From matheu at danwin1210.me Sat Aug 3 20:42:00 2019 From: matheu at danwin1210.me (matheu) Date: Sat, 03 Aug 2019 20:42:00 +0000 Subject: [tor-talk] tor-browser with system tor, "authentication cookie with wrong length" Message-ID: <9e3aaed6-a7fd-7589-60c7-86bb29b4af28@tt3j2x4k5ycaa5zt.onion> Hi! I tried to use Debian system tor, instead of the bundled TBB tor. (NOTE: I know it's not supported, won't take it hard if I do not get much support. However, it's in the script below...) First source for my experiments was the canonical start-tor-browser script in tor-browser_en-US. Followed it, and created this file: -rw-r--r-- 1 nym nym 658 2018-03-29 10:07 tor-browser_en-US/Browser/TorBrowser/Data/Browser/profile.default/user.js // as per start-tor-browser user_pref("network.security.ports.banned", "9050,9051"); user_pref("network.proxy.socks", "127.0.0.1"); user_pref("network.proxy.socks_port", 9050); user_pref("extensions.torbutton.inserted_button", true); user_pref("extensions.torbutton.launch_warning", false); user_pref("extensions.torbutton.loglevel", 2); user_pref("extensions.torbutton.logmethod", 0); user_pref("extensions.torlauncher.control_port", 9051); user_pref("extensions.torlauncher.loglevel", 2); user_pref("extensions.torlauncher.logmethod", 0); user_pref("extensions.torlauncher.prompt_at_startup", false); user_pref("extensions.torlauncher.start_tor", false); Second (major) source was: https://trac.torproject.org/projects/tor/wiki/TorBrowserBundleSAQ The user nym is memeber of group debian-tor: $ groups nym nym : nym mail cdrom floppy sudo audio [...] debian-tor [...] (and I did not just log out and log in, I even rebooted, in vain hope... so far... ) And also (but it's probably extra since the user.js does the same, I did set the export lines from the "Seldom Asked Questions" above: nym at ymous:~/tor-browser_en-US/Browser$ echo $TOR_CONTROL_COOKIE_AUTH_FILE /run/tor/control.authcookie nym at ymous:~/tor-browser_en-US/Browser$ echo $TOR_SOCKS_PORT 9050 nym at ymous:~/tor-browser_en-US/Browser$ echo $TOR_CONTROL_PORT 9051 nym at ymous:~/tor-browser_en-US/Browser$ echo $TOR_SKIP_LAUNCH 1 nym at ymous:~/tor-browser_en-US/Browser$ And, temporarily (the SafeLogging and the debug line), this is the: $ cat /etc/tor/torrc # This file was generated by Tor; if you edit it, comments will not be preserved # The old torrc file was renamed to torrc.orig.1 or similar, and Tor will ignore it SocksPort 9050 IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth ControlPort 9051 ExcludeExitNodes {??} Log debug file /var/log/tor/log SafeLogging 0 LogTimeGranularity 50 Launching Tor browser with nym at ymous:~/tor-browser_en-US/Browser$ ./start-tor-browser got me an all-in-red Tor browser window telling: Something went wrong. (in huge print) Tor is not working in this browser. The lines that I got in the /var/log/tor/log and which correspond to the failure are: Aug 01 11:24:52.500 [notice] New control connection opened from 127.0.0.1. Aug 01 11:24:52.500 [debug] connection_add_impl(): new conn type Control, socket 12, address 127.0.0.1, n_conns 5. Aug 01 11:24:52.850 [debug] conn_read_callback(): socket 12 wants to read. Aug 01 11:24:52.850 [debug] read_to_chunk(): Read 43 bytes. 43 on inbuf. Aug 01 11:24:52.850 [warn] Got authentication cookie with wrong length (8) Aug 01 11:24:52.850 [debug] conn_close_if_marked(): Cleaning up connection (fd 12). Aug 01 11:24:52.850 [info] conn_close_if_marked(): Conn (addr "127.0.0.1", fd 12, type Control, state 2) marked, but wants to flush 67 bytes. (Marked at ../src/feature/control/control.c:1622) And a little later: Aug 01 11:24:54.000 [debug] connection_handle_listener_read(): Connection accepted on socket 13 (child of fd 8). Aug 01 11:24:54.000 [notice] New control connection opened from 127.0.0.1. Aug 01 11:24:54.000 [debug] connection_add_impl(): new conn type Control, socket 13, address 127.0.0.1, n_conns 6. Aug 01 11:24:54.000 [debug] conn_read_callback(): socket 13 wants to read. Aug 01 11:24:54.000 [debug] read_to_chunk(): Read 1 bytes. 1 on inbuf. Aug 01 11:24:54.000 [debug] conn_read_callback(): socket 13 wants to read. Aug 01 11:24:54.000 [debug] read_to_chunk(): Read 1 bytes. 2 on inbuf. Aug 01 11:24:54.000 [debug] conn_read_callback(): socket 13 wants to read. Aug 01 11:24:54.000 [debug] read_to_chunk(): Read 1 bytes. 3 on inbuf. Aug 01 11:24:54.000 [debug] conn_read_callback(): socket 13 wants to read. Aug 01 11:24:54.000 [debug] read_to_chunk(): Read 1 bytes. 4 on inbuf. Aug 01 11:24:54.000 [debug] conn_read_callback(): socket 13 wants to read. Aug 01 11:24:54.000 [debug] read_to_chunk(): Read 1 bytes. 5 on inbuf. Aug 01 11:24:54.000 [debug] conn_read_callback(): socket 13 wants to read. Aug 01 11:24:54.000 [debug] read_to_chunk(): Read 1 bytes. 6 on inbuf. Aug 01 11:24:54.000 [debug] conn_read_callback(): socket 13 wants to read. Aug 01 11:24:54.000 [debug] read_to_chunk(): Read 1 bytes. 7 on inbuf. Aug 01 11:24:54.000 [debug] conn_read_callback(): socket 13 wants to read. Aug 01 11:24:54.000 [debug] read_to_chunk(): Read 1 bytes. 8 on inbuf. Aug 01 11:24:54.000 [debug] conn_read_callback(): socket 13 wants to read. Aug 01 11:24:54.050 [debug] read_to_chunk(): Read 1 bytes. 9 on inbuf. Aug 01 11:24:54.050 [debug] conn_read_callback(): socket 13 wants to read. Aug 01 11:24:54.050 [debug] read_to_chunk(): Read 1 bytes. 10 on inbuf. Aug 01 11:24:54.050 [debug] conn_read_callback(): socket 13 wants to read. Aug 01 11:24:54.050 [debug] read_to_chunk(): Read 1 bytes. 11 on inbuf. Aug 01 11:24:54.050 [debug] conn_read_callback(): socket 13 wants to read. Aug 01 11:24:54.050 [debug] read_to_chunk(): Read 1 bytes. 12 on inbuf. Aug 01 11:24:54.050 [debug] conn_read_callback(): socket 13 wants to read. Aug 01 11:24:54.050 [debug] read_to_chunk(): Read 1 bytes. 13 on inbuf. Aug 01 11:24:54.050 [debug] conn_read_callback(): socket 13 wants to read. Aug 01 11:24:54.050 [debug] read_to_chunk(): Read 1 bytes. 14 on inbuf. Aug 01 11:24:54.050 [debug] conn_read_callback(): socket 13 wants to read. Aug 01 11:24:54.050 [debug] read_to_chunk(): Read 1 bytes. 15 on inbuf. Aug 01 11:24:54.050 [debug] conn_read_callback(): socket 13 wants to read. Aug 01 11:24:54.050 [debug] read_to_chunk(): Read 1 bytes. 16 on inbuf. Aug 01 11:24:54.050 [debug] conn_read_callback(): socket 13 wants to read. Aug 01 11:24:54.050 [debug] read_to_chunk(): Read 1 bytes. 17 on inbuf. Aug 01 11:24:54.050 [debug] conn_read_callback(): socket 13 wants to read. Aug 01 11:24:54.050 [debug] read_to_chunk(): Read 1 bytes. 18 on inbuf. Aug 01 11:24:54.050 [debug] conn_read_callback(): socket 13 wants to read. Aug 01 11:24:54.050 [debug] read_to_chunk(): Read 2 bytes. 20 on inbuf. Aug 01 11:24:54.050 [debug] conn_read_callback(): socket 13 wants to read. Aug 01 11:24:54.050 [debug] read_to_chunk(): Read 1 bytes. 21 on inbuf. Aug 01 11:24:54.050 [debug] conn_read_callback(): socket 13 wants to read. Aug 01 11:24:54.050 [debug] read_to_chunk(): Read 1 bytes. 22 on inbuf. Aug 01 11:24:54.050 [debug] conn_read_callback(): socket 13 wants to read. Aug 01 11:24:54.050 [debug] read_to_chunk(): Read 1 bytes. 23 on inbuf. Aug 01 11:24:54.050 [debug] conn_read_callback(): socket 13 wants to read. Aug 01 11:24:54.050 [debug] read_to_chunk(): Read 1 bytes. 24 on inbuf. Aug 01 11:24:54.050 [debug] conn_read_callback(): socket 13 wants to read. Aug 01 11:24:54.050 [debug] read_to_chunk(): Read 1 bytes. 25 on inbuf. Aug 01 11:24:54.050 [warn] Got authentication cookie with wrong length (8) Aug 01 11:24:54.050 [debug] conn_close_if_marked(): Cleaning up connection (fd 13). Aug 01 11:24:54.050 [info] conn_close_if_marked(): Conn (addr "127.0.0.1", fd 13, type Control, state 2) marked, but wants to flush 67 bytes. (Marked at ../src/feature/control/control.c:1622) Aug 01 11:24:54.050 [debug] connection_remove(): removing socket 13 (type Control), n_conns now 6 Aug 01 11:24:54.050 [debug] connection_free_minimal(): closing fd 13. (NOTE: dates, times and names redacted/anonymized in this entire mail, however, I tried to keep it consistent, such as the time difference of the lines with "Got authentication cookie with wrong length (8)", and all lines btwn them are correctly consecutive.) That was also with the current Debian Tor package (from unstable repo), previously. Back then I thought if I get the Debian source from unstable repo and compile my own Tor packages (of the 0.4 version as the TorBrowser bundles), this might be solved, but no. The above is with the 0.4.0.5 that I compiled. Is this a bug in Tor? Because I do not see I did anything the wrong way nor that I missed to do something... Thanks and regards! Mathe From intrigeri at boum.org Fri Aug 16 09:04:57 2019 From: intrigeri at boum.org (intrigeri) Date: Fri, 16 Aug 2019 11:04:57 +0200 Subject: [tor-talk] Announce: amnesia Live system (initial release) In-Reply-To: Message-ID: <87sgq1cwg6.fsf@manticora> Hi, 10 years ago, I announced here the first public release of "amnesia", that later merged with Incognito to give birth to the operating system that's now called Tails: https://lists.torproject.org/pipermail/tor-talk/2009-August/002667.html To quote my team-mate anonym: 🥳🍰🎈🎉🥳🎂🎈🎉🍰🥳🎈 It was a great journey and I'd like to thank everyone who participated in this collective effort or supported it :) Cheers, -- intrigeri From bf at abenteuerland.at Tue Aug 20 20:31:08 2019 From: bf at abenteuerland.at (Bernhard R. Fischer) Date: Tue, 20 Aug 2019 22:31:08 +0200 Subject: [tor-talk] Onioncat and Tor Hidden Services V3 Message-ID: <8995aacb-170c-cb54-6f29-adfe297b61e0@abenteuerland.at> Dear list, I finally wrote a HOWTO on using OnionCat with v3 hidden services. I also did some patches to OnionCat to have a better integration. https://www.onioncat.org/2019/08/onioncat-and-tor-hidden-services-v3/ Best regards, Bernhard From procmem at riseup.net Mon Aug 26 19:30:12 2019 From: procmem at riseup.net (procmem at riseup.net) Date: Mon, 26 Aug 2019 19:30:12 +0000 Subject: [tor-talk] Announce: amnesia Live system (initial release) Message-ID: @intrigeri Congrats. Tails is a great inspiration for Whonix and it's been a pleasure to work with you guys! :-) From grarpamp at gmail.com Wed Aug 28 00:29:27 2019 From: grarpamp at gmail.com (grarpamp) Date: Tue, 27 Aug 2019 20:29:27 -0400 Subject: [tor-talk] Privacy, Censorship, Freedom Message-ID: Lot of talk on tor tech itself, but little on tech as enabling a range of potential futures for history that encrypted censorship resistant overlay communication, social and transaction networks as a whole can help liberate in conversation... without those spanning from Zimmerman to overlays to now Satoshi, all sorts of discussion on new models, regardless of what any may favor or take up among them or may create of their own, these free exchanges around the world would not be happening in real time today without such tools serving both sci-fi like inspiration, as iterative building blocks, and now in use in the world. That such new crypto things and convo are now in politics, that one can even find any uncurated uncensored convo, or create or take part in any, globally, in a few keystrokes, is testament to the good of such agnostic tools re the subject. https://www.youtube.com/watch?v=FDffZ7PwbBY Those interested in tor as applied technology should definitely take time not only with tor itself, but to survey and try all the new overlay tech, many now exist... from transports, to distributed storage, messaging, cryptocurrency, text, audio, video, and social comms platforms... but perhaps even more importantly, the range of new conversations occuring over them, and what convo and tools you might add out there in the new decentralized world. World is changing fast, have fun :) From grarpamp at gmail.com Wed Aug 28 11:11:08 2019 From: grarpamp at gmail.com (grarpamp) Date: Wed, 28 Aug 2019 07:11:08 -0400 Subject: [tor-talk] PaperDump: Mirai, Tor, Darknet, TLA, I2P Censorship, PETs in Sidechains, and more Message-ID: https://news.softpedia.com/news/mozilla-firefox-could-soon-get-a-tor-mode-add-on-526774.shtml https://www.zdnet.com/article/new-mirai-botnet-lurks-in-the-tor-network-to-stay-under-the-radar/ OSINT Analysis of the TOR Foundation https://arxiv.org/pdf/1803.05201.pdf Tempest: Temporal Dynamics in Anonymity Systems https://arxiv.org/pdf/1801.01932.pdf Adversaries monitoring Tor traffic crossing their jurisdictional border and reconstructing Tor circuits https://arxiv.org/pdf/1808.09237.pdf DeepCorr: Strong Flow Correlation Attacks on Tor Using Deep Learning https://arxiv.org/pdf/1808.07285.pdf Onions in the Crosshairs: When The Man really is out to get you https://arxiv.org/pdf/1706.10292.pdf Shedding Light on the Dark Corners of the Internet: A Survey of Tor Research https://arxiv.org/pdf/1803.02816.pdf Adaptive Traffic Fingerprinting for Darknet Threat Intelligence https://arxiv.org/pdf/1808.01155.pdf Counter-RAPTOR: Safeguarding Tor Against Active Routing Attacks https://arxiv.org/pdf/1704.00843.pdf Peel the onion: Recognition of Android apps behind the Tor Network https://arxiv.org/pdf/1901.04434.pdf Tik-Tok: The Utility of Packet Timing in Website Fingerprinting Attacks https://arxiv.org/pdf/1902.06421.pdf Mockingbird: Defending Against Deep-Learning-Based Website Fingerprinting Attacks with Adversarial Traces https://arxiv.org/pdf/1902.06626.pdf A Forensic Audit of the Tor Browser Bundle https://arxiv.org/pdf/1907.10279.pdf Anomalous keys in Tor relays https://arxiv.org/pdf/1704.00792.pdf Mitigating Censorship with Multi-Circuit Tor and Linear Network Coding https://arxiv.org/pdf/1907.03473.pdf DNS-Morph: UDP-Based Bootstrapping Protocol For Tor https://arxiv.org/pdf/1904.01240.pdf Towards Predicting Efficient and Anonymous Tor Circuits https://arxiv.org/pdf/1805.01977.pdf TorPolice: Towards Enforcing Service-Defined Access Policies in Anonymous Systems https://arxiv.org/pdf/1708.08162.pdf DROPWAT: an Invisible Network Flow Watermark for Data Exfiltration Traceback https://arxiv.org/pdf/1705.09460.pdf Deanonymizing Tor hidden service users through Bitcoin transactions analysis https://arxiv.org/pdf/1801.07501.pdf Tor Users Contributing to Wikipedia: Just Like Everybody Else? https://arxiv.org/pdf/1904.04324.pdf Open Dataset of Phishing and Tor Hidden Services Screen-captures https://arxiv.org/pdf/1908.02449.pdf A Broad Evaluation of the Tor English Content Ecosystem https://arxiv.org/pdf/1902.06680.pdf Structure and Content of the Visible Darknet https://arxiv.org/pdf/1811.01348.pdf On the Complexity of Anonymous Communication Through Public Networks https://arxiv.org/pdf/1902.06306.pdf A Survey of Privacy Infrastructures and Their Vulnerabilities https://arxiv.org/pdf/1812.06226.pdf The Effectiveness of Privacy Enhancing Technologies against Fingerprinting https://arxiv.org/pdf/1812.03920.pdf Where The Light Gets In: Analyzing Web Censorship Mechanisms in India https://arxiv.org/pdf/1808.01708.pdf An Extensive Evaluation of the Internet's Open Proxies https://arxiv.org/pdf/1806.10258.pdf Measuring I2P Censorship at a Global Scale https://arxiv.org/pdf/1907.07120.pdf An Empirical Study of the I2P Anonymity Network and its Censorship Resistance https://arxiv.org/pdf/1809.09086.pdf Integrating Privacy Enhancing Techniques into Blockchains Using Sidechains https://arxiv.org/pdf/1906.04953.pdf BlockTag: Design and applications of a tagging system for blockchain analysis https://arxiv.org/pdf/1809.06044.pdf Interesting that many attacks on overlay networks seem to depend on lack of fulltime 100% capacity fill and reclocking, and that no overlay [or underlying physical] networks currently deploy it, nor do many nets of other design seem to make extensive impact upon that class of GPA. Even 14.4-56k rates could could have interesting uses at secure levels. From florentin.rochet at uclouvain.be Wed Aug 28 11:52:13 2019 From: florentin.rochet at uclouvain.be (Florentin Rochet) Date: Wed, 28 Aug 2019 11:52:13 +0000 Subject: [tor-talk] PaperDump: Mirai, Tor, Darknet, TLA, I2P Censorship, PETs in Sidechains, and more In-Reply-To: References: Message-ID: Hey, This list is mixing good papers with several dubious ones. I find important to mention that it would be better looking here instead for non-expert readers: https://www.freehaven.net/anonbib/ to find quality peer-reviewed works, and keep the ones that intersect both lists for now. Best, On 28.08.19 13:11, grarpamp wrote: > https://news.softpedia.com/news/mozilla-firefox-could-soon-get-a-tor-mode-add-on-526774.shtml > https://www.zdnet.com/article/new-mirai-botnet-lurks-in-the-tor-network-to-stay-under-the-radar/ > > > OSINT Analysis of the TOR Foundation > https://arxiv.org/pdf/1803.05201.pdf > > Tempest: Temporal Dynamics in Anonymity Systems > https://arxiv.org/pdf/1801.01932.pdf > > Adversaries monitoring Tor traffic crossing their jurisdictional > border and reconstructing Tor circuits > https://arxiv.org/pdf/1808.09237.pdf > > DeepCorr: Strong Flow Correlation Attacks on Tor Using Deep Learning > https://arxiv.org/pdf/1808.07285.pdf > > Onions in the Crosshairs: When The Man really is out to get you > https://arxiv.org/pdf/1706.10292.pdf > > Shedding Light on the Dark Corners of the Internet: A Survey of Tor Research > https://arxiv.org/pdf/1803.02816.pdf > > Adaptive Traffic Fingerprinting for Darknet Threat Intelligence > https://arxiv.org/pdf/1808.01155.pdf > > Counter-RAPTOR: Safeguarding Tor Against Active Routing Attacks > https://arxiv.org/pdf/1704.00843.pdf > > Peel the onion: Recognition of Android apps behind the Tor Network > https://arxiv.org/pdf/1901.04434.pdf > > Tik-Tok: The Utility of Packet Timing in Website Fingerprinting Attacks > https://arxiv.org/pdf/1902.06421.pdf > > Mockingbird: Defending Against Deep-Learning-Based Website > Fingerprinting Attacks with Adversarial Traces > https://arxiv.org/pdf/1902.06626.pdf > > A Forensic Audit of the Tor Browser Bundle > https://arxiv.org/pdf/1907.10279.pdf > > Anomalous keys in Tor relays > https://arxiv.org/pdf/1704.00792.pdf > > Mitigating Censorship with Multi-Circuit Tor and Linear Network Coding > https://arxiv.org/pdf/1907.03473.pdf > > DNS-Morph: UDP-Based Bootstrapping Protocol For Tor > https://arxiv.org/pdf/1904.01240.pdf > > Towards Predicting Efficient and Anonymous Tor Circuits > https://arxiv.org/pdf/1805.01977.pdf > > TorPolice: Towards Enforcing Service-Defined Access Policies in > Anonymous Systems > https://arxiv.org/pdf/1708.08162.pdf > > DROPWAT: an Invisible Network Flow Watermark for Data Exfiltration Traceback > https://arxiv.org/pdf/1705.09460.pdf > > > Deanonymizing Tor hidden service users through Bitcoin transactions analysis > https://arxiv.org/pdf/1801.07501.pdf > > Tor Users Contributing to Wikipedia: Just Like Everybody Else? > https://arxiv.org/pdf/1904.04324.pdf > > Open Dataset of Phishing and Tor Hidden Services Screen-captures > https://arxiv.org/pdf/1908.02449.pdf > > A Broad Evaluation of the Tor English Content Ecosystem > https://arxiv.org/pdf/1902.06680.pdf > > Structure and Content of the Visible Darknet > https://arxiv.org/pdf/1811.01348.pdf > > On the Complexity of Anonymous Communication Through Public Networks > https://arxiv.org/pdf/1902.06306.pdf > > A Survey of Privacy Infrastructures and Their Vulnerabilities > https://arxiv.org/pdf/1812.06226.pdf > > The Effectiveness of Privacy Enhancing Technologies against Fingerprinting > https://arxiv.org/pdf/1812.03920.pdf > > Where The Light Gets In: Analyzing Web Censorship Mechanisms in India > https://arxiv.org/pdf/1808.01708.pdf > > An Extensive Evaluation of the Internet's Open Proxies > https://arxiv.org/pdf/1806.10258.pdf > > > > Measuring I2P Censorship at a Global Scale > https://arxiv.org/pdf/1907.07120.pdf > > An Empirical Study of the I2P Anonymity Network and its Censorship Resistance > https://arxiv.org/pdf/1809.09086.pdf > > > Integrating Privacy Enhancing Techniques into Blockchains Using Sidechains > https://arxiv.org/pdf/1906.04953.pdf > > BlockTag: Design and applications of a tagging system for blockchain analysis > https://arxiv.org/pdf/1809.06044.pdf > > > Interesting that many attacks on overlay networks > seem to depend on lack of fulltime 100% capacity fill > and reclocking, and that no overlay [or underlying physical] > networks currently deploy it, nor do many nets > of other design seem to make extensive impact > upon that class of GPA. Even 14.4-56k rates could > could have interesting uses at secure levels. From grarpamp at gmail.com Thu Aug 29 05:32:19 2019 From: grarpamp at gmail.com (grarpamp) Date: Thu, 29 Aug 2019 01:32:19 -0400 Subject: [tor-talk] PaperDump: Mirai, Tor, Darknet, TLA, I2P Censorship, PETs in Sidechains, and more In-Reply-To: References: Message-ID: On 8/28/19, Florentin Rochet LAZILY TOP POSTED AND BLOCK QUOTED: > This list is mixing good papers with several dubious ones. Failed to denote which, and why in detail such labels may or may not apply to them. > I find important to mention that it would be better looking here instead > for non-expert readers: https://www.freehaven.net/anonbib/ to find > quality peer-reviewed works, and keep the ones that intersect both lists > for now. Such intersection (logical AND) will of course yield only those papers approved and posted there by TPO / principals... any entity doing such self curation is prone to variety of selection biases. And peer review is somewhat often an ivory tower circle jerk among an exclusive peer group... equally often any supposed reviewers are not denoted anywhere. Novel papers are surely free as any to come from anywhere with zero association, consultation, editorial priviledge, consideration, etc given. If you really want to know what is good vs marginal vs rubbish, read and validate them yourselves, consult independants, study the knowledge areas, actually discuss them in detail in whatever communities you wish, including as desired in those that are their subject, try writing your own papers, etc.