- tor-dev - lists.torproject.org

User Behavior Tracking defenses in VMs
by bancfc＠openmailbox.org 15 Mar '16

15 Mar '16

Intended for qemu-discuss /cc/ libvir-list, whonix-devel, tor-dev *** Hello. I work on WhonixOS an anonymity distro based on Tor. This feature request is related to the topics of privacy and anonymity. Its a complex topic and probably not in your area of focus but I think it has important implications because security and privacy are very much related in today's hostile computing environment. Virtualization is useful in presenting an identical environment and set of "hardware" for each user which goes a long way in creating an anonymity set of systems. That way a system attacker, advertisers and online trackers would not be able to fingerprint a user or their hardware. The problem: Tracking techniques have become more sophisticated with time. They advanced from simple cookies to browser/device fingerprinting (which Tor Browser focuses on defeating) to user behavior fingerprinting. The latter is about profiling how a user types on a keyboard or uses a mouse [2]. Keystroke dynamics is a super creepy way to track users based on how long they press keys (dwell time) and the time between key presses (gap time). This is extremely accurate at identifying individuals because of how unique these measurements are. Advertising networks (Google, Facebook...) that fingeprprint users on both the clearnet and Tor can deanonymize users. This technique is already actively used in the wild [6][7]. Potential Solutions: Since input devices are all emulated its a great opportunity to stop this profiling technique. * A security researcher designed a proof of concept plugin for Chrome browser that mitigates this. Implementing something like the PoC addon in [1] known as KeyBoardPrivacy. Some random delay in milliseconds in a 50 millisecond range for dwell and gap times for the emulated keyboards is enough to skew the values to render this attack useless while not affecting performance. * The changes made to Tor Borwser to make JS timers more coarse grained but constant (250ms for keyboard events) were not enough to stop keystroke dynamics fingerprinting because a malicious script can evict the cache and allow extrapolation of true timing events within 1-5ms accuracy .[3][5] Their goal is to instead add jitter to the timers [4]. A similar solution proposed in [4] can be implemented in all QEMU-KVM timers to mitigate both attacks. [1] https://paul.reviews/behavioral-profiling-the-password-you-cant-change/ [2] http://jcarlosnorte.com/security/2016/03/06/advanced-tor-browser-fingerprin… [3] https://www.lightbluetouchpaper.org/2015/07/30/double-bill-password-hashing… [4] https://trac.torproject.org/projects/tor/ticket/16110 [5] https://trac.torproject.org/projects/tor/ticket/1517 [6] http://scraping.pro/no-captcha-recaptcha-challenge/ [7] https://nakedsecurity.sophos.com/2013/11/01/facebook-to-silent-track-users-…

2 1

GSoC: Tor Messenger CONIKS integration
by Elias Rohrer 12 Mar '16

12 Mar '16

Hello nice people of the Tor project! I'm very interested in using the Google Summer of Code stipend to integrate the CONIKS key verification protocol into Tor Messenger. So I wanted to say 'Hi!' and introduce myself: I'm a computer science student at Humboldt Universität zu Berlin in Berlin, Germany. The main focus of my studies lies on security, computer networks (such as the peer-to-peer ones) and privacy enhancing technologies. In the last years I mostly worked with C/C++, but these days I'm learning erlang – mostly for its benefits in concurrent & network scalable programming, but also to learn 'something different'. This brings me to some questions regarding the project: If I understand correctly (after reading [1], there are three parts which should get implemented in course of the project: - A server component which stores the tamper-resistant database and would be run by the identity providers. - An auditor module which tracks the states of the server and publishes its view, so users can check that theirs is consistent with it. - And a client side plugin for Tor Messenger written in JavaScript. Concerning the two first parts: What would be the requirements concerning the language of the server? The Projects page list JavaScript and C as required languages, but would you also consider a server component written in erlang? I could do that in C/C++, but since I'm experimenting with erlang I thought I'd ask, especially, because I could imagine that the auditor functionality could be implemented into a XMPP server such as ejabberd or prosody. So, while the CONIKS provider would be more or less centralised for Tor Messenger, third parties like the XMPP server hosters could act as auditors by just loading up a plugin for their XMPP server. This Idea is based on the Q&A found in the ticket [1]. Do you think this would be a viable idea to roll out the auditor software? This should be it for my first questions. I'll study the CONIKS paper more in depth in the next days and will come back at you if more questions come up concerning the project idea – if that's okay with you. Best Wishes! Elias Rohrer / _tnull @ irc [1]: https://trac.torproject.org/projects/tor/ticket/17961)

3 8

What is Design?
by Spencer 12 Mar '16

12 Mar '16

1 de·sign verb \di-ˈzīn\ To plan and make decisions about [something]; to plan and make [something] for a specific use or purpose, or no purpose at all; to think of [something, such as a plan]; to plan [something]. ORIGIN - late Middle English as a verb in the sense 'to designate'; from Latin designare 'to designate', reinforced by French désigner; the noun is via French from Italian. TL;DR - to designate. --- Copied -dev, -ux, and -teachers once for relevance but, should there be, responses live on -talk. Wordlife, Spencer

1 0

Latency measurement from exits
by Zack Weinberg 10 Mar '16

10 Mar '16

Before I go reinventing wheels, has anyone got code to measure network latency (either RTT or one-way packet travel time will do) from a chosen Tor exit to an arbitrary destination? Latency from client to exit would also be useful. Thanks, zw

3 2

Tor browser (and releated) improvement ideas
by Michał Dziczkowski 10 Mar '16

10 Mar '16

Here are few of my improvement ideas for Tor Browser (and releated): * add more possible proxy hosts * make that TOR probes very often all avaliable hosts and pick every time the fastest one to prevent lagging while sites load * add a module with discovers the site load time and it determine that it's (or it's content) load to slow then would self switch proxy for the site to make it load faster * don't make tor browser install by default the No-Script plugin because it's preventing sites from working correctly (and it's very annoying to unblock each time scripts for each page, site or server) --- Mcgiwer

1 0

Make TorBirdy Better [GSoc16]
by Pushkar Pathak 09 Mar '16

09 Mar '16

Hi, I am a sophomore in IIIT,Hyderabd and would like to take the project to build TorBirdy better as my GSoc project.I have experience in c++,python,javascript,bash. Any links to get me started would be obliged. Thanks, Pushkar.

1 0

Interest in GSOC 2016
by AKASH DAS 09 Mar '16

09 Mar '16

Hii Community, I am a great enthusiast in network security and is very keen to increase my knowledge in this field and I think this is a way I can learn more things. So, I want to do something for this org and wanna contribute to it. I am currently a second year undergrad CSE student in Indian Institute Of Information Technology, Sricity. So please can anyone guide me so that I can get into it as soon as possible and start contributing. Regards, Akash Das Indian Institute Of Information Technology, Sricity System Administrator

2 1

TorBirdy (HTTP Proxy) [GSoC 2016]
by Prakhar Pratyush 09 Mar '16

09 Mar '16

Hello, My name is Prakhar Pratyush. I've been working on this project- "Make TorBirdy Better (HTTP Proxy)" for a few days. I have tried to understand the project and I would like to discuss a few things. At present, what TorBirdy does is- it configures ThunderBird to access the internet through a proxy SOCKSv5 server provided by Tor Bundle. So, are we trying to design an standalone HTTP Proxy which will directly connect to Tor network entry point without needing entire Tor bundle or are we just trying to design an intermediatery HTTP Proxy which will then connect to Tor SOCKSv5 proxy using some form of tunneling or Masqueranding. Thanks Prakhar Pratyush 3rd year, IIT Roorkee

1 1

Re: [tor-dev] Leif's important piece on update golden keys
by Nathan Freitas 07 Mar '16

07 Mar '16

On Mon, Mar 7, 2016, at 11:11 AM, Spencer wrote: > Hi, > > >> > >> Holger Levsen: > >> https://reproducible-builds.org and > >> https://reproducible.debian.net > >> > > Thanks! > > > > > Nathan Freitas: > > https://f-droid.org/wiki/page/Deterministic,_Reproducible_Builds > > > > Thanks! > > However, even though reproducible-builds seems to address the manual > install as well, which is good, I read the problem as being the actual > backdoor of auto-update. > > Since my Dad will not be able to make this verification, removing > auto-update from the package is the only real resolution here. I think our goal is to remove any one person from having the authority to release an update. F-Droid or similar package managers should expect multiple signatures in the future instead of just one. Part of the trust people will place in projects or apps in the future is that they are not only open-source, but have a judicially diverse or robust set of signatories. > Besides, given the broken/missing auto-update opt-out in packages like > OrFox, it is difficult to trust the developers, since it is the user who > defines "malicious". Can you explain this more? I want to make sure I don't misunderstand what the issue is. +n

2 1

Re: [tor-dev] [valencia2016] Leif's important piece on update golden keys
by Nathan Freitas 07 Mar '16

07 Mar '16

On Sun, Mar 6, 2016, at 11:44 AM, Holger Levsen wrote: > Hi, > > On Montag, 29. Februar 2016, Spencer wrote: > > > [auto update] a threat model we must > > > take more seriously. > > > we are making real progress. > > Like what? > > https://reproducible-builds.org has the very long answer and > https://reproducible.debian.net shows the status for Debian in great > detail. > (And these pages have links to the status of other projects as well.) ... and also: https://f-droid.org/wiki/page/Deterministic,_Reproducible_Builds +n

2 1