- tor-dev - lists.torproject.org

GreatFire Circumvention Central: tests of speed and stability of circumvention tools in China
by David Fifield 13 Jul '16

13 Jul '16

https://en.greatfire.org/blog/2016/jul/greatfireorg-now-testing-vpn-speed-a… https://cc.greatfire.org/en "Our newest website, Circumvention Central (CC), aims to provide real-time information and data about circumvention solutions that work in China. Since 2011, we have been collecting data about blocked websites in China and now we will add data about the effectiveness of VPNs and other circumvention tools." They list various VPNs and other tools. Tor is on the list. (This page has JavaScript charts that aren't working for me in Tor Browser.) https://cc.greatfire.org/en/provider/Tor At the moment, these are the figures I see: Speed (kbps) Stability 1. HideMyAss 504 (+39%) 98% (-1%) 2. VyprVPN 445 (−33%) 98% (+11%) 3. FreeBrowser 440 (+13%) 88% (+1%) 4. XX-Net 356 (New) 97% 5. Astrill 294 (−32%) 97% (+1%) 6. Lantern 262 (+15%) 95% (+3%) 7. VPNSecure 259 (New) 87% 8. Psiphon 218 (+6%) 89% (+2%) 9. Ultrasurf 206 (+460%) 86% (−4%) 10. Freegate 188 (−29%) 91% (+1%) 11. PureVPN 151 (−25%) 94% (+1%) 12. Tor 112 (+237%) 96% (+1%) The test details have interesting values under the "Settings" header: https://cc.greatfire.org/en/provider/Tor#http-tests "0", "socks5", "是", "lantern-proxy", "lantern-proxy,no bridge", "lantern-proxy,meek-arzue", "proxy,no bridge", "lantern-proxy,obfs4", "obfs4", "否", "meek-arzue", "obfs4,sock5 proxy". There's a tool on the list I didn't know, XX-Net. Its GitHub page says "It uses google app engine (GAE) as a proxy server through the firewall" and "A Reborn GoAgent." https://github.com/XX-net/XX-Net

1 0

BSc Honor Track Research Topic
by Bram van den Heuvel 13 Jul '16

13 Jul '16

Dear all, I'm currently an undergraduate student double BSc Applied Mathematics/Computer Science. This year I'll be doing a small (~500 hour) research project as part of my Honor track. I'm looking for a suitable research question I can try to answer, preferrably by using mathematical modeling. To give you an idea what kind of research I was planning to do, I briefly described my current idea below. I was considering researching path selection, specifically the probability of selecting only faulty/malicious nodes and how this might be improved by including an extra reputation metric. This hypothetical reputation metric would be a "social" like reputation, based on for example real-world connections between people. In the most extreme case, one could choose a path of which all nodes are ran by real-world trusted people. As there might be a more usefull research question out there, I was wondering whether there are any questions that the Tor Project has that might be answered by using mathematical modelling. I could then consider to try and answer this question in my research project. Thanks in advance.

1 0

Re: [tor-dev] Using Tor Stealth HS with a home automation server
by Nathan Freitas 10 Jul '16

10 Jul '16

On Fri, Jul 8, 2016, at 10:38 PM, bancfc(a)openmailbox.org wrote: > On 2016-07-08 18:53, Nathan Freitas wrote: > > I've been working on some ideas about using Tor to secure "internet of > > things", smart devices other than phones, and other home / industrial > > automation infrastructure. Specifically, I think this could be a huge > > application for Tor Hidden Services and Onion sites configured with > > Hidden Service Authentication and "stealth" mode. > > > > Earlier this year, I published some ideas on the subject here > > https://github.com/n8fr8/talks/blob/master/onion_things/Internet%20of%20Oni… > > showing how you could use Orbot and IP Camera apps to build a > > cloud-free > > Tor-secured "Dropcam" style setup. > > > > Nice! An interesting Orbot feature to have is making QR Codes of > authenticated Hidden Service info so mobile devices can easily add each > other to a trusted network. That is a great idea. I am thinking of writing a module for the Home Assistant platform that would handle the tor install and setup, and it could autogenerate this QRcode as well. Any thoughts on a format? torhs://clientname:authcookie@foo.onion looks decent.

4 3

Using Tor Stealth HS with a home automation server
by Nathan Freitas 09 Jul '16

09 Jul '16

I've been working on some ideas about using Tor to secure "internet of things", smart devices other than phones, and other home / industrial automation infrastructure. Specifically, I think this could be a huge application for Tor Hidden Services and Onion sites configured with Hidden Service Authentication and "stealth" mode. Earlier this year, I published some ideas on the subject here https://github.com/n8fr8/talks/blob/master/onion_things/Internet%20of%20Oni… showing how you could use Orbot and IP Camera apps to build a cloud-free Tor-secured "Dropcam" style setup. Now, I've taken the first step to setup my own instance of Home Assistant "an open-source home automation platform running on Python 3. Track and control all devices at home and automate control. Installation in less than a minute." Instructions on this are below. It all seems to be working well, but I would love any feedback, comments, thoughts that you might have. I would also like to ensure that any work on next-gen HS designs includes these kinds of use-cases. *** Pull request for the new "Tor cookbook" example for Home Assistant: https://github.com/home-assistant/home-assistant.io/pull/627 *** Tor Onion Service Configuration This is an example about how you can configure Tor to provide secure remote access to your home assitance instance as an Onion site, through Tor’s Hidden Service feature. With this enabled, you do not need to open your firewall ports or setup HTTPS to enable secure remote access. This is useful if you want to have: Access your HA instance remotely without opening a firewall port or setting up a VPN Don’t want to or know how to get an SSL/TLS certificate and HTTPS configuration setup Want to block attackers from even being able to access/scan your port and server at all Want to block anyone from knowing your home IP address and seeing your traffic to your HA Background and Contact This configuration is part of an effort to apply strong cryptography technologies (like Onion Routing and End-to-End Encryption) to technology we increasingly depend on in our day to day lives. Just like when WhatsApp enabled end-to-end encryption messaging for everyone, every home automation and IoT platform should do the same, because A) the technology is all there, freely licensed and open-source and B) up to this point, all the commercial manufacturers have been doing a horrific job with security. You can learn more about how Tor can be used to secure home automation and IoT platforms through this short set of slides on the Internet of Onion Things This configuration was provided by @n8fr8 (github, twitter) of Guardian Project and Tor Project. You can send questions, feedback and ideas to support(a)guardianproject.info. Hidden Services and Onion Sites Tor allows clients and relays to offer hidden services. That is, you can offer a web server, SSH server, etc., without revealing your IP address to its users. In fact, because you don’t use any public address, you can run a hidden service from behind your firewall. Learn more about Hidden Services on the Tor Project website. Onion sites are websites that run on a Tor Hidden Service node. “dot onion” sites are an IETF recognized special use domain name. Setting up Tor on your Home Assistant First, install Tor. On a Debain-based system, you can install the package easily: > sudo apt-get install tor You can find more instructions for downloading and installing Tor on other platforms on the Tor Project Download Page. Next, modify Tor’s main configuration file /etc/tor/torrc to include the following lines: ... HiddenServiceDir /var/lib/tor/homeassistant/ HiddenServicePort 80 127.0.0.1:8123 HiddenServiceAuthorizeClient stealth haremote1 ... The “sleath” entry above ensures traffic to and from your HA instance over Tor, is hidden even from other nodes on the Tor network. The “haremote1” value is a generic client name entry that you can modify as you please. Then, restart Tor: >/etc/init.d/tor restart Then read the new generated authentication cookie from the Tor-generated hostname file: > sudo more /var/lib/tor/homeassistant/hostname The output of that command should look something like this, but with your own unique “dot onion” domain and authentication cookie: abcdef1234567890.onion ABCDEF1122334455667789 # client: haremote1 You are now done with the HA Tor server configuration. Make sure your HA instance is running, and now you can move to client configuration. Tor Client Access Setup Using this setup, you can access your HA instance over Tor from your laptop or mobile device, using Tor Browser and other software. Add the authentication cookie to your torrc client configuration on your laptop or mobile device. Using the sample values from above, it would look like this: HidServAuth abcdef1234567890.onion ABCDEF1122334455667789 For Tor Browser on Windows, Mac or Linux, you can find the torrc file here: <tor browser install directory>/Browser/TorBrowser/Data/Tor/torrc-defaults Once you have added the entry, restart the browser, and then browse to the “dot onion” site address to connect to your HA instance. For Orbot: Tor on Android, add it in Orbot->Menu->Settings to the “Torrc Custom Config” entry. Restart Orbot, and then use the Orfox browser app, and browse to the “dot onion” site name to access your HA instance. You can also use Orbot’s VPN mode, to enable Tor access from any application on your device, such as Tasker or Owntracks. On iOS, we have not fully tested this yet, but you should be able to add custom torrc entries on Onion Browser, Red Onion or TOBY browsers, all available in the iTunes App Store. Some More Advanced Ideas With this configuration, only you can access your HA instance Onion site through Tor, and no one else. You can share the authentication cookie with multiple devices and users, or you can generate a unique one for each - up to you! If you have multiple, say for an industrial, business or corporate configuration, this would provide an easy way to revoke access to a specific user or device. If you always access your HA instance via Tor, you can easily run this on an isolated “IoT” network segment at your install site, keeping your internal home network traffic seperate from any potentially compromised devices (like cheap “smart” lightbulbs with backdoors!). You could also use Tor as a means to connect your HA instance to a remote device, sensor or other service that you do not want to or connect provide a direct, open IP connection to. Again, Tor provides authenticated and confidential routing (aka “privacy and encryption”) by default, without having to setup TLS/SSL or VPN. It is just important to secure IoT nodes within your network, as it is to secure remote access! As mentioned, with Orbot on Android, you can enable a “full device” VPN mode, that allows any app you have to tunnel through Tor, even if it is not Tor or proxy aware. This means you should be able to enter your “dot onion” Onion site address into any app you want to access to your HA instance, and it should work.

2 1

Re: [tor-dev] Using Tor Stealth HS with a home automation server
by Nathan Freitas 09 Jul '16

09 Jul '16

Now published here: https://home-assistant.io/cookbook/tor_configuration/ On Fri, Jul 8, 2016, at 12:53 PM, Nathan Freitas wrote: > I've been working on some ideas about using Tor to secure "internet of > things", smart devices other than phones, and other home / industrial > automation infrastructure. Specifically, I think this could be a huge > application for Tor Hidden Services and Onion sites configured with > Hidden Service Authentication and "stealth" mode. > > Earlier this year, I published some ideas on the subject here > https://github.com/n8fr8/talks/blob/master/onion_things/Internet%20of%20Oni… > showing how you could use Orbot and IP Camera apps to build a cloud-free > Tor-secured "Dropcam" style setup. > > Now, I've taken the first step to setup my own instance of Home > Assistant "an open-source home automation platform running on Python 3. > Track and control all devices at home and automate control. Installation > in less than a minute." > > Instructions on this are below. It all seems to be working well, but I > would love any feedback, comments, thoughts that you might have. I would > also like to ensure that any work on next-gen HS designs includes these > kinds of use-cases. > > *** > Pull request for the new "Tor cookbook" example for Home Assistant: > https://github.com/home-assistant/home-assistant.io/pull/627 > > *** > > Tor Onion Service Configuration > > This is an example about how you can configure Tor to provide secure > remote access to your home assitance instance as an Onion site, through > Tor’s Hidden Service feature. With this enabled, you do not need to open > your firewall ports or setup HTTPS to enable secure remote access. > > This is useful if you want to have: > > Access your HA instance remotely without opening a firewall port or > setting up a VPN > Don’t want to or know how to get an SSL/TLS certificate and HTTPS > configuration setup > Want to block attackers from even being able to access/scan your port > and server at all > Want to block anyone from knowing your home IP address and seeing your > traffic to your HA > Background and Contact > > This configuration is part of an effort to apply strong cryptography > technologies (like Onion Routing and End-to-End Encryption) to > technology we increasingly depend on in our day to day lives. Just like > when WhatsApp enabled end-to-end encryption messaging for everyone, > every home automation and IoT platform should do the same, because A) > the technology is all there, freely licensed and open-source and B) up > to this point, all the commercial manufacturers have been doing a > horrific job with security. > > You can learn more about how Tor can be used to secure home automation > and IoT platforms through this short set of slides on the Internet of > Onion Things > > This configuration was provided by @n8fr8 (github, twitter) of Guardian > Project and Tor Project. You can send questions, feedback and ideas to > support(a)guardianproject.info. > > Hidden Services and Onion Sites > > Tor allows clients and relays to offer hidden services. That is, you can > offer a web server, SSH server, etc., without revealing your IP address > to its users. In fact, because you don’t use any public address, you can > run a hidden service from behind your firewall. Learn more about Hidden > Services on the Tor Project website. > > Onion sites are websites that run on a Tor Hidden Service node. “dot > onion” sites are an IETF recognized special use domain name. > > Setting up Tor on your Home Assistant > > First, install Tor. On a Debain-based system, you can install the > package easily: > > sudo apt-get install tor > > You can find more instructions for downloading and installing Tor on > other platforms on the Tor Project Download Page. > > Next, modify Tor’s main configuration file /etc/tor/torrc to include the > following lines: > > ... > HiddenServiceDir /var/lib/tor/homeassistant/ > HiddenServicePort 80 127.0.0.1:8123 > HiddenServiceAuthorizeClient stealth haremote1 > ... > The “sleath” entry above ensures traffic to and from your HA instance > over Tor, is hidden even from other nodes on the Tor network. The > “haremote1” value is a generic client name entry that you can modify as > you please. > > Then, restart Tor: >/etc/init.d/tor restart > > Then read the new generated authentication cookie from the Tor-generated > hostname file: > > sudo more /var/lib/tor/homeassistant/hostname > > The output of that command should look something like this, but with > your own unique “dot onion” domain and authentication cookie: > abcdef1234567890.onion ABCDEF1122334455667789 # client: haremote1 > > You are now done with the HA Tor server configuration. Make sure your HA > instance is running, and now you can move to client configuration. > > Tor Client Access Setup > > Using this setup, you can access your HA instance over Tor from your > laptop or mobile device, using Tor Browser and other software. > > Add the authentication cookie to your torrc client configuration on your > laptop or mobile device. Using the sample values from above, it would > look like this: > HidServAuth abcdef1234567890.onion ABCDEF1122334455667789 > > For Tor Browser on Windows, Mac or Linux, you can find the torrc file > here: > <tor browser install > directory>/Browser/TorBrowser/Data/Tor/torrc-defaults > Once you have added the entry, restart the browser, and then browse to > the “dot onion” site address to connect to your HA instance. > > For Orbot: Tor on Android, add it in Orbot->Menu->Settings to the “Torrc > Custom Config” entry. Restart Orbot, and then use the Orfox browser app, > and browse to the “dot onion” site name to access your HA instance. You > can also use Orbot’s VPN mode, to enable Tor access from any application > on your device, such as Tasker or Owntracks. > > On iOS, we have not fully tested this yet, but you should be able to add > custom torrc entries on Onion Browser, Red Onion or TOBY browsers, all > available in the iTunes App Store. > > Some More Advanced Ideas > > With this configuration, only you can access your HA instance Onion site > through Tor, and no one else. You can share the authentication cookie > with multiple devices and users, or you can generate a unique one for > each - up to you! If you have multiple, say for an industrial, business > or corporate configuration, this would provide an easy way to revoke > access to a specific user or device. > > If you always access your HA instance via Tor, you can easily run this > on an isolated “IoT” network segment at your install site, keeping your > internal home network traffic seperate from any potentially compromised > devices (like cheap “smart” lightbulbs with backdoors!). > > You could also use Tor as a means to connect your HA instance to a > remote device, sensor or other service that you do not want to or > connect provide a direct, open IP connection to. Again, Tor provides > authenticated and confidential routing (aka “privacy and encryption”) by > default, without having to setup TLS/SSL or VPN. It is just important to > secure IoT nodes within your network, as it is to secure remote access! > > As mentioned, with Orbot on Android, you can enable a “full device” VPN > mode, that allows any app you have to tunnel through Tor, even if it is > not Tor or proxy aware. This means you should be able to enter your “dot > onion” Onion site address into any app you want to access to your HA > instance, and it should work. > _______________________________________________ > tor-dev mailing list > tor-dev(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev

1 0

metrics-lib/DescripTor 1.3.0 is released
by Karsten Loesing 08 Jul '16

08 Jul '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello devs, we just released metrics-lib/DescripTor 1.3.0: https://dist.torproject.org/descriptor/1.3.0/ - From the change log: # Changes in version 1.3.0 - 2016-07-06 * Medium changes - Parse "package" lines in consensuses and votes. - Support more than one "directory-signature" line in a vote, which may become relevant when authorities start signing votes using more than one algorithm. - Provide directory signatures in consensuses and votes in a list rather than a map to support multiple signatures made using the same identity key digest but different algorithms. - Be more lenient about digest lengths in directory signatures which may be longer or shorter than 20 bytes. - Parse "tunnelled-dir-server" lines in server descriptors. * Minor changes - Stop reporting "-----END .*-----" lines in v2 network statuses as unrecognized. Another, less visible improvement is that we're down to 0 checkstyle complaints! Happy descriptor parsing! All the best, Karsten -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJXfqObAAoJEC3ESO/4X7XBI3QIALoBgBHfrQCKKe2qrFfFFSh9 T0CAFTA4XDb/O+/4KJcSfglktD5jyhShVcwvdKyqQ1h0SHW9Zk+luWJju+h7JWpH DOu1ixG9Foh/CLFRrMs6UWaHQGbbU5mKrp1bqWplcWDC9nqbs/PNJg47JYjSke/J yx5U/ONxs6KhhSkQmLCxeN2xy0J6BntxaTZ6MyVWrSKv0af2JcruG7r1R7rQ6TEL k0wbV5riZmZeHY5XPYJup41oAvEB9S+AkECipSIBEHy9RhtFYUnYdEARvBMyA5yA 2QbJxD2aqlhUfGkL8S6qYWGfdREM7b9diMYwj/XDUxXt6gisuMPT+pM4HjEKkVk= =9yCN -----END PGP SIGNATURE-----

1 0

Re: [tor-dev] tor-dev Digest, Vol 66, Issue 7
by Nathan Kettle 07 Jul '16

07 Jul '16

unsubscribe me please On Wed, Jul 6, 2016 at 10:00 PM, <tor-dev-request(a)lists.torproject.org> wrote: > Send tor-dev mailing list submissions to > tor-dev(a)lists.torproject.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev > or, via email, send a message with subject or body 'help' to > tor-dev-request(a)lists.torproject.org > > You can reach the person managing the list at > tor-dev-owner(a)lists.torproject.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of tor-dev digest..." > > > Today's Topics: > > 1. Re: Adding depictor/stem to Jenkins (Tom Ritter) > 2. Re: GeoLite ASN Database broken (Jason Ketola) > 3. Re: GeoLite ASN Database (still) broken (nusenu) > 4. Re: GeoLite ASN Database (still) broken (Jason Ketola) > 5. Re: [network-team] [doodle poll] Meeting to discuss guard > proposal draft status (isis agora lovecruft) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 5 Jul 2016 14:48:43 -0500 > From: Tom Ritter <tom(a)ritter.vg> > To: tor-dev(a)lists.torproject.org > Subject: Re: [tor-dev] Adding depictor/stem to Jenkins > Message-ID: > < > CA+cU71mHtgMRnfq3F51U+MTTDs9V9ySHgUfeyHWZ3gntuRf5eQ(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > On 5 July 2016 at 14:34, Damian Johnson <atagar(a)torproject.org> wrote: > > Hi Tom, just food for thought but another option would be a cron task > > that pulls the repos and runs that if there's a change. That's what I > > do for stem's website so it reflects the changes I push. > > I think that's a good model for webpages-backed-by-git, but less so > for integration/software testing. > > I could probably rig something up like that locally, but I'd have to > make it detect a crash and email me. The advantage of jenkins is it > will do that automatically, on infrastructure I don't have to worry > about maintaining[0], as well as making the crash details public. > There's a chance it might even detect a break in stem. > > -tom > > [0] A problem I've had a lot is that my 'email me stuff' scripts will > stop emailing... and I never find out they're failing! > > > ------------------------------ > > Message: 2 > Date: Tue, 5 Jul 2016 17:40:20 -0400 > From: Jason Ketola <jketola(a)maxmind.com> > To: tor-dev(a)lists.torproject.org > Subject: Re: [tor-dev] GeoLite ASN Database broken > Message-ID: > <CADrFj5Aw7b0SVMmo=M33-+zdHOUKbrNr= > p3zs4crUj_067agsw(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Hello, > > I'm writing on behalf of MaxMind. We believe we have addressed the issues > you noted in the latest update of our GeoLite ASN database: > http://dev.maxmind.com/geoip/legacy/geolite/#Downloads. > > Thank you for bringing the issues to our attention. > > Regards, > Jason > > -- > Jason Ketola > Vice President, Operations > MaxMind, Inc. > www.maxmind.com > 617-500-4493 x807 >

1 0

Torsocks workalikes
by grarpamp 07 Jul '16

07 Jul '16

I remember a survey list of torsocks workalikes somewhere (where?). This one's for windows and I don't remember it. Whoever maintains that list can add it for reference. https://github.com/cpatulea/TorCap2

1 0

Re: [tor-dev] GeoLite ASN Database broken
by Jason Ketola 06 Jul '16

06 Jul '16

Hello, I'm writing on behalf of MaxMind. We believe we have addressed the issues you noted in the latest update of our GeoLite ASN database: http://dev.maxmind.com/geoip/legacy/geolite/#Downloads. Thank you for bringing the issues to our attention. Regards, Jason -- Jason Ketola Vice President, Operations MaxMind, Inc. www.maxmind.com 617-500-4493 x807

2 2

Adding depictor/stem to Jenkins
by Tom Ritter 06 Jul '16

06 Jul '16

Hi all, Hoping someone can help me out here... I'd like to add a job to jenkins that runs the depictor command (`python write_website.py`) whenever a commit is made to the dev repo master branch[0] OR stem's master branch. (If I could only have one I'd pick stem's.) Historically, one of the reasons consensus-health has lagged a little bit has been because in the past there was some tiny change in Stem that wound up breaking it. I don't think that's happened lately, but it's caused me to be conservative about upgrading stem, and usually the changes I need are the latest one added to master. A jenkins job would give me a bit more confidence and enable a bit more proactivity on fixing it for breaking changes. Who runs jenkins? What would I need to do to set this up? The good news is there's only three commands needed to go from zero to index.html: git clone https://git.torproject.org/user/tom/depictor.git cd depictor git clone https://git.torproject.org/stem.git ./write_website.py -tom [0] https://gitweb.torproject.org/user/tom/depictor.git/

2 2