tor-dev

tor-dev@lists.torproject.org

February 2019

28 participants
22 discussions

The Tor project as a GSoC voucher for Whonix?
by iry 06 Feb '19

06 Feb '19

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Dear Tor Developers, Whonix is applying to be a Google Summer of Code organization this year. I am writing on behalf of Whonix to ask if the Tor project could be a voucher for Whonix. Specifically, in the application form, it asks: > If you are a new organization to GSoC, is there a Google employee > or previously participating organization who will vouch for you? If > so, please enter their name, contact email, and relationship to > your organization. Whonix community would be really appreciated if Tor can be our voucher this year. And please feel free to contact me to provide the information described above anytime before the deadline (February 6, 2019 at 20:00 UTC). Thank you very much! Cheers, iry -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEzKSpZKlpRovTotu+oUtNvG3N1TwFAlxY0EMACgkQoUtNvG3N 1TwY/A//SawazcU4EosRFRkF8YJSz3LsRor820uF+X/QovEi5J8EJGaXBgO+Dp+Q Ryi/LzmdGwIWfmWJKk+kWpzfIROYkmNWS6xzz+iwZEYvxvJ2QH5twlAWKDWSwFHm kz7/6AhWnoq+GnsBF+Eg0jNcxSQGLum89Ul4Y3kll4PYriqpDxzQblYt7qzffJJu UJdh9Y5SkSRyX0HThuRgMtCs1l9z7BEY0tkLbUm1pRcU8KuomTy4f1L45T49h7ub rfDc4AOBcA8wtX3CF/1oR0AmRo5YvwD9rMNsk4f+bHphdn07iOcwF5kGi6TxA8Va fLUflN0cIPnk62RmQPebkHSjcyWi74z4rxe2j7trmiDyN2DI3D7wLxNQPYRzO5/H 4YodMAgUkhNluDmJ0Hewq6e3q9js5/6ks1vTGbJjzTW+le2+MOiSiJeZgQYfdF1d Fu7Yf3h6HmIs9zg9zv9qf7CUSizBQVqGqnSUVVyMSsSE5xtX0Enri15PodkMac5C 87m5JDJIuf6HdsCiJ+cXQsCOoTCVz1rFxUMmH3URIOJQX6POZlYjZ4yir1TVc1Uj OkjvsUO89YbnmBpnTJe/0KGS+OjXI+NE3iQfV5d6hIoruqVuIMzL6/O/1Q4onviu oFiCp/ilBtDm8lRlXAbKAIKibYPSAPhoO4xN9jI1NIPoWouwusk= =xX5B -----END PGP SIGNATURE-----

3 5

Release: obfs4proxy-0.0.9
by Yawning Angel 05 Feb '19

05 Feb '19

Hello all, I just tagged obfs4proxy-0.0.9. The main features of this release are primarily related to improving the behavior of the `meek_lite` transport. Since some of the changes are major, I will expand on them separately from the brief summary given in the ChangeLog. * A forked version[0] of https://github.com/refraction-networking/utls is now used to mask the TLS signature. This results in a ClientHello that should resemble modern versions of Firefox by default. While the utls profile is named `HelloFirefox_63`, a cursory examination leads me to believe that there are no differences in FF 65. The bridge line option `utls=<fingerprint>` will allow specifying the behavior, with (case-insenstive) string representations of the utls fingerprint names. `none` will revert to the previous behavior. Not all fingerprints were tested and or are guaranteed to work. Development was primarily done with `HelloChrome_70, `HelloFirefox_63`, and `HelloChrome_71` (experimental). While I can not vouch for the mimicry accuracy of every single profile, all of the profiles that attempt to mimic browsers should function fairly well[1], though this partially depends on the the configuration of the host doing the fronting. * meek_lite now has HPKP[2] style public key pins for all of the Microsoft CA certs that are used to sign Azure leaf certificates. This is only enabled when `utls` is being used, because I'm lazy. If Microsoft happens to change their CA certificates prior to the next release, 2024-05-20, or you are ok with being actively man-in-the- middled for some reason, adding `disableHPKP=true` to the bridge line will disable certificate pin validation. HPKP headers in HTTP responses are ignored, only the static pin list is consulted. * Due to a shift in my philosophy, portions of the new code are released under the GNU General Public License v3. Exceptions to the viral nature of the license will be considered on a case-by-case basis. Contact me for more details. Tarball/Signature: https://people.torproject.org/~yawning/releases/obfs4proxy/obfs4proxy-0.0.9… https://people.torproject.org/~yawning/releases/obfs4proxy/obfs4proxy-0.0.9… Changes in version 0.0.9 - 2019-02-05: - Various meek_lite code cleanups and bug fixes. - Bug 29077: uTLS for ClientHello camouflage (meek_lite). - More fixes to HTTP Basic auth. - (meek_lite) Pin the certificate chain public keys for the default Tor Browser Azure bridge (meek_lite). Regards, -- Yawning Angel [0]: obfs4proxy WILL NOT build with the upstream version of the library, and the Firefox fingerprint will not function with Azure using the upstream version. [1]: For "I can watch Eluveitie music videos on youtube over it" definitions of "fairly well". [2]: Yes, the HPKP spec is rather dead in the wild with a lot of people giving up on it. It is my opinion that in this context having such a mechanism makes sense.

1 0