- tor-dev - lists.torproject.org

Re: [tor-dev] A suggestion for differential private statistics gathering
by teor 07 Jan '18

07 Jan '18

Hi Eyal, Thank you for letting us know about your research. You've emailed an internal discussion list, so I'm going to direct all responses to the public tor-dev@ list. That is the list where we discuss changes to Tor. Please see my response below: > On 7 Jan 2018, at 20:31, Eyal Ronen <eyal.ronen(a)weizmann.ac.il> wrote: > > I am a PHD student, and have just published online a paper, that shows a protocol that I think might be relevant to the TOR network. > The protocol allows a server to privately learn information from a client, and is resilient to a situation where a malicious adversary wants to temper with the statistics. > The main use case in our paper is learning popular passwords, Are you aware of this password list? (It has no privacy apart from hashing the passwords, because the passwords are already publicly available in data breaches.) https://www.troyhunt.com/introducing-306-million-freely-downloadable-pwned-… > but we believe that it might also be usable for other cases in the TOR network. As we do not know the needs and challenges in the TOR network, we would greatly appreciate any feedback from the TOR metrics community. I would be interested in an explanation of the tradeoffs between the 16 and 32 bit versions of the protocol. In particular, we may not be able to provide servers with 4 GB of RAM for the 32 bit protocol. What would we lose with a 16 bit version? Is a 24 bit version possible? > The paper is titles "How to (not) share a password: Privacy preserving protocols for finding heavy hitters with adversarial behavior" and can be found at https://eprint.iacr.org/2018/003 > > The abstract is: > "Bad choices of passwords were and are a pervasive problem. Most password alternatives (such as two-factor authentication) may increase cost and arguably hurt the usability of the system. This is of special significance for low cost IoT devices. > > Users choosing weak passwords do not only compromise themselves, but the whole eco system. For example, common and default passwords in IoT devices were exploited by hackers to create botnets and mount severe attacks on large Internet services, such as the Mirai botnet DDoS attack. > > We present a method to help protect the Internet from such large scale attacks. We enable a server to identify popular passwords (heavy hitters), and publish a list of over-popular passwords that must be avoided. This filter ensures that no single password can be used to comprise a large percentage of the users. The list is dynamic and can be changed as new users are added or when current users change their passwords. We apply maliciously secure two-party computation and differential privacy to protect the users' password privacy. Our solution does not require extra hardware or cost, and is transparent to the user. > > The construction is secure even against a malicious coalition of devices which tries to manipulate the protocol in order to hide the popularity of some password that the attacker is exploiting. We show a proof-of-concept implementation and analyze its performance. > > Our construction can also be used in any setting where one would desire to privately learn heavy hitters in the presence of an active malicious adversary. For example, learning the most popular sites accessed by the TOR network." Tor Proposals There is a current proposal to add privacy-preserving statistics to Tor using a scheme that's based on PrivCount: https://gitweb.torproject.org/torspec.git/tree/proposals/288-privcount-with… PrivCount is limited to counters with integer increments, so we can't easily find the most popular site (the mode), or calculate the median. We discussed the proposal on tor-dev@, and decided that we could add more sophisticated statistics later. We would appreciate your feedback on the proposal. In particular, please let us know if there is anything we should change in the proposal to make it easier to extend with schemes like yours in future. Here is the proposal thread: https://lists.torproject.org/pipermail/tor-dev/2017-December/012699.html Anyone is welcome to submit Tor proposals, the process is described here: https://gitweb.torproject.org/torspec.git/tree/proposals/001-process.txt Related Research There was a paper at CCS 2017 that sounds very similar to your scheme: Ellis Fenske, Akshaya Mani, Aaron Johnson, and Micah Sherr. Distributed Measurement with Private Set-Union Cardinality. In ACM Conference on Computer and Communications Security (CCS), November 2017. Source: http://safecounting.com/ Can you explain how your scheme differs from PSC? There's a forthcoming paper at NDSS 2018 that measures a single onion site's popularity with differential privacy using PrivCount: Inside Job: Applying Traffic Analysis to Measure Tor from Within 25th Symposium on Network and Distributed System Security (NDSS 2018) Rob Jansen, Marc Juarez, Rafael Galvez, Tariq Elahi, and Claudia Diaz Source: https://onionpop.github.io/ But the measurement was limited to one site, because PrivCount can't calculate the modal value from set of samples. So I can see the advantages of a scheme like yours over PrivCount. Your Own Research And finally, if you do want to do research on the public Tor network, I would recommend contacting the Tor Research Safety Board for advice: https://research.torproject.org/safetyboard.html T -- Tim Wilson-Brown (teor) teor2345 at gmail dot com PGP C855 6CED 5D90 A0C5 29F6 4D43 450C BA7F 968F 094B ricochet:ekmygaiu4rzgsk6n xmpp: teor at torproject dot org ------------------------------------------------------------------------

1 0

Call for review of Tor Relay Guide (#24497)
by nusenu 05 Jan '18

05 Jan '18

Hi, since the instructions on the website on how to setup a Tor relay are lacking information and clear guidance we have been working on improving it. The current version lives in the wiki and it reached a point where it makes sense to get reviews. https://trac.torproject.org/projects/tor/wiki/TorRelayGuide If there are major changes you would like to see please discuss them on the ticket before proceeding in the wiki: https://trac.torproject.org/projects/tor/ticket/24497 looking forward to your feedback and reviews! thanks, nusenu -- https://mastodon.social/@nusenu twitter: @nusenu_

1 0

#24526: neeeds review: require ContactInfo+MyFamily for multi-relay operators
by nusenu 04 Jan '18

04 Jan '18

Hi, it would be great if someone could review this change so we can move forward on this topic: https://gitweb.torproject.org/nickm/tor.git/commit/?h=bug24526&id=fbb6f9a18… https://trac.torproject.org/projects/tor/ticket/24526#comment:7 thanks, nusenu -- https://mastodon.social/@nusenu twitter: @nusenu_

2 1

Re: [tor-dev] Did tor-wiki-changes ML break?
by Damian Johnson 03 Jan '18

03 Jan '18

Hi nusenu. Yup, a CenturyLink technician is coming in a few hours to restore my connection. Note to self: losing home internet connectivity sucks. Cheers! -Damian from a coffee shop On Jan 3, 2018 2:38 AM, "nusenu" <nusenu-lists(a)riseup.net> wrote: Hello Damian, Damian Johnson: > Hi nusenu. Yup, I was just thinking about that. CenturyLink did some > work on my apartment's connection yesterday that knocked it offline. > Probably just needs the router to be rebooted but I'm visiting with > family through new years so the r2e instance will be unavailable until > then. are you planing to bring this functionality back any time soon? thanks for considering it, nusenu -- https://mastodon.social/@nusenu twitter: @nusenu_ _______________________________________________ tor-dev mailing list tor-dev(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev

2 1

Did tor-wiki-changes ML break?
by nusenu 03 Jan '18

03 Jan '18

Hi Damian, it appears to be the case that wiki changes are no longer send to this ML. Could you have a look? https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-wiki-changes thank you! nusenu -- https://mastodon.social/@nusenu twitter: @nusenu_

3 7

trac.tpo issues
by nusenu 24 Dec '17

24 Dec '17

Hi, in the last few days trac says occasionally "Service Unavailable" and right now trac times out. Since we are currently (attempting to) work on a wiki page, this is somewhat blocking our edits. Has trac some known issue? I'm looking forward to a reachable and stable trac :) thanks, nusenu -- https://mastodon.social/@nusenu twitter: @nusenu_

2 1

Rust rewrite help
by Ivan Mandura 24 Dec '17

24 Dec '17

Hello, My name is Ivan and I would like to help out with Rust rewrite. I'm a huge fan of both Rust and TOR. Recently, I spent some time in China and it made me realize the importance of a project like TOR. Have experience with low-level code, being in DB industry for a few years now. Any pointers would be of huge help :) Thanks, Ivan

3 4

#tor-dev exitmap
by Harshavardhan Reddy 23 Dec '17

23 Dec '17

Hi, How does the Tor Project deal with the malicious exit relays. Do you still run exitmap or something better?

3 2

Using bridges in different /16s
by teor 21 Dec '17

21 Dec '17

Hi all, If bridges users configure at least two bridges in different /16s, it makes it harder to run some kinds of statistical attacks on the paths that they build through the Tor network. (For example, working out that relays in that /16 are never used by the client.) For context, see this Twitter thread: https://twitter.com/twbtwb/status/943974051000721408 I think that: * most of the current default Tor Browser bridges are in at least two /16s, except for the single-bridge pluggable transports, * almost all the 3-bridge sets given out by BridgeDB are in at least two /16s. Should we: * document this as a recommendation? Where? * add code to Tor that warns when it isn't true? (Maybe not?) * make sure all of the Tor Browser bridges are across two or three /16s? * make sure BridgeDB gives out bridge sets in two or three /16s? T

1 0

[release] [protocol] Onionoo 5.0-1.9.0
by iwakeh 20 Dec '17

20 Dec '17

Hi there! as announced in November Onionoo's protocol has a major version jump to 5.0 Download available at: https://dist.torproject.org/onionoo/5.0-1.9.0/ Main protocol change (also summarized in [0]): Removed the $ from fingerprints in fields "effective_family", "alleged_family", and "indirect_family". Details can be found in [1] and [2]. The changes are already deployed on all onionoo.torproject.org instances. Please direct comments and questions to the metrics-team mailing list [3]. Cheers, iwakeh [0] https://metrics.torproject.org/onionoo.html#versions_5_0 [1] https://metrics.torproject.org/onionoo.html#details_relay_effective_family [2] https://gitweb.torproject.org/onionoo.git/plain/CHANGELOG.md?id=0bce98a8177… [3] https://lists.torproject.org/cgi-bin/mailman/listinfo/metrics-team

1 0