- tor-project - lists.torproject.org

Tor teachers mailing list
by Alison Macrina 03 Mar '16

03 Mar '16

Hi all, After a session at Tor dev about training users on Tor, a few of us thought it might be a good idea to make another push for the Tor-teachers list [1]. This list is for anyone who teaches Tor or want to teach Tor. We use this list to circulate training materials, share stories, and build community. Please join us on the list and tell us how you're teaching Tor, or how you'd like to! Some things that are particularly needed in the group: more curricula on the wiki [2] in more languages! Especially curricula aimed at different user groups (teens, lawyers, activists, etc). We're also hoping to get a list on there of possible places to go and teach Tor, eg upcoming conferences outside of the privacy/security world. I will send an update to the tor-teachers list with the rest of what we discussed at the training session, but I'll wait a few days so that folks can have some time to join the list. See you there! Alison [1] https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-teachers [2] https://trac.torproject.org/projects/tor/wiki/doc/tor-teachers

1 1

Our Jabber Server
by David Goulet 03 Mar '16

03 Mar '16

Greetings Everyone! Thanks to weasel for bringing Debian Jessie to the server, we now have a working usable Jabber server. Woot! Here is our XMPP score: c2s: https://xmpp.net/result.php?domain=torproject.org&type=client s2s: https://xmpp.net/result.php?domain=torproject.org&type=server Everyone with an LDAP account can connect to the server. Else, you can't. Before you can do that, you need to set your "rtc" password. Here is how: 1) Enter your user and ldap password at https://db.torproject.org/login.html and press "Update my info". 2) At the very bottom, you should see this https://people.torproject.org/~dgoulet/volatile/rtc-pass.png, the "Change rtc password" field. Put your password in there. Unfortunately, it silent fails if you enter a "too big of a password" and we are unsure of the maximum length so I think 16 characters (based on my experiment) is the maximum possible. 3) Wait a couple of minutes so the database sync up and reaches the jabber server. When you connect, if it fails, wait a bit more. Usually after 5 to 10 minutes it should work so report the issue if it still fails. Useful informations about the server now and how to use it. Your account is <ldap-user>@torproject.org. You have to enable TLS of course. We also have a hidden service! It's: k2r67kry5haud25b.onion. To use it, set the server of your account with it but the user must be your LDAP one that is <ldap-user>@torproject.org. It's federating that means you can add contact that are OUTSIDE of this server such as riseup users or any workable jabber server supporting TLS. Our TLS certificate is from Let's Encrypt and checksum is below. Remember that in 3 months that fingerprint will change: SHA256 Fingerprint=56:4B:0B:AC:7A:55:1D:8F:52:29:E0:A6:61:D7:0F:B6:EC:41:FC:59:FE:2B:B3:39:FA:14:23:65:38:13:26:A0 Finally, this server has a special quirk. It will _tell_ you when you are NOT using OTR. I've put it in "optional" mode but we can also put it in "mandatory" mode if needed which will force all messages going through to be OTR encrypted. I don't expect any big issues to arise once this server gets more users but at first we might need to tweak some stuff thus restart it. Enjoy! David

13 15

Griffin's ICFP February
by Griffin Boyce 03 Mar '16

03 Mar '16

-------- Original Message -------- Subject: [icfp-active] Griffin's ICFP February Date: 2016-03-03 13:50 From: Griffin Boyce <griffin(a)cryptolab.net> To: ICFP Active <icfp-active(a)opentechfund.org> Hello all, In February, I fought logistics and small delays, but got some interesting initial results from Russia. Ultimately, I was not able to gather enough data to complete a paper before the PETS deadline. However, I have proposed a talk for the HOPE conference in NYC this summer [1]. My co-author, Jeff Landale, and I will continue working on a paper with the goal of submitting for USENIX:FOCI. Initial results from Russia have been surprising. Of the Alexa top 1M sites, 153,000 seem to be blocked. I've run the test twice, and will re-run the test from another location, but if the block percentage really is ~15.3%, then that is quite extreme! I was guessing that around 2000 sites would be blocked. Towards the end of the month I prepared for and attended the Internet Freedom Festival in Valencia, Spain. As part of the paper-writing process, I wrote up a first draft of the project methodology, which appears below. Please let me know if you see any gaps or have additional tests to suggest. Methodology: # Website Diagnostics The sites to be tested are divided into segments of 10,000 websites, plus custom tests for sites focused on circumvention. This way, if there’s an error during the test, it’s easier to perform a re-test without having to test over a million sites (again). The first test is a simple check to see if the site is available (code 200) or if it’s down. This test is performed from both the target region and a presumed-uncensored area (typically Germany or the US) to ensure that the site is not simply down for maintenance. (In the process, I determine whether it’s a DNS block or an IP block). Once I have a list of not-(code 200) sites, I dig in deeper. I take a screenshot of all sites using EyeWitness. Then I see if the site is being blocked or is giving a proper Block Page. If the block pages follow a common format *and* give the block reason, I scrape the reasons and map them to the domains. There can be interesting differences found here. For example, in Indonesia SMBC Comics is blocked for ‘pornography and promoting bigotry and sectarian violence,’ when the site is not pornographic and contains minimal fantasy violence. If the site is inaccessible for whatever reason, I check for TCP reset packets, check if there is an SSL/TLS error, check for forced downloads, and for some sites check for MitM. MitM test is only performed for sites where a user would typically be trying to download something, such as Lantern or Tor Browser. In cases of possible MitM, I collect PCAP data (packet captures) and attempt to download the relevant parts of the website to compare with a non-suspicious version of the website. While some regional differences may exist -- news in different languages, for example -- differences in executables or malware injections are indicators of active man-in-the-middle attacks. Once all website tests are performed, I categorize the sites by cross-referencing Alexa data. Categorizing website content is one of the harder problems at scale, so relying on Alexa for categorization appears to be the best solution. For example, it would be impossible for me to categorize 153,000 blocked websites from Russia given the sheer number of websites involved. # Tor & Lantern tests Once all websites are categorized, I check whether or not Tor Browser and Lantern are usable within the country. Lantern has a built-in test for this purpose. For Tor Browser, I use a modified version of Philipp Winter’s ExitMap, and feed it an up-to-date list of Tor nodes. It then cycles through thousands of individual tor circuits to check whether every entry node is available from the test location. From there, I determine whether all of Tor is blocked, or only some nodes. If only some guard nodes are blocked, this may mean (depending on the age of the unblocked nodes relative to the blocked nodes) that the unblocked guard nodes were set up to track users or indicate that the system for blocking Tor nodes hasn’t updated since those nodes were created. I then test whether different kinds of bridges are blocked within the country by making circuits using bridges (including obfs2/obfs3/obfs4/fte/scramblesuit and standard bridges). For some locations, we will also test flashproxy- and snowflake-backed Tor connectivity. All Tor-related tests are run twice, with pre-selected nodes where possible, to minimize errors and ensure test accuracy. # Tests Performed OONI: website accessibility, HTTP error codes, TCP reset packets ExitMap (hacked/customized): checks Tor network node connectivity Tor daemon: test bridge connectivity EyeWitness: screenshots Custom nmap script: to get data on SSL/TLS certificates Custom scripts: to compare SSL/TLS certificates between test locations, compare websites for MitM determination, collecting blocked website HTML, collecting blocked website reasons (as needed), and formatting collected data # Websites Tested The top one million sites, as determined by Alexa’s traffic analyses. This includes a very diverse group of religious and LGBT websites. In addition, I am testing some circumvention websites. As mentioned above, these are grouped into segments so that re-tests can be performed without having to re-test everything. Box status: RU =) UA =| EG =) TN =( -- coordinating local tests instead KG =) KZ =( -- ISP set up Crunchbang OS instead of Debian [1] Due to this, I will not be attending PETS. -- “We have to create; it is the only thing louder than destruction.” ~ Andrea Gibson

1 0

Grants for Tor-related work/research
by Virgil Griffith 03 Mar '16

03 Mar '16

Particularly, I can see research getting funded that explores counter-measures to the kinds of attacks discussed in: http://conferences.sigcomm.org/hotnets/2014/papers/hotnets-XIII-final80.pdf (1) http://www.isif.asia/researchgrant --- "open to all relevant topics of interest around Internet operations, infrastructure and related protocols, such as Network measurement and analysis; IPv6; BGP routing; Network security and Peering and interconnection." --- I can see someone from Tor Metrics doing well here. (2) http://isif.asia/ISOC_CybersecGrant --- Research on improving DNSSEC --- Research/greater deployment of secure routing. -V

1 0

Fwd: The Tor Project has been accepted as a GSoC 2016 mentor organization!
by Damian Johnson 29 Feb '16

29 Feb '16

---------- Forwarded message ---------- From: Google Summer of Code <summerofcode-noreply(a)google.com> Date: Mon, Feb 29, 2016 at 12:32 PM Subject: The Tor Project has been accepted as a GSoC 2016 mentor organization! To: atagar1(a)gmail.com [image: Google Summer of Code] Congratulations! The Tor Project has been selected as a Google Summer of Code 2016 mentor organization. Please click here to visit your organization profile and start adding mentors: https://summerofcode.withgoogle.com/dashboard/org-profile/ You are receiving this email because of your participation in Google Summer of Code 2016. https://summerofcode.withgoogle.com To leave the program and stop receiving all emails, you can go to your profile <https://summerofcode.withgoogle.com/dashboard/profile/> and request deletion of your program profile. For any questions, please contact gsoc-support(a)google.com. Replies to this message go to an unmonitored mailbox. © 2016 Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

4 3

Summary of meek's costs, January 2016
by David Fifield 29 Feb '16

29 Feb '16

Here's the summary of meek's CDN fees for January 2016. App Engine + Amazon + Azure = total by period all 2014 $600.63 + $917.89 + $0.00 = $1518.52 January 2015 $464.37 + $669.02 + $0.00 = $1133.39 February 2015 $650.53 + $604.83 + $0.00 = $1255.36 March 2015 $690.29 + $815.68 + $0.00 = $1505.97 April 2015 $886.43 + $785.37 + $0.00 = $1671.80 May 2015 $871.64 + $896.39 + $0.00 = $1768.03 June 2015 $601.83 + $820.00 + $0.00 = $1421.83 July 2015 $732.01 + $837.08 + $0.00 = $1569.09 August 2015 $656.76 + $819.59 + $154.89 = $1631.24 September 2015 $617.08 + $710.75 + $490.58 = $1818.41 October 2015 $672.01 + $110.72 + $300.64 = $1083.37 November 2015 $602.35 + $474.13 + $174.18 = $1250.66 December 2015 $561.29 + $603.27 + $172.60 = $1337.16 January 2016 $771.17 + $1581.88 + $329.10 = $2682.15 -- total by CDN $9378.39 + $10646.60 + $1621.99 = $21646.98 grand total https://metrics.torproject.org/userstats-bridge-transport.html?graph=userst… Halfway through January 2016 we were able to relax the rate limits on the meek backing bridges, and it showed in the number of users, which increased from 6,000 to just over 10,000 simultaneous users. The cost for meek-amazon was markedly higher this month, which I don't think is entirely due to the relaxed rate limits. The number of HTTPS requests (which cost money on their own) was increased without a matching increase in data transfered. There was a week or so in January when the meek-amazon bridge was having trouble and dropping some connections, so that might have been the cause. Reminder that if you configure your own CDN or App Engine account and point it at https://meek.bamsoftware.com/, you will be using a completely unlimited bridge, which will go faster and help save money. == App Engine a.k.a. meek-google == Here is how the Google costs broke down: 4274 GB $512.86 5166 instance hours $258.31 Compared to the previous month: 2528 GB $303.39 5158 instance hours $257.90 https://globe.torproject.org/#/bridge/88F745840F47CE0C6A4FE61D827950B06F9E4… == Amazon a.k.a. meek-amazon == The number of HTTPS requests is strangely high in the EU (Ireland) region. Last month was 142M, this month is 805M. However the amount of data transfered in that region did not increase (968 GB to 957 GB). I don't have an explanation for that. Asia Pacific (Singapore) 220M requests $264.97 569 GB $78.58 Asia Pacific (Sydney) 1M requests $1.86 5 GB $0.68 Asia Pacific (Tokyo) 21M requests $25.59 161 GB $21.08 EU (Ireland) 805M requests $966.45 957 GB $76.72 South America (Sao Paulo) 6M requests $13.65 38 GB $9.17 US East (Northern Virginia) 79M requests $79.16 559 GB $43.99 -- total 1134M requests $1351.68 2291 GB $230.22 https://globe.torproject.org/#/bridge/F4AD82B2032EDEF6C02C5A529C42CFAFE5165… == Azure a.k.a. meek-azure == Zone 1 3000 GB $261.02 Zone 2 493 GB $ 68.08 -- total 3494 GB $329.10 https://globe.torproject.org/#/bridge/AA033EEB61601B2B7312D89B62AAA23DC3ED8… Earlier reports in this series: https://trac.torproject.org/projects/tor/wiki/doc/meek#Costs

2 1

silliness
by Shari Steele 29 Feb '16

29 Feb '16

Hey all. A friend sent me this picture. Note the missing letters on the sign. :) Shari This is where I go for safe 'Net surfing and an oil change. Sent from an iOS device.

2 2

Research paper on differential treatment of anonymous users
by Griffin Boyce 27 Feb '16

27 Feb '16

Hey all, Just wanted to point to Sadia Afroz / David Fifield et al's research on differential treatment of anonymous users -- such as CloudFlare's blocking of Tor users. Unfortunately, it's not "just" CloudFlare (which holds substantial market share) and it's not "just" Tor users who are impacted by these things. It's a good read: http://www.eecs.berkeley.edu/~sa499/papers/ndss2016.pdf One curious finding is that some sites only block large exits. I'd be curious if an intended side effect were the ability to say "Oh we only block 15% of Tor exits" rather than saying "We block [>>15%] of Tor connections". Thoughts? ~Griffin -- “We have to create; it is the only thing louder than destruction.” ~ Andrea Gibson

1 0

Your gsoc project idea listing
by Sebastian Hahn 25 Feb '16

25 Feb '16

Hello! You are listed on our projects[0] page as likely mentors for students participating in a possible google summer of code 2016 for at least one of the following projects: - Ahmia - Hidden Service Search - Help improve Tor hidden services Please review these entries and let me know if you think these are still good ideas and you're willing to mentor this summer. If I do not receive a reply until the dev meeting, I will remove the above projects from the website until I hear otherwise. Please also suggest more project ideas and either submit them as website patches or let me know here and I'll make them appear on the website! Thanks Sebastian [0]: https://www.torproject.org/getinvolved/volunteer.html.en#Projects

2 1

Re: [tor-project] Moar Project Ideas!!
by Damian Johnson 24 Feb '16

24 Feb '16

> I guess the specific things I'd be interested in would be: > > - Is this tor node still up and running Hi Tom. Do you mean for individual relay operators? This sounds like Weather. > - The various checks Karsten outlined in my link for CollecTor (which > looks like 7-10 checks) Not sure how meaty this is. Checks sound pretty simple. > - 3-4 checks for a BWAuth (have the scanners looped in the last N > days; are the number of measured relays in the correct quantity > threshold; have an obscene percentage of relays not been measured in a > while) DocTor already includes checks around unmeasured relays though no doubt there's room for expansion. This reminds me though that we've wanted to overhaul the BWAuths for a long, long time. If that's feasible and something we have a mentor for that would be sweet! > - Both of the above would involve changes to CollecTor/Torflow to > nicely output better status information > > In fact - a whole different project would be a consensus-health-like > site specifically for bandwidth authorities. I don't know what's > going on with the bwauth stuff though... I'd suggest talking with > people in Valencia and seeing if I'm the only person interested in > this (either individually or as a whole). I won't be there but Mr. Sebastian will be prompting folks to give more thought to project ideas. Cheers! -Damian

1 0