- tor-dev - lists.torproject.org

Raptor
by Liste 01 Apr '15

01 Apr '15

Some people say to track tor users there is a tool named raptor. It uses the packet data recognition to track via AS the data streams between tor hosts. Can be a good idea to split, merge, change the packet order, the data streams etc... to obfuscate the traffic with an algotithm to create false data recostruction? Example: Alice --->node-> node -> node --> Bob1 ----> False/EndOfStream ^ ^v ^v ^v ^v | \------- node <- node <- node <-- node ---------/ If a complex network is created and some random data and connection are added to negotiate the data obfuscation, is very difficult to track a single data stream or packet. When the data arrival, send some data (same payload size)to a random loop circuit. What do you think?

1 0

0.2.7 triage [almost there!]
by Isabela 01 Apr '15

01 Apr '15

Hello there! we are almost done with the triage of 0.2.7 - we have a good chunk of tickets organized into 2 groups at the spreadsheet. Now what I would like to ask people from today till our next IRC meeting (Core Tor meeting on Wednesday) is shape group 1 to be our final list. What that means? Review what is in there and what is not in there. We have added an extra column for you to have a chance to nominate things out of group 1 or to be added to group 1 (things from group 2). We are also asking that folks try to balance nominations always towards having more negative ones than positive ones (we don't want group 1 to end up with 200 tickets again :)) https://docs.google.com/spreadsheets/d/1H_kAcQQ-NpGpKWG9RlF3w-NhruKKE9EZJcR… Thanks for playing it! See ya on Wednesday) Isabela

2 2

What's going on with websocket user numbers?
by David Fifield 31 Mar '15

31 Mar '15

I noticed there's a big increase in reported users of the websocket transport in the past few weeks, from about 5 to over 50. https://metrics.torproject.org/userstats-bridge-transport.html?graph=userst… "websocket" is the transport name that flash proxy uses. I checked the bridge for flash proxy, and it doesn't seem to be used notably more often in the last weeks than before. https://globe.torproject.org/#/bridge/9DD7D759971D03E70F0181B4E6D5F7735E7BF… There are other bridges out there that also support the websocket transport. I don't know who's running them. I appended a list at the end of this message. It comes from grepping for "websocket" in https://onionoo.torproject.org/details?type=bridge&fields=nickname,hashed_f… Most of them seem to be related; namely, there are a lot with these characteristics: 80 <= ORPort <= 105 platform = Tor 0.2.7.0-alpha-dev on Linux transports = ["websocket","fte","obfs3","scramblesuit"] Morlock-sounding nicknames: ashrak, bashaak, delmac, gonach... The only bridges not belonging to this set are C3L (ORPort = 8118), giygas (my bridge), and nerds (ORPort = 9052, platform = Tor 0.2.5.11 on Linux"). It's possible that the new websocket users are using one of these other bridges. It's also possible, since the bridges run more than one transport, that the users are actually using some other transport, and they are mistakenly being counted for websocket: https://lists.torproject.org/pipermail/tor-dev/2014-September/007483.html A lot of them have last_restarted of 2015-03-14 or 2014-03-25, which fall roughly where the user increase is on the metrics graphs. Maybe they were recently rebooted with support for the websocket transport. David Fifield {"nickname":"ashrak","hashed_fingerprint":"F1C465D38F18091F6FED9CAC924DA50F2813C0AE","or_addresses":["10.219.160.68:80"],"platform":"Tor 0.2.7.0-alpha-dev on Linux","transports":["websocket","fte","obfs3","scramblesuit"]}, {"nickname":"bashaak1","hashed_fingerprint":"196FC9A50B1F3828730C11C4E1DD5B55F979F548","or_addresses":["10.152.136.2:80"],"platform":"Tor 0.2.7.0-alpha-dev on Linux","transports":["obfs3","scramblesuit","websocket","fte"]}, {"nickname":"bashaak2","hashed_fingerprint":"F76FB49B6B1CC1BB23618A20A2D6E8B1509BF7BC","or_addresses":["10.128.21.28:81"],"platform":"Tor 0.2.7.0-alpha-dev on Linux","transports":["obfs3","scramblesuit","websocket","fte"]}, {"nickname":"benna2","hashed_fingerprint":"3665A4A74A6554CA03122AFBC9C3C6C5AD2F9BC6","or_addresses":["10.35.205.157:83"],"platform":"Tor 0.2.7.0-alpha-dev on Linux","transports":["obfs3","scramblesuit","websocket","fte"]}, {"nickname":"C3L","hashed_fingerprint":"E1F69F3CE3107F740646127527F8B21BA8BCDFC4","or_addresses":["10.226.202.166:8118","[fd9f:2e19:3bcf::73:c310]:8118"],"platform":"Tor 0.2.7.0-alpha-dev on Linux","transports":["obfs3","scramblesuit","obfs4","websocket","fte"]}, {"nickname":"delmac1","hashed_fingerprint":"16EBD0A3DAD2833FDA9323F89ED9B2EFF484D748","or_addresses":["10.223.29.80:84"],"platform":"Tor 0.2.7.0-alpha-dev on Linux","transports":["obfs3","scramblesuit","websocket","fte"]}, {"nickname":"delmac2","hashed_fingerprint":"5B300273F583602780746191ADF17AC96190CC92","or_addresses":["10.12.236.225:85"],"platform":"Tor 0.2.7.0-alpha-dev on Linux","transports":["obfs3","scramblesuit","websocket","fte"]}, {"nickname":"giygas","hashed_fingerprint":"9DD7D759971D03E70F0181B4E6D5F7735E7BFDED","or_addresses":["10.233.17.187:9001","[fd9f:2e19:3bcf::df:d557]:9001"],"platform":"Tor 0.2.5.10 on Linux","transports":["websocket","obfs3_websocket"]}, {"nickname":"gonach1","hashed_fingerprint":"F532D7DC394BAE539D530EB9EC5BA22450A7910D","or_addresses":["10.231.241.32:86"],"platform":"Tor 0.2.7.0-alpha-dev on Linux","transports":["obfs3","scramblesuit","websocket","fte"]}, {"nickname":"gonach2","hashed_fingerprint":"6C1259CE071500804AC2E67673EA57045D44004B","or_addresses":["10.7.64.152:87"],"platform":"Tor 0.2.7.0-alpha-dev on Linux","transports":["obfs3","scramblesuit","websocket","fte"]}, {"nickname":"hoktar","hashed_fingerprint":"86D33A3BA7A04A1D8C1D4C44AEC5BF1FC163815C","or_addresses":["10.230.24.16:80"],"platform":"Tor 0.2.7.0-alpha-dev on Linux","transports":["websocket","fte","obfs3","scramblesuit"]}, {"nickname":"intar1","hashed_fingerprint":"98FC0DADB4EF313BAB18C4F8F5B29186CEC1EFEE","or_addresses":["10.142.253.194:90"],"platform":"Tor 0.2.7.0-alpha-dev on Linux","transports":["obfs3","scramblesuit","websocket","fte"]}, {"nickname":"intar2","hashed_fingerprint":"22A42B97C35A6CABCB837E308E302321DEE8860B","or_addresses":["10.227.197.14:91"],"platform":"Tor 0.2.7.0-alpha-dev on Linux","transports":["obfs3","scramblesuit","websocket","fte"]}, {"nickname":"kalma","hashed_fingerprint":"D923FB993A480E27023814CB22FA568B418C3561","or_addresses":["10.86.149.238:443"],"platform":"Tor 0.2.7.0-alpha-dev on Linux","transports":["websocket","obfs3","scramblesuit"]}, {"nickname":"krantu","hashed_fingerprint":"121385AFAC02851932A40635235D16A9A47390BE","or_addresses":["10.58.14.110:82"],"platform":"Tor 0.2.7.0-alpha-dev on Linux","transports":["obfs3","scramblesuit","fte","websocket"]}, {"nickname":"kreeshak","hashed_fingerprint":"94A4DCD9C31958710A8208233E2FA8A58F90DD08","or_addresses":["10.85.219.97:81"],"platform":"Tor 0.2.7.0-alpha-dev on Linux","transports":["obfs3","scramblesuit","fte","websocket"]}, {"nickname":"krelnok","hashed_fingerprint":"D1B0B1FDE5FF1047C5636BEAB06E22F3505D0895","or_addresses":["10.101.210.202:83"],"platform":"Tor 0.2.7.0-alpha-dev on Linux","transports":["obfs3","scramblesuit","fte","websocket"]}, {"nickname":"lantia","hashed_fingerprint":"6173C626355BA51DFE93F515F792CDC7B36652F4","or_addresses":["10.74.170.126:80"],"platform":"Tor 0.2.7.0-alpha-dev on Linux","transports":["obfs3","scramblesuit","fte","websocket"]}, {"nickname":"linvris1","hashed_fingerprint":"2DE8ED06644EAD67A4351F73CF94ED4819604AB3","or_addresses":["10.90.170.20:92"],"platform":"Tor 0.2.7.0-alpha-dev on Linux","transports":["obfs3","scramblesuit","websocket","fte"]}, {"nickname":"linvris2","hashed_fingerprint":"FFC371256605279169C8F740378EB88C542940E1","or_addresses":["10.15.182.141:93"],"platform":"Tor 0.2.7.0-alpha-dev on Linux","transports":["obfs3","scramblesuit","websocket","fte"]}, {"nickname":"naquadah1","hashed_fingerprint":"6D83B4CAF9807CB2C4C8C6C04EDDE27496E47525","or_addresses":["10.184.185.130:94"],"platform":"Tor 0.2.7.0-alpha-dev on Linux","transports":["obfs3","scramblesuit","websocket","fte"]}, {"nickname":"naquadah2","hashed_fingerprint":"9577348174583345AFF8FB2CD5C1DAAC3042F0BB","or_addresses":["10.99.253.237:95"],"platform":"Tor 0.2.7.0-alpha-dev on Linux","transports":["obfs3","scramblesuit","websocket","fte"]}, {"nickname":"nerds","hashed_fingerprint":"EE2AFFBF783BEA2D24904240A48DEDA2D5372FC8","or_addresses":["10.104.45.191:9052"],"platform":"Tor 0.2.5.11 on Linux","transports":["websocket","fte","obfs3","scramblesuit"]}, {"nickname":"orak1","hashed_fingerprint":"2E3494ABC70A4AF8AD301569C40D620C565A235A","or_addresses":["10.88.122.255:96"],"platform":"Tor 0.2.7.0-alpha-dev on Linux","transports":["obfs3","scramblesuit","websocket","fte"]}, {"nickname":"paiboun","hashed_fingerprint":"D416D28AB1C24C215D40CEB70BE36F2779E8B4A2","or_addresses":["10.54.177.10:105"],"platform":"Tor 0.2.7.0-alpha-dev on Linux","transports":["obfs3","scramblesuit","websocket","fte"]}, {"nickname":"piratepartei","hashed_fingerprint":"319F4D05D76537AADD499D5B48B4425DDFEF66C7","or_addresses":["10.133.182.221:80"],"platform":"Tor 0.2.7.0-alpha-dev on Linux","transports":["obfs3","scramblesuit","fte","websocket"]}, {"nickname":"shaltek2","hashed_fingerprint":"09C6AD6382A5C0AB268D0AEA25284E4AC0E5E4AC","or_addresses":["10.83.36.70:99"],"platform":"Tor 0.2.7.0-alpha-dev on Linux","transports":["obfs3","scramblesuit","websocket","fte"]}, {"nickname":"tauri1","hashed_fingerprint":"5B27B16BFF449E60C6084D1ED2A082AF8C459531","or_addresses":["10.16.110.176:102"],"platform":"Tor 0.2.7.0-alpha-dev on Linux","transports":["obfs3","scramblesuit","websocket","fte"]}, {"nickname":"tauri2","hashed_fingerprint":"B694A8E4E60E4CA6BF173D973731DA0B7D425999","or_addresses":["10.73.213.191:103"],"platform":"Tor 0.2.7.0-alpha-dev on Linux","transports":["obfs3","scramblesuit","websocket","fte"]}, {"nickname":"teltac1","hashed_fingerprint":"3EAA792F08B6D99031BBC3BCEB2C4BA58C5FAA41","or_addresses":["10.210.205.232:104"],"platform":"Tor 0.2.7.0-alpha-dev on Linux","transports":["obfs3","scramblesuit","websocket","fte"]},

1 1

maintenance status of atlas or globe
by Nusenu 31 Mar '15

31 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi, is globe or atlas actively maintained? Does it make sense to create trac entries? (I just want to avoid doing worthless things.) thanks, Nusenu -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJVFqYBAAoJEFv7XvVCELh0u1QQAKSai+lYibASpYdqUFnfka7E APq5zGYnkR1I9KGTR8aL9+Z/dlEzl2fCCztwyfFZPYFudh/qzPtSPDUInLvDE/za 3X25hbCHwyW9Q7jQKAYWYuYWACE1S4F62e6TFzoT20gga1EhldBO+FqL943D7DuV 4FPT6lkWuPtZKF5X3gb0tkS6d48o5NYSp3RhFsowX2Y3SfdoRnTa86QbQ+2k9g7K R2W6f53c6jxwUU8MC4W3Tqc2JykojFbZADvwi8QxJ+4KlxWimG6PDshuJoY+sdsX R0n5o0L986uAn9CA5K5s/ANLkl9cYgt/oxptsY4HWSFKAh6xjdQBSYt5qjXI+KxL d1PDPdGXjolePsjUv/md+hnoRVjo4FCjx+5aQw23QhGaCi9Np0E87rF2xuUNmszs y9F/niXvNJMp1OIhVDeTinLm18lkOVCoGz/UkHdbiBj5md/5GTfql3zp2Nssku30 O+hUOEuvTJ0mousMglFeWRiO2UiliU55qTEbIUV5o4YVCK4uWA11v06so6dI4FNh bRwqUTsnzU/PqLdvgDUP3fiZXizVoxQB+KMzwnmroV+QmL+cnAR7ac8hU/PfPH/F nC/lONV5ZiXnmBZXvHTnIUBeHRwtQi48rDWtNLnSQmRN3i8jwP1NiUmuyKXZgA2a 6+cGVMKBA+Xy2sBciw9y =2YsQ -----END PGP SIGNATURE-----

5 9

#14997: canonical path to tor alpha debian repo
by Nusenu 30 Mar '15

30 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi Erinn, it would be great if there was a canonical path to tor alpha releases (like the RPM repo provides) so people that choose to use alpha releases would not have to change their apt sources.list as soon as a new major tor version is released. What do you think about #14997? https://trac.torproject.org/projects/tor/ticket/14997 I guess this would not be big effort - simply creating a subfolder for the alpha builds would do it? thanks, Nusenu -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJVGTW8AAoJEFv7XvVCELh0zmIP/2Whg3TTSFVXTmvV4dz0oJaq 5caVsMJcKqeNXSxhg5hs4oVVpJco5wSdMrFkz384svFNGvhbnEsPxVy24tLjUw0O EUUzw6MQ4nbL4sEV9AjjVDKTcvPPM9l4jTfLb5/l49j6X9TNmW/DLJ3qm3/KHlM/ ny3Jzm9fXIu37WjkBfGJf5FDspLNKSOVkLj2tSXe/DURZ86caRH+HJkWD6cu4A+L QtfgZgFrmSS1oLwXsvt8PB5b7Hf7uoQlNoAJiS1WneEYlREZA1B9Jj/hdjtbUbaE pS46bFGghl6l8JVkaheHauCkc5sCXQegRQ4b4280ENmGqNcWyVQiIHwJ0q1xiI5G 88oMniG3SAELvsTBWd9idH2gkvst82qtHpq8kpA0Vk1TvbL1M6gI9YECf7f2VeMi w2zZSCgeCmI509GEsG53PiR2uj+7VGPSbSTeUlLXBOx9u0Qlt8UHhSwR58LJrp7C 79RzJxoXbJKWhPmNjIbcr2xX4TYyIqtmPvq6NCq3DpF73X/XrNPE9hF2t1PHPbR5 3rhgt4NyU65Oj8T79CHn1u7Lgd2VGaYf3hVnAHd+M1R270APhGu30Qur+Y6ta/54 3m0Ai81QRdxXZSJbRGZiAUhEh+bq1MMrj/aFZtBaVzT0tT5pDcdnIzAKeLPSbsRT UkiJp34p8BB6FoFel1uc =Znzj -----END PGP SIGNATURE-----

1 1

What is the unit of the bw reported in the descriptor?
by Thee Chanyaswad 30 Mar '15

30 Mar '15

Dear all, Following the earlier question about the gap between total bw reported, what is the unit of the bw shown? The Torspec doc says it's in Byte/s. Is this still correct? Thank you very much. Best Regards, Thee

2 1

HS bi-weekly community meeting
by Isabela 29 Mar '15

29 Mar '15

Hello there, I am very sorry for this to be taking so long. I keep forgetting about it! I created a poll for us to pick a day/time and start a bi-weekly meeting for the HS community. This was something we spoke in Valencia and the members of the community think is a good idea (a place to talk about HS in general not only sponsorR stuff). The times proposed at the poll are the most common time we meet (in UTC time) and for the slots where there is no meeting going on at #dev-tor. http://doodle.com/xnxugpt9fb7rvch2 Please vote! Thanks isabela

2 3

Renaming arm
by Damian Johnson 29 Mar '15

29 Mar '15

Hmmm, thread about something as squishing and infinitely debatable as a name. What could go wrong? But before you get excited I've already picked one, this is just to sanity check with the community that I'm not making a stupid mistake... again. Five years ago when I started arm [1] I had the following criteria for picking its name... 1. It needs to be short. This is a terminal command so anything lengthy is just begging people to alias it down. 2. It should be reasonably memorable. Sorry, no 'z62*'. 3. No naming conflict with other technical things. Body parts though are fair game though. Clearly the name failed at #3. When I picked it the ARM processor was just barely becoming a thing, but time marched on and now every irc discussion goes... new_person: New relay operator here, any tips? somebody: Hey, try arm! new_person: The processor? I'm so confused now. somebody: Nope, something completely different. It's a confusing name. I'm rewriting the whole bloody codebase so why not fix this along the way? So without further ado the name I've picked is 'Seth'. It's easy to type (#1), memorable (#2), and from what I can tell no SETH processors are on the horizon. I've reserved the name on PyPI, and searchs on wikipedia looks fine (most interesting match is the Egyptian god [2], which is actually kinda neat). So now just a final sanity check with you, our wonderful community. Any strong reasons to pick something else? Nothing is set in stone yet so still open to alternatives. Cheers! -Damian [1] https://www.atagar.com/arm/ [2] https://en.wikipedia.org/wiki/Set_%28mythology%29

13 23

Damian's Status Report - March 2015
by Damian Johnson 29 Mar '15

29 Mar '15

Guten tag world! Time again for another status report... -------------------------------------------------------------------------------- Arm Graph Panel Rewrite -------------------------------------------------------------------------------- Really? Has it actually been four months? Dusted off my work from November and finished rewriting arm's graph panel. Besides untangling a mess of code that would make my family disown me, this leverages 'GETINFO bw-event-cache' to greatly improve graph prepopulation. Thanks, Nick, for adding that! Coding aside, real challenge this month has been finding a better name. Thanks everyone who has helped (especially Mike!)... https://lists.torproject.org/pipermail/tor-dev/2015-March/008398.html I'm now strongly leaning toward Nyx. Brevity aside, Nyx is the primordial goddess of the night with a description that's positively delightful... "Her appearances are sparse in surviving mythology, but reveal her as a figure of such exceptional power and beauty, that she is feared by Zeus himself. She is found in the shadows of the world and only ever seen in glimpses." Very curious to hear what the community thinks. -------------------------------------------------------------------------------- New Development Blog -------------------------------------------------------------------------------- Five years now I've dumped my status reports onto a single page. While this worked, clearly it lacked a certain... elegance. Moved to a proper blog... * before: https://www.atagar.com/log.php * after: http://blog.atagar.com/ Personally I found it interesting how my style has evolved over the years. My current approach is to focus on a couple topics, followed by a brief list of additional things I've been up to. This is much easier to skim than the walls of text I once wrote. -------------------------------------------------------------------------------- Few other noteworthy things were... * Stem can now read encrypted hidden service introduction-points. (#15004) * Support for the consensus' new packages field and new HS extrainfo stats. * You can now specify just a single test to run, rather than a whole module. (#14944) * clv expanded our tests to check if tor has capabilities Stem lacks. (#8250) * Sebastian sped up our integ tests by making them use trigger-able events. (#14943) Cheers! -Damian

1 0

Tor Browser 4.5a5 will change circuit expiry to 2hrs
by Mike Perry 28 Mar '15

28 Mar '15

In Tor Browser 4.5a5, we decided to increase MaxCircuitDirtiness to 2 hours (https://trac.torproject.org/projects/tor/ticket/13766) Because we also use Tor's SOCKS username isolation using the URL bar domain as the SOCKS username in Tor Browser 4.5 now, this has the effect that websites you visit will continue to use the same circuit (and thus the same exit IP) for all of their content elements for 2 hours, or until you click "New Identity" or "New Tor Circuit for this Site" (which appeared in Tor Browser 4.5a4). The reasons for this change are detailed in that ticket description, but in summary I think it is a really, really bad user experience when a website switches languages, bans you, or logs you out every 10 minutes. My own workflow in Tor Browser has been frequently interrupted by this in ways that have caused lost work and/or lost access due to this problem. With this change in combination with the "New Tor Circuit for this Site" Torbutton menu option, you now have the ability to get a good circuit for a site that you can actually use long enough to get something done. However, there are some downsides to this change: 1. Longer circuit lifetimes may mean more memory consumption at relays. 2. Longer circuit lifetimes may make correlation easier for adversaries that run Tor nodes or can see inside TLS (by stealing node keys). 3. Longer circuit lifetimes may distinguish Tor Browser users at the Guard node. 4. Longer circuit lifetimes may mean that the Tor client is less able to adapt to transient changes in Tor relay overload - the load conditions that caused the Circuit Build Timeout code to pick your current path may have long since changed over the span of 2 hours. 5. We actually had to hack update, OCSP, and favicon requests to continue to use 10 minute circuits, because Firefox does not make it easy to determine the URL bar associated with them. (We opted to keep the circuits for these requests at 10 minutes to avoid excessive linkability at the exit.) Did I miss any? Long term, I think what I'd rather do to achieve this functionality is to create a "TrackIsolationExits" Tor feature that ensures that Tor Browser keeps the same exit IP for a given URL bar domain independent of the underlying circuit lifespan, as I mentioned in https://trac.torproject.org/projects/tor/ticket/15458#comment:2. So: How do we make the decision as to if it is more important to improve usability in the short term while we design and implement "TrackIsolationExits", or if the above concerns (and others) trump poor usability? Right now, I am inclined to make the choice that leads to more people being able to effectively use Tor Browser in the short term, and then try to provide a better solution that gives similar user-facing behaviors with better network usage properties in the long term. To complicate matters, as ticket #15458 indicates, there are several other security concerns related to circuit use by Tor Browser that also need to be ironed out. In particular, it is actually somewhat dangerous to allow websites to use a new circuit every 10 minutes for things like Javascript/AJAX requests, because this enables Guard discovery. SOCKS isolation and a long circuit lifespan may actually make such Guard discovery harder, but unfortunately, there may still be other ways to do this in Tor today (See https://trac.torproject.org/projects/tor/ticket/13669 and https://trac.torproject.org/projects/tor/ticket/7870) Thoughts? -- Mike Perry

5 8