Re: A Few Random Thoughts...
On Fri, 26 Jun 2009 11:04:59 -0400 Michael co...@cozziconsulting.com wrote: Roger Dingledine wrote: On Fri, Jun 26, 2009 at 08:16:00AM -0400, Michael wrote: What I *am* doing is deploying a couple of heavy iron closed relays on OC3 or better bandwidth. The first is now deployed after a lot of up and down testing, and I'll get to the second in due time. Sounds great. Let us know if you have any questions or run into any problems. Roger, Come to think of it I have a question about best practices. My first Tor server is racked in the same datacenter as apparently two other Tor servers, one is an exit. Should I name these as family in my config? Although Roger can certainly speak/write for himself, I'll jump into this one, too. I'm thinking yes. But since I don't own the other servers I'm hesitant. But at face value it might make sense to disallow building circuits through them. If you don't have administrative control over the other relays, then no, your node is not part of whatever family/families they may/may not be a part of. Keep in mind that most clients will not build circuits that include more than a single node with an IP address in any given /16. Some hosting services may have more than that much IP address space, but in those cases, I really doubt that you'll find much reason to worry except for the fact that they could all be shut down at once. This points up an other issue that is indeed a potential security risk. Those who manage tor nodes at hosting companies need to have ways to protect the security of their nodes' log files and, most especially, their nodes' secret keys. Nodes at commercial hosting facilities need to keep *all* of that kind of information in well encrypted file systems with no access to anyone but the system administrator of the hosted system. Scott Bennett, Comm. ASMELG, CFIAG ** * Internet: bennett at cs.niu.edu * ** * A well regulated and disciplined militia, is at all times a good * * objection to the introduction of that bane of all free governments * * -- a standing army. * *-- Gov. John Hancock, New York Journal, 28 January 1790 * ** /16 spaces.
A Few Random Thoughts...
Hi all, As one of those lucky souls with access to almost limitless bandwidth and the skills (or stupidity) to use it, I suppose an apology is in order: I'm sorry- after reviewing what *could* be the consequences, I have to whimp out based on professional risk factors... I can't run an exit node. So I have to leave it to other folks who have a different situation to do the heavy lifting. What I *am* doing is deploying a couple of heavy iron closed relays on OC3 or better bandwidth. The first is now deployed after a lot of up and down testing, and I'll get to the second in due time. I've been watching Tor for a long time and just recently decided to get involved. The Iran situation cemented that decision. Anyhow, here are some random thoughts: On the Who uses Tor? section of the website, I see no mention of IT people. I've used the Tor network for many practical uses as an IT Director. These range from bypassing my own firewall to test incoming connections, to helping my legal department do research on a pending lawsuit without the opposition *knowing* we even looked at their website. Having a random and easily accessible IP to initiate connections from is a priceless testing tool. Especially when dealing with niggling routing problems. On one occasion my ISP was having routing/DNS problems, and Tor was able to find an entrance node and allow me to work even though I couldn't get to my remote servers directly. This saved my client a lot of downtime, and might have saved me the account. Also, my employer's RD department sometimes needs to look at things they don't want anyone to know they looked at (All quite legal mind you). Quite frankly Tor is an undervalued IT tool and it's capabilities should be trumpeted loudly on the web page. You might also find IT guys like me throwing up some relays in exchange. After all- who has the bandwidth anyway? And before anyone accuses me of it, I'm not nearly stupid enough to do a port scan over Tor. Phew. One of the issues I ran into when looking into running an exit relay had to do with not only the legalities, but identifying a server vendor that was offshore from my home country and friendly to a Tor exit. In order for me to run an exit node, I have to be completely shielded. As it stands now, I can probably run an exit for instant messaging- and that's it. However, if Tor itself had a relationship with someone who rents hardware, perhaps a partnership, Tor could get the exit nodes it needs, and the server vendor could get lots of cash. From my standpoint, it doesn't matter whether I rent or colocate my hardware. So if Tor as an organization had a partnership with a few server rental whores (in multiple countries), it would simplify getting more exits. I need servers, Tor runs with little impact on my server, I could care less where my remote hardware is provisioned from. Bingo- more exits. I read back about 6 months in the or-talk list and there were a couple of suggestions inferring that *everyone* should be forced to be an exit node. I think this is a very bad idea, and hurts the security of the person trying to remain anonymous by causing an identifiable change in bandwidth usage that could infer Tor usage (Information leakage). Simply speaking, on a default Windows/Vidalia installation, outgoing Tor traffic usually looks like https traffic, but on a forced exit, now Tor is identified by relatively matched traffic on port 443 both in and out of the client's connection (Unless it's entrance node is a *nix variant). This could mean death (literal) for a political dissident who is now identified as having an in/out matching traffic pattern assuming his entrance node is on Windows. It is more likely, that a country monitoring it's citizens would miss simple https traffic. But even myself as a lowly IT director, would have alarm bells going off if https was initiating in two directions from the same machine. Alternative ports can also set off alarm bells. But given the nature of Onion Routing, two way traffic needs to be avoided in the most sensitive sensitive situations. Forcing exit nodes is a bad idea for users. It will also drive away anyone who cannot provide an exit node that's chasing away bandwidth as non exit relays run for the hills. Long post. Too much coffee and too much time staring at routing tables. Michael
Re: A Few Random Thoughts...
On Fri, 26 Jun 2009 08:16:00 -0400 Michael co...@cozziconsulting.com wrote: Quite frankly Tor is an undervalued IT tool and it's capabilities should be trumpeted loudly on the web page. You might also find IT guys like me throwing up some relays in exchange. After all- who has the bandwidth anyway? I second this thought and have used Tor for many of the same things. Tor is immensely helpful when I was dealing with an ISP that had consistent DNS server problems. It is great for checking if my small web server is up (my current ISP blocks connections to oneself). I think that it would be an excellent Idea to have some of these uses of Tor promoted on the website. -- free...@gmail.com free...@yahoo.ca This e-mail has been digitally signed with GnuPG - ( http://gnupg.org/ ) signature.asc Description: PGP signature
Re: A Few Random Thoughts...
On Fri, June 26, 2009 16:45, Roger Dingledine wrote: Yep. The next step is to come up with some really good clean simple example sentences for our new category. Those examples will dictate the title we give it -- Security experts use Tor, Sysadmins use Tor, Computer experts use Tor, or something else. Maybe you could try to tickle the listener working on the idea of a server with no exposed listening ports: a client-only Tor node could still export hidden services like http or ssh. the latter is quite cool if the user will survive the lag ;-) -- Marco Bonetti BT3 EeePC enhancing module: http://sid77.slackware.it/bt3/ Slackintosh Linux Project Developer: http://workaround.ch/ Linux-live for powerpc: http://workaround.ch/pub/rsync/mb/linux-live/ My GnuPG key id: 0x86A91047
Re: A Few Random Thoughts...
Roger Dingledine wrote: On Fri, Jun 26, 2009 at 08:16:00AM -0400, Michael wrote: What I *am* doing is deploying a couple of heavy iron closed relays on OC3 or better bandwidth. The first is now deployed after a lot of up and down testing, and I'll get to the second in due time. Sounds great. Let us know if you have any questions or run into any problems. Roger, Come to think of it I have a question about best practices. My first Tor server is racked in the same datacenter as apparently two other Tor servers, one is an exit. Should I name these as family in my config? I'm thinking yes. But since I don't own the other servers I'm hesitant. But at face value it might make sense to disallow building circuits through them. Michael
thoughts???
Just came across this: http://hosted.ap.org/dynamic/stories/T/TEC_PUNISHING_PROXIES?SITE=ILEDWSECTION=HOMETEMPLATE=DEFAULT Cheers, Harry
Re: thoughts???
On Tue, 14 Apr 2009 21:17:19 -0400 Harry Hoffman hhoff...@ip-solutions.net wrote: Just came across this: http://hosted.ap.org/dynamic/stories/T/TEC_PUNISHING_PROXIES?SITE=ILEDWSECTION=HOMETEMPLATE=DEFAULT From the March 2009 Progress Report, https://blog.torproject.org/blog/march-2009-progress-report On March 17, Roger attended a hearing at the US Sentencing Commission, where Seth Schoen from EFF was testifying in opposition to a new if you use a proxy when committing a crime, it's a sophisticated crime so you get more jail-time clause they were considering. It turned out one of the commissioners is an avid Tor user, so they were sympathetic to his testimony. -- Andrew Lewman The Tor Project pgp 0x31B0974B Website: https://torproject.org/ Blog: https://blog.torproject.org/ Identica/Twitter: torproject
Re: Firefox extension SafeCache? Thoughts?
Thus spake jeffery statin ([EMAIL PROTECTED]): Hello, Has anyone used Collin Jackson's plugin SafeCache http://www.safecache.com/ ? Opinions? Is is OK to use in conjunction with TorButton? The alpha version of Torbutton (https://torbutton.torproject.org/dev/) should clear your browser cache on Tor toggle. However, SafeCache may still be helpful to have if you are not the type to toggle Tor very often or restart your browser (since it isolates the cache on a per domain basis). It should work fine with Torbutton, but I have not tested it. Please let me know if you notice any bugs. -- Mike Perry Mad Computer Scientist fscked.org evil labs pgpHagXGJJGdD.pgp Description: PGP signature
Re: Firefox extension SafeCache? Thoughts?
Mike Perry [EMAIL PROTECTED] wrote: [snip] (since it isolates the cache on a per domain basis). This is why I was considering using SafeCache; are there attacks where the cache could be read, accessed, etc? It should work fine with Torbutton,but I have not tested it. Please let me know if you notice any bugs. Will do. BTW, SafeHistory is not needed because you incorporated some of Collin Jackson's code into TorButton, correct? Jeff Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs
Firefox extension SafeCache? Thoughts?
Hello, Has anyone used Collin Jackson's plugin SafeCache http://www.safecache.com/ ? Opinions? Is is OK to use in conjunction with TorButton? - Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now.
