February 2019 - tor-project - lists.torproject.org

Are there countries where using Tor is illegal?
by Cristian Consonni 12 May '25

12 May '25

Hi, (Sorry if this question has already been asked in the past, feel free to point me to the relevant resources.) I know that the legal FAQs by the EFF state that: «we believe that running a Tor relay — including an exit relay that allows people to anonymously send and receive traffic — is legal under U.S. law.»[1] I also know there is a list of countries for which there is legislation that exclude communication service providers from liability. They are indicated in the Legal of the Tor Exit Guidelines page[2], they are USA, Germany, Netherlands, Austria, France, and Sweden. >From some articles in the press[3a][3b] it may be illegal - depending on how you interpret the wording[*] - to use Tor (and other technologies such as VPNs or proxies) in the UAE, with fines ranging in the millions of dirhams (hundreds of thousand of dollars). A couple of weeks ago it was discussed - on this list as well - that a law was introduced to the state parliament to ban Tor[4a][4b]. This follows a case of some months ago of a Russian Tor exit node operator being arrested for inciting mass riots and terrorism[4c][4d]. The idea of blocking VPNs or Tor seems to have already been considered in the past[4e]. This infographic about pluggable transports[5] suggests access to the Tor network is censored or limited in China, Uzbekistan, Iran, and Kazakhstan. Tor being censored orblocked may be different from it being illegal. What about other countries? Is there a place where I can find more about this topic? Cristian [1]: https://www.torproject.org/eff/tor-legal-faq.html.en [2]: https://trac.torproject.org/projects/tor/wiki/doc/TorExitGuidelines [3a]: http://www.emirates247.com/news/emirates/dh500-000-fine-if-you-use-fraud-ip… [3b]: http://news.softpedia.com/news/people-caught-using-vpns-tor-or-proxies-in-t… [*]: «Whoever uses a fraudulent computer network protocol address (IP address) by using a false address or a third-party address by any other means for the purpose of committing a crime or preventing its discovery» [4a]: https://lists.torproject.org/pipermail/tor-talk/2017-June/043293.html [4b]: https://trac.torproject.org/projects/tor/ticket/22055 [4c]: https://lists.torproject.org/pipermail/tor-talk/2017-April/043109.html [4d]: https://techcrunch.com/2017/04/24/dmitry-bogatov-tor-russia/ [4e]; https://torrentfreak.com/vpn-and-tor-ban-looming-on-the-horizon-for-russia-… [5]: https://www.torproject.org/images/PT/2016-07-how-to-use-PT.png

4 3

Roadmap for hypothetical network health team
by Roger Dingledine 29 Aug '19

29 Aug '19

Here is an area list for a hypothetical future "network health" team. I say hypothetical because we have no near-term plans to form such a team -- but imo the task areas make sense together. Some of them are being handled by other teams right now, but some of them aren't getting as much attention as they need. (1) track community standards about what makes a good relay - publish up-to-date expectations for relay operators - set best practices for how to set relay families - detect and resolve bad relays - exitmap, sybil detection, hsdir traps (2) anomaly analysis / network health engineer [with network team] - establish baselines of expected network behavior - look for and resolve denial of service issues - track connectivity issues between relays - look for relays hitting resource limits (3) make sure usage/growth stats are collected and accurate - track network performance, relay diversity by various metrics - count users [with network team and metrics team] - monitor bridge growth and usage [with censorship team] (4) relay advocacy [with community team] - maintain docs for setting up and running relays and bridges - grow a cohesive community of relay operators so they have peers - keep relays on the right tor versions - relaunch a gamification / badge system for lauding good relay progress - strengthen relationships with non-profit orgs that run relays - help companies that want to offset their tor network load (5) maintain the components of the network - maintain directory authority relationships - keep bandwidth authorities working (including setting the right balance between speed and location diversity) - have enough tor browser default bridges, and keep them running smoothly [with censorship team] - update the fallbackdirs list

3 2

Tor Browser Vision Brainstorm: Friday 8th February @ 20:00 UTC
by Pili Guerra 12 Mar '19

12 Mar '19

Hi everyone, We’ll be holding a brainstorming session this Friday 8th February @ 20:00 UTC over on #tor-meeting to discuss our joint vision for the Tor Browser in the near future. Please join us! We would love to hear your views. Thanks! Pili — Project Manager: Tor Browser, UX and Community teams pili at torproject dot org gpg 3E7F A89E 2459 B6CC A62F 56B8 C6CB 772E F096 9C45

5 7

Damian's Status Report - February 2019
by Damian Johnson 01 Mar '19

01 Mar '19

Hi all! Here's my status report for this last month (I miss the days when everyone wrote these...). https://blog.atagar.com/february2019/

1 0

Tor Browser Vision Brainstorm: Part II
by Pili Guerra 26 Feb '19

26 Feb '19

Hi everyone, We’re going to have the second part of this visioning exercise this Friday 1st March at 19:00 UTC on #tor-meeting. During the first part we discussed why we need a Tor Browser and some potential directions for the Tor Browser for the future. For this next session we will discuss our current users and how Tor Browser helps them with a view to the problems they will have in future and how we can continue serving them. We will also discuss where the Tor Browser fits into the Tor Project and what value it provides to TPI as an organisation. Additionally, on a more personal note, it would be good if everyone can think about the following questions to answer during the meeting, or even before on this thread: - why are you excited to work on Tor Browser - why you care about it - what positive change Tor Browser should bring about, and - how will Tor Browser shape the future. I’m excited to hear your views! Thanks, Pili — Project Manager: Tor Browser, UX and Community teams pili at torproject dot org gpg 3E7F A89E 2459 B6CC A62F 56B8 C6CB 772E F096 9C45

1 0

Next Tor Browser Release meeting: Wednesday 27th February @ 19:00 UTC
by Pili Guerra 26 Feb '19

26 Feb '19

Hi everyone, Just an email to let you know that there’ll be NO Tor Browser Release meeting next week. Instead our next meeting will be on Wednesday 27th February @1900UTC over at #tor-meeting on OFTC. I will send a reminder email closer to the time. Thanks! Pili — Project Manager: Tor Browser, UX and Community teams pili at torproject dot org gpg 3E7F A89E 2459 B6CC A62F 56B8 C6CB 772E F096 9C45

1 1

User Feedback Report - January 2019
by Maggie 26 Feb '19

26 Feb '19

Hey, team! Welcome to the January 2019 user feedback report! I hope 2019 is treating you well so far. For more information on what users and community members were talking about this month, check out the December 2018/January 2019 User Feedback pad [1]. TL;DR: There were a bunch of releases this month, and a few user bug reports in the blog post comments. Reddit was about the same as always (with a focus on VPN and fingerprinting questions), and RT brought in a lot of questions about problems connecting with bridges. - The question I see most often across platforms is 'why can't I connect to Tor?'. I think we should provide more information to users when they run into problems connecting. Ideally, we would implement error messages that let users know exactly what's wrong, and what they can do to fix it. Until then, it would be very useful to have a guide to finding and understanding Tor logs. I've opened a trac task for this [2]. I will need some assistance from the browser/applications team, so if you're able/willing to help teach me how to read these logs better, please reach out! - Reddit is mostly full of the same questions we saw last month (i.e. 'will doing x allow me to be fingerprinted?' & 'my bridges aren't working - what do I do?'). Hopefully the second problem can be addressed by the Tor log document proposed above. - Tor is still broken for screen readers. I've been receiving some messages about this in RT from folks affected by the issue. They're having to use TB 7 instead of TB 8, since updating breaks screen reader compatibility. Now, on to the feedback! Scroll further down to see a summary of Reddit posts, some points from Google Play Store reviews, a list of the most common Stack Exchange tags from the month, and a collection of some notable issues and bugs mentioned by users in January. --- Most common questions on Reddit: - Will doing _____ allow me to be fingerprinted? - Why can't I connect/why aren't my bridges working? One Reddit user is having a lot of trouble connecting from Turkey [3]. --- TBA Reviews & Feedback on Google Play Store: The average review score is still at 4.2 stars. Some people are a bit confused about bridges - it seems they don't know what to do once they run into connection issues. We should provide some more guidance, perhaps in the form of links to information about bridges. Some users were still experiencing crashes in January when saving files, as well. --- Most common stack exchange tags: configuration: 20 this month tor-browser-bundle: 15 this month connection: 11 this month hidden-services: 7 this month relays: 7 this month --- Notable bugs, fixes, & issues: #27503 [4] - Disabling accessibility on Windows breaks screen readers - OPEN #29238 [5] - TBA: Prevent crash following upgrade - OPEN #28705 [6] - Tor Browser on Android is crashing on newer Android devices (>= Android N) by file download - CLOSED #29175 [7] - Tor 0.3.5.x mishandles empty socks5 auth - CLOSED #29327 [8] - TypeError: hostName is null on about:tor page - CLOSED --- Other user suggestions: - "I want to suggest making a personalized .iso distro for people that want to run relays...We should be able to download something that is already configured with everything you need software wise to run the relay. The only thing we should have to do is open up the correct ports for port forwarding in our router. If this was procedure, I think there would be many more relays and exit nodes than there are." - "I understand why you've rolled Orbot into TB, but can you add an option to use the "legacy", separate Orbot into the settings? I used to have TB as the default browser on my 'droid, but now that every time I open it I have to sign into a second instance of Orbot (as a big chunk of traffic from my phone is Torified, I have Orbot on all the time) - since this takes a long time, I've resorted to using Firefox Klar/Focus." - "I want to set Tor Android Alpha to clear all personal data on exit so I went to Privacy -> Clear private data on exit. It works except for Downloads, which get un-ticked every time I re-launch Tor. It's probably a minor issue as other things like history and cookies do get cleared and stay like that. Although to be honest it would be nice to just have a single setting for always-on Private Tab whenever I launch Tor." (notably, I have not been able to reproduce the issue they describe with Download privacy settings resetting after a restart.) --- That's it for the month of January! If you want to know more, please do check out the December 2018/January 2019 User Feedback pad [1] or reach out to me via email (waywardwyrd at riseup dot net) or IRC (wayward). Before signing off, I'll leave you with this gem of a post [9]. Thanks for reading! I'll see you all back here next month! - wayward/Maggie pronouns: she/they | twitter: @meochaidha <https://www.twitter.com/meochaidha> pgp: 0626 9C68 D0CC 1A5B E41B 72F2 615E B878 975C 4CDC ------ Annotations: 1. https://storm.torproject.org/shared/CsGcDVAvB32NeawrrziFcprx22gp9EjUscJ61hm… 2. https://trac.torproject.org/projects/tor/ticket/29584 3. https://www.reddit.com/r/TOR/comments/alecre/turkey_cannot_connect_to_tor_w… 4. https://trac.torproject.org/projects/tor/ticket/27503 5. https://trac.torproject.org/projects/tor/ticket/29238 6. https://trac.torproject.org/projects/tor/ticket/28705 7. https://trac.torproject.org/projects/tor/ticket/29175 8. https://trac.torproject.org/projects/tor/ticket/29327 9. https://www.reddit.com/r/TOR/comments/akqh58/when_i_think_of_tor/

1 0

Tor Browser meeting notes, 25 Feb 2019
by Georg Koppen 25 Feb '19

25 Feb '19

Hi everyone! Our weekly Tor Browser meeting just finished. Here come the link to the IRC log (http://meetbot.debian.net/tor-meeting2/2019/tor-meeting2.2019-02-25-18.29.l…) and, as usual, the contents of our meeting pad: Week of February 25, 2019 Discussion: - Brainstorming dev meeting invites - is there anyone that we're working with a lot that we want to make sure is invited? - Tor Browser dev hiring process - Tor Browser vision exercise part II scheduling (GeKo: presumably on Friday 3/1 1900 UTC; pili nails that down) boklm: Since last meeting: - helped with publishing of the new releases, signing of the alpha, and following blog comments - reported #29476 (Add RecommendedTBBVersions to the new website) - reported #29550 (Tor nightly fails to build for Windows) - reviewed #25849 (Ship tor in Tor Browser nightly builds for Windows with Rust enabled) - fixed #29556 (nightly builds and testsuite emails) - reviewed #27210 (TBA - Support i386 target) - made patch for #29579 (Fix typo in projects/tor/build) - made patch for #28685 (Tor Browser for Android needs a more dynamic Build ID) This week: - try to finsh patch for #26323 (Build 32bit Linux bundles on 64bit systems) - continue work on testsuite - some reviews - look at CVs of browser developer candidates mcs and brade: Last week: - Made progress on #28044 (Integrate Tor Launcher into tor-browser). - Finished #27486 (Onboarding: "Visit an Onion" creates an "about:blank" loading page) - Debugged #29497 (After tor crash, firefox.exe shoots up to 50+% cpu usage) - Provided feedback on the browser developer hiring criteria (brade) and on some of the candidates (mcs). - Helped with triage of incoming bugs. This week/soon: - Make patches available for #28044 (Integrate Tor Launcher into tor-browser). - #29430 (meek-lite support in TL) - Review the Firefox updater security audit report. sisbell: Last week(s): - 29080: PR for TOPL accepted and merged - 29312: Create tor-browser-build for TOPL (in review) - 29313: Create tor-browser-build for tor-android-service (in review). Involved additional changes to packaging and proguard use. Made tor-android-service gradle build more configurable. This replaces orbotservice - 29574: Modify Orbot project in tor-browser-build to use TOPL (in review) - 29575: Create tor-browser-build for Firefox with TOPL libraries (in progress). - Resolving some issues around duplicate classes in dependencies. This Week: - 29575 - complete this - Testing APK - Start looking at changes of new Orbot UI to see what changes may need to be made pospeselr: Last week(s): #seattle-snowmagedeon2019 - built snowman - fell on ice - snow in the eyes - made a custom build for pili and antonella with #25658 changes - filed #29554 (about:preferences links do not function properly, needed for #25658) - most of the way done with #25658 - built alpha builds; a bit of a shit-show as i686 linux refuses to build on my machines - boklm: I neglected this a bit to focus on getting pili's macos build out, but everything matches on my end apart from the macos mar-tools (which doesn't quite seem right, given that all the other macos builds match) This week: - tonight! upoad macos mar tools file for boklm diff - uplift #29120 (neglected this one last week) - get a patch up for #25658 - hopefully fix #29554 GeKo: Today: - started to cut down my backlog - reviewed #29759 - wrote patches for #27210 and #29467 This week: - more backlog cutting down - reviews and help with mobile work - release prep (hopefully) - new month team admin stuff pili: Last week: - Mainly security settings user testing in India! This week: - Tor Browser release meeting - Tor Browser vision exercise part II - Organising and sharing India user testing and workshop notes - Onion Services proposal got accepted by OTF! - NLNet proposal for ESR migration got through to the second round Antonela: Last week: - Testing TBA - Preparing TB usability research in India and Indonesia This week: - #29440 - Update about:tor when Tor Browser is updated - Could we have some of these bridge decisions in TBA? sysrqb, sisbell, igt0, geko? [GeKo: yes, this sounds like something we should consider and build upon Anto: Awesome] https://lists.torproject.org/pipermail/tor-dev/2019-February/013708.html - Start digesting user research from India sysrqb: Last weeks: Put #28329 in review (TBA bootstrapping) Reviewed (most) TOPL patches Nearly have a F-Droid build ready for submission Worked on fastlane integration and auto-generating screenshots This week: Finish F-Droid submission patch Continue work on fastlane integration Review other tba-a3 tickets Georg

1 0

Update on Tor Meeting - where & when
by isabela 23 Feb '19

23 Feb '19

Hello Tor, I just want to share that we will be partnering with KTH Royal Institute of Technology in Sweden for our first Tor Meeting in 2019. It will take place in Stockholm and dates are July 11 to 15, where: * July 11 - people arrive * July 12 - meeting day * July 13 - meeting day * July 14 - meeting day * July 15 - people leave This meeting will have 3 days, not 5. This is not a change that will affect other Tor meetings, we are doing this just for this one to keep ourselves on budget. I will be sharing more information about the meeting, and what we are hoping to do that is open for the public since there won't be open days. You might have notice that our meeting is ending right when PETS[1] starts (in the same place). I will be sharing more information as we get things organized. Cheers, isabela [1] https://petsymposium.org/2019/index.php

1 0

Problems fetching Debian package archive signing key (0xEE8CBC9E886DDD89)
by Matthew Finkel 22 Feb '19

22 Feb '19

Hi All, Someone reported difficulty with retrieving 0xEE8CBC9E886DDD89 from the key servers. It seems this is only affecting some of the keyservers (but I don't know which ones because load-balancing). I was able to reproduce it, but not consistently. $ gpg --recv-key A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 gpg: packet(13) too large gpg: read_block: read error: Invalid packet gpg: no valid OpenPGP data found. gpg: Total number processed: 0 This error seems suspiciously similar to this sks-keyserver bug[0]. If anyone has any ideas of how we should troubleshoot or fix this, that'd be helpful. - Matt [0] https://bitbucket.org/skskeyserver/sks-keyserver/issues/57

4 5