April 2013 - tor-dev - lists.torproject.org

Obfsproxy support for Tor Browser Launcher
by Micah Lee 27 Apr '13

27 Apr '13

I want to make it so Tor Browser Launcher users can optionally choose to install teh Obfsproxy TBB instead of the normal one, but I have some questions about that on this issue: https://github.com/micahflee/torbrowser-launcher/issues/38 Maybe someone here knows the answers. Here's the question: Do the obfsproxy bundles have the exact same release schedule as normal TBB? I know what the current alpha and stable version numbers are by looking here: https://check.torproject.org/RecommendedTBBVersions At the moment it seems like the current alpha is 2.4.11-alpha-2, and the obfsproxy bundle is at that same version too. Is it ever recommended to run the "stable" obfsproxy bundle? -- Micah Lee https://twitter.com/micahflee

4 4

GSoC 2013: Build Better Pluggable Transports
by Chang Lan 26 Apr '13

26 Apr '13

Hello all, My name is Chang Lan. I am a fourth-year computer science undergraduate student at Tsinghua University, China, and will be a grad student at Berkeley focusing on networking in this fall. I have been a big fan of the Tor Project for years, as I am actually using it for circumventing the censorship. I look forward to contributing to this project as well. Specifically, I would like to improve current obfsproxy implementation, so that it can resist active censors from scanning its presence. To my knowledge, obfsproxy should avoid responding to handshake requests from clients unless clients have the server's key, which shall be obtained from BridgeDB. I am a newbie at Tor development though, and it would be great if there is anyone willing to talk further with me on this topic. Thanks. - Chang

1 0

Human factors of security software
by Bernard Tyers - ei8fdb 26 Apr '13

26 Apr '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello nice Tor people, [I've spoken with Runa about this and she suggested me to send this to the dev list. If it should belong somewhere else, just let me know. Thanks Runa.] Tl;dr: 6 months worth of a reasonably security/privacy/encryption savvy HCI researchers time to carry out a MSc dissertation about usability of security software, and the effect their UIs have on peoples idea of how they work. (You may see this e-mail on a number of lists,I'm mailing each list individually.) Seeing as I am going to be asking for a favour, I should give some information about me. My background is: electronics engineering, network and systems admin, then telecoms engineer (mobile networks). I'm not a coding/security/crypto bod, but security has been part of the past 10 years+ of my work that I can understand some and know where to find/who to ask for the answers for the other. My interest is: HCISEC - Human Computer Interaction in security technology. Security, privacy, encryption tools and why people, who should use them, do not use them. I define a "people who should use them" as human rights activists, investigative journalists, people in countries whose government are oppressive. I define "security, privacy, encryption tools" as "Tor, TBB, Orweb, Orbot, PGP, Redphone, TextSecure, Pixelknot, Silent Circle, Tails, and other tools I don't yet know about. My focus is not with security professionals/experts, technical people who can understand the limitations of these tools, threats they defend against. These users have the technical knowledge and understanding of computing concepts, and threat models, etc which allow them to make a more educated decision. I am doing a masters in human computer systems, and it's coming to the time to start planning my dissertation. My chosen topic (very generally) is: "Usable security and its impact on mental models and trust." Over the next few weeks I want to focus this better. (If you're familiar with the concept, or are not interested, just skip this.) A mental model is a "small scale model of reality" humans create to use to reason, to anticipate events, and to reenforce explanation. Based on the users understanding of a software interface, they will construct an idea of what is happening in an application. If a user creates a number of mental models because a software interface gives different/wrong/conflicting information, this causes the user to be confused, as as result, they will make incorrect decisions, and possibly stop using the software. Given the scenarios where these tools are used, making mistakes, having a false sense of security, or not using them, can be dangerous. There is a lot of research in trust and confidence in recommender systems, transparency in system status, credibility of information provided in user interface, but (from what I've found so far) not much specifically to do with security and privacy tools. So to my request: I have 6 months (beginning from May) to carry out a hcisec human factors focused project. There have been usability evaluations of Tor carried out already, and I was looking for other areas to focus on. I can find a subject myself, but I would like to do some work on an area that could lead to some useful research/provide input to making these tools better, from a user point of view. Is there a question you'd love to see answered? Is there some area of a tool that needs some research? I will also be looking for participants to take part in research - again I am very conscience of the scenarios where these tools are used, and the need to maintain anonymity and privacy. I will be anonymising all research, asking for the minimum information and am happy to carry out communications via secure communications tools. I would appreciate support from users of security and privacy tools. At the end, all research will be released and available for use by the security community if required. At the risk of teaching you to suck eggs, if you are interested in learning more, I can recommend the "Security and Usability: Designing Secure Systems that People Can Use" book by Lorrie Faith Crannor and also the SOUPS Conference (http://cups.cs.cmu.edu/soups/2013/) I look forward to some feedback (on or off list). thanks, Bernard - -------------------------------------- Bernard / bluboxthief / ei8fdb IO91XM / www.ei8fdb.org -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJRY/8bAAoJENsz1IO7MIrrM4AIALW27F757Fn4Jgy3pk0ZX4PQ yl4ToEyJcFmZcKNjlejuTAeeVc00UGLlJRNTPuGT1WAUwt7JhgCYX8p9/YwgA4Pm 1AU6tCHcg9LBpc8ca+0lqBvCh/ZmVf5zTTEVjlXyylrUpqdlR67QemkpyjN0sUJW V7PGPxig2Y3opdVzWZRrmvhLsJf7qN2mAxLUyzSS44nInqpS9+Db1MsDLpI5mof5 ze/FUKV3eTiTzJJ1qLMXbo8VbJvpZO3HgeUFwZH7btbUZQszwrifWupuZefqtro5 nyCNFnUcQ6fyxMOnRLPAji2eAe/fBasQ9h5pCiYVScclddWe1VWhf4poyjVHv9U= =Sak4 -----END PGP SIGNATURE-----

2 3

Finding the HSDIR responsible for a certain onion address
by Frank Young 25 Apr '13

25 Apr '13

Dealing with v2 hidden service descriptors, how does a tor client get the list of HSDIR are responsible for a certain onion address so it can contact them for descriptor of the hidden service?. According to rend-spec.txt the list of the responsible HSDIR for a particular hidden service changes almost in every 24.

3 3

Atlas/Compass GSoC 2013
by Newk 24 Apr '13

24 Apr '13

Hi, I'm Nikola, 1st year student in the university in Skopje, Macedonia. Around 6 months ago I've put a tor relay at home - one of only two running in the whole country (the other one is placed in the local hackerspace, also the only one in the country). Being interested in internet anonymity and network security, I've started reading about how tor works and how I can make a contribution in the project. I would like to work on Atlas and/or Compass (even Vidalia or Arm), because as a tor relay owner, I've met some points I would like to improve. Any thoughts? Thanks, Nikola P.S. As a late blooming activist, I would like to contribute to this project even if I don't be selected for this years GSoC program. The reason being that in couple of years or less, you will see my country as a place where democracy quietly ceased to exist. And tor will be the only way reaching to the outside. On this note, I'd like to add that my goal is not only contributing by improving tor, but also making a shout to the free-minded

3 4

Txtorcon/Stem Integration : GSoC 2013
by Akshit Khurana 23 Apr '13

23 Apr '13

Hi, I'm Akshit, a 4th year Computer Science student at IIT Roorkee. I'm a part of Information Management Group(IMG) here, which is a student body responsible for developing and managing all Internet and Intranet applications in IIT Roorkee, including the institute website and registration & placement portals. I would like to work on Txtorcon/Stem Integration. I have some experience working with Python and web frameworks Django and Flask contributing to IMG's projects and to openSUSE's popcorn project[1]. I don't have much experience with Twisted except for a few tutorials but I'm sure I'll pick it up. To get acquainted with Tor and Stem, I'm working on a patch[2] for stem with Damian's help. I'm going though txtorcon's code as well. Thanks, Akshit http://github.com/axitkhurana [1] https://github.com/openSUSE/popcorn/commits/master?page=2 (username axitkhurana) [2] https://trac.torproject.org/projects/tor/ticket/8607

2 1

Stem GSoC 2013
by Tomasz Kunikowski 23 Apr '13

23 Apr '13

Hey, My name is Tomasz Kunikowski, I'm a production engineering student at Wroclaw University of Economics branching heavily into IT. My handle on IRC and trac is ragwater. I'm mainly interested in expanding stem's tutorial base as it could really use some more real-world applications and examples, but I'd be fine with extending the tests, too. I started with some minor bugfixes to stem to get a better hang of the library and the inner workings of tor in general, and if time permits I'll contribute some more besides the code sample required in application. Regards, Tom

2 1

Removing Onion Skins
by Frank Young 22 Apr '13

22 Apr '13

After circuit extension to the second Node, I realized that the OR at the second node can decrypt my cells and successfully process my circuit extension request to increase my circuit length to three but i can't decrypt the response from the same OR. At first I thought maybe I was messing up the key for backward encryption (should be decryption but it is counter mode crypto) but i realized it wasn't true. I extracted both the KF and KB at the same time and the crypto scheme is also the same for encryption and decryption since it is a counter mode AES operation. From the tor protocol specification, I will have to remove all skins starting with the immediate OR towards the exit Node. When the application of the above specification failed to decrypt the cell successfully, i decided to remove the skins in reverse order but this also failed. I'm really confused at the moment. Aren't each successive AES counter operation independent of the previous?

2 2

Remote access to TOR through web server
by Mahesh Baheti 22 Apr '13

22 Apr '13

I've discussed this idea before here. Few people asked me how to implement it? I can discuss it if someone gives me any idea about gsoc applications. Mentors please reply.

1 0

Behavior of pluggable transport proxies on SIGINT
by David Fifield 20 Apr '13

20 Apr '13

This is what 180-pluggable-transport.txt says about proxies and SIGINT: > Proxies should respond to a single INT signal by closing their listener > ports and not accepting any new connections, but keeping all connections > open, then terminating when connections are all closed. Proxies should > respond to a second INT signal by shutting down cleanly. I implemented the websocket-server transport to do this. https://gitweb.torproject.org/flashproxy.git/blob/c23caf1f71f8281319cadf550… I noticed unexpected behavior when the proxy receives a SIGINT, and doesn't have any open connection, and so exits immediately without waiting for a second SIGINT. The parent tor process tries to kill a nonexistent PID: > ^CApr 19 17:58:59.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now. > ^CApr 19 17:59:05.000 [notice] SIGINT received a second time; exiting now. > Apr 19 17:59:05.000 [notice] Failed to terminate process with PID '18277' ('No such process'). Is this intended? It seems the PID might have been reclaimed in the meantime, and tor could be killing an unrelated process. I can think of two changes that would make it seem to me to work more naturally. The first is for tor to poll the child PID to see if it has exited before killing it; this reduces the race window. The other is to require proxies always to wait until their second SIGINT before quitting. (Concretely in the websocket-server example, remove the"numHandlers != 0" condition from the second sigint loop.) David Fifield

2 1