

commit bc58546d31cfcbebbc1972ab8d99c57c2eb1ffbe Merge: 4c16d95 10bc0c9 Author: gus <gus(a)torproject.org> Date: Fri Jan 8 15:15:25 2021 -0500 Merge branch 'onion-services-overview' content/onion-services/overview/contents.lr | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)

1 0