- tor-commits - lists.torproject.org

[translation/tsum] Update translations for tsum
by translation＠torproject.org 29 Dec '11

29 Dec '11

commit 5ea1adf6a899f4d4d553f9022d38cab5be3ac281 Author: Translation commit bot <translation(a)torproject.org> Date: Thu Dec 29 17:15:04 2011 +0000 Update translations for tsum --- el_GR/tsum.po | 20 ++++++++++++++++++-- 1 files changed, 18 insertions(+), 2 deletions(-) diff --git a/el_GR/tsum.po b/el_GR/tsum.po index 57ba5b1..3d97b0e 100644 --- a/el_GR/tsum.po +++ b/el_GR/tsum.po @@ -9,7 +9,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: https://trac.torproject.org/projects/tor\n" "POT-Creation-Date: 2011-11-05 17:16+0000\n" -"PO-Revision-Date: 2011-12-29 16:43+0000\n" +"PO-Revision-Date: 2011-12-29 16:52+0000\n" "Last-Translator: anvo <fragos.george(a)hotmail.com>\n" "Language-Team: LANGUAGE <LL(a)li.org>\n" "MIME-Version: 1.0\n" @@ -83,6 +83,11 @@ msgid "" "traffic inside the Tor network, but it cannot encrypt your traffic between " "the Tor network and its final destination." msgstr "" +"Το Tor \"ανωνυμοποιεί\" την προέλευση της κυκλοφορίας σας και κρυπτογραφεί " +"όλα τα δεδομένα μεταξύ του χρήστη και του δικτύου Tor. Το Tor, επίσης, " +"κρυπτογραφεί την κυκλοφορία των δεδομένων σας εντός του δικτύου του, αλλά " +"δεν κρυπτογραφεί την κυκλοφορία μεταξύ του δικτύου του και του τελικού " +"προορισμού της." #. type: Plain text #: en/tsum.text:36 @@ -98,7 +103,7 @@ msgstr "" msgid "" "How to download Tor\n" "-------------------\n" -msgstr "" +msgstr "Πώς να λάβετε το Tor\n" #. type: Plain text #: en/tsum.text:44 @@ -109,6 +114,11 @@ msgid "" "and requires no installation. You download the bundle, extract the archive, " "and start Tor." msgstr "" +"Το πακέτο (bundle) που προτείνουμε στους περισσότερους χρήστες είναι το [Tor" +" Browser Bundle](https://www.torproject.org/projects/torbrowser.html). Το " +"πακέτο αυτό περιέχει έναν φυλλομετρητή (browser) ιστού προρυθμισμένο για " +"ασφαλή περιήγηση στο Διαδίκτυο μέσω Tor και δεν απαιτεί εγκατάσταση. " +"Κατεβάζετε το πακέτο, αποσυμπιέζετε το αρχείο και ξεκινάτε το Tor." #. type: Plain text #: en/tsum.text:48 @@ -132,6 +142,9 @@ msgid "" "**macos-i386**), and Linux (write **linux-i386** for 32-bit systems or " "**linux-x86_64** for 64-bit systems)." msgstr "" +"Μπορείτε να λάβετε, επίσης, το Πακέτο Φυλλομετρητή Tor για το Mac OS X " +"(πληκτρολογήστε **macos-i386) και Linux (πληκτρολογήστε **linux-i386 για " +"32μπιτα συστήματα ή **linux-x86_64 για 64μπιτα συστήματα)." #. type: Plain text #: en/tsum.text:61 @@ -139,6 +152,9 @@ msgid "" "If you want a translated version of Tor, write **help** instead. You will " "then receive an email with instructions and a list of available languages." msgstr "" +"Αν επιθυμείτε μια μεταφρασμένη έκδοση του Tor, πληκτρολογήστε **help**. Θα " +"λάβετε ηλεκτρονικό μήνυμα με οδηγίες και έναν κατάλογο με τις διαθέσιμες " +"γλώσες." #. type: Plain text #: en/tsum.text:67

1 0

r25276: {website} add the latest press hits. (website/trunk/press/en)
by Andrew Lewman 29 Dec '11

29 Dec '11

Author: phobos Date: 2011-12-29 16:49:03 +0000 (Thu, 29 Dec 2011) New Revision: 25276 Modified: website/trunk/press/en/inthemedia.wml Log: add the latest press hits. Modified: website/trunk/press/en/inthemedia.wml =================================================================== --- website/trunk/press/en/inthemedia.wml 2011-12-29 04:23:25 UTC (rev 25275) +++ website/trunk/press/en/inthemedia.wml 2011-12-29 16:49:03 UTC (rev 25276) @@ -33,6 +33,16 @@ </tr> </thead> <tr style="background-color: #e5e5e5;"> +<td>2011 Dec 29</td> +<td>Boing Boing</td> +<td><a href="http://boingboing.net/2011/12/29/state-of-the-arms-race-between.html">State of the arms race between repressive governments and anti-censorship/surveillance Tor technology (and why American companies are on the repressive governments' side)</a></td> +</tr> +<tr> +<td>2011 Dec 28</td> +<td>ZDNet Asia</td> +<td><a href="http://www.zdnetasia.com/tor-project-creates-safer-internet-62303332.htm">Tor Project creates safer Internet</a></td> +</tr> +<tr style="background-color: #e5e5e5;"> <td>2011 Dec 01</td> <td>itbusiness.ca</td> <td><a href="http://www.itbusiness.ca/it/client/en/home/news.asp?id=65170">Convenience technology threatening personal privacy, experts say</a></td>

1 0

[translation/tsum] Update translations for tsum
by translation＠torproject.org 29 Dec '11

29 Dec '11

commit cdff22c04da85bbe1f505bc7663f423729f295ac Author: Translation commit bot <translation(a)torproject.org> Date: Thu Dec 29 16:45:04 2011 +0000 Update translations for tsum --- el_GR/tsum.po | 610 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 610 insertions(+), 0 deletions(-) diff --git a/el_GR/tsum.po b/el_GR/tsum.po new file mode 100644 index 0000000..57ba5b1 --- /dev/null +++ b/el_GR/tsum.po @@ -0,0 +1,610 @@ +# SOME DESCRIPTIVE TITLE +# Copyright (C) YEAR The Tor Project, Inc +# This file is distributed under the same license as the PACKAGE package. +# +# Translators: +# <fragos.george(a)hotmail.com>, 2011. +msgid "" +msgstr "" +"Project-Id-Version: The Tor Project\n" +"Report-Msgid-Bugs-To: https://trac.torproject.org/projects/tor\n" +"POT-Creation-Date: 2011-11-05 17:16+0000\n" +"PO-Revision-Date: 2011-12-29 16:43+0000\n" +"Last-Translator: anvo <fragos.george(a)hotmail.com>\n" +"Language-Team: LANGUAGE <LL(a)li.org>\n" +"MIME-Version: 1.0\n" +"Content-Type: text/plain; charset=UTF-8\n" +"Content-Transfer-Encoding: 8bit\n" +"Language: el_GR\n" +"Plural-Forms: nplurals=2; plural=(n != 1)\n" + +#. type: Plain text +#: en/tsum.text:2 +msgid "# The Short User Manual\n" +msgstr "" + +#. type: Plain text +#: en/tsum.text:7 +msgid "" +"This user manual contains information about how to download Tor, how to use " +"it, and what to do if Tor is unable to connect to the network. If you can't " +"find the answer to your question in this document, email " +"help(a)rt.torproject.org." +msgstr "" + +#. type: Plain text +#: en/tsum.text:11 +msgid "" +"Please note that we are providing support on a voluntary basis, and we get a" +" lot of emails every single day. There is no need to worry if we don't get " +"back to you straight away." +msgstr "" + +#. type: Plain text +#: en/tsum.text:13 +#, no-wrap +msgid "" +"How Tor works\n" +"-------------\n" +msgstr "Πώς δουλεύει το Tor\n" + +#. type: Plain text +#: en/tsum.text:19 +msgid "" +"Tor is a network of virtual tunnels that allows you to improve your privacy " +"and security on the Internet. Tor works by sending your traffic through " +"three random servers (also known as *relays*) in the Tor network, before the" +" traffic is sent out onto the public Internet." +msgstr "" +"Το Tor είναι ένα δίκτυο εικονικών διαύλων που επιτρέπει την βελτίωση της " +"ιδιοτικότητας και της ασφάλειας στο Διαδίκτυο. Το Tor λειτουργεί στέλνοντας" +" την κυκλοφορία σας στο Διαδίκτυο μέσω τριών τυχαίων εξυπηρετητών (γνωστών " +"και ως αναμεταδοτών-\"relays\") εντός του δικτύου Tor, πριν η κυκλοφορία " +"αποσταλεί προς το δημόσιο ή'γενικό Διαδίκτυο." + +#. type: Plain text +#: en/tsum.text:21 +msgid "![How Tor Works](images/how-tor-works.png)" +msgstr "![Πώς δουλεύει το Tor](images/how-tor-works.png)" + +#. type: Plain text +#: en/tsum.text:26 +msgid "" +"The image above illustrates a user browsing to different websites over Tor. " +"The green monitors represent relays in the Tor network, while the three keys" +" represent the layers of encryption between the user and each relay." +msgstr "" + +#. type: Plain text +#: en/tsum.text:31 +msgid "" +"Tor will anonymize the origin of your traffic, and it will encrypt " +"everything between you and the Tor network. Tor will also encrypt your " +"traffic inside the Tor network, but it cannot encrypt your traffic between " +"the Tor network and its final destination." +msgstr "" + +#. type: Plain text +#: en/tsum.text:36 +msgid "" +"If you are communicating sensitive information, for example when logging on " +"to a website with a username and password, make sure that you are using " +"HTTPS (e.g. **https**://torproject.org/, not **http**://torproject.org/)." +msgstr "" + +#. type: Plain text +#: en/tsum.text:38 +#, no-wrap +msgid "" +"How to download Tor\n" +"-------------------\n" +msgstr "" + +#. type: Plain text +#: en/tsum.text:44 +msgid "" +"The bundle we recommend to most users is the [Tor Browser " +"Bundle](https://www.torproject.org/projects/torbrowser.html). This bundle " +"contains a browser preconfigured to safely browse the Internet through Tor, " +"and requires no installation. You download the bundle, extract the archive, " +"and start Tor." +msgstr "" + +#. type: Plain text +#: en/tsum.text:48 +msgid "" +"There are two different ways to get hold of the Tor software. You can either" +" browse to the [Tor Project website](https://www.torproject.org/) and " +"download it there, or you can use GetTor, the email autoresponder." +msgstr "" + +#. type: Plain text +#: en/tsum.text:53 +msgid "" +"### How to get Tor via email\n" +"To receive the English Tor Browser Bundle for Windows, send an email to gettor(a)torproject.org with **windows** in the body of the message. You can leave the subject blank." +msgstr "" + +#. type: Plain text +#: en/tsum.text:57 +msgid "" +"You can also request the Tor Browser Bundle for Mac OS X (write " +"**macos-i386**), and Linux (write **linux-i386** for 32-bit systems or " +"**linux-x86_64** for 64-bit systems)." +msgstr "" + +#. type: Plain text +#: en/tsum.text:61 +msgid "" +"If you want a translated version of Tor, write **help** instead. You will " +"then receive an email with instructions and a list of available languages." +msgstr "" + +#. type: Plain text +#: en/tsum.text:67 +#, no-wrap +msgid "" +"**Note**: The Tor Browser Bundles for Linux and Mac OS X are rather\n" +"large, and you will not be able to receive any of these bundles with a\n" +"Gmail, Hotmail or Yahoo account. If you cannot receive the bundle you\n" +"want, send an email to help(a)rt.torproject.org and we\n" +"will give you a list of website mirrors to use.\n" +msgstr "" + +#. type: Plain text +#: en/tsum.text:73 +msgid "" +"#### How to get Tor as several small sized packages\n" +"It is possible to request the Tor Browser Bundle for Windows as several small sized packages, instead of one big package. This can be useful if you don't have a lot of bandwidth available, or if your email provider does not allow you to receive large attachments." +msgstr "" + +#. type: Plain text +#: en/tsum.text:76 +msgid "" +"Send an email to gettor(a)torproject.org with the following words in the body " +"of the email:" +msgstr "" + +#. type: Plain text +#: en/tsum.text:79 +#, no-wrap +msgid "" +"windows \n" +"split\n" +msgstr "" + +#. type: Plain text +#: en/tsum.text:83 +msgid "" +"It is important that you include the keyword *split* on its own line. See " +"*What to do with split packages* for information on how to unpack and re-" +"assemble the small sized packages." +msgstr "" + +#. type: Plain text +#: en/tsum.text:89 +msgid "" +"### Tor for smartphones\n" +"You can get Tor on your Android device by installing the package named *Orbot*. For information about how to download and install Orbot, please see the [Tor Project website](https://www.torproject.org/docs/android.html.en)." +msgstr "" + +#. type: Plain text +#: en/tsum.text:93 +msgid "" +"We also have experimental packages for [Nokia " +"Maemo/N900](https://www.torproject.org/docs/N900.html.en) and [Apple " +"iOS](http://sid77.slackware.it/iphone/)." +msgstr "" + +#. type: Plain text +#: en/tsum.text:97 +msgid "" +"### How to verify that you have the right version\n" +"Before running the Tor Browser Bundle, you should make sure that you have the right version." +msgstr "" + +#. type: Plain text +#: en/tsum.text:102 +msgid "" +"The software you receive is accompanied by a file with the same name as the " +"bundle and the extension **.asc**. This .asc file is a GPG signature, and " +"will allow you to verify the file you've downloaded is exactly the one that " +"we intended you to get." +msgstr "" + +#. type: Plain text +#: en/tsum.text:105 +#, no-wrap +msgid "" +"Before you can verify the signature, you will have to download and\n" +"install GnuPG: \n" +msgstr "" + +#. type: Plain text +#: en/tsum.text:109 +#, no-wrap +msgid "" +"**Windows**: [http://gpg4win.org/download.html](http://gpg4win.org/download.html) \n" +"**Mac OS X**: [http://macgpg.sourceforge.net/](http://macgpg.sourceforge.net/) \n" +"**Linux**: Most Linux distributions come with GnuPG preinstalled.\n" +msgstr "" + +#. type: Plain text +#: en/tsum.text:112 +msgid "" +"Please note that you may need to edit the paths and the commands used below " +"to get it to work on your system." +msgstr "" + +#. type: Plain text +#: en/tsum.text:115 +msgid "" +"Erinn Clark signs the Tor Browser Bundles with key 0x63FEE659. To import " +"Erinn's key, run:" +msgstr "" + +#. type: Plain text +#: en/tsum.text:117 +#, no-wrap +msgid "\tgpg --keyserver hkp://keys.gnupg.net --recv-keys 0x63FEE659\n" +msgstr "" + +#. type: Plain text +#: en/tsum.text:119 +msgid "After importing the key, verify that the fingerprint is correct:" +msgstr "" + +#. type: Plain text +#: en/tsum.text:121 +#, no-wrap +msgid "\tgpg --fingerprint 0x63FEE659\n" +msgstr "" + +#. type: Plain text +#: en/tsum.text:123 +msgid "You should see:" +msgstr "" + +#. type: Plain text +#: en/tsum.text:130 +#, no-wrap +msgid "" +"\tpub 2048R/63FEE659 2003-10-16\n" +"\t Key fingerprint = 8738 A680 B84B 3031 A630 F2DB 416F 0610 63FE E659\n" +"\tuid Erinn Clark <erinn(a)torproject.org>\n" +"\tuid Erinn Clark <erinn(a)debian.org>\n" +"\tuid Erinn Clark <erinn(a)double-helix.org>\n" +"\tsub 2048R/EB399FD7 2003-10-16\n" +msgstr "" + +#. type: Plain text +#: en/tsum.text:132 +msgid "" +"To verify the signature of the package you downloaded, run the following " +"command:" +msgstr "" + +#. type: Plain text +#: en/tsum.text:134 +#, no-wrap +msgid "" +"\tgpg --verify tor-browser-2.2.33-2_en-US.exe.asc tor-browser-2.2.33-2_en-" +"US.exe\n" +msgstr "" + +#. type: Plain text +#: en/tsum.text:140 +msgid "" +"The output should say *\"Good signature\"*. A bad signature means that the " +"file may have been tampered with. If you see a bad signature, send details " +"about where you downloaded the package from, how you verified the signature," +" and the output from GnuPG in an email to help(a)rt.torproject.org." +msgstr "" + +#. type: Plain text +#: en/tsum.text:147 +msgid "" +"Once you have verified the signature and seen the *\"Good signature\"* " +"output, go ahead and extract the package archive. You should then see a " +"directory similar to **tor-browser_en-US**. Inside that directory is another" +" directory called **Docs**, which contains a file called **changelog**. You " +"want to make sure that the version number on the top line of the changelog " +"file matches the version number in the filename." +msgstr "" + +#. type: Plain text +#: en/tsum.text:153 +msgid "" +"### How to use the Tor Browser Bundle\n" +"After downloading the Tor Browser Bundle and extracting the package, you should have a directory with a few files in it. One of the files is an executable called \"Start Tor Browser\" (or \"start-tor-browser\", depending on your operating system)." +msgstr "" + +#. type: Plain text +#: en/tsum.text:160 +msgid "" +"When you start the Tor Browser Bundle, you will first see Vidalia start up " +"and connect you to the Tor network. After that, you will see a browser " +"confirming that you are now using Tor. This is done by displaying " +"[https://check.torproject.org/](https://check.torproject.org/). You can now " +"browse the Internet through Tor." +msgstr "" + +#. type: Plain text +#: en/tsum.text:163 +#, no-wrap +msgid "" +"*Please note that it is important that you use the browser that comes\n" +"with the bundle, and not your own browser.*\n" +msgstr "" + +#. type: Plain text +#: en/tsum.text:169 +msgid "" +"### What to do when Tor does not connect\n" +"Some users will notice that Vidalia gets stuck when trying to connect to the Tor network. If this happens, make sure that you are connected to the Internet. If you need to connect to a proxy server, see *How to use an open proxy* below." +msgstr "" + +#. type: Plain text +#: en/tsum.text:174 +msgid "" +"If your normal Internet connection is working, but Tor still can't connect " +"to the network, try the following; open the Vidalia control panel, click on " +"*Message Log* and select the *Advanced* tab. It may be that Tor won't " +"connect because:" +msgstr "" + +#. type: Plain text +#: en/tsum.text:178 +#, no-wrap +msgid "" +"**Your system clock is off**: Make sure that the date and time on your\n" +"system is correct, and restart Tor. You may need to synchronize your\n" +"system clock with an Internet time server. \n" +msgstr "" + +#. type: Plain text +#: en/tsum.text:183 +#, no-wrap +msgid "" +"**You are behind a restrictive firewall**: To tell Tor to only try port\n" +"80 and port 443, open the Vidalia control panel, click on *Settings* and\n" +"*Network*, and tick the box that says *My firewall only lets me connect\n" +"to certain ports*. \n" +msgstr "" + +#. type: Plain text +#: en/tsum.text:187 +#, no-wrap +msgid "" +"**Your anti-virus program is blocking Tor**: Make sure that your\n" +"anti-virus program is not preventing Tor from making network\n" +"connections.\n" +msgstr "" + +#. type: Plain text +#: en/tsum.text:191 +msgid "" +"If Tor still doesn't work, it's likely that your Internet Service Provider " +"(ISP) is blocking Tor. Very often this can be worked around with **Tor " +"bridges**, hidden relays that aren't as easy to block." +msgstr "" + +#. type: Plain text +#: en/tsum.text:195 +msgid "" +"If you need help with figuring out why Tor can't connect, send an email to " +"help(a)rt.torproject.org and include the relevant parts from the log file." +msgstr "" + +#. type: Plain text +#: en/tsum.text:203 +msgid "" +"### How to find a bridge\n" +"To use a bridge, you will first have to locate one; you can either browse to [bridges.torproject.org](https://bridges.torproject.org/), or you can send an email to bridges(a)torproject.org. If you do send an email, please make sure that you write **get bridges** in the body of the email. Without this, you will not get a reply. Note that you need to send this email from either a gmail.com or a yahoo.com address." +msgstr "" + +#. type: Plain text +#: en/tsum.text:208 +msgid "" +"Configuring more than one bridge address will make your Tor connection more " +"stable, in case some of the bridges become unreachable. There is no " +"guarantee that the bridge you are using now will work tomorrow, so you " +"should make a habit of updating your list of bridges every so often." +msgstr "" + +#. type: Plain text +#: en/tsum.text:214 +msgid "" +"### How to use a bridge\n" +"Once you have a set of bridges to use, open the Vidalia control panel, click on *Settings*, *Network* and tick the box that says *My ISP blocks connections to the Tor network*. Enter the bridges in the box below, hit *OK* and start Tor again." +msgstr "" + +#. type: Plain text +#: en/tsum.text:220 +msgid "" +"### How to use an open proxy\n" +"If using a bridge does not work, try configuring Tor to use any HTTPS or SOCKS proxy to get access to the Tor network. This means even if Tor is blocked by your local network, open proxies can be safely used to connect to the Tor Network and on to the uncensored Internet." +msgstr "" + +#. type: Plain text +#: en/tsum.text:223 +msgid "" +"The steps below assume you have a functional Tor/Vidalia configuration, and " +"you have found a list of HTTPS, SOCKS4, or SOCKS5 proxies." +msgstr "" + +#. type: Bullet: '1. ' +#: en/tsum.text:235 +msgid "Open the Vidalia control panel, click on *Settings*." +msgstr "" + +#. type: Bullet: '2. ' +#: en/tsum.text:235 +msgid "Click *Network*. Select *I use a proxy to access the Internet*." +msgstr "" + +#. type: Plain text +#: en/tsum.text:235 +#, no-wrap +msgid "" +"3. On the *Address* line, enter the open proxy address. This can be a\n" +"hostname or an IP Address.\n" +"4. Enter the port for the proxy.\n" +"5. Generally, you do not need a username and password. If you do,\n" +"enter the information in the proper fields.\n" +"6. Choose the *Type* of proxy you are using, whether HTTP/HTTPS, SOCKS4,\n" +"or SOCKS5.\n" +"7. Push the *OK* button. Vidalia and Tor are now configured to use a\n" +"proxy to access the rest of the Tor network.\n" +msgstr "" + +#. type: Plain text +#: en/tsum.text:240 +msgid "" +"## Frequently Asked Questions\n" +"This section will answer some of the most common questions. If your question is not mentioned here, please send an email to help(a)rt.torproject.org." +msgstr "" + +#. type: Plain text +#: en/tsum.text:244 +msgid "" +"### Unable to extract the archive\n" +"If you are using Windows and find that you cannot extract the archive, download and install [7-Zip](http://www.7-zip.org/)." +msgstr "" + +#. type: Plain text +#: en/tsum.text:248 +msgid "" +"If you are unable to download 7-Zip, try to rename the file from .z to .zip " +"and use winzip to extract the archive. Before renaming the file, tell " +"Windows to show file extensions:" +msgstr "" + +#. type: Plain text +#: en/tsum.text:254 +msgid "" +"#### Windows XP\n" +"1. Open *My Computer*\n" +"2. Click on *Tools* and choose *Folder Options...* in the menu\n" +"3. Click on the *View* tab\n" +"4. Uncheck *Hide extensions for known file types* and click *OK*" +msgstr "" + +#. type: Plain text +#: en/tsum.text:260 +msgid "" +"#### Windows Vista\n" +"1. Open *Computer*\n" +"2. Click on *Organize* and choose *Folder and search options* in the menu\n" +"3. Click on the *View* tab\n" +"4. Uncheck *Hide extensions for known file types* and click *OK*" +msgstr "" + +#. type: Plain text +#: en/tsum.text:266 +msgid "" +"#### Windows 7\n" +"1. Open *Computer*\n" +"2. Click on *Organize* and choose *Folder and search options* in the menu\n" +"3. Click on the *View* tab\n" +" 4. Uncheck *Hide extensions for known file types* and click *OK*" +msgstr "" + +#. type: Plain text +#: en/tsum.text:273 +msgid "" +"### What to do with split packages\n" +"When you request a split package, the parts may arrive out of order. You need to make sure you have received all the parts before you attempt to unpack them. Save all the parts into one directory on your computer, unzip them, and double-click the file that ends in \"..split.part01.exe\" to start the unpacking process." +msgstr "" + +#. type: Plain text +#: en/tsum.text:277 +msgid "" +"Once the unpacking process has completed, you should see a newly created " +"\".exe\" file in the same directory. Run this file and wait for the Tor " +"Browser Bundle to start." +msgstr "" + +#. type: Plain text +#: en/tsum.text:281 +msgid "" +"### Vidalia asks for a password\n" +"You should not have to enter a password when starting Vidalia. If you are prompted for one, you are likely affected by one of these problems:" +msgstr "" + +#. type: Plain text +#: en/tsum.text:287 +#, no-wrap +msgid "" +"**You are already running Vidalia and Tor**:\n" +"For example, this situation can happen if you installed the Vidalia\n" +"bundle and now you're trying to run the Tor Browser Bundle. In that\n" +"case, you will need to close the old Vidalia and Tor before you can run\n" +"this one.\n" +msgstr "" + +#. type: Plain text +#: en/tsum.text:294 +#, no-wrap +msgid "" +"**Vidalia crashed, but left Tor running**:\n" +"If the dialog that prompts you for a control password has a Reset\n" +"button, you can click the button and Vidalia will restart Tor with a new\n" +"random control password. If you do not see a Reset button, or if Vidalia\n" +"is unable to restart Tor for you; go into your process or task manager,\n" +"and terminate the Tor process. Then use Vidalia to restart Tor.\n" +msgstr "" + +#. type: Plain text +#: en/tsum.text:298 +msgid "" +"For more information, see the " +"[FAQ](https://torproject.org/docs/faq.html#VidaliaPassword) on the Tor " +"Project website." +msgstr "" + +#. type: Plain text +#: en/tsum.text:303 +msgid "" +"### Flash does not work\n" +"For security reasons, Flash, Java, and other plugins are currently disabled for Tor. Plugins operate independently from Firefox and can perform activity on your computer that ruins your anonymity." +msgstr "" + +#. type: Plain text +#: en/tsum.text:308 +msgid "" +"Most YouTube videos work with HTML5, and it is possible to view these videos" +" over Tor. You need to join the [HTML5 trial](https://www.youtube.com/html5)" +" on the YouTube website before you can use the HTML5 player." +msgstr "" + +#. type: Plain text +#: en/tsum.text:312 +msgid "" +"Note that the browser will not remember that you joined the trial once you " +"close it, so you will need to re-join the trial the next time you run the " +"Tor Browser Bundle." +msgstr "" + +#. type: Plain text +#: en/tsum.text:315 +msgid "" +"Please see the [Torbutton FAQ](https://www.torproject.org/torbutton" +"/torbutton-faq.html#noflash) for more information." +msgstr "" + +#. type: Plain text +#: en/tsum.text:321 +msgid "" +"### I want to use another browser\n" +"For security reasons, we recommend that you only browse the web through Tor using the Tor Browser Bundle. It is technically possible to use Tor with other browsers, but by doing so you open yourself up to potential attacks." +msgstr "" + +#. type: Plain text +#: en/tsum.text:325 +msgid "" +"### Why Tor is slow\n" +"Tor can sometimes be a bit slower than your normal Internet connection. After all, your traffic is sent through many different countries, sometimes across oceans around the world!" +msgstr "" + +

1 0

[metrics-web/master] Make the dirbytes graph look at start/end parameters.
by karsten＠torproject.org 29 Dec '11

29 Dec '11

commit 2b533a8eb4406b9e9651c7b0f0690b0a56b12782 Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Thu Dec 29 17:27:41 2011 +0100 Make the dirbytes graph look at start/end parameters. Bug found by rransom. --- rserve/graphs.R | 8 +++++--- 1 files changed, 5 insertions(+), 3 deletions(-) diff --git a/rserve/graphs.R b/rserve/graphs.R index c8265c3..886fabf 100644 --- a/rserve/graphs.R +++ b/rserve/graphs.R @@ -523,9 +523,11 @@ plot_bwhist_flags <- function(start, end, path, dpi) { plot_dirbytes <- function(start, end, path, dpi) { drv <- dbDriver("PostgreSQL") con <- dbConnect(drv, user = dbuser, password = dbpassword, dbname = db) - q <- paste("SELECT date, dr, dw, brp, bwp, brd, bwd FROM user_stats", - "WHERE country = 'zy' AND bwp / bwd <= 3", - "AND date < (SELECT MAX(date) FROM user_stats) - 1 ORDER BY date") + q <- paste("SELECT date, dr, dw, brp, bwp, brd, bwd FROM user_stats ", + "WHERE country = 'zy' AND bwp / bwd <= 3 AND date >= '", start, + "' AND date <= '", end, "' ", + "AND date < (SELECT MAX(date) FROM user_stats) - 1 ORDER BY date", + sep = "") rs <- dbSendQuery(con, q) dir <- fetch(rs, n = -1) dbDisconnect(con)

1 0

[obfsproxy/master] Revise threat model doc to be descriptive, not aspirational
by nickm＠torproject.org 29 Dec '11

29 Dec '11

commit f53763c920f76be066ff7307810929949e361d60 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Dec 29 10:42:23 2011 -0500 Revise threat model doc to be descriptive, not aspirational The idea is to describe the adversary we _do_ defeat, not the adversary we _wish_ we could defeat. --- doc/obfs2_threat_model.txt | 54 +++++++++++++++++++++++++++++-------------- 1 files changed, 36 insertions(+), 18 deletions(-) diff --git a/doc/obfs2_threat_model.txt b/doc/obfs2_threat_model.txt index ed2c694..c13da2c 100644 --- a/doc/obfs2_threat_model.txt +++ b/doc/obfs2_threat_model.txt @@ -13,51 +13,69 @@ and is documented in the 'doc/protocol-spec.txt' file in the obfsproxy distribution. -1. Adversary capabilities and goals +1. Adversary capabilities and non-capabilities + + We assume a censor with limited per-connection resources. The adversary controls the infrastructure of the network within and at the edges of her jurisdiction, and she can potentially monitor, block, alter, and inject trafﬁc anywhere within this region. - The censor also holds a blacklist of network protocols, which she is - interested in blocking. + However, the adversary's computational resources are limited. + Specifically, the adversary does not have the resources in her + censorship infrastructure to store very much long-term information + about any given IP or connection. + + The adversary also holds a blacklist of network protocols, which she + is interested in blocking. We assume that the adversary does not have + a complete list of specific IPs running that protocol, though + preventing this is out-of-scope. -2. Adversary attacks: +2. The adversary's goals - The censor passively monitors traffic and looks for content - signatures, in an attempt to distinguish network protocols. Upon - detecting a blacklisted protocol, the censor blocks the connection. + The censor wants to ban particular encrypted protocols or + applications, and is willing to tolerate some collateral damage, but + is not willing to ban all encrypted traffic entirely. 3. Goals of obfs2 + Currently, most attackers in the category described above implement + their censorship by one or more firewalls that looking for protocol + signatures and block protocols matching those signatures. These + signatures are typically in the form of static strings to be matched + or regular expressions to be evaluated, over a packet or TCP flow. + obfs2 attempts to counter the above attack by removing content signatures from network traffic. obfs2 encrypts the traffic stream with a stream cipher, which results in the traffic looking uniformly random. -4. Discussion +4. Non-goals of obfs2 -4.1. obfs2 shortcomings + obfs2 was designed as a proof-of-concept for Tor's pluggable + transport system: it is simple, useable and easily implementable. It + does _not_ try to protect against more sophisticated adversaries. - obfs2 was designed as a pluggable transports proof-of-concept: it is - simple, useable and easily implementable. It does _not_ try to protect - against sophisticated adversaries: - - obfs2 does not try to protect against Tor protocol fingerprints, like - the packet size or packet timing. + obfs2 does not try to protect against non-content protocol + fingerprints, like the packet size or timing. obfs2 does not try to protect against attackers capable of measuring traffic entropy. - obfs2 does not try to protect against Deep Packet Inspection machines - that expect the obfs2 protocol. Such machines can trivially retrieve + obfs2 (in its default configuration) does not try to protect against + Deep Packet Inspection machines that expect the obfs2 protocol and + have the resources to run it. Such machines can trivially retrieve the decryption key off the traffic stream and use it to decrypt obfs2 and detect the Tor protocol. + obfs2 assumes that the underlying protocol provides (or does not + need!) integrity, confidentiality, and authentication; it provides + none of those on its own. + In other words, obfs2 does not try to protect against anything other than fingerprintable TLS content patterns. That said, obfs2 is not useless. It protects against many real-life Tor traffic detection methods currentl deployed, since most of them - use static SSL handshake strings as signatures. + currently use static SSL handshake strings as signatures.

1 0

[obfsproxy/master] Reformat threat model doc
by nickm＠torproject.org 29 Dec '11

29 Dec '11

commit 2bc1d70055dc35751f73bdda5c66dba37eec0778 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Dec 29 10:04:10 2011 -0500 Reformat threat model doc --- doc/obfs2_threat_model.txt | 81 +++++++++++++++++++++++++------------------ 1 files changed, 47 insertions(+), 34 deletions(-) diff --git a/doc/obfs2_threat_model.txt b/doc/obfs2_threat_model.txt index 08385ae..ed2c694 100644 --- a/doc/obfs2_threat_model.txt +++ b/doc/obfs2_threat_model.txt @@ -1,50 +1,63 @@ -threat model: + Threat model for the obfs2 obfuscation protocol - Adversary capabilities: + George Kadianakis + Nick Mathewson -The adversary controls the infrastructure of the network within her -jurisdiction, and she can potentially monitor, block, alter, and -inject trafﬁc anywhere within this region. +0. Abstract -The censor also holds a blacklist of network protocols, which she is -interested in blocking. + We discuss the intended threat model for the 'obfs2' protocol + obfuscator, its limitations, and its implications for the protocol + design. - Adversary attacks: + The 'obfs2' protocol is based on Bruce Leidl's obfuscated SSH layer, + and is documented in the 'doc/protocol-spec.txt' file in the obfsproxy + distribution. -The censor passively monitors traffic and looks for content -signatures, in an attempt to distinguish network protocols. Upon -detecting a blacklisted protocol, the censor blocks the connection. +1. Adversary capabilities and goals - Goals of obfs2: + The adversary controls the infrastructure of the network within and + at the edges of her jurisdiction, and she can potentially monitor, + block, alter, and inject trafﬁc anywhere within this region. -obfs2 attempts to counter the above attack by removing content -signatures from network traffic. obfs2 encrypts the traffic stream -with a stream cipher, which results in the traffic looking uniformly -random. + The censor also holds a blacklist of network protocols, which she is + interested in blocking. - Discussion: +2. Adversary attacks: -obfs2 shortcomings: + The censor passively monitors traffic and looks for content + signatures, in an attempt to distinguish network protocols. Upon + detecting a blacklisted protocol, the censor blocks the connection. -obfs2 was designed as a pluggable transports proof-of-concept: it is -simple, useable and easily implementable. It does _not_ try to protect -against sophisticated adversaries: +3. Goals of obfs2 -obfs2 does not try to protect against Tor protocol fingerprints, like -the packet size or packet timing. + obfs2 attempts to counter the above attack by removing content + signatures from network traffic. obfs2 encrypts the traffic stream + with a stream cipher, which results in the traffic looking uniformly + random. -obfs2 does not try to protect against attackers capable of measuring -traffic entropy. +4. Discussion -obfs2 does not try to protect against Deep Packet Inspection machines -that expect the obfs2 protocol. Such machines can trivially retrieve -the decryption key off the traffic stream and use it to decrypt obfs2 -and detect the Tor protocol. +4.1. obfs2 shortcomings -In other words, obfs2 does not try to protect against anything other -than fingerprintable TLS content patterns. + obfs2 was designed as a pluggable transports proof-of-concept: it is + simple, useable and easily implementable. It does _not_ try to protect + against sophisticated adversaries: -That said, obfs2 is not useless. It protects against many real-life -Tor traffic detection methods currentl deployed, since most of them -use static SSL handshake strings as signatures. + obfs2 does not try to protect against Tor protocol fingerprints, like + the packet size or packet timing. + + obfs2 does not try to protect against attackers capable of measuring + traffic entropy. + + obfs2 does not try to protect against Deep Packet Inspection machines + that expect the obfs2 protocol. Such machines can trivially retrieve + the decryption key off the traffic stream and use it to decrypt obfs2 + and detect the Tor protocol. + + In other words, obfs2 does not try to protect against anything other + than fingerprintable TLS content patterns. + + That said, obfs2 is not useless. It protects against many real-life + Tor traffic detection methods currentl deployed, since most of them + use static SSL handshake strings as signatures.

1 0

[obfsproxy/master] Reformat architecture document
by nickm＠torproject.org 29 Dec '11

29 Dec '11

commit 69c83bca5098f678d0d91f3c3603c0debbf59024 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Dec 29 10:53:28 2011 -0500 Reformat architecture document --- doc/obfsproxy_architecture.txt | 259 ++++++++++++++++++++-------------------- 1 files changed, 131 insertions(+), 128 deletions(-) diff --git a/doc/obfsproxy_architecture.txt b/doc/obfsproxy_architecture.txt index 05ee5eb..19809e6 100644 --- a/doc/obfsproxy_architecture.txt +++ b/doc/obfsproxy_architecture.txt @@ -1,73 +1,75 @@ -architecture + Obfsproxy Architecture - : Top Level View -obfsproxy is a pluggable transports proxy written in C. It's compliant -to the pluggable transports specification [0], and its modular -architecture allows it to support multiple pluggable transports. +1. Top Level View -# It supports two modes of operation, the 'external proxy' mode and the -# 'managed proxy' mode. When used as an 'external proxy', the user -# configures obfsproxy using the command-line. When used as a 'managed -# proxy', obfsproxy can be configured by another application using the -# managed proxy configuration protocol defined in the pluggable -# transports specification [0]. + obfsproxy is a pluggable transports proxy written in C. It's + compliant to the pluggable transports specification [0], and its + modular architecture allows it to support multiple pluggable + transports. - : Modularity + # It supports two modes of operation, the 'external proxy' mode and + # the 'managed proxy' mode. When used as an 'external proxy', the + # user configures obfsproxy using the command-line. When used as a + # 'managed proxy', obfsproxy can be configured by another application + # using the managed proxy configuration protocol defined in the + # pluggable transports specification [0]. -obfsproxy uses callbacks and object-oriented programming principles to -achieve modularity. This way, a developer who is interested in writing -a pluggable transport doesn't need to know obfsproxy's code inside -out. +2. Modularity -- Callbacks + obfsproxy uses callbacks and object-oriented programming principles + to achieve modularity. This way, a developer who is interested in + writing a pluggable transport doesn't need to know obfsproxy's code + inside out. - obfsproxy provides a set of callbacks that the plugin writer can use - to execute his transport's code, in an event-driven programming - fashion. +2.1. Callbacks - As a basic example, there is a callback triggering when obfsproxy - receives network data. The plugin writer uses that callback to - retrieve and process data according to his pluggable transport - protocol. + obfsproxy provides a set of callbacks that the plugin writer can use + to execute his transport's code, in an event-driven programming + fashion. -- OOP + As a basic example, there is a callback triggering when obfsproxy + receives network data. The plugin writer uses that callback to + retrieve and process data according to his pluggable transport + protocol. - obfsproxy provides a set of base classes, representing networking - concepts, that the developer can inherit and populate with his - transport's data. +2.2. OOP - As an example, the 'conn_t' structure represents a bidirectional - network connection between two peers. The pluggable transport writer - can inherit 'conn_t' and save his transport's state for that - connection to the new struct. + obfsproxy provides a set of base classes, representing networking + concepts, that the developer can inherit and populate with his + transport's data. -Developers that make good use of obfsproxy's callbacks and OOP, should -be able to implement most pluggable transports. + As an example, the 'conn_t' structure represents a bidirectional + network connection between two peers. The pluggable transport writer + can inherit 'conn_t' and save his transport's state for that + connection to the new struct. - : Codebase tour + Developers that make good use of obfsproxy's callbacks and OOP, + should be able to implement most pluggable transports. -This section does a short introduction into some areas of obfsproxy's -code. +3. Codebase tour -- Networking subsystem + This section does a short introduction into some areas of obfsproxy's + code. -This section explains the networking concepts and terminology of -obfsproxy. The relevant code can be found in src/network.c. +3.1. Networking subsystem -A 'connection' is a bidirectional communications channel, usually -backed by a network socket. For example, the communication channel -between tor and obfsproxy is a 'connection'. + This section explains the networking concepts and terminology of + obfsproxy. The relevant code can be found in src/network.c. -A 'circuit' is a pair of connections, referred to as the 'upstream' -and 'downstream' connections. The upstream connection of a circuit -communicates in cleartext with the higher-level program that wishes to -make use of our obfuscation service. The downstream connection -commmunicates in an obfuscated fashion with the remote peer that the -higher-level client wishes to contact. + A 'connection' is a bidirectional communications channel, usually + backed by a network socket. For example, the communication channel + between tor and obfsproxy is a 'connection'. -The diagram below might help demonstrate the relationship between -connections and circuits: + A 'circuit' is a pair of connections, referred to as the 'upstream' + and 'downstream' connections. The upstream connection of a circuit + communicates in cleartext with the higher-level program that wishes + to make use of our obfuscation service. The downstream connection + commmunicates in an obfuscated fashion with the remote peer that the + higher-level client wishes to contact. + + The diagram below might help demonstrate the relationship between + connections and circuits: downstream @@ -80,107 +82,108 @@ connections and circuits: | Tor Client | | Tor Bridge | +------------+ +--------------+ -In the above diagram, "obfsproxy c" is the client-side obfsproxy, and -"obfsproxy s" is the server-side obfsproxy. "conn_t CU" is the -Client's Upstream connection, the communication channel between tor -and obfsproxy. "conn_t CD" is the Client's Downstream connection, the -communication channel between obfsproxy and the remote peer. These two -connections form "circuit_t C". + In the above diagram, "obfsproxy c" is the client-side obfsproxy, and + "obfsproxy s" is the server-side obfsproxy. "conn_t CU" is the + Client's Upstream connection, the communication channel between tor + and obfsproxy. "conn_t CD" is the Client's Downstream connection, + the communication channel between obfsproxy and the remote + peer. These two connections form "circuit_t C". -A 'listener' is a listening socket bound to a particular obfuscation -protocol. Connecting to a listener creates one connection of a -circuit, and causes this program to initiate the other connection -(possibly after receiving in-band instructions about where to connect -to). A listener is said to be a 'client' listener if connecting to it -creates the upstream connection, and a 'server' listener if connecting -to it creates the downstream connection. + A 'listener' is a listening socket bound to a particular obfuscation + protocol. Connecting to a listener creates one connection of a + circuit, and causes this program to initiate the other connection + (possibly after receiving in-band instructions about where to connect + to). A listener is said to be a 'client' listener if connecting to it + creates the upstream connection, and a 'server' listener if + connecting to it creates the downstream connection. -There are two kinds of client listeners: a 'simple' client listener -always connects to the same remote peer every time it needs to -initiate a downstream connection; a 'socks' client listener can be -told to connect to an arbitrary remote peer using the SOCKS protocol -(version 4 or 5). + There are two kinds of client listeners: a 'simple' client listener + always connects to the same remote peer every time it needs to + initiate a downstream connection; a 'socks' client listener can be + told to connect to an arbitrary remote peer using the SOCKS protocol + (version 4 or 5). -- Protocol subsystem +3.2. Protocol subsystem -Pluggable transports are called 'protocols' in obfsproxy -code. Protocol-specific code can be found in src/protocols/. + Pluggable transports are called 'protocols' in obfsproxy + code. Protocol-specific code can be found in src/protocols/. -src/protocol.c acts as an intermediary between generic obfsproxy code -and protocol-specific code. It wraps protocol-specific functions for -use by the rest of obfsproxy, and provides various protocol-related -functions. + src/protocol.c acts as an intermediary between generic obfsproxy code + and protocol-specific code. It wraps protocol-specific functions for + use by the rest of obfsproxy, and provides various protocol-related + functions. -All supported protocols are registered to obfsproxy by adding them to -the supported_protocols[] array in src/protocol.c. + All supported protocols are registered to obfsproxy by adding them to + the supported_protocols[] array in src/protocol.c. -- Cryptography subsystem +3.3. Cryptography subsystem -The primary goal of pluggable transports is to obfuscate network -traffic. This means that most transports will need to use -cryptography. + The primary goal of pluggable transports is to obfuscate network + traffic. This means that most transports will need to use + cryptography. -obfsproxy provides a cryptography subsystem for transports that need -it; the code can be found in src/crypt.c. It supports various -cryptographic operations, like hashing, symmetric encryption and -random-number generation. + obfsproxy provides a cryptography subsystem for transports that need + it; the code can be found in src/crypt.c. It supports various + cryptographic operations, like hashing, symmetric encryption and + random-number generation. - : Extending obfsproxy +4. Extending obfsproxy -- Adding pluggable transports +4.1. Adding pluggable transports -Ideally, this is the only thing you will ever want to add to -obfsproxy: your pluggable transport. A low-level guide on how to add -your own pluggable transport can be found in doc/HACKING. This is a -high level overview: + Ideally, this is the only thing you will ever want to add to + obfsproxy: your pluggable transport. A low-level guide on how to add + your own pluggable transport can be found in doc/HACKING. This is a + high level overview: - * Write your pluggable transport, by writing code for the callback - events in protocol.c:protocol_vtable and by subclassing the base - classes of network.h and protocol.h. Look at doc/HACKING and at the - code of existing transports in src/protocols/. + * Write your pluggable transport, by writing code for the callback + events in protocol.c:protocol_vtable and by subclassing the base + classes of network.h and protocol.h. Look at doc/HACKING and at + the code of existing transports in src/protocols/. - * Register your transport to the protocol subsystem by adding it to - the supported_protocols list in src/protocol.c. + * Register your transport to the protocol subsystem by adding it to + the supported_protocols list in src/protocol.c. - * Add all new files to the Makefile. + * Add all new files to the Makefile. -- Extending callbacks +4.2. Extending callbacks -obfsproxy's modularity is based on callbacks, and even though the -defaults should satisfy the needs of many plugin writers, it's -possible that some plugin writers will need to extend obfsproxy to -write their own callbacks. + obfsproxy's modularity is based on callbacks, and even though the + defaults should satisfy the needs of many plugin writers, it's + possible that some plugin writers will need to extend obfsproxy to + write their own callbacks. -As an example, think of a plugin that needs to send fake data in the -absense of network activity: the current obfsproxy doesn't have a -callback for this scenario. The plugin writer would have to dive into -the networking subsystem of obfsproxy, write the callback triggering -code, register the new callback and finally write the code that -executes when the callback triggers. + As an example, think of a plugin that needs to send fake data in the + absence of network activity: the current obfsproxy doesn't have a + callback for this scenario. The plugin writer would have to dive into + the networking subsystem of obfsproxy, write the callback triggering + code, register the new callback and finally write the code that + executes when the callback triggers. -Depending on the scenario's complexity this might be a difficult task, -but there is not much that obfsproxy can do, since it's not possible -to have callbacks for any potentially useful scenario. + Depending on the scenario's complexity this might be a difficult + task, but there is not much that obfsproxy can do, since it's not + possible to have callbacks for any potentially useful scenario. -- Extending crypto +4.3. Extending crypto -The current cryptography subsystem is made to order for the current -transports, and might not be sufficient for all transports. If a -transport needs more crypto, the plugin writer can add his own -cryptography functions to src/crypt.c. + The current cryptography subsystem is made to order for the current + transports, and might not be sufficient for all transports. If a + transport needs more crypto, the plugin writer can add his own + cryptography functions to src/crypt.c. -- Extending architecture logic +4.4. Extending architecture logic -obfsproxy tries to keep obfsproxy code and protocol-specific code as -disconnected as possible. This means that protocol-specific code -should know as little as possible about generic code internals, and -generic code should know nothing about protocol-specific code except -from what's exported through the protocol subsystem (src/protocol.[ch]). + obfsproxy tries to keep obfsproxy code and protocol-specific code as + disconnected as possible. This means that protocol-specific code + should know as little as possible about generic code internals, and + generic code should know nothing about protocol-specific code except + from what's exported through the protocol subsystem + (src/protocol.[ch]). -Plugin writers should not use their protocol-specific functions in -generic code, and should find a way to complete their task in the most -protocol-agnostic way possible. This helps keep both parts of the code -clean. + Plugin writers should not use their protocol-specific functions in + generic code, and should find a way to complete their task in the + most protocol-agnostic way possible. This helps keep both parts of + the code clean. [0]: https://gitweb.torproject.org/torspec.git/blob/HEAD:/proposals/180-pluggabl…

1 0

[obfsproxy/master] Add some more content to the architecture doc
by nickm＠torproject.org 29 Dec '11

29 Dec '11

commit d8f3f69dc761140a34653aff3b1db8c6925809f9 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Dec 29 11:10:29 2011 -0500 Add some more content to the architecture doc --- doc/obfsproxy_architecture.txt | 65 ++++++++++++++++++++++++++------------- 1 files changed, 43 insertions(+), 22 deletions(-) diff --git a/doc/obfsproxy_architecture.txt b/doc/obfsproxy_architecture.txt index 19809e6..299eb7d 100644 --- a/doc/obfsproxy_architecture.txt +++ b/doc/obfsproxy_architecture.txt @@ -1,26 +1,42 @@ - Obfsproxy Architecture + Obfsproxy Architecture + + George Kadianakis + Nick Mathewson 1. Top Level View obfsproxy is a pluggable transports proxy written in C. It's - compliant to the pluggable transports specification [0], and its + compliant to the Tor pluggable transports specification [0], and its modular architecture allows it to support multiple pluggable transports. - # It supports two modes of operation, the 'external proxy' mode and - # the 'managed proxy' mode. When used as an 'external proxy', the - # user configures obfsproxy using the command-line. When used as a - # 'managed proxy', obfsproxy can be configured by another application - # using the managed proxy configuration protocol defined in the - # pluggable transports specification [0]. + It supports two modes of operation, the 'external proxy' mode and + the 'managed proxy' mode. When used as an 'external proxy', the + user configures obfsproxy using the command-line. When used as a + 'managed proxy', obfsproxy can be configured by another application + using the managed proxy configuration protocol defined in the + pluggable transports specification [0]. + + While designed for use with Tor, it should be suitable for + integration with other protocols as well. + + Note also that although obfsproxy is designed to support multiple + protocols and obfuscation mechanisms, it is NOT required (or + intended) that every pluggable transport for Tor be implemented as a + module for obfsproxy. The point of pluggable transports [0] after + all, is that not every obfuscation mechanism should or can be part of + the same program. 2. Modularity - obfsproxy uses callbacks and object-oriented programming principles - to achieve modularity. This way, a developer who is interested in - writing a pluggable transport doesn't need to know obfsproxy's code - inside out. + obfsproxy tries to isolate its modules using callbacks and + vtable-based object-oriented programming principles. This way, a + developer who is interested in writing a pluggable transport doesn't + need to know obfsproxy's code inside out. + + obfsproxy outsources its networking and cryptography functionality to + Libevent 2.x and OpenSSL respectively. 2.1. Callbacks @@ -47,6 +63,11 @@ Developers that make good use of obfsproxy's callbacks and OOP, should be able to implement most pluggable transports. + The implementation uses the standard OOP-in-C trick of having a + subclass's type be a structure that includes the parent class's + structure as its first member, and having polymorphic functions be + implemented as an explicit vtable structure of function pointers. + 3. Codebase tour This section does a short introduction into some areas of obfsproxy's @@ -65,22 +86,22 @@ and 'downstream' connections. The upstream connection of a circuit communicates in cleartext with the higher-level program that wishes to make use of our obfuscation service. The downstream connection - commmunicates in an obfuscated fashion with the remote peer that the + communicates in an obfuscated fashion with the remote peer that the higher-level client wishes to contact. The diagram below might help demonstrate the relationship between connections and circuits: - downstream + downstream - 'circuit_t C' 'conn_t CD' 'conn_t SD' 'circuit_t S' - +-----------+ +-----------+ - upstream ----|obfsproxy c|-------------|obfsproxy s|---- upstream - | +-----------+ +-----------+ | - 'conn_t CU'| |'conn_t SU' - +------------+ +--------------+ - | Tor Client | | Tor Bridge | - +------------+ +--------------+ + 'circuit_t C' 'conn_t CD' 'conn_t SD' 'circuit_t S' + +-----------+ +-----------+ + upstream ----|obfsproxy c|----------|obfsproxy s|---- upstream + | +-----------+ ^ +-----------+ | + 'conn_t CU'| | |'conn_t SU' + +------------+ Sent over +--------------+ + | Tor Client | the net | Tor Bridge | + +------------+ +--------------+ In the above diagram, "obfsproxy c" is the client-side obfsproxy, and "obfsproxy s" is the server-side obfsproxy. "conn_t CU" is the

1 0

[obfsproxy/master] Minor correction on the handshake part of doc/protocol-spec.txt.
by nickm＠torproject.org 29 Dec '11

29 Dec '11

commit 2b0682cdaaa1338db7dc922854a9ff1da91952f6 Author: George Kadianakis <desnacked(a)gmail.com> Date: Mon Dec 19 18:39:05 2011 +0100 Minor correction on the handshake part of doc/protocol-spec.txt. Servers send their initial message right after clients connect to them. --- doc/protocol-spec.txt | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/doc/protocol-spec.txt b/doc/protocol-spec.txt index 4035b23..c0b0578 100644 --- a/doc/protocol-spec.txt +++ b/doc/protocol-spec.txt @@ -66,7 +66,7 @@ INIT_SEED | E(INIT_PAD_KEY, UINT32(MAGIC_VALUE) | UINT32(PADLEN) | WR(PADLEN)) - and the responder replies with: + and the responder sends: RESP_SEED | E(RESP_PAD_KEY, UINT32(MAGIC_VALUE) | UINT32(PADLEN) | WR(PADLEN))

1 0

r25275: {website} Update design doc to describe CSS media query and font patch (website/trunk/projects/torbrowser/design)
by Mike Perry 29 Dec '11

29 Dec '11

Author: mikeperry Date: 2011-12-29 04:23:25 +0000 (Thu, 29 Dec 2011) New Revision: 25275 Modified: website/trunk/projects/torbrowser/design/index.html.en Log: Update design doc to describe CSS media query and font patches. Modified: website/trunk/projects/torbrowser/design/index.html.en =================================================================== --- website/trunk/projects/torbrowser/design/index.html.en 2011-12-29 04:10:04 UTC (rev 25274) +++ website/trunk/projects/torbrowser/design/index.html.en 2011-12-29 04:23:25 UTC (rev 25275) @@ -1,6 +1,6 @@ <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> -<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>The Design and Implementation of the Tor Browser [DRAFT]</title><meta name="generator" content="DocBook XSL Stylesheets V1.75.2" /></head><body><div class="article" title="The Design and Implementation of the Tor Browser [DRAFT]"><div class="titlepage"><div><div><h2 class="title"><a id="design"></a>The Design and Implementation of the Tor Browser [DRAFT]</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Mike</span> <span class="surname">Perry</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:mikeperry#torproject org">mikeperry#torproject org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Erinn</span> <span class="surname">Clark</span></h3><div class="affiliation"><div class="address"><p><code class= "email"><<a class="email" href="mailto:erinn#torproject org">erinn#torproject org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Steven</span> <span class="surname">Murdoch</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:sjmurdoch#torproject org">sjmurdoch#torproject org</a>></code></p></div></div></div></div><div><p class="pubdate">Dec 16 2011</p></div></div><hr /></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="#id2532509">1. Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="#adversary">1.1. Adversary Model</a></span></dt></dl></dd><dt><span class="sect1"><a href="#DesignRequirements">2. Design Requirements and Philosophy</a></span></dt><dd><dl><dt><span class="sect2"><a href="#security">2.1. Security Requirements</a></span></dt><dt><span class="sect2"><a href="#privacy">2.2. Pr ivacy Requirements</a></span></dt><dt><span class="sect2"><a href="#philosophy">2.3. Philosophy</a></span></dt></dl></dd><dt><span class="sect1"><a href="#Implementation">3. Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="#proxy-obedience">3.1. Proxy Obedience</a></span></dt><dt><span class="sect2"><a href="#state-separation">3.2. State Separation</a></span></dt><dt><span class="sect2"><a href="#disk-avoidance">3.3. Disk Avoidance</a></span></dt><dt><span class="sect2"><a href="#app-data-isolation">3.4. Application Data Isolation</a></span></dt><dt><span class="sect2"><a href="#identifier-linkability">3.5. Cross-Origin Identifier Unlinkability</a></span></dt><dt><span class="sect2"><a href="#fingerprinting-linkability">3.6. Cross-Origin Fingerprinting Unlinkability</a></span></dt><dt><span class="sect2"><a href="#new-identity">3.7. Long-Term Unlinkability via "New Identity" button</a></span></dt><dt><span class="sect2"><a href="#click-to-play">3.8. Cli ck-to-play for plugins and invasive content</a></span></dt><dt><span class="sect2"><a href="#firefox-patches">3.9. Description of Firefox Patches</a></span></dt></dl></dd><dt><span class="sect1"><a href="#Packaging">4. Packaging</a></span></dt><dd><dl><dt><span class="sect2"><a href="#build-security">4.1. Build Process Security</a></span></dt><dt><span class="sect2"><a href="#addons">4.2. External Addons</a></span></dt><dt><span class="sect2"><a href="#prefs">4.3. Pref Changes</a></span></dt><dt><span class="sect2"><a href="#update-mechanism">4.4. Update Security</a></span></dt></dl></dd><dt><span class="sect1"><a href="#Testing">5. Testing</a></span></dt><dd><dl><dt><span class="sect2"><a href="#SingleStateTesting">5.1. Single state testing</a></span></dt></dl></dd></dl></div><div class="sect1" title="1. Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2532509"></a>1. Introduction</h2></div></div></div><p> +<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>The Design and Implementation of the Tor Browser [DRAFT]</title><meta name="generator" content="DocBook XSL Stylesheets V1.75.2" /></head><body><div class="article" title="The Design and Implementation of the Tor Browser [DRAFT]"><div class="titlepage"><div><div><h2 class="title"><a id="design"></a>The Design and Implementation of the Tor Browser [DRAFT]</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Mike</span> <span class="surname">Perry</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:mikeperry#torproject org">mikeperry#torproject org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Erinn</span> <span class="surname">Clark</span></h3><div class="affiliation"><div class="address"><p><code class= "email"><<a class="email" href="mailto:erinn#torproject org">erinn#torproject org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Steven</span> <span class="surname">Murdoch</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:sjmurdoch#torproject org">sjmurdoch#torproject org</a>></code></p></div></div></div></div><div><p class="pubdate">Dec 28 2011</p></div></div><hr /></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="#id2619754">1. Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="#adversary">1.1. Adversary Model</a></span></dt></dl></dd><dt><span class="sect1"><a href="#DesignRequirements">2. Design Requirements and Philosophy</a></span></dt><dd><dl><dt><span class="sect2"><a href="#security">2.1. Security Requirements</a></span></dt><dt><span class="sect2"><a href="#privacy">2.2. Pr ivacy Requirements</a></span></dt><dt><span class="sect2"><a href="#philosophy">2.3. Philosophy</a></span></dt></dl></dd><dt><span class="sect1"><a href="#Implementation">3. Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="#proxy-obedience">3.1. Proxy Obedience</a></span></dt><dt><span class="sect2"><a href="#state-separation">3.2. State Separation</a></span></dt><dt><span class="sect2"><a href="#disk-avoidance">3.3. Disk Avoidance</a></span></dt><dt><span class="sect2"><a href="#app-data-isolation">3.4. Application Data Isolation</a></span></dt><dt><span class="sect2"><a href="#identifier-linkability">3.5. Cross-Origin Identifier Unlinkability</a></span></dt><dt><span class="sect2"><a href="#fingerprinting-linkability">3.6. Cross-Origin Fingerprinting Unlinkability</a></span></dt><dt><span class="sect2"><a href="#new-identity">3.7. Long-Term Unlinkability via "New Identity" button</a></span></dt><dt><span class="sect2"><a href="#click-to-play">3.8. Cli ck-to-play for plugins and invasive content</a></span></dt><dt><span class="sect2"><a href="#firefox-patches">3.9. Description of Firefox Patches</a></span></dt></dl></dd><dt><span class="sect1"><a href="#Packaging">4. Packaging</a></span></dt><dd><dl><dt><span class="sect2"><a href="#build-security">4.1. Build Process Security</a></span></dt><dt><span class="sect2"><a href="#addons">4.2. External Addons</a></span></dt><dt><span class="sect2"><a href="#prefs">4.3. Pref Changes</a></span></dt><dt><span class="sect2"><a href="#update-mechanism">4.4. Update Security</a></span></dt></dl></dd><dt><span class="sect1"><a href="#Testing">5. Testing</a></span></dt><dd><dl><dt><span class="sect2"><a href="#SingleStateTesting">5.1. Single state testing</a></span></dt></dl></dd></dl></div><div class="sect1" title="1. Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2619754"></a>1. Introduction</h2></div></div></div><p> This document describes the <a class="link" href="#adversary" title="1.1. Adversary Model">adversary model</a>, <a class="link" href="#DesignRequirements" title="2. Design Requirements and Philosophy">design requirements</a>, @@ -473,13 +473,13 @@ Tor Browser State is separated from existing browser state through use of a custom Firefox profile. Furthermore, plugins are disabled, which prevents Flash cookies from leaking from a pre-existing Flash directory. - </p></div><div class="sect2" title="3.3. Disk Avoidance"><div class="titlepage"><div><div><h3 class="title"><a id="disk-avoidance"></a>3.3. Disk Avoidance</h3></div></div></div><div class="sect3" title="Design Goal:"><div class="titlepage"><div><div><h4 class="title"><a id="id2564908"></a>Design Goal:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> + </p></div><div class="sect2" title="3.3. Disk Avoidance"><div class="titlepage"><div><div><h3 class="title"><a id="disk-avoidance"></a>3.3. Disk Avoidance</h3></div></div></div><div class="sect3" title="Design Goal:"><div class="titlepage"><div><div><h4 class="title"><a id="id2652153"></a>Design Goal:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> Tor Browser MUST (at user option) prevent all disk records of browser activity. The user should be able to optionally enable URL history and other history features if they so desire. Once we <a class="ulink" href="https://trac.torproject.org/projects/tor/ticket/3100" target="_top">simplify the preferences interface</a>, we will likely just enable Private Browsing mode by default to handle this goal. - </blockquote></div></div><div class="sect3" title="Implementation Status:"><div class="titlepage"><div><div><h4 class="title"><a id="id2562959"></a>Implementation Status:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> + </blockquote></div></div><div class="sect3" title="Implementation Status:"><div class="titlepage"><div><div><h4 class="title"><a id="id2650204"></a>Implementation Status:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> For now, Tor Browser blocks write access to the disk through Torbutton using several Firefox preferences. @@ -544,7 +544,7 @@ context-menu option to drill down into specific types of state or permissions. An example of this simplification can be seen in Figure 1. - </p><div class="figure"><a id="id2547125"></a><p class="title"><b>Figure 1. Improving the Privacy UI</b></p><div class="figure-contents"><div class="mediaobject" align="center"><img src="CookieManagers.png" align="middle" alt="Improving the Privacy UI" /></div><div class="caption"><p></p> + </p><div class="figure"><a id="id2634370"></a><p class="title"><b>Figure 1. Improving the Privacy UI</b></p><div class="figure-contents"><div class="mediaobject" align="center"><img src="CookieManagers.png" align="middle" alt="Improving the Privacy UI" /></div><div class="caption"><p></p> On the left is the standard Firefox cookie manager. On the right is a mock-up of how isolating identifiers to the URL bar origin might simplify the privacy @@ -825,16 +825,16 @@ number of bits available to the adversary while avoiding the rendering and language issues of supporting a global font set. - </p><p><span class="command"><strong>Design Goal:</strong></span> - -We intend to <a class="ulink" href="https://trac.torproject.org/projects/tor/ticket/2872" target="_top">limit the number of -fonts</a> a url bar origin can load, gracefully degrading to built-in -and/or remote fonts once the limit is reached. - </p><p><span class="command"><strong>Implementation Status:</strong></span> -Aside from disabling plugins to prevent enumeration, we have not yet -implemented any defense against CSS or Javascript fonts. +We disable plugins, which prevents font enumeration. Additionally, we limit +both the number of font queries from CSS, as well as the total number of +fonts that can be used in a document by patching Firefox. We create two prefs, +<span class="command"><strong>browser.display.max_font_attempts</strong></span> and +<span class="command"><strong>browser.display.max_font_count</strong></span> for this purpose. Once these +limits are reached, the browser behaves as if +<span class="command"><strong>browser.display.use_document_fonts</strong></span> was reached. We are +still working to determine optimal values for these prefs. </p></li><li class="listitem">User Agent and HTTP Headers <p><span class="command"><strong>Design Goal:</strong></span> @@ -874,10 +874,15 @@ We have implemented the above strategy for Javascript using Torbutton's <a class="ulink" href="https://gitweb.torproject.org/torbutton.git/blob/HEAD:/src/chrome/content/j…" target="_top">JavaScript hooks</a> as well as a window observer to <a class="ulink" href="https://gitweb.torproject.org/torbutton.git/blob/HEAD:/src/chrome/content/t…" target="_top">resize -new windows based on desktop resolution</a>. However, CSS Media Queries -still <a class="ulink" href="https://trac.torproject.org/projects/tor/ticket/2875" target="_top">need -to be dealt with</a>. +new windows based on desktop resolution</a>. Additionally, we patch +Firefox to cause CSS Media Queries to use the client content window size +for all desktop size related media queries. + </p><p> + +As far as we know, this fully satisfies our design goals for desktop +resolution information. + </p></li><li class="listitem">Timezone and clock offset <p><span class="command"><strong>Design Goal:</strong></span> @@ -962,11 +967,11 @@ </p></li></ol></div></div><div class="sect2" title="3.7. Long-Term Unlinkability via "New Identity" button"><div class="titlepage"><div><div><h3 class="title"><a id="new-identity"></a>3.7. Long-Term Unlinkability via "New Identity" button</h3></div></div></div><p> In order to avoid long-term linkability, we provide a "New Identity" context menu option in Torbutton. - </p><div class="sect3" title="Design Goal:"><div class="titlepage"><div><div><h4 class="title"><a id="id2550338"></a>Design Goal:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> + </p><div class="sect3" title="Design Goal:"><div class="titlepage"><div><div><h4 class="title"><a id="id2637889"></a>Design Goal:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> All linkable identifiers and browser state MUST be cleared by this feature. - </blockquote></div></div><div class="sect3" title="Implementation Status:"><div class="titlepage"><div><div><h4 class="title"><a id="id2529377"></a>Implementation Status:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> + </blockquote></div></div><div class="sect3" title="Implementation Status:"><div class="titlepage"><div><div><h4 class="title"><a id="id2630536"></a>Implementation Status:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> First, Torbutton disables all open tabs and windows by tagging them and blocking them via the nsIContentPolicy, and then closes each tab and @@ -1095,7 +1100,7 @@ all keep-alive connections that still happen to be open. This event is emitted by the <a class="link" href="#new-identity" title="3.7. Long-Term Unlinkability via "New Identity" button">New Identity</a> button. - </p></li></ol></div></div></div><div class="sect1" title="4. Packaging"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="Packaging"></a>4. Packaging</h2></div></div></div><p> </p><div class="sect2" title="4.1. Build Process Security"><div class="titlepage"><div><div><h3 class="title"><a id="build-security"></a>4.1. Build Process Security</h3></div></div></div><p> </p></div><div class="sect2" title="4.2. External Addons"><div class="titlepage"><div><div><h3 class="title"><a id="addons"></a>4.2. External Addons</h3></div></div></div><p> </p><div class="sect3" title="Included Addons"><div class="titlepage"><div><div><h4 class="title"><a id="id2524128"></a>Included Addons</h4></div></div></div></div><div class="sect3" title="Excluded Addons"><div class="titlepage"><div><div><h4 class="title"><a id="id2524142"></a>Excluded Addons</h4></div></div></div></div><div class="sect3" title="Dangerous Addons"><div class="titlepage"><div><div><h4 cla ss="title"><a id="id2524152"></a>Dangerous Addons</h4></div></div></div></div></div><div class="sect2" title="4.3. Pref Changes"><div class="titlepage"><div><div><h3 class="title"><a id="prefs"></a>4.3. Pref Changes</h3></div></div></div><p> </p></div><div class="sect2" title="4.4. Update Security"><div class="titlepage"><div><div><h3 class="title"><a id="update-mechanism"></a>4.4. Update Security</h3></div></div></div><p> </p></div></div><div class="sect1" title="5. Testing"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="Testing"></a>5. Testing</h2></div></div></div><p> + </p></li></ol></div></div></div><div class="sect1" title="4. Packaging"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="Packaging"></a>4. Packaging</h2></div></div></div><p> </p><div class="sect2" title="4.1. Build Process Security"><div class="titlepage"><div><div><h3 class="title"><a id="build-security"></a>4.1. Build Process Security</h3></div></div></div><p> </p></div><div class="sect2" title="4.2. External Addons"><div class="titlepage"><div><div><h3 class="title"><a id="addons"></a>4.2. External Addons</h3></div></div></div><p> </p><div class="sect3" title="Included Addons"><div class="titlepage"><div><div><h4 class="title"><a id="id2611402"></a>Included Addons</h4></div></div></div></div><div class="sect3" title="Excluded Addons"><div class="titlepage"><div><div><h4 class="title"><a id="id2611409"></a>Excluded Addons</h4></div></div></div></div><div class="sect3" title="Dangerous Addons"><div class="titlepage"><div><div><h4 cla ss="title"><a id="id2611419"></a>Dangerous Addons</h4></div></div></div></div></div><div class="sect2" title="4.3. Pref Changes"><div class="titlepage"><div><div><h3 class="title"><a id="prefs"></a>4.3. Pref Changes</h3></div></div></div><p> </p></div><div class="sect2" title="4.4. Update Security"><div class="titlepage"><div><div><h3 class="title"><a id="update-mechanism"></a>4.4. Update Security</h3></div></div></div><p> </p></div></div><div class="sect1" title="5. Testing"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="Testing"></a>5. Testing</h2></div></div></div><p> The purpose of this section is to cover all the known ways that Tor browser security can be subverted from a penetration testing perspective. The hope

1 0