March 2019 - tor-dev - lists.torproject.org

Orbot and Tor on Android Q
by Nathan Freitas 22 Mar '19

22 Mar '19

Orbot 16.0.6-BETA-1-tor-0.3.5.8 <https://github.com/n8fr8/orbot/releases/tag/16.0.6-BETA-1-tor-0.3.5.8> https://github.com/n8fr8/orbot/releases/tag/16.0.6-BETA-1-tor-0.3.5.8 is out (binaries on Github for now) for testing, specifically on Android Q. It is built on a new release of: tor-android-binary-tor-0.3.5.8-rc <https://github.com/n8fr8/tor-android/releases/tag/tor-android-binary-tor-0.…> https://github.com/n8fr8/tor-android/releases/tag/tor-android-binary-tor-0.… This now uses the method of bundling the tor executable as a tor.so library, allowing the Android runtime to unpack them into the /data/libs read-only space within the app's private directory. We then can just execute it there, without needing to unpack it, copy it, etc. The word is that this will work on Android Q still. I have tested on an emulator, but not a real device yet. I don't have a Pixel of any kind, at the moment, so please let me know if you do and can test. Otherwise, we are working to move tor and other important binaries, like obfs4proxy, into actual in-process libraries. We've recently made great progress with this on our iOS work with Onion Browser, and so it should now be possible on Android. New commits below.... *** ATTENTION ANDROID Q / PIXEL TEST USERS: We've made changes just for you! WARNING: Meek/Obfs4 bridges WILL NOT work on Android Q yet, just plain Tor fb14c76 <https://github.com/n8fr8/orbot/commit/fb14c76c3a75977af9e86887b54dad5d15ae2…> fixed strings with two many \ escapes 4557577 <https://github.com/n8fr8/orbot/commit/455757726d519ac56cd53eaed29c3abef2570…> updating to tor-0.3.5.8-rc to add support for Android Q 22d5ffd <https://github.com/n8fr8/orbot/commit/22d5ffdf8bc3d51bb014e319d9f1e6b2ecb3e…> update gradle tools 76796fe <https://github.com/n8fr8/orbot/commit/76796fea83ef7efe3e33f6f5862fd71171a70…> Merge pull request #200 <https://github.com/n8fr8/orbot/pull/200> from eighthave/fastlane-supply 6ba0cec <https://github.com/n8fr8/orbot/commit/6ba0ceccbde67310c22fc9fa4e0dc88d93274…> add .gitlab-ci.yml setup with errorprone 3face00 <https://github.com/n8fr8/orbot/commit/3face00a66874afb793470922e381a9e463b1…> build gradle to 4.4.1, and make gradlew verify the download 69bd7fe <https://github.com/n8fr8/orbot/commit/69bd7fe9e6fd0fcde92ea53dd6236e50f7b37…> move app store graphics into fdroid/fastlane file layout f93c11e <https://github.com/n8fr8/orbot/commit/f93c11e74599cc24c7467d58ba0fc81c38c3c…> Merge pull request #190 <https://github.com/n8fr8/orbot/pull/190> from SkewedZeppelin/master 8ab13f6 <https://github.com/n8fr8/orbot/commit/8ab13f63a6f529d97816568170e02a1bced3c…> Fixup bad indentation from 6e4b700 <https://github.com/n8fr8/orbot/commit/6e4b7008035b2bf1a9035b730aad178bfd424…> 12b91c4 <https://github.com/n8fr8/orbot/commit/12b91c44f3af675dd0db5a3bacbf232c0f8d6…> Expose PreferIPv6 and NoIPv4Traffic options 8ad7668 <https://github.com/n8fr8/orbot/commit/8ad7668013a7291b98cf8689cd99961db69f8…> Move Google repo above jcenter d4befad <https://github.com/n8fr8/orbot/commit/d4befad117f3485f0aa67b2ce44d3f1b13de2…> cleanup and binary loading fixes

1 0

Testing Tor bridge assignments
by Jodi Spacek 20 Mar '19

20 Mar '19

Hi! I'm seeking advice on simulating Tor's consistent hashing, bridge ring distributor. I'm finishing up my Master's thesis on proxy distribution :) I run BridgeDB through my Python simulator to analyze the https distributor's bridge assignments over multiple bridge pool sizes and trials. So far, it follows a uniform random distribution (as expected). I'm using https distributor's prepopulateRings() example as a guideline on how the rings should be populated. Besides the default ring settings, are there any other test scenarios that I should cover? For instance, is there a possibility that the behaviour might change if there are quality of service limitations? Aside from the reserved set, are there any cases where it may not assign bridges uniform randomly that I should consider? I attempted to use the descriptors from leekspin, but ran into some hurdles integrating it with my simulator. My simulator doesn't need to persist or store state, since I only need the assignment information of proxies to clients until all proxies are enumerated. I hope the pared down version using the test data from generateFakeBridges() in test/util.py is adequate. Any advice is greatly appreciated!

1 0

Tor Friendliness Scanner
by Kevin Gallagher 18 Mar '19

18 Mar '19

Hello tor-dev! My name is Kevin and I'm a PhD student at NYU. Recently I've been working on creating a "Tor Friendliness Scanner" (TFS), or a scanner that will measure what features of a given website are broken (non-functional) when accessed on the Tor Browser (TB), along with actionable suggestions to improve it. In order to do this, we first must get an approximation of ground-truth data of how a given website should work. We then need to compare it to how the website works on the TB to determine any changes. To generate a method of determining ground-truth, we decided to modify* the Firefox (FF) browser to log all of the steps of the creation of the Content Tree (also called the DOM tree), and to log the execution of all JavaScript functions (currently underway). We then will apply these changes to the TB as well, and run a scan of popular Web sites using the modified FF and the modified TB on all three of the TB security slider settings. We will then compare the resulting logs to determine where the tree creation processes differed* and why. These differences could potentially help us illuminate two things: 1. what functionality issues the Tor Browser encounters on popular Web sites, and 2. what threats (beyond metadata surveillance) the TB is protecting its users from in-the-wild. As far as I have considered, this method seems to capture a lot, but it's far from complete. For one thing, it obviously won't detect any difference that's spawned from user interaction or input (such as a script launched by an OnClick event). However, it does seem to make automation of scanning for Tor Friendliness possible, and can allow for wide-scale use. We have moved ahead with development (though have not yet finished it) and are (hopefully) very close to a working prototype. I was wondering if there was feedback on this method, or if anyone can consider an angle we have not that would either make the TFS more robust, easier to create, or both. Thanks for your time and consideration! Kevin *Note 1: Unfortunately we cannot just rely on JavaScript for examining the content tree, since this needs to work on all 3 security settings of the TB's security slider, and the "safest" setting deactivates JavaScript by default on all Web pages. *Note 2: There can be non-functional differences in Web pages, such as different ads showing or the display of the current time. We are working on methods to distinguish these from functional differences, such as using ad blacklists to determine if a given request or script is part of an ad, and ignoring it as part of the difference between the two trees. -- Kevin Gallagher Ph.D. Candidate Center For Cybersecurity NYU Tandon School of Engineering Key Fingerprint: D02B 25CB 0F7D E276 06C3 BF08 53E4 C50F 8247 4861

8 10

Proposal: Don't include package fingerprints in consensus documents
by Iain Learmonth 13 Mar '19

13 Mar '19

Hi All, #28465 [0] needed a proposal. Feedback is welcome and encouraged. I've not written a proposal before, so if someone could let me know if I'm following the process OK (or not) then that is useful too. Thanks, Iain. [0] https://trac.torproject.org/projects/tor/ticket/28465

3 8

#3600 tech doc
by Richard Pospesel 13 Mar '19

13 Mar '19

Hey y'all, For the past little while I've been working on a technical overview doc for #3600 (Prevent redirects from transmitting+storing cookies+identifiers) detailing the problems, scenarios and possible solutions. Please take a look and feel free to comment, edit or add! Link: https://storm.torproject.org/grain/X4nhdNqR9fGRc7sgTefFkg/ best, -Richard

3 7

Updating Proposal 299 (Preferring IPv4 or IPv6 based on IP Version Failure Count)
by Neel Chauhan 13 Mar '19

13 Mar '19

Hi tor-dev@ mailing list, I have Proposal 299, also known as "Preferring IPv4 or IPv6 based on IP Version Failure Count" which makes ClientAutoIPv6ORPort take into account IPv4 and IPv6 failures. An older version of this document is available here: https://gitweb.torproject.org/torspec.git/tree/proposals/299-ip-failure-cou… I have attached an updated copy of this proposal to this message. This includes the changes recommended by teor at https://lists.torproject.org/pipermail/tor-dev/2019-February/013673.html. Would someone be able to update torspec to include the updated (and attached) proposal? Also, if any of you have opinions on this proposal, please share them with me. -Neel === https://www.neelc.org/

2 5

download consensus from mirrors based on frequency options in torrc
by Pouya Miralaee 08 Mar '19

08 Mar '19

Hello to the community. according to these frequency options below, how should i specify that tor does not or if it has to, only in necessary times downloads consensus from directory servers and in all other cases, download them from mirrors or fallbacks. "ClientBootstrapConsensusAuthorityDownloadSchedule": "6, 11, 3600, 10800, 25200, 54000, 111600, 262800", "ClientBootstrapConsensusFallbackDownloadSchedule": "0, 1, 4, 11, 3600, 10800, 25200, 54000, 111600,262800", "ClientBootstrapConsensusAuthorityOnlyDownloadSchedule": "0, 3, 7, 3600, 10800, 25200, 54000, 111600,262800", I just intend to complete the decentralized situation in here. but i can not figure out how these frequency options work together. thanks in advance. Cheers. -- *Pouya Miralayi* -- *Pouya Miralayi*

2 1

March Network Team Meeting Schedule
by teor 01 Mar '19

01 Mar '19

Hi, Next week's network team meeting is at a different time. We'll be meeting at Tuesday 5 March at 2300 UTC on #tor-meeting on OFTC. Here is our March schedule: * Tuesday 5 March at 2300 UTC * Monday 11 March at 1800 UTC * Monday 18 March at 1800 UTC * Monday 25 March at 1800 UTC We'll have a similar schedule in April, except for the company holiday on April 22. T -- teor ----------------------------------------------------------------------

1 0