- tor-project - lists.torproject.org

Updating the Tor Browser user manual
by Colin Childs 08 Mar '16

08 Mar '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi everyone, I hope you all had a great time in Valencia! As I mentioned in my previous status report, here is my current plan for updating the Tor Browser user manual. The idea behind doing this, is that a large portion of the tickets that come into the help-desk could be directly resolved by this document, if it were maintained and available in a way that users could easily access. I believe spending the time to finish up the manual and make it available would be more helpful to the help-desk, and the users than answering the hundreds of individual questions posed by the users that are already answered in this manual. When the help-desk initially started, the "short user manual" existed, which was where the majority of answers for users came from. This was extremely handy, as we were able to link them that document and the majority of users could work through it themselves, saving the help-desk for when they ran into issues. I'd like it if this could be the state of affairs again, as it made the lives of help-desk staff a lot easier at the time. Please let me know what you think of the plan below: - - Update certain outdated screenshots - - Do a complete pass of content review, and update / clean up any outdated or missing sections - - Write out an update plan for the manual, as described in https://gitweb.torproject.org/tor-browser/user-manual.git/tree/TODO - - Find a home for the document on torproject.org, hopefully in a mirrored location - - Contact trusted translators to work on localizing the user manual, or updating the parts that were already localized but updated. - - Upload manual to Transifex, and let translators begin working on the strings. - - Discuss ways the manual could be added to the Tor Browser (Only after it exists on the website) - - Begin pulling in new translations from language teams with trusted reviewers, and are at 100% completion Thanks for looking this over! - -- Colin Childs Tor Project https://www.torproject.org Twitter: @Phoul -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJW3sZRAAoJEJWQHABkmqq54YoP/jYzxUFN0+buF+jW51yJlkqP 98J09z4G7uAIN1vXp3jpWdm/EeddTkFsbIXkc/aJB88navwZZzJ5FQWVHsBBi6BG dHEjINFqSwWbHhytTNI808QBFs1u9eLHSjL8BaImTbRzey+teWTecaBozuDXZU/h 6cCGrkbUK9Zz58Z/Af8W9xNWopXZvK72AnTuX5ccaUpBDpATwG+NvJSsYuLG6Ca9 IB/2ZMZW9uTI9vcegpsY7FYIj1UWfE2wW2Aj6IAoLEFWSpO4NbZMow2edDyRrQco 09wXB59RQQI7yXCIF6d6dAGQHzTVtQ2G4SO04tuRAd1XfUn3VwzI2a5+EmLHWYsp jpeLu6GG2ia8g9dBnXrr4E+HYuqPpTYNxj5EuXF8yJj5zXX07bkxrAtfMy8+wyIV oEeMUTpls+bD2PS/COYEzy4T3gdOci5ptOb2yQr/rWVtVMfXu6Z1qwenbeAJxbu0 eRhfGXQ+eiyL7Om/8A5KdMNHpcK11Q019zbHiTpn8fxKTJW0HpaZJfNKckVJ3fBD Y7ILa1QgaDq19pOgYW1O+FFzS2W49xQHuIP54KxN5KUSOYBrrr48LogDrRLC9jvC 8h6haRP+YYT3smiUrn+thnkrqGu1wJC9X0vJaZIqPdwVGp/geCWQ3hI5rgXWI0px t/5UdHvNjT8lafy611c1 =ShOT -----END PGP SIGNATURE-----

2 1

Tor teachers mailing list
by Alison Macrina 03 Mar '16

03 Mar '16

Hi all, After a session at Tor dev about training users on Tor, a few of us thought it might be a good idea to make another push for the Tor-teachers list [1]. This list is for anyone who teaches Tor or want to teach Tor. We use this list to circulate training materials, share stories, and build community. Please join us on the list and tell us how you're teaching Tor, or how you'd like to! Some things that are particularly needed in the group: more curricula on the wiki [2] in more languages! Especially curricula aimed at different user groups (teens, lawyers, activists, etc). We're also hoping to get a list on there of possible places to go and teach Tor, eg upcoming conferences outside of the privacy/security world. I will send an update to the tor-teachers list with the rest of what we discussed at the training session, but I'll wait a few days so that folks can have some time to join the list. See you there! Alison [1] https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-teachers [2] https://trac.torproject.org/projects/tor/wiki/doc/tor-teachers

1 1

Our Jabber Server
by David Goulet 03 Mar '16

03 Mar '16

Greetings Everyone! Thanks to weasel for bringing Debian Jessie to the server, we now have a working usable Jabber server. Woot! Here is our XMPP score: c2s: https://xmpp.net/result.php?domain=torproject.org&type=client s2s: https://xmpp.net/result.php?domain=torproject.org&type=server Everyone with an LDAP account can connect to the server. Else, you can't. Before you can do that, you need to set your "rtc" password. Here is how: 1) Enter your user and ldap password at https://db.torproject.org/login.html and press "Update my info". 2) At the very bottom, you should see this https://people.torproject.org/~dgoulet/volatile/rtc-pass.png, the "Change rtc password" field. Put your password in there. Unfortunately, it silent fails if you enter a "too big of a password" and we are unsure of the maximum length so I think 16 characters (based on my experiment) is the maximum possible. 3) Wait a couple of minutes so the database sync up and reaches the jabber server. When you connect, if it fails, wait a bit more. Usually after 5 to 10 minutes it should work so report the issue if it still fails. Useful informations about the server now and how to use it. Your account is <ldap-user>@torproject.org. You have to enable TLS of course. We also have a hidden service! It's: k2r67kry5haud25b.onion. To use it, set the server of your account with it but the user must be your LDAP one that is <ldap-user>@torproject.org. It's federating that means you can add contact that are OUTSIDE of this server such as riseup users or any workable jabber server supporting TLS. Our TLS certificate is from Let's Encrypt and checksum is below. Remember that in 3 months that fingerprint will change: SHA256 Fingerprint=56:4B:0B:AC:7A:55:1D:8F:52:29:E0:A6:61:D7:0F:B6:EC:41:FC:59:FE:2B:B3:39:FA:14:23:65:38:13:26:A0 Finally, this server has a special quirk. It will _tell_ you when you are NOT using OTR. I've put it in "optional" mode but we can also put it in "mandatory" mode if needed which will force all messages going through to be OTR encrypted. I don't expect any big issues to arise once this server gets more users but at first we might need to tweak some stuff thus restart it. Enjoy! David

13 15

Griffin's ICFP February
by Griffin Boyce 03 Mar '16

03 Mar '16

-------- Original Message -------- Subject: [icfp-active] Griffin's ICFP February Date: 2016-03-03 13:50 From: Griffin Boyce <griffin(a)cryptolab.net> To: ICFP Active <icfp-active(a)opentechfund.org> Hello all, In February, I fought logistics and small delays, but got some interesting initial results from Russia. Ultimately, I was not able to gather enough data to complete a paper before the PETS deadline. However, I have proposed a talk for the HOPE conference in NYC this summer [1]. My co-author, Jeff Landale, and I will continue working on a paper with the goal of submitting for USENIX:FOCI. Initial results from Russia have been surprising. Of the Alexa top 1M sites, 153,000 seem to be blocked. I've run the test twice, and will re-run the test from another location, but if the block percentage really is ~15.3%, then that is quite extreme! I was guessing that around 2000 sites would be blocked. Towards the end of the month I prepared for and attended the Internet Freedom Festival in Valencia, Spain. As part of the paper-writing process, I wrote up a first draft of the project methodology, which appears below. Please let me know if you see any gaps or have additional tests to suggest. Methodology: # Website Diagnostics The sites to be tested are divided into segments of 10,000 websites, plus custom tests for sites focused on circumvention. This way, if there’s an error during the test, it’s easier to perform a re-test without having to test over a million sites (again). The first test is a simple check to see if the site is available (code 200) or if it’s down. This test is performed from both the target region and a presumed-uncensored area (typically Germany or the US) to ensure that the site is not simply down for maintenance. (In the process, I determine whether it’s a DNS block or an IP block). Once I have a list of not-(code 200) sites, I dig in deeper. I take a screenshot of all sites using EyeWitness. Then I see if the site is being blocked or is giving a proper Block Page. If the block pages follow a common format *and* give the block reason, I scrape the reasons and map them to the domains. There can be interesting differences found here. For example, in Indonesia SMBC Comics is blocked for ‘pornography and promoting bigotry and sectarian violence,’ when the site is not pornographic and contains minimal fantasy violence. If the site is inaccessible for whatever reason, I check for TCP reset packets, check if there is an SSL/TLS error, check for forced downloads, and for some sites check for MitM. MitM test is only performed for sites where a user would typically be trying to download something, such as Lantern or Tor Browser. In cases of possible MitM, I collect PCAP data (packet captures) and attempt to download the relevant parts of the website to compare with a non-suspicious version of the website. While some regional differences may exist -- news in different languages, for example -- differences in executables or malware injections are indicators of active man-in-the-middle attacks. Once all website tests are performed, I categorize the sites by cross-referencing Alexa data. Categorizing website content is one of the harder problems at scale, so relying on Alexa for categorization appears to be the best solution. For example, it would be impossible for me to categorize 153,000 blocked websites from Russia given the sheer number of websites involved. # Tor & Lantern tests Once all websites are categorized, I check whether or not Tor Browser and Lantern are usable within the country. Lantern has a built-in test for this purpose. For Tor Browser, I use a modified version of Philipp Winter’s ExitMap, and feed it an up-to-date list of Tor nodes. It then cycles through thousands of individual tor circuits to check whether every entry node is available from the test location. From there, I determine whether all of Tor is blocked, or only some nodes. If only some guard nodes are blocked, this may mean (depending on the age of the unblocked nodes relative to the blocked nodes) that the unblocked guard nodes were set up to track users or indicate that the system for blocking Tor nodes hasn’t updated since those nodes were created. I then test whether different kinds of bridges are blocked within the country by making circuits using bridges (including obfs2/obfs3/obfs4/fte/scramblesuit and standard bridges). For some locations, we will also test flashproxy- and snowflake-backed Tor connectivity. All Tor-related tests are run twice, with pre-selected nodes where possible, to minimize errors and ensure test accuracy. # Tests Performed OONI: website accessibility, HTTP error codes, TCP reset packets ExitMap (hacked/customized): checks Tor network node connectivity Tor daemon: test bridge connectivity EyeWitness: screenshots Custom nmap script: to get data on SSL/TLS certificates Custom scripts: to compare SSL/TLS certificates between test locations, compare websites for MitM determination, collecting blocked website HTML, collecting blocked website reasons (as needed), and formatting collected data # Websites Tested The top one million sites, as determined by Alexa’s traffic analyses. This includes a very diverse group of religious and LGBT websites. In addition, I am testing some circumvention websites. As mentioned above, these are grouped into segments so that re-tests can be performed without having to re-test everything. Box status: RU =) UA =| EG =) TN =( -- coordinating local tests instead KG =) KZ =( -- ISP set up Crunchbang OS instead of Debian [1] Due to this, I will not be attending PETS. -- “We have to create; it is the only thing louder than destruction.” ~ Andrea Gibson

1 0

Grants for Tor-related work/research
by Virgil Griffith 02 Mar '16

02 Mar '16

Particularly, I can see research getting funded that explores counter-measures to the kinds of attacks discussed in: http://conferences.sigcomm.org/hotnets/2014/papers/hotnets-XIII-final80.pdf (1) http://www.isif.asia/researchgrant --- "open to all relevant topics of interest around Internet operations, infrastructure and related protocols, such as Network measurement and analysis; IPv6; BGP routing; Network security and Peering and interconnection." --- I can see someone from Tor Metrics doing well here. (2) http://isif.asia/ISOC_CybersecGrant --- Research on improving DNSSEC --- Research/greater deployment of secure routing. -V

1 0

Fwd: The Tor Project has been accepted as a GSoC 2016 mentor organization!
by Damian Johnson 29 Feb '16

29 Feb '16

---------- Forwarded message ---------- From: Google Summer of Code <summerofcode-noreply(a)google.com> Date: Mon, Feb 29, 2016 at 12:32 PM Subject: The Tor Project has been accepted as a GSoC 2016 mentor organization! To: atagar1(a)gmail.com [image: Google Summer of Code] Congratulations! The Tor Project has been selected as a Google Summer of Code 2016 mentor organization. Please click here to visit your organization profile and start adding mentors: https://summerofcode.withgoogle.com/dashboard/org-profile/ You are receiving this email because of your participation in Google Summer of Code 2016. https://summerofcode.withgoogle.com To leave the program and stop receiving all emails, you can go to your profile <https://summerofcode.withgoogle.com/dashboard/profile/> and request deletion of your program profile. For any questions, please contact gsoc-support(a)google.com. Replies to this message go to an unmonitored mailbox. © 2016 Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

4 3

Summary of meek's costs, January 2016
by David Fifield 29 Feb '16

29 Feb '16

Here's the summary of meek's CDN fees for January 2016. App Engine + Amazon + Azure = total by period all 2014 $600.63 + $917.89 + $0.00 = $1518.52 January 2015 $464.37 + $669.02 + $0.00 = $1133.39 February 2015 $650.53 + $604.83 + $0.00 = $1255.36 March 2015 $690.29 + $815.68 + $0.00 = $1505.97 April 2015 $886.43 + $785.37 + $0.00 = $1671.80 May 2015 $871.64 + $896.39 + $0.00 = $1768.03 June 2015 $601.83 + $820.00 + $0.00 = $1421.83 July 2015 $732.01 + $837.08 + $0.00 = $1569.09 August 2015 $656.76 + $819.59 + $154.89 = $1631.24 September 2015 $617.08 + $710.75 + $490.58 = $1818.41 October 2015 $672.01 + $110.72 + $300.64 = $1083.37 November 2015 $602.35 + $474.13 + $174.18 = $1250.66 December 2015 $561.29 + $603.27 + $172.60 = $1337.16 January 2016 $771.17 + $1581.88 + $329.10 = $2682.15 -- total by CDN $9378.39 + $10646.60 + $1621.99 = $21646.98 grand total https://metrics.torproject.org/userstats-bridge-transport.html?graph=userst… Halfway through January 2016 we were able to relax the rate limits on the meek backing bridges, and it showed in the number of users, which increased from 6,000 to just over 10,000 simultaneous users. The cost for meek-amazon was markedly higher this month, which I don't think is entirely due to the relaxed rate limits. The number of HTTPS requests (which cost money on their own) was increased without a matching increase in data transfered. There was a week or so in January when the meek-amazon bridge was having trouble and dropping some connections, so that might have been the cause. Reminder that if you configure your own CDN or App Engine account and point it at https://meek.bamsoftware.com/, you will be using a completely unlimited bridge, which will go faster and help save money. == App Engine a.k.a. meek-google == Here is how the Google costs broke down: 4274 GB $512.86 5166 instance hours $258.31 Compared to the previous month: 2528 GB $303.39 5158 instance hours $257.90 https://globe.torproject.org/#/bridge/88F745840F47CE0C6A4FE61D827950B06F9E4… == Amazon a.k.a. meek-amazon == The number of HTTPS requests is strangely high in the EU (Ireland) region. Last month was 142M, this month is 805M. However the amount of data transfered in that region did not increase (968 GB to 957 GB). I don't have an explanation for that. Asia Pacific (Singapore) 220M requests $264.97 569 GB $78.58 Asia Pacific (Sydney) 1M requests $1.86 5 GB $0.68 Asia Pacific (Tokyo) 21M requests $25.59 161 GB $21.08 EU (Ireland) 805M requests $966.45 957 GB $76.72 South America (Sao Paulo) 6M requests $13.65 38 GB $9.17 US East (Northern Virginia) 79M requests $79.16 559 GB $43.99 -- total 1134M requests $1351.68 2291 GB $230.22 https://globe.torproject.org/#/bridge/F4AD82B2032EDEF6C02C5A529C42CFAFE5165… == Azure a.k.a. meek-azure == Zone 1 3000 GB $261.02 Zone 2 493 GB $ 68.08 -- total 3494 GB $329.10 https://globe.torproject.org/#/bridge/AA033EEB61601B2B7312D89B62AAA23DC3ED8… Earlier reports in this series: https://trac.torproject.org/projects/tor/wiki/doc/meek#Costs

2 1

silliness
by Shari Steele 29 Feb '16

29 Feb '16

Hey all. A friend sent me this picture. Note the missing letters on the sign. :) Shari This is where I go for safe 'Net surfing and an oil change. Sent from an iOS device.

2 2

Research paper on differential treatment of anonymous users
by Griffin Boyce 27 Feb '16

27 Feb '16

Hey all, Just wanted to point to Sadia Afroz / David Fifield et al's research on differential treatment of anonymous users -- such as CloudFlare's blocking of Tor users. Unfortunately, it's not "just" CloudFlare (which holds substantial market share) and it's not "just" Tor users who are impacted by these things. It's a good read: http://www.eecs.berkeley.edu/~sa499/papers/ndss2016.pdf One curious finding is that some sites only block large exits. I'd be curious if an intended side effect were the ability to say "Oh we only block 15% of Tor exits" rather than saying "We block [>>15%] of Tor connections". Thoughts? ~Griffin -- “We have to create; it is the only thing louder than destruction.” ~ Andrea Gibson

1 0

Your gsoc project idea listing
by Sebastian Hahn 25 Feb '16

25 Feb '16

Hello! You are listed on our projects[0] page as likely mentors for students participating in a possible google summer of code 2016 for at least one of the following projects: - Ahmia - Hidden Service Search - Help improve Tor hidden services Please review these entries and let me know if you think these are still good ideas and you're willing to mentor this summer. If I do not receive a reply until the dev meeting, I will remove the above projects from the website until I hear otherwise. Please also suggest more project ideas and either submit them as website patches or let me know here and I'll make them appear on the website! Thanks Sebastian [0]: https://www.torproject.org/getinvolved/volunteer.html.en#Projects

2 1