- tor-dev - lists.torproject.org

Proposal 334: A flag to mark Relays as middle-only
by ezhigp＠Safe-mail.net 14 Sep '21

14 Sep '21

Neel Chauman wrote at Sun Sep 12 19:17:37 UTC 2021: >my updated proposal >says that if one dirauth gives a relay the MiddleOnly flag, then it's >set for that relay. This is to prevent harm while all (or the majority >of) dirauths give the relay that flag. Imagine one hostile dirauth that votes for this flag on every relay it cannot control. Guessing the result is left as an exercise to the reader :). (Spoiler: IIUC, this will result in using only attacker-controlled relays as entries and exits, resulting in both-ends control of all external and hidserv circuits).

1 0

No arti report this week.
by Nick Mathewson 01 Sep '21

01 Sep '21

Hi! Usually I do Arti reports every other Wednesday, but this week I'm on vacation. I'll send the next report on September 15, so that the reports can be offset from the Arti meetings. cheers, -- Nick

1 0

Next public Arti meeting happening on September 8th at 1500 UTC
by Gaba 26 Aug '21

26 Aug '21

Hi! We are canceling the meeting on September 1st. Our next meeting will be on September 8th (and then every 2 weeks). Meeting's room: https://tor.meet.coop/gab-sis-ldw-xad Meeting notes in: http://kfahv6wfkbezjyg4r6mlhpmieydbebr5vkok5r34ya464gqz6c44bnyd.onion/p/art… Recording of previous meetings: https://www.youtube.com/playlist?list=PLwyU2dZ3LJErozq7cTtImuWkSn_34pEpq Agenda - status of Arti development and planning - user stories for Arti API https://pad.riseup.net/p/MUjnic0eRT0WrDW7M-us cheers gaba -- pronouns she/her/they GPG Fingerprint EE3F DF5C AD91 643C 21BE 8370 180D B06C 59CA BD19

1 0

Arti report 4: August 4 through August 18
by Nick Mathewson 18 Aug '21

18 Aug '21

# Arti Report 3: August 4 through August 18 At last we're done with circuit timeout inference! See the last weeks update for an overview of what this was, and why it was hard. As of last Friday, we've finally got an Arti implementation that builds testing circuits as appropriate, infers reasonable timeouts, and remembers those timeouts across runs. As a side-benefit to this work, we've found a number of points where we need to clarify the Tor specification to be more precise about correct behavior for a Tor client. (For example, how to break ties when deciding on the most populous histogram bins.) I'm taking some time to circle back and fix those in the Tor specs. Here is the first recorded persistent state from an Arti implementation, lightly reformatted: version = 1 histogram = [[415, 1], [495, 2], [515, 1], [535, 1], [545, 1], [555, 1], [625, 1], [655, 1], [665, 1], [785, 1], [835, 1], [865, 2], [885, 3], [955, 1], [965, 1], [975, 2], [985, 1], [1005, 2], [1025, 1], [1035, 2], [1055, 3], [1065, 1], [1075, 1], [1085, 2], [1095, 1], [1115, 2], [1135, 2], [1145, 2], [1175, 1], [1185, 1], [1195, 2], [1205, 3], [1215, 1], [1235, 2], [1245, 6], [1255, 1], [1265, 2], [1285, 2], [1295, 3], [1305, 1], [1315, 1], [1355, 2], [1375, 2], [1385, 2], [1405, 2], [1435, 1], [1455, 1], [1465, 1], [1495, 1], [1505, 1], [1525, 1], [1535, 1], [1555, 1], [1565, 1], [1605, 1], [1625, 1], [1665, 1], [1765, 1], [1785, 1], [1825, 1], [1965, 1], [2165, 1], [2495, 1], [3025, 1], [3855, 1], [4265, 1], [4795, 1], [4935, 1], [5435, 1], [6825, 1]] current_timeout = 1592 abandoned_circs = 0 successful_circs = 20 ## Other work We've continued to review and merge volunteer patches. Thanks, everybody! In response to a patch documenting a number of possible panics, I've taken a pass through the code to reduce the number of functions that could panic. I've also been spending some time improving test coverage: while doing so, I found an incorrect behavior when checking whether two IPv6 addresses were on the same network. (Tests are great and need to be everywhere, apparently.) ## Coming up Our current priorities are: * Starting API design work. So far we've been feeling our way forward, and it's time to get more systematic. * Improving our APIs and internal functionality for stream isolation, to support a variety of usecases more like what can be done with current Tor. * Kicking off the work on a Guard implementation. This is the last key feature we need for a basic level of privacy. * Lots more interviewing job candidates. Let's see how far we get in the next two weeks!

1 0

txtorcon 21.1.0
by meejah 16 Aug '21

16 Aug '21

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 I'm pleased to announce txtorcon 21.1.0. This fixes some incorrectly-skipped tests in 21.0.0 * Fix some incorrect unit-test skipping logic (thanks Jean-Paul Calderone) https://github.com/meejah/txtorcon/issues/354 and https://github.com/meejah/txtorcon/issues/352 * Fix broken tests revealed by previous fixes (thanks Jean-Paul Calderone) https://github.com/meejah/txtorcon/issues/356 You can download the release from PyPI or GitHub (or of course "pip install txtorcon"): https://pypi.python.org/pypi/txtorcon/21.1.0 https://github.com/meejah/txtorcon/releases/tag/v21.1.0 Releases are also available from the hidden service: http://fjblvrw2jrxnhtg67qpbzi45r7ofojaoo3orzykesly2j3c2m3htapid.onion/txtor… http://fjblvrw2jrxnhtg67qpbzi45r7ofojaoo3orzykesly2j3c2m3htapid.onion/txtor… You can verify the sha256sum of both by running the following 4 lines in a shell wherever you have the files downloaded: cat <<EOF | sha256sum --check aebf0b9ec6c69a029f6b61fd534e785692e28fdcd2fd003ce3cc132b9393b7d6 dist/txtorcon-21.1.0.tar.gz bcc54299e5119d6a9ace889bbefc1ff93108a204824b738e9c77bdb71f61661f dist/txtorcon-21.1.0-py2.py3-none-any.whl EOF thanks, meejah -----BEGIN PGP SIGNATURE----- iQFFBAEBCgAvFiEEnVor1WiOy4id680/wmAoAxKAaacFAmEa1UoRHG1lZWphaEBt ZWVqYWguY2EACgkQwmAoAxKAaad3/gf/S0mneFfvY0CdqR3DyIOgjX29lIotkDzf 1SeTnLdSU2SYXj89d8TnCUONkQiFZvruGcQufASA+mbIFKC+2KwZ7BVJLlYJ9MGu Cyjt+1jr2xXGmAEVqLcDwCZM7v4BknD/W2jxZqLx3CjDuU3U1abjcJUBlt2Pq/uA B5wWK6PAxIE1rksGtk+ftMf+jMIRwTb5hNj9HynDuGzW3MFbmanyQh2eBfQPlrve 1FqmQUEaOKMM6S34mvExRIjB5/q1SNs8+zX9oAR5wrLh3NVCsiVyXtVOvU949sLy HKVm9nHzgemRrj/nsKetLahM5MYpRYFMhZVYTK+nyotK+I5tRfrXGQ== =e+mc -----END PGP SIGNATURE-----

1 0

This week's arti meeting rescheduled: 18 August, 1600 UTC
by Nick Mathewson 16 Aug '21

16 Aug '21

Hi! Because of a scheduling conflict, our biweekly Arti meeting is rescheduled (for this Wednesday only). The time this week will be at 18 August, 1600 UTC, at https://tor.meet.coop/gab-sis-ldw-xad . This week we'll be brainstorming API ideas, use cases, and user stories. Don't worry if you can't make it: we record our meetings and put them online on Tor's youtube channel. (And this won't be your last chance to influence the API; it's just an initial brainstorming session.) cheers, -- Nick

1 0

GSoC 2021 - Alexa Top Sites Captcha and Tor Block Monitoring #Update
by Apratim Ranjan Chakrabarty 09 Aug '21

09 Aug '21

Hi, Since my previous updates I've come up with a near working system that fetches data from different browsers via a control node and exit relays, and analyzes the different results, and further renders and plots the data into the localhost of the system. Areas where work is pending: + The Captcha Monitor is working and producing data-points, provided "captchamonitor-tor-container" works correctly. As of now I do have data but not much. Can check here:[0].The fault in container is that it turns unhealthy and therby the application doesn't work, as it depends upon the "captchamonitor-tor-container". Tickets regarding this are: [1],[2]. So this will be one of my tasks to complete as more the data, more will the cases to look for and access the working. + Create more graphs which would provide more insights and data to the users[3]. + Reviews from the Community: For the dashboard [0], I'll add the search bar which as of now is disabled. Further on clicking the individual Relay it redirects to the detailed page based on relay. As of now there are a lot of directions where it could be improved, one possible example could be the UI of the website. This is a field I would require some help from the community for ideas on improving it. That being said, I'm maintaining more on to-dos and resources here: [4]. Again,feel free to add more resources and discussions here as to what you feel could be added or removed and help a better working for the system. Thanks, Apratim References: [0]: http://20.85.221.64:5000/dashboard.html [1]: https://gitlab.torproject.org/woswos/CAPTCHA-Monitor/-/issues/95 [2]: https://gitlab.torproject.org/woswos/CAPTCHA-Monitor/-/issues/99 [3]: https://gitlab.torproject.org/woswos/CAPTCHA-Monitor/-/issues/88 [4]: https://gitlab.torproject.org/woswos/CAPTCHA-Monitor/-/issues/96

1 0

Arti Report 3: July 21 through August 4
by Nick Mathewson 05 Aug '21

05 Aug '21

Still quiet here for the last couple of weeks. I've been moving ahead on circuit timeout inference, and reviewing _lots_ of volunteer-submitted code (and job applications). The quiet part is coming to an end: Two of the engineers who have been on vacation or leave are back, and we're all trying to ramp up. We're also hoping to be scheduling interviews with prospective co-workers soon, so that's taking up some of our time.. but once it's done, it should accelerate our pace a bit. ## Circuit timeout inference logic I had hoped to be done with this by now, but it turns out that this code touches on several key architectural issues that we'll want to make sure we get right in the future. I'll touch on them a bit here. ### Persistent state The Tor protocol requires clients to keep persistent state across invocations in order to achieve good performance and privacy. Two notable cases of this are in the circuit management code: client need to remember circuit timeout data, and need to remember guard selection data. The C Tor client records these items in the same ad-hoc format used by Tor's configuration code. But for Rust, using serde seems like a better fit. I want to maintain the feature that Arti has now where you can run multiple processes with the same state directory. That could get tricky in the long run, but I think it's a design feature we need if we're going to keep Arti flexible enough for general use. My first implementation here is going to be bare-bones, but I'm trying to design it to grow and get replaced down the line. ### Inter-module event notification Frequently one module needs to notify another when some event occurs. In the circuit-timeout case, we need to notify the circuit manager whenever the network parameters have changed. We don't want to have the circuit manager probing the directory manager, since that's a higher-level module. And we don't want it probing the `NetDir` object it gets whenever it's time to build a circuit, since that would be a weird side-effect. The best I've been able to come up with for now is to allow the directory manager to expose a `Stream` of events for directory changes, and to have the `TorClient` object use events from that stream to alert the circuit manager to possibly changed network parameters. I think this should scale to other kinds of inter-module events in the future, though I do have a slight concern that it makes `TorClient` harder to reproduce with lower-level crates than it would be otherwise. (There's probably no avoiding that at this stage, though.) ### Non-user-initiated background tasks The circuit timeout code sometimes needs to build testing circuits in order to gather data, and the guard code does too. If we code this in a sloppy way, we'll wind up with three separate systems that all build circuits for different reasons at different times. With any luck, we can summarize the triggers from all of these circuit types into a single system. ## Coming up We've been working on refinements to the API in `arti-tor-client` to try to simplify the API as much as possible while still exposing the full back-end functionality. Everybody should expect a lot of unstability here. I am still hoping very much that the next time I write one of these reports, we'll be done with circuit timeout inference, and I can talk about API work and early progress on guards! :)

1 0

A proposal to phase out CAPTCHAs for BridgeDB
by Cecylia Bocovich 02 Aug '21

02 Aug '21

Hi everyone, We've been working on improving the usability of BridgeDB lately, and our CAPTCHAs have been a constant thorny problem. They are not accessible for blind users [0]. We've gotten many complaints over the years that they are hard to use [1], I'm sure Gus and the community team members can vent about the impact they've had on users. We even have some evidence that bots have been able to enumerate our CAPTCHAs just fine [2]. There are other anti-enumeration defences on BridgeDB that are perhaps more useful including: - partitioning bridges into buckets based on IP subnet: A user who requests bridges from a single IP address or multiple IP addresses from the same subnet won't be able to see every bridge. - time-locking access to bridges: The set of bridges that BridgeDB distributes to users during a single time period is locked to a small number. Repeated requests for bridges during that time period will return the same 3 bridges to the user. We haven't done a lot of experimenting with tuning these parameters to slow bridge enumeration attempts. For the most part, on the country level, censors that are willing to put the effort into blocking BridgeDB bridges seem to be pretty effective at it regardless of CAPTCHAs. The GFW blocked all of the new bridges from our 2019 bridge campaign in less than a month [3]. There was a recent case of censorship in Belarus where state censors blocked all of BridgeDB's email distributed bridges, but weren't able to enumerate bridges distributed over Moat or HTTPS [4]. It's possible that that CAPTCHAs were the reason behind this, but it's hard to know for sure. I would like to propose that we remove the CAPTCHAs from BridgeDB entirely, but I'd like to know whether there is research out there *specifically that fits with the anti-censorship context* showing that these CAPTCHAs are actually doing useful work to prevent Bridge enumeration. But, even if the CAPTCHAs are preventing a small number of censors from enumerating more bridges, is the usability impact worth what marginal benefit we get from it? Options for how to move forward: Option 1: Just remove the CAPTCHAs already! We're tired of waiting and just want our bridges. Option 2: Do some science? We could make a new distribution bucket in BridgeDB that distributes bridges through Moat without a CAPTCHA and have new versions of Tor Browser pull from this bucket. We can watch and perform measurements in places we know enumeration attempts have occurred in the past and see whether these bridges are enumerated more quickly and more completely than the old-school Moat bucket. Option 3: Keep doing what we're doing but try to make the CAPTCHAs more usable. This is the work we've had planned, but will only get us so far. Endpoint enumeration is a tricky topic and we do have some other alternatives in the pipeline. Conjure is more of a "blocking resistance through collateral damage" approach that's somewhat similar to domain fronting [5]. We've been looking at and hope to do more work in the future on reputation-based bridge distribution [6]. I see these as more promising than CAPTCHAs in the long run, and CAPTCHA-less BridgeDB bridges seem to still fill a need that built-in bridges and private bridges don't fill. I'd appreciate any thoughts, comments, or experiences others have! Cecylia [0] https://gitlab.torproject.org/tpo/anti-censorship/bridgedb/-/issues/10831 [1] https://gitlab.torproject.org/tpo/anti-censorship/bridgedb/-/issues/24607 [2] https://gitlab.torproject.org/tpo/anti-censorship/bridgedb/-/issues/32117 [3] https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/obfs… [4] https://gitlab.torproject.org/tpo/anti-censorship/censorship-analysis/-/blo… [5] https://gitlab.torproject.org/tpo/anti-censorship/team/-/issues/9 [6] https://gitlab.torproject.org/tpo/anti-censorship/bridgedb/-/issues/31873

4 3

Scalability or Onionbalance for v3 ephemeral/ADD_ONION services
by Chad Retz 26 Jul '21

26 Jul '21

A quick glance at the code shows that ADD_ONION (i.e. "ephemeral" onion services) doesn't support setting an Onionbalance frontend/master onion address (specifically https://gitlab.torproject.org/tpo/core/tor/-/issues/32709 doesn't seem to have a control-side analogue). Would a feature request for adding a `*(SP "OnionbalanceMasterKey=" OBKey)` (or "OBMasterKey" or whatever) to ADD_ONION be reasonable? If so, just add in Gitlab? Also curious alternative scalability and load balancing options for ephemeral v3 onion services. I have read https://www.benthamsgaze.org/wp-content/uploads/2015/11/sucu-torscaling.pdf but unsure if anything more recent has been written. Beyond that and Onionbalance, any other interesting approaches I could employ (assuming I can dev anything from a control port pov, but am wanting to work w/ an unmodified Tor binary)? Thanks, Chad

3 5