- tor-dev - lists.torproject.org

Interested in GSoC opportunity
by Deepankar Tyagi 16 Mar '16

16 Mar '16

Hi everyone, I am a computer science student at undergrad level, would love to contribute to Tor, currently in the process of drafting the proposal. This mail is an effort to seek guidance to define scope, goals and timeline more clearly. Currently interested in two ideas and plan to submit only one of these based on feedback and guidance from mentors. idea #1 Extending and Improving Krotor. This is continuation of my last year GSoC project in which libevent and Tor were ported to NaCl (a C/C++ sandbox environment on chrome), full detail can be seen at https://deepankar.io/gsoc and https://deepankar.io/krotor. It was later published on webstore and currently has close to 13k active users. A lot of improvement can be made to this project, viz supporting obfuscation, making it more user friendly, adding support for configuring exit gates etc, updating it to latest stable release. I would greatly appreciate any guidance on various matters for instance: making it more resistant to any privacy leaks such as dns leaks on webrtc and on windows due to no global policy of dns etc. I would be very grateful if anyone is willing to mentor for this. idea #2 Exitmap Improvements I got stuck when defining timeline for this project. I would appreciate any insights regarding what should be deliverable by mid-term of GSoC. Also this project will a involve lot of brainstorming, preferably with mentor, is there a possibility of weekly/every two weeks session for an hour or half hour with mentor on hangout/skype etc (at least in the beginning) What would be preferred means to get/see progress reports and preferred frequency of the same. Some hyperlinks: Github <https://github.com/codebuff> || LinkedIn <https://www.linkedin.com/in/codebuff> || KroTor <https://deepankar.io/krotor> Best Regards. *Deepankar Tyagi* *Projects & Resume : deepankar.io <https://deepankar.io>*

3 7

Prop259 simulator and results
by George Kadianakis 16 Mar '16

16 Mar '16

Hello there, I'm not sure what kind of statistics we get out of the current guard simulator. In general, we are interested in security and performance. For security we are trying to minimize our exposure to network. For performance, we want to minimize our downtime when our current guard becomes unreachable or after our network comes back up. Here are some concrete statistics that we could gather in the simulator: Security statistics: - Number of unique guards we connected to during the course of the simulation. - Time spent connected to lower priority guards while a primary guard was online. - Time spent connected to lower priority guards while a higher priority guard was online and the network was up. Performance statistics: - Time spent cycling through guards. - Time spent cycling through guards while network is up. - Time spent on dystopic mode. - Time spent on dystopic mode while the network was utopic. Is it possible to collect those statistics? I'm curious to learn how the current guard algorithm compares to the new prop259 on those aspects. What other stats are important here you think?

2 7

GSOC: Panopticlick
by - - 15 Mar '16

15 Mar '16

Hello! My name is Akito Ono. I'm a computer science student in Japan and very intrested in participating in GSoC this year. I read docs about projects and I was particularly intrested in Panopticlick project. And I have some questions about Panopticlick. Is this project based on Libre-Panopticlick( https://github.com/qqTYXn7/browserprint) or building from scratch? Is programming language used in project designated? Best regards!

4 5

User Behavior Tracking defenses in VMs
by bancfc＠openmailbox.org 15 Mar '16

15 Mar '16

Intended for qemu-discuss /cc/ libvir-list, whonix-devel, tor-dev *** Hello. I work on WhonixOS an anonymity distro based on Tor. This feature request is related to the topics of privacy and anonymity. Its a complex topic and probably not in your area of focus but I think it has important implications because security and privacy are very much related in today's hostile computing environment. Virtualization is useful in presenting an identical environment and set of "hardware" for each user which goes a long way in creating an anonymity set of systems. That way a system attacker, advertisers and online trackers would not be able to fingerprint a user or their hardware. The problem: Tracking techniques have become more sophisticated with time. They advanced from simple cookies to browser/device fingerprinting (which Tor Browser focuses on defeating) to user behavior fingerprinting. The latter is about profiling how a user types on a keyboard or uses a mouse [2]. Keystroke dynamics is a super creepy way to track users based on how long they press keys (dwell time) and the time between key presses (gap time). This is extremely accurate at identifying individuals because of how unique these measurements are. Advertising networks (Google, Facebook...) that fingeprprint users on both the clearnet and Tor can deanonymize users. This technique is already actively used in the wild [6][7]. Potential Solutions: Since input devices are all emulated its a great opportunity to stop this profiling technique. * A security researcher designed a proof of concept plugin for Chrome browser that mitigates this. Implementing something like the PoC addon in [1] known as KeyBoardPrivacy. Some random delay in milliseconds in a 50 millisecond range for dwell and gap times for the emulated keyboards is enough to skew the values to render this attack useless while not affecting performance. * The changes made to Tor Borwser to make JS timers more coarse grained but constant (250ms for keyboard events) were not enough to stop keystroke dynamics fingerprinting because a malicious script can evict the cache and allow extrapolation of true timing events within 1-5ms accuracy .[3][5] Their goal is to instead add jitter to the timers [4]. A similar solution proposed in [4] can be implemented in all QEMU-KVM timers to mitigate both attacks. [1] https://paul.reviews/behavioral-profiling-the-password-you-cant-change/ [2] http://jcarlosnorte.com/security/2016/03/06/advanced-tor-browser-fingerprin… [3] https://www.lightbluetouchpaper.org/2015/07/30/double-bill-password-hashing… [4] https://trac.torproject.org/projects/tor/ticket/16110 [5] https://trac.torproject.org/projects/tor/ticket/1517 [6] http://scraping.pro/no-captcha-recaptcha-challenge/ [7] https://nakedsecurity.sophos.com/2013/11/01/facebook-to-silent-track-users-…

2 1

GSoC: Tor Messenger CONIKS integration
by Elias Rohrer 12 Mar '16

12 Mar '16

Hello nice people of the Tor project! I'm very interested in using the Google Summer of Code stipend to integrate the CONIKS key verification protocol into Tor Messenger. So I wanted to say 'Hi!' and introduce myself: I'm a computer science student at Humboldt Universität zu Berlin in Berlin, Germany. The main focus of my studies lies on security, computer networks (such as the peer-to-peer ones) and privacy enhancing technologies. In the last years I mostly worked with C/C++, but these days I'm learning erlang – mostly for its benefits in concurrent & network scalable programming, but also to learn 'something different'. This brings me to some questions regarding the project: If I understand correctly (after reading [1], there are three parts which should get implemented in course of the project: - A server component which stores the tamper-resistant database and would be run by the identity providers. - An auditor module which tracks the states of the server and publishes its view, so users can check that theirs is consistent with it. - And a client side plugin for Tor Messenger written in JavaScript. Concerning the two first parts: What would be the requirements concerning the language of the server? The Projects page list JavaScript and C as required languages, but would you also consider a server component written in erlang? I could do that in C/C++, but since I'm experimenting with erlang I thought I'd ask, especially, because I could imagine that the auditor functionality could be implemented into a XMPP server such as ejabberd or prosody. So, while the CONIKS provider would be more or less centralised for Tor Messenger, third parties like the XMPP server hosters could act as auditors by just loading up a plugin for their XMPP server. This Idea is based on the Q&A found in the ticket [1]. Do you think this would be a viable idea to roll out the auditor software? This should be it for my first questions. I'll study the CONIKS paper more in depth in the next days and will come back at you if more questions come up concerning the project idea – if that's okay with you. Best Wishes! Elias Rohrer / _tnull @ irc [1]: https://trac.torproject.org/projects/tor/ticket/17961)

3 8

What is Design?
by Spencer 12 Mar '16

12 Mar '16

1 de·sign verb \di-ˈzīn\ To plan and make decisions about [something]; to plan and make [something] for a specific use or purpose, or no purpose at all; to think of [something, such as a plan]; to plan [something]. ORIGIN - late Middle English as a verb in the sense 'to designate'; from Latin designare 'to designate', reinforced by French désigner; the noun is via French from Italian. TL;DR - to designate. --- Copied -dev, -ux, and -teachers once for relevance but, should there be, responses live on -talk. Wordlife, Spencer

1 0

Latency measurement from exits
by Zack Weinberg 10 Mar '16

10 Mar '16

Before I go reinventing wheels, has anyone got code to measure network latency (either RTT or one-way packet travel time will do) from a chosen Tor exit to an arbitrary destination? Latency from client to exit would also be useful. Thanks, zw

3 2

Tor browser (and releated) improvement ideas
by Michał Dziczkowski 10 Mar '16

10 Mar '16

Here are few of my improvement ideas for Tor Browser (and releated): * add more possible proxy hosts * make that TOR probes very often all avaliable hosts and pick every time the fastest one to prevent lagging while sites load * add a module with discovers the site load time and it determine that it's (or it's content) load to slow then would self switch proxy for the site to make it load faster * don't make tor browser install by default the No-Script plugin because it's preventing sites from working correctly (and it's very annoying to unblock each time scripts for each page, site or server) --- Mcgiwer

1 0

Make TorBirdy Better [GSoc16]
by Pushkar Pathak 09 Mar '16

09 Mar '16

Hi, I am a sophomore in IIIT,Hyderabd and would like to take the project to build TorBirdy better as my GSoc project.I have experience in c++,python,javascript,bash. Any links to get me started would be obliged. Thanks, Pushkar.

1 0

Interest in GSOC 2016
by AKASH DAS 09 Mar '16

09 Mar '16

Hii Community, I am a great enthusiast in network security and is very keen to increase my knowledge in this field and I think this is a way I can learn more things. So, I want to do something for this org and wanna contribute to it. I am currently a second year undergrad CSE student in Indian Institute Of Information Technology, Sricity. So please can anyone guide me so that I can get into it as soon as possible and start contributing. Regards, Akash Das Indian Institute Of Information Technology, Sricity System Administrator

2 1

TorBirdy (HTTP Proxy) [GSoC 2016]
by Prakhar Pratyush 09 Mar '16

09 Mar '16

Hello, My name is Prakhar Pratyush. I've been working on this project- "Make TorBirdy Better (HTTP Proxy)" for a few days. I have tried to understand the project and I would like to discuss a few things. At present, what TorBirdy does is- it configures ThunderBird to access the internet through a proxy SOCKSv5 server provided by Tor Bundle. So, are we trying to design an standalone HTTP Proxy which will directly connect to Tor network entry point without needing entire Tor bundle or are we just trying to design an intermediatery HTTP Proxy which will then connect to Tor SOCKSv5 proxy using some form of tunneling or Masqueranding. Thanks Prakhar Pratyush 3rd year, IIT Roorkee

1 1

Re: [tor-dev] Leif's important piece on update golden keys
by Nathan Freitas 07 Mar '16

07 Mar '16

On Mon, Mar 7, 2016, at 11:11 AM, Spencer wrote: > Hi, > > >> > >> Holger Levsen: > >> https://reproducible-builds.org and > >> https://reproducible.debian.net > >> > > Thanks! > > > > > Nathan Freitas: > > https://f-droid.org/wiki/page/Deterministic,_Reproducible_Builds > > > > Thanks! > > However, even though reproducible-builds seems to address the manual > install as well, which is good, I read the problem as being the actual > backdoor of auto-update. > > Since my Dad will not be able to make this verification, removing > auto-update from the package is the only real resolution here. I think our goal is to remove any one person from having the authority to release an update. F-Droid or similar package managers should expect multiple signatures in the future instead of just one. Part of the trust people will place in projects or apps in the future is that they are not only open-source, but have a judicially diverse or robust set of signatories. > Besides, given the broken/missing auto-update opt-out in packages like > OrFox, it is difficult to trust the developers, since it is the user who > defines "malicious". Can you explain this more? I want to make sure I don't misunderstand what the issue is. +n

2 1

Re: [tor-dev] [valencia2016] Leif's important piece on update golden keys
by Nathan Freitas 07 Mar '16

07 Mar '16

On Sun, Mar 6, 2016, at 11:44 AM, Holger Levsen wrote: > Hi, > > On Montag, 29. Februar 2016, Spencer wrote: > > > [auto update] a threat model we must > > > take more seriously. > > > we are making real progress. > > Like what? > > https://reproducible-builds.org has the very long answer and > https://reproducible.debian.net shows the status for Debian in great > detail. > (And these pages have links to the status of other projects as well.) ... and also: https://f-droid.org/wiki/page/Deterministic,_Reproducible_Builds +n

2 1

Questions regarding the future of families
by Brian "redbeard" Harrington 06 Mar '16

06 Mar '16

For a few months I've been tracking this ticket: https://trac.torproject.org/projects/tor/ticket/6676 Regarding the state of family support. I've been working on a project which could be used to expand the number of running relays and have been trying to find the best way to coordinate this so as to make it both obvious who the operator is (which can be done with contact info) as well as to help users avoid building circuits within these related nodes. In the vein of "playing nicely" with the network my concern is that when running large scale infrastructure one needs to minimize the number of moving pieces possible. Ideally this would allow me (in the best case scenario) to supply a static family identifier en masse minimizing the need for managed configurations. In the worst case scenario (that of an entity trying to launch a sybil attack) the administrator would not even attempt to populate this so as to try and appear as separate nodes in the network. Do folks have suggestions on the best way to "play nice" here? --redbeard

5 5

(no subject)
by Alex Mourtziapis 05 Mar '16

05 Mar '16

HI, My name is Alex and I am looking forward in collaborating with you. I am particularly interested in working for Tor messenger but sadly things seemed a little unclear to me and the existing code here [1] didnt help me at all. If I got it right you want the messenger to be written in Node.js and use a lib like nw.js or electron to package and distribute it. Am I looking at the wrong direction? [1] https://gitweb.torproject.org/tor-messenger-build.git ᐧ

2 2

tor-roaster.org creates incentives for *non*-proper MyFamily configurations
by nusenu 05 Mar '16

05 Mar '16

(since this is not really part of that ticket I'm moving this reply to tor-dev) Replying to [comment:21 virgil][1]: > Re: comment #15 >> 2) there are no incentives for a relay operator to set it properly > > Roster aims to fix this. http://tor-roster.org Quite the opposite I think. tor-roster creates incentives for lazy operators because it does not require a proper MyFamily configuration to aggregate relays into a group. tor-roaster's way to group relays (one mutual connection into a group of relays is enough iirc) does not match tor's definition of MyFamily. While tor-roster's way to group actual set of relays to it's operator might represent a more accurate picture of reality than systems that do require proper MyFamily configs, it misses the possibility to create incentives for proper configurations. > For what it's worth, Roster also makes MyFamily a bit less painful to > work with because the detected families are now robust to changes > in the Family graph. For details see [3] This causes the offset between tor's and tor-roster's interpretation/definition. To give you an example, roster says this relay is part of a 24 relays group [4] even though it has only a mutual MyFamily with two other relays: https://atlas.torproject.org/#details/E6E18151300F90C235D3809F90B31330737CE… Ideally tor-roster would make it very clear on their website that groups do not require a complete mutual MyFamily agreement between all relays in that group, or require proper MyFamily configuration to create incentives for properly configured families. [1] https://trac.torproject.org/projects/tor/ticket/6676 [3] ttps://trac.torproject.org/projects/tor/ticket/16750 [4] http://tor-roster.org/family_detail/E26AFC5F718E21AC502899B20C653AEFF688B0D2

1 0

Next version of the algorithm
by Ola Bini 04 Mar '16

04 Mar '16

Hi, Here is the next version of the algorithm - put it in a gist to make it easier to look at: https://gist.github.com/olabini/343da01de8e01491bf5c Cheers -- Ola Bini (https://olabini.se) "Yields falsehood when quined" yields falsehood when quined.

4 16

Tor in Google Summer of Code 2016
by Damian Johnson 03 Mar '16

03 Mar '16

Interested in coding on Tor and getting paid for it by Google? If you are a student, we have good news for you: we have been accepted as a mentoring organization for Google Summer of Code 2016! https://summerofcode.withgoogle.com/organizations/6655685232164864/ Here's the facts: GSoC gives you the opportunity to work on your own Tor-related coding project with one of the Tor developers as your mentor. Your mentor will help you when you're stuck and guide you in becoming part of the Tor community. Google pays you 5,500 USD for the three months of your project, so that you can focus on coding and don't have to worry about how to pay your bills. https://www.torproject.org/getinvolved/volunteer.html.en#Projects Did we catch your attention? These are your next steps: Go look at the Google Summer of Code FAQ [1] to make sure you are eligible to participate. Have a look at our ideas list [2] to see if one of those projects matches your interests. If there is no project on that list that you'd want to work on, read the documentation on our website [3] and make up your own! Come to #tor-dev on OFTC [4] or let us know about your project idea here. Communication is essential to success in the summer of code, and we're unlikely to accept students we haven't heard from before reading their application. So really, speak up on this list or come to our IRC channel and talk to us! Finally, write down your project idea using our template [5] and submit your application to Google before March 25th [6]. We are looking forward to discussing your project idea with you! [1] https://developers.google.com/open-source/gsoc/faq [2] https://www.torproject.org/getinvolved/volunteer.html.en#Coding [3] https://www.torproject.org/docs/documentation.html.en#UpToSpeed [4] https://www.torproject.org/about/contact.html.en#irc [5] https://www.torproject.org/about/gsoc.html.en#Template [6] https://developers.google.com/open-source/gsoc/timeline

1 0

Set up Tor private network
by SMTP Test 02 Mar '16

02 Mar '16

Hi all, I try to set up a Tor private network. I found two tutorials online ( http://liufengyun.chaos-lab.com/prog/2015/01/09/private-tor-network.html and https://ritter.vg/blog-run_your_own_tor_network.html) but seems that they both are outdated. Could anyone please give me a tutorial or some hints on building a private Tor network? Another question is: what is the minimum number of required directory authorities for a private Tor network? I am wondering if one directory authority is enough. Thanks

3 3

[Vidalia Bundle] Linux support
by Yaroslav Pronin 29 Feb '16

29 Feb '16

Hello. Why Vidalia Bundle doesn't support Linux? A few years ago there was Vidalia for Linux (https://dist.torproject.org/vidalia/) but its development stopped abruptly. I'm maintainer Vidalia package in the AUR and concerned about the fate and future development of the GUI client. Whenever possible, I would have been able to help support the implementation of Linux in the Vidalia Bundle, or to take care of Vidalia (https://dist.torproject.org/ vidalia/) and maintain it.

1 0

Stopping the censoring of tor users (via exit bridges / proxies / OpenVPNs)
by grarpamp 29 Feb '16

29 Feb '16

On 2/25/16, blacklight . <pandakaasftw(a)gmail.com> wrote: > hello there! i don't know if this mailing list works but i thought of > giving it a try. > > i was lately reading an article ( > http://www.pcworld.com/article/3037180/security/tor-users-increasingly-trea… > ) > and it was about tor users getting blocked from accessing alot of website. > but after giving this some thought i think i came up with a possible > solution to the problem :there is a thing called bridges, they are used to > access the tor network without your isp knowing that you use tor, but if > you can use those proxies to enter the network, it might also be possible > to exit the network with them. But then we face a second challenge, the > exit nodes have to be configured in such a way that it will relay traffic > to such a bridge, so the exit node owners also need to know the ip of the > bridge. While this doesn't seem difficult to do, it can become difficult. > You see if the bridges are published on a public list(like normal bridges > are) then the blocking sites in question will be able to block those > address too. While this also posses a problem, a possible solution could be > found in something called flashproxies, flashproxies are bridges with a > really short life span, they are created and destroyed fairly swiftly, when > this is done in a rapid pace, they become really hard to block because the > ip changes all the time. So if the exit nodes can be configured to make use > of such flash proxies, then the problem could be solved. I Must admit that > not an expert on this or anything, and it needs alot of more thought, but > it could work. so i was wondering if there are any experts who could help > me with thinking out this subject and maybe confirm if this idea could > work. Skipping that whoever wants to enumerate, test, block, and share lists of the IP of your final hop will find a way to do so... "flashproxies" - are essentially illegal to use as the operator got stupid, and didn't gave permission. - are unstable as were never intentionally provisioned, and the operators get smart when abuse reports and shut them off. - proxy lists are going to be a pain for you to scrape and maintain Options - run your own volunteer network of last hop "proxies" / bridges - buy them from AWS or wherever "meek" style - partner with or plug into already existing networks of those - get tor relays or bridges to do this I previously wrote in archives that exit relays could bind OpenVPN to extra IP's they configure on their exit relay boxes. Tor daemon has nothing to do with those IP so they never appear in tor's easily blacklistable consensus. Users then OpenVPN over tor to those via use of the relay fingerprint to reach vpn terminator IP over relay localhost to save bandwidth, and on out to clearnet. You can OpenVPN to some list of onions if you don't feel like listing the relay fingerprints / extra input IP's on wikis. But it's not going to stop dedicated blacklisters, and onion doubles bandwidth use. However it could also be used by non-exits that for whatever reason didn't want to be a tor-exit but did want to offer exit via some remote third party vpn service. And strictly social sharing on forums etc could happen for distribution. There are already some exits that for various reasons, intentional or other, do not exit from their OR IP. That is a feature that some tor users do now find and use. And relays don't offer OpenVPN yet which would also give users more than just IPv4-TCP exit scheme. Though it is integrated somewhat, I2P has this manual sort of exit offering model with false.i2p and a few other nodes. [Doesn't seem to require daemon dev work, updated subject, continuing thread reply to relays and talk.]

1 0

Leif's important piece on update golden keys
by Nathan Freitas 28 Feb '16

28 Feb '16

The issues in this timely story came up a number of times today at Tor Dev as a threat model we must take more seriously. Fortunately, thanks to Tor Browser, Lunar, Holger, Hans, Fdroid and others, we are making real progress. http://arstechnica.com/security/2016/02/most-software-already-has-a-golden-…

2 1

Is tor-wiki-changes ML dead?
by nusenu 27 Feb '16

27 Feb '16

Hi, tor-wiki-changes doesn't seem to send out any emails? https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-wiki-changes https://trac.torproject.org/projects/tor/ticket/18262

2 4

Relay Database: Existing Schemas?
by nusenu 26 Feb '16

26 Feb '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi, I'm planing to store relay data in a database for analysis. I assume others have done so as well, so before going ahead and designing a db schema I'd like to make sure I didn't miss pre-existing db schemas one could build on. Data to be stored: - - (most) descriptor fields - - everything that onionoo provides in a details record (geoip, asn, rdns, tordnsel, cw, ...) - - historic records I didn't find something matching so far, so I'll go ahead, but if you know of other existing relay db schemas I'd like to hear about it. thanks, nusenu "GSoC2013: Searchable Tor descriptor archive" (Kostas Jakeliunas) https://www.google-melange.com/gsoc/project/details/google/gsoc2013/wfn/ 5866452879933440 https://lists.torproject.org/pipermail/tor-dev/2013-May/004923.html https://lists.torproject.org/pipermail/tor-dev/2013-September/005357.htm l https://github.com/wfn/torsearch (btw, someone knows the license of this?) > This is true: the summary/details documents (just like in Onionoo > proper) deal with the *last* known info about relays. ernie https://gitweb.torproject.org/metrics-db.git/plain/doc/manual.pdf (didn't find db/tordir.sql mentioned in the pdf) "Instructions for setting up relay descriptor database" https://lists.torproject.org/pipermail/tor-dev/2010-March/001783.html "Set up descriptor database for other researchers" https://trac.torproject.org/projects/tor/ticket/1643 -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJVLrmVAAoJEFv7XvVCELh0+ycP/0VkRWMGAhx7YwWhixtOPB0q ouitosse3SdLCMd1W7cps7nnQhcGv8E1xeUPYeizNQ+RIK9ldvnwgxhVt9ETOI3e oL6bcx3B/NSbTcGfZhIU6XCCX7+39CXz3/+/gXg4c1a5Cd9rYKuwTn7ZApPUNAK2 9yfckCwHaqh67ZDHB1A7nrHX1BJAjwhri5JRGomHSUXPwNZOyMzpgPkB+I92esqc Z4ajQo2D+Vyk42qF7apqp5ApVBLdt5ycUtW1j4s4KvyJH2BjeP4tCXvvYLKv9IvN TGHMJ111NQXbuk6H1OdaDmMZhhW6utPk8YAbNc7RZHqCdH7No40zFVlikLDrV2Xl uLt8FMlck7hGQv/4udA59Dw3PGHfrSiCbvJXb0S2jarnWOH2O+zSSuMs8jQM/x7k 6tIOlwtRDVGw3VuvNbb4MJnLzdHRxq3qy6ueDYuhmhHslxjD1Cbr3eE1RA7Da9aX kNDgjfXtdah52HWUZbIIxHQYzyCg5G3M5yy51GhUlA2Fe1sbPpNcEBeyEDK/jH3Y +7G+tgR+CdMvSFraCiYKHa1drVPJHeqNvZAqPNHKxpKwOwOoJEYrsW4wb/mJ7ybe o8xNYK691hcaMvHqwI47tw4hZfrI0f0+gQKKzENQQk8/8yUZ/0jgMRlW/Cz0yYIa FZEg+OJ/yEs8vKfYerIN =Rfn4 -----END PGP SIGNATURE-----

3 2

stopping the censoring of tor users.
by blacklight . 26 Feb '16

26 Feb '16

hello there! i don't know if this mailing list works but i thought of giving it a try. i was lately reading an article ( http://www.pcworld.com/article/3037180/security/tor-users-increasingly-trea… ) and it was about tor users getting blocked from accessing alot of website. but after giving this some thought i think i came up with a possible solution to the problem :there is a thing called bridges, they are used to access the tor network without your isp knowing that you use tor, but if you can use those proxies to enter the network, it might also be possible to exit the network with them. But then we face a second challenge, the exit nodes have to be configured in such a way that it will relay traffic to such a bridge, so the exit node owners also need to know the ip of the bridge. While this doesn't seem difficult to do, it can become difficult. You see if the bridges are published on a public list(like normal bridges are) then the blocking sites in question will be able to block those address too. While this also posses a problem, a possible solution could be found in something called flashproxies, flashproxies are bridges with a really short life span, they are created and destroyed fairly swiftly, when this is done in a rapid pace, they become really hard to block because the ip changes all the time. So if the exit nodes can be configured to make use of such flash proxies, then the problem could be solved. I Must admit that not an expert on this or anything, and it needs alot of more thought, but it could work. so i was wondering if there are any experts who could help me with thinking out this subject and maybe confirm if this idea could work. greetings, blacklight

3 4