January 2016 - tor-dev - lists.torproject.org

Fwd: Orbot 15.1.0-RC-1
by Nathan Freitas 15 Jan '16

15 Jan '16

----- Original message ----- From: Nathan of Guardian <nathan(a)guardianproject.info> To: guardian-dev(a)lists.mayfirst.org Subject: Orbot 15.1.0-RC-1 Date: Fri, 15 Jan 2016 15:34:20 -0500 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Orbot v15.1 is out as a release candidate. It includes Tor 0.2.7.6, a very reliable VPN mode (full device or app-specific), a major update to Orbot icon, and many more important improvements. APK: https://guardianproject.info/releases/Orbot-v15.1.0-RC-1.apk Sig: https://guardianproject.info/releases/Orbot-v15.1.0-RC-1.apk.asc Code: https://gitweb.torproject.org/orbot.git/commit/?id=f541e9ffe14a2719863327bf… Changelog: https://gitweb.torproject.org/orbot.git/tree/CHANGELOG?id=f541e9ffe14a27198… /** 15.1.0-RC-1 / 15-January-2016 / f541e9ffe14a2719863327bf262b48de135ee0fd **/ We updated the essentials * 317405d update external versions of Tor 0.2.7.6 and OpenSSL 1.0.1q We made the ability scan QR codes from bridges.torproject.org work again! * 8f7165c fixes for settings processing and QRCode scanning of bridges - support new JSON array form bridges.torproject.org - only en ab We fixed the DNS leak bug in the VPN feature and improved the usability overall (no Orbot restart required) * 76b2171 update pdnsd and tun2socks to Android-16 add stpcpy function not present before Android-21 * 39244a6 fix the ability to select per app VPN routing * d839b15 fixes for VPN service UI to work on Android6 * 3691cca native binary asset building fixes move pdnsd exec to assets * f369652 add code to kill pdnsd daemon when VPN is stopped * f1fcec3 add support for PDNSD DNS Daemon for VPN DNS resolution Tor's DNS port doesn't work well with the VPN mode, so we will use PD * 8d8fe0c updates to improve VPN support * 699b60d add linancillary for badvpn tun2socks update for DNS We added the controversial ability for the user to easily set their exit country, with the default to the whole world * 52acf68 move "World" string to resource * 3b41365 allow country exit node select to persist * b208178 add initial support for easy exit country selection We now recommend Orfox over Orweb * 51205b8 update for Orfox * 0a5dd08 use a browser constant here, with the new constant being Orfox We made some new graphics * c54ab18 deleted these graphics * 534c2fb update style, icons and graphics We improve the build process, updated localizations and links to other repos: * 3240367 clean shouldn't clean assets, so we can easily builds for multiple platforms * 0081d00 remove Pluto Go building form this Makefile for now * 2288210 update to OpenSSL's github mirror * dfc5101 update tfx config * eaf49da update store and app translations * fe9119d update jenkins-build script * 6dc8cf6 update makefile for new pluto builds * 0261236 change this to "browser button" * 3462cbd small updates to icon and strings * bb55557 update installer to get PLUTO binaries from assets * 7d213e2 delete pluggable transport binaries here; build with Makefile use the external/pluto project * 6cf1201 update makefile to support PLUTO builds * 871701e add link for new icon * 6fb4f0c update binaries * cd0bfd3 [Trivial] Fixed broken reference to Main Activity in WALKTHROUGH * 0cde639 fix translations for common issues * 2acdd29 update localizations for strings and app description - - -- Nathan of Guardian nathan(a)guardianproject.info -----BEGIN PGP SIGNATURE----- Version: Mailvelope v1.3.3 Comment: https://www.mailvelope.com wsFcBAEBCAAQBQJWmVe+CRCoARg+abN6qQAAdksP/2REHo8U2M42/cBLD9Pd wKnPxGTNMnLYsv0Nq7hJMwmMky/7BNopBW9T2pjIiLSxj3soNUdw7LJAgA57 ns0bI2BNqILcai/gK3j9tw1dOQdfvYmfKL4omZuJpGSOSotGW/F9nVnv8SBn l8ddE0rU5FUyrJ3Si+QNgkCB4heij6oNOAFqrUb6YRQcUuu08tl18b3IGr1N VfWk4504FjwJIKX1LiYLVHRL2Se49UGYOmeg+cZtKcVV/6zmcl66hsaAdqZD +7IhcUivlGPU37v/IP3Af9hbpLIcW/eyW6Arf3kKD8Pv08mwg5gHQDblOcD0 j5Ai29Tig+75RHjmCdkIBnc4dhByGbNaiY49t12gBq2/m9zNwgqibmxozG3Y gTecvL5rGxgYdOYby1Hd9ndSF7x5R2L/IREAbotsvph4TxUhHh2AAnumAU9a YitErhaNE3vim6ywP8Il92WJ3gIDUlQimXAJuVmsOQcnXRLIq2LcJUW2IkfJ 1+D+Z4z1xJePDAOaguxK1WHb3TerG4y/CT7btQb2ibTf6u0pMgCYK7+bRf1S pPlkzr6sh+DWkihom+rU+vrLsqAhuGfVydsVy3RS+n6ea+dEpqY92YGaFXxZ XbwYrNOsBDD+rlzvKJr/51GgxmtGvVTfeh+P0bxClnIkwoyuDSH7MftONFeY OxI3 =16US -----END PGP SIGNATURE-----

1 0

Re: [tor-dev] Fwd: Orbot roadmap feedback
by Nathan Freitas 14 Jan '16

14 Jan '16

On Tue, Jan 12, 2016, at 10:48 AM, Georg Koppen wrote: > Nathan Freitas: > > - Overall improved configuration / settings UI to make tuning Orbot a > > better, simpler experience... this is an expansion of the new exit > > country selector in Orbot v15.1, but also includes managing things like > > network usage and so on. > > Could you explain that point a bit more, what you currently have and > what you plan to do? Especially the exit country selector seems kind of > scary to me but maybe I am just missing some bits. I looked at the > changelog you sent to tor-talk (in the alpha 1 release mail) but did not > find anything related. The broader idea is to determine which Tor torrc settings are relevant to the mobile environment, and that could use a more intuitive user interface than the empty text input we currently offer in our Settings panel. This may also mean implement a slider type interface mechanism similar to Tor Browser. In addition, users are interested in being able to control which network types (wifi vs 3g) Orbot runs on, in order to conserve spending on bandwidth. The Exit country selector option (basically a list of countries that starts with "World" as the option) is definitely controversial, but it is also something that comes up over and over again as a feature request. It is expected especially of a VPN-style app, which Orbot now is. It may be we only enable it when the VPN feature is enabled, and disable it when Tor is used directly via SOCKS from the Orfox browser. We may also need to just sufficiently warn and inform the user so they can decide for themselves what to do. +n

4 3

txtorcon: ipaddress instead of ipaddr?
by meejah 13 Jan '16

13 Jan '16

Regarding https://github.com/meejah/txtorcon/pull/155 does anyone have a good reason not to move txtorcon to using "ipaddress" -- this is a built-in library on Python3, with backports to Python2. Thanks, meejah

1 0

Re: [tor-dev] Fwd: Orbot roadmap feedback
by Nathan Freitas 13 Jan '16

13 Jan '16

On Tue, Jan 12, 2016, at 11:52 AM, Michael Rogers wrote: > On 12/01/16 16:16, Nathan Freitas wrote: > > The broader idea is to determine which Tor torrc settings are relevant > > to the mobile environment, and that could use a more intuitive user > > interface than the empty text input we currently offer in our Settings > > panel. This may also mean implement a slider type interface mechanism > > similar to Tor Browser. In addition, users are interested in being able > > to control which network types (wifi vs 3g) Orbot runs on, in order to > > conserve spending on bandwidth. > > Briar's TorPlugin has an option to disable Tor when using mobile data, > feel free to backport it to Orbot. Likewise for the plugin as a whole, > if it would be a suitable basis for LibOrbot. We've benefitted a lot > from your work and I'd love to send some contributions back upstream! Is TorPlugin already a distinct library / module? +n

2 1

Needs Code Review: Shared Randomness Generation for Tor
by George Kadianakis 13 Jan '16

13 Jan '16

Hello there, we are happy to tell you that we finished coding proposal 250 and our first attempt at implementation is ready for review. You can find the final specification here: https://gitweb.torproject.org/user/dgoulet/torspec.git/log/?h=prop250_final… and the corresponding code here: https://gitweb.torproject.org/user/dgoulet/tor.git/log/?h=prop250_final_v1 Trac ticket #16943 (https://trac.torproject.org/projects/tor/ticket/16943) will be used for code review. Please use this mailing list to discuss any issues with the spec. Some notes: We've separated this in 7 commits prefixed with prop250: except first one that adds a needed tor_htonll/ntohll function to tor utils. This code is mostly contained in two *new* files (with their headers) that are shared-random.{c|h} and shared-random-state.{c|h}. For what it's worth, we expect this code to run for a long time before the shared random values generated by the authorities are used for anything (e.g. HSDir scrambling). Cheers!

3 3

Questions about censorship detection paper
by John 13 Jan '16

13 Jan '16

Hi, I ran into the technical report from George Danezis about an anomaly-based censorship-detection system for Tor. I have a few questions that I hope you can help me with. Is there an implementation available of the approach described in the paper? The paper talks about finding anomalies in the time series of the number of requests to directory servers from certain jurisdictions. Where can I find this data about the requests to directory servers? --john [1] https://research.torproject.org/techreports/detector-2011-09-09.pdf

2 3

Fwd: Orbot roadmap feedback
by Nathan Freitas 12 Jan '16

12 Jan '16

I've got big plans for Orbot in 2016... any thoughts on the roadmap below, particularly how it aligns with Tor core roadmap, would be appreciated. ----- Original message ----- From: Nathan of Guardian <nathan(a)guardianproject.info> To: guardian-dev(a)lists.mayfirst.org Subject: Orbot roadmap feedback Date: Mon, 11 Jan 2016 22:58:05 -0500 Here is my current set of brainstormed ideas for Orbot that I am currently working through... please add, edit, improve and prioritize as you are willing and able. - Continued inclusion of the latest and greatest pluggable transports (Obfs*, Meek, ???) - Improved support for requesting and configuring Obfs4 bridges - directly integrate with BridgeDB to provide streamlined way for people to get bridges where Tor is blocked - More Orbot VPN features including better UI for enabling/disabling Tor routing, blocking specific apps, ports and/or hosts, and general "firewall" or little snitch type features within the Orbot VPN - OrbotShare: an OnionShare inspired file sharing and download manager service to enable easy hidden service .onion setup and sharing (including support for new ephemeral onions) - OrbotRelay/Bridge: improved UI for running a bridge or relay from within Orbot, including support for scheduled times (night only) or states (only when plugged in, on wifi, and screen is off, etc) - Removal of Polipo, in favor of new streamlined in process HTTP proxy (less memory use, and more stable) - Creation of LibOrbot module/library for use by any app to embed Tor into their app - Overall improved configuration / settings UI to make tuning Orbot a better, simpler experience... this is an expansion of the new exit country selector in Orbot v15.1, but also includes managing things like network usage and so on. - OrbotWear / OrbotTV: Should we expand Orbot support to other Android platforms like watches and Smart TVs? Perhaps Orbot relay/bridge mode could run on a TV or set top box? - Some sort of "Pro" or Donation-ware version to allow a pay-what-you-can concept within the app Good, bad, ugly? Let me know! -- Nathan of Guardian nathan(a)guardianproject.info

3 2

Propsal 263 Quantum-safe Hybrid handshake for Tor, updated feature request
by Zhenfei Zhang 12 Jan '16

12 Jan '16

Hi list, Thanks for all your valuable comments. We have updated the feature request following your comments. Please see the attachment for the updated feature request, and see https://github.com/zhenfeizhang/ntru-tor/commit/0354fe1d61b2b79615301ff387e… for the modification over last version. Thanks for your time, and please let us know if you have any further comments/suggestions. Cheers, Zhenfei

2 1

Summary of meek's costs, December 2015
by David Fifield 11 Jan '16

11 Jan '16

Here's the summary of meek's CDN fees for December 2015. App Engine + Amazon + Azure = total by month February 2014 $0.09 + -- + -- = $0.09 March 2014 $0.00 + -- + -- = $0.00 April 2014 $0.73 + -- + -- = $0.73 May 2014 $0.69 + -- + -- = $0.69 June 2014 $0.65 + -- + -- = $0.65 July 2014 $0.56 + $0.00 + -- = $0.56 August 2014 $1.56 + $3.10 + -- = $4.66 September 2014 $4.02 + $4.59 + $0.00 = $8.61 October 2014 $40.85 + $130.29 + $0.00 = $171.14 November 2014 $224.67 + $362.60 + $0.00 = $587.27 December 2014 $326.81 + $417.31 + $0.00 = $744.12 January 2015 $464.37 + $669.02 + $0.00 = $1133.39 February 2015 $650.53 + $604.83 + $0.00 = $1255.36 March 2015 $690.29 + $815.68 + $0.00 = $1505.97 April 2015 $886.43 + $785.37 + $0.00 = $1671.80 May 2015 $871.64 + $896.39 + $0.00 = $1768.03 June 2015 $601.83 + $820.00 + $0.00 = $1421.83 July 2015 $732.01 + $837.08 + $0.00 = $1569.09 August 2015 $656.76 + $819.59 + $154.89 = $1631.24 September 2015 $617.08 + $710.75 + $490.58 = $1818.41 October 2015 $672.01 + $110.72 + $300.64 = $1083.37 November 2015 $602.35 + $474.13 + $174.18 = $1250.66 December 2015 $561.29 + $603.27 + $172.60 = $1337.16 -- total by CDN $8607.22 + $9064.72 + $1292.89 = $18964.83 grand total https://metrics.torproject.org/userstats-bridge-transport.html?graph=userst… The number of users increased by about 1,000 in December 2015. meek-google had an outage as a result of a server migration between 23 November and 4 December. I set up a bridge that is not rate-limited. If you use it, your meek will go a lot faster. https://bugs.torproject.org/17890 The catch is that you have to set up a CDN or upload a PHP file yourself. Here are some docs to look at: https://trac.torproject.org/projects/tor/wiki/doc/meek#Howtorunameek-server… https://trac.torproject.org/projects/tor/wiki/doc/meek#GoogleAppEngine https://trac.torproject.org/projects/tor/wiki/doc/meek#AmazonCloudFront https://trac.torproject.org/projects/tor/wiki/doc/meek#MicrosoftAzure == App Engine a.k.a. meek-google == Here is how the Google costs broke down: 2528 GB $303.39 5158 instance hours $257.90 Compared to the previous month: 2162 GB $259.52 6856 instance hours $342.83 https://globe.torproject.org/#/bridge/88F745840F47CE0C6A4FE61D827950B06F9E4… == Amazon a.k.a. meek-amazon == Asia Pacific (Singapore) 56M requests $67.98 425 GB $58.83 Asia Pacific (Sydney) 2M requests $3.37 10 GB $1.41 Asia Pacific (Tokyo) 30M requests $37.14 242 GB $31.64 EU (Ireland) 142M requests $171.48 968 GB $76.50 South America (Sao Paulo) 5M requests $11.03 31 GB $7.46 US East (Northern Virginia) 86M requests $86.54 635 GB $49.88 -- total 324M requests $377.54 2314 GB $225.72 https://globe.torproject.org/#/bridge/F4AD82B2032EDEF6C02C5A529C42CFAFE5165… == Azure a.k.a. meek-azure == Zone 1 1560 GB $135.71 Zone 2 267 GB $ 36.89 -- total 1827 GB $172.60 https://globe.torproject.org/#/bridge/AA033EEB61601B2B7312D89B62AAA23DC3ED8… Earlier reports in this series: https://trac.torproject.org/projects/tor/wiki/doc/meek#Costs

2 5

Transparent proxying: automagically add firewall rules
by Rene Bartsch 11 Jan '16

11 Jan '16

Hi, transparent proxying to TOR Hidden Services is a great feature of the TOR daemon when it comes to other applications/protocols than HTTP and surfing. It would also be great with privacy appliances (e.g. Mailpile using TOR as secure SMTP transport channel). John Does have problems with such a setup because of the NAT firewall rules. So I suggest the TOR daemon should automagically set the necessary NAT-rules on Windows, Linux and BSD when "TransPort" and "VirtualAddrNetworkIPv[4|6]" are configured in torrc. -- Best regards, Renne

2 1