- tor-dev - lists.torproject.org

Jacob Appelbaum's departure?
by Jacek Wielemborek 03 Jun '16

03 Jun '16

Hello, I heard on Hacker News that Tor Project announced that Jacob Appelbaum "Appelbaum stepped down from his position at The Tor Project". Why is that? HN users are theorizing about FBI's involvement: https://news.ycombinator.com/item?id=11831629 Does anybody know anything specific? Cheers, d33tah

2 1

adding smartcard support to Tor
by Razvan Dragomirescu 03 Jun '16

03 Jun '16

Hello, I am not sure if this has been discussed before or how hard it would be to implement, but I'm looking for a way to integrate a smartcard with Tor - essentially, I want to be able to host hidden service keys on the card. I'm trying to bind the hidden service to a hardware component (the smartcard) so that it can be securely hosted in a hostile environment as well as impossible to clone/move without physical access to the smartcard. I have Tor running on the USBArmory by InversePath ( http://inversepath.com/usbarmory.html ) and have a microSD form factor card made by Swissbit ( www.swissbit.com/products/security-products/overwiev/security-products-over… ) up and running on it. I am a JavaCard developer myself and I have developed embedded Linux firmwares before but I have never touched the Tor source. Is there anyone that is willing to take on a side project doing this? Would it be just a matter of configuring OpenSSL to use the card (I haven't tried that yet)? Thank you, Razvan -- Razvan Dragomirescu Chief Technology Officer Cayenne Graphics SRL

8 34

[GSOC 16] Ahmia status update #1
by Ismael R 03 Jun '16

03 Jun '16

Hi everyone, I'm working on ahmia.fi, the hidden service search engine and you're reading status update #1. During the last two weeks i've been working on several things: 1/ Settle on a new structure for ahmia source code. The official repository [1] contains all the code related to ahmia. Some of this code is deprecated (solr is not used anymore), documentation needed to be updated, so it needed a bit of cleanup anyway. A structure with two repositories was chosen: - ahmia-site [2] is going to contain the django website, configuration to use it in production (apache, nginx, uwsgi) and documentation on how to get the project running. - ahmia-crawler [3] is going to contain scrapy bots, configuration + documentation (elasticsearch, polipo) I tried to keep all past commits when creating these repositories. 2/ Update documentation See [2] and [3]. 3/ Start to refactor the django project The django project is going to be composed by two apps: - search is going to be the search engine frontend + future API endpoints - trends is going to be the statistics visualization frontend + future API endpoints Some logic is also going to move from the website source code to the indexer part of the search engine (ex: removal of fake/banned domains). You can see this work on the ahmia-site repository [2]. Note: The trends app is not yet done so it isn't visible online. 4/ Implement continuous integration with travis.CI Tests are going to be automatically run on travis.CI. I also consider to display test code coverage with coveralls.io but I fear about people focusing on improving the coverage percentage at all cost, which is not very good. This work is going to be pushed during the week-end. 5/ Start to write a proposal with details on how to improve search I have yet to write a much more readable document, but here are a couple ideas: - Regroup all data related to domains, stats, content into elasticsearch so when can use it for search or insights - What about a pagerank-like algorithm to estimate a webpage popularity instead of tor2web popularity ? - Improve search with human language thanks to elasticsearch [4] - Use static boosting with popularity (or pagerank) field [5] We have a meeting planned tuesday with all ahmia's contributors. I hope to have a clean proposal by then to discuss it with them. During the next two weeks, I plan to continue working on the same things. I want to finish 1/ to 4/ as quickly as possible to start working on search quality. See you in two weeks :) Ismael [1] https://github.com/ahmia/search [2] https://github.com/iriahi/ahmia-site [3] https://github.com/iriahi/ahmia-crawler [4] https://www.elastic.co/guide/en/elasticsearch/guide/current/languages.html [5] https://marcobonzanini.com/2015/06/22/tuning-relevance-in-elasticsearch-wit…

1 0

[GSOC16] Fingerprint Central - Status report n°1
by Pierre Laperdrix 03 Jun '16

03 Jun '16

Hi everyone, Here is my first status report for my GSOC project. 1 - Here is the link to the GitHub repo of the project: https://github.com/plaperdr/fp-central I have chosen the name "Fingerprint Central" for the project. I may change it in the future but I'm pretty satisfied with it for the moment. If someone has a great suggestion to replace it, don't hesitate to send it to me! I have also included on the main page a checklist for anyone to follow the progression of development. 2 - I took the time to build strong foundations for my project to support both current and future features. * To support addition and removal of fingerprinting tests, I have added a system that need two components: - a definition file where one gives all the information related to the test - the source code needed to execute the test With this system, I can manage tests dynamically and I can give information to the users on what is currently being run in the test suite. * To support different types of fingerprints and browsers, I plan to integrate a system to tag fingerprints. Instead of storing fingerprints in specific databases, I found that a tag system is a flexible way to deal with any changes and when statistics will be implemented, it will be easier to get numbers on relevant categories thanks to tags. Everything is explained in greater details in the "fingerprint" folder of the repo in the Readme files. I'd love to have feedback on it to know if I'm going in the right direction and if my project seems well structured. 3 - Everything that I'm planning to use is present in the Debian repositories except for the PyMongo support of Flask. This means that it may possible to use the Tor infrastructure to host the website. I'll see when I get closer to a first stable version what could be possible on that front. What's next? My focus for the next two weeks is mainly to add new tests (both standard and specific to the Tor browser) and to add support of MongoDB. I hope to have a page that collects fingerprints, stores them in Mongo and calculate statistics on them. That's it for me this week! Have a great week-end everyone, Pierre

1 0

[GSoC 2016] Orfox - Report 1
by Amogh Pradeep 03 Jun '16

03 Jun '16

Hey guys, This is my first status report for GSoC 2016. I’ve attended the tor browser meeting on IRC and done some organizational work there. We plan to now track Orfox specific tickets on trac [0] using the keyword “tbb-mobile”. We still have bugs on the TGP bug tracker [1] but plan to move slowly from there to trac. Currently, on the tor projects trac, we have mobile fingerprinting tickets. I’ve also had success in rebasing from orfox-tor-browser-38.5.0esr-5.5-2 to orfox-tor-browser-38.8.0esr-5.5-1 [2]. Between the time of writing the GSoC proposal and the start of the program, we rebased from orfox-tb_GECKO380esr_2015050513_RELBRANCH to orfox-tor-browser-38.5.0esr-5.5-2. And now we’ve successfully moved to 38.8.0. Here’s a temporary build if someone wants to check it out [3]. But the official one should be on FDroid pretty soon. Next up, ESR 45. Rebasing to 45 might be harder, but I will see how it goes. After which I plan on starting with the code audit. Thats it for now, just regular maintenance stuff, nothing fancy to report! Hope you guys have a nice weekend. Best, Amogh Pradeep amoghbl1(a)gmail.com [0] https://trac.torproject.org/projects/tor/query?status=!closed&keywords=~tbb… [1] https://dev.guardianproject.info/projects/orfox-private-browser/issues/ [2] https://github.com/amoghbl1/tor-browser/ [3] https://web.iiit.ac.in/~amoghbl1/Orfox-38.8.0.apk

1 0

[GSoC] CONIKS for Tor Messenger - 1st status report
by Huy Vu Quoc 02 Jun '16

02 Jun '16

Hi everyone, This is the first status report on the CONIKS for Tor Messenger project. This is what I have done so far: * Discussing with Arlo and Marcela about the account verification module. The proposal is described below. * Implementing the Merkle prefix tree module. The source code is under review and is available on github repo [1] * Submitting 2 patches for ctype-otr addon (pull #74 and #75 [2]) For now, I'm working on implementing the STR module as a part of Merkle tree module. This module would be moved into its own repo as a library, separated from the key server module, after others commented on the code. Next I plan to continue implementing the key server module (including the registration and key change operation). It also requires a prototype implementation of the account verification module. Besides, we also established the collaboration with engineers and PhD students from EPFL on developing the CONIKS server module. The source code of the CONIKS server module would be committed to its own repo [3], while other Tor Messenger specific modules would be committed to the repo of the project [4]. --- The account verification protocol is proposed as follows (credit to Arlo) - the user connects to an account - the client sends the registration request to a registration bot on the server - the client also signs the registered public key and sends it to the registration bot - the bot verifies the signature and registers the sending account with the public key The client sends the signed public key to the registration bot by using one of following methods: - send a direct message to the Twitter account of the bot (in case the account is a Twitter account) - send a private chat to the Jabber account of the bot (in case the account is a Jabber account) Best, Huy [1] https://github.com/coniks-sys/libconiks-server-go/pull/1 [2] https://github.com/arlolra/ctypes-otr/pulls [3] https://github.com/coniks-sys/libconiks-server-go/ [4] https://github.com/c633/tor-messenger-coniks

1 0

SHA-256 checksum mismatch
by Tuuranton 02 Jun '16

02 Jun '16

The SHA-256 checksum of the downloaded file https://www.torproject.org/dist/torbrowser/6.0/TorBrowser-6.0-osx64_en-US.d… is on my computer 0f4f6ca01028c2956c811dd94d67a76feb507cad176c031f32e6f95873003b4c But according to the text file https://dist.torproject.org/torbrowser/6.0/sha256sums-unsigned-build.txt the SHA-256 checksum of the file TorBrowser-6.0-osx64_en-US.dmg should be d68d01889ba38764ebf2057b3cd3263f638a74205031a6d1df11ab8ca13a3618 Why the mismatch?

3 2

Tor Messenger Sources
by AKASH DAS 01 Jun '16

01 Jun '16

Sir, Can you please tell me from where and how can I install sources of tor messenger so that I can start building it. Akash Das Student Systems Admin IIIT-Sricity

3 2

Re: [tor-dev] Tor Messenger Sources
by moosehadley＠gmail.com 01 Jun '16

01 Jun '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 The guide on how to build Tor Messenger from source is here- https://gitweb.torproject.org/tor-messenger-build.git/tree/README Including the dependencies you need to build it. On Jun 1, 2016, at 2:56 AM, AKASH DAS <akash.d14(a)iiits.in> wrote: Sir, Can you please tell me from where and how can I install sources of tor messenger so that I can start building it. Akash Das Student Systems Admin IIIT-Sricity _______________________________________________ tor-dev mailing list tor-dev(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev -----BEGIN PGP SIGNATURE----- Version: iPGMail (3.0.1) iQIcBAEBCAAGBQJXTpNWAAoJEMV6CBTIYTyTAAEQAMXb89I+5FzPtqqc1BcD8NAOBay6JYTb+/YR ytvipWr8uReasnXqnUnHM4uAJd5chtu3+1zHE25XCviozZPrg84OTNtGOTE4IbIVAnMx4e7dfbte Z2Pte4nOoixidU4AJfmhQL+rkyLQEIsTYcRxDTrSdEmXhxVFc1WfCEVy+ksq5g46xkEM/5TMZX2D v6T4tV7fBD9S/Aj9r/CL4GeeOVyH4Garj/ibpcSRbFeMJ/NnmmllJvq64/LHQvvIzRw+JatSg7Pk 4qtB/ccWNRPuA0YWCZncepE1SobtwY6HJLnDPw4+2umwhbRAG3Er0ojnpuqYRbQ3dfgJMENZA393 M/Pnmt3ex9t10gNJlYF1uSfu+ZXW6XbF5NLz6/6CmmjeLFxT0FN89xfgWbThlJIgarQI32Vy9/MD sNigyZAndifNpTiSnaarshmT46NLJT0l9/IIXDBZZrVC3vdZU3Rv48gco4YEFUzq3WrO5KpCHBER kBcbhHTlXsrhIo2iozQ0oDLkRBU9XAdLW47ELQc/is9P+GIumuysV58qaX/c3NrGjHCev+IqUbNk 2sCNBM5T1TvmYqDGBmgcKjSHggMj2zRNLxmu7ULeUOznvT6ZgHGDWbiPY5lJjPrSb1lrwEGA7mTW 9uLxKwdzPYxEKJuNUjwFHxs3H5GeQ2/bSYxivmfG =4Ssu -----END PGP SIGNATURE-----

1 0

both onionoo instances behind, any others available?
by nusenu 31 May '16

31 May '16

Hi, since both onionoo instances[1] I know of are currently "behind" (2016-05-26 and 2016-05-30 as of today 2016-05-31), does anyone know of other onionoo instances? thanks! https://onionoo.thecthulhu.com/details?limit=0 https://onionoo.torproject.org/details?limit=0

1 0