[tor-dev] Guard-security projects extracted from Roger's blog post

2013-10-25 Thread George Kadianakis
Hey Nick,

I made a pad with some of the tasks that Roger mentioned in his recent
blog post [0]. The pad can be found here:
https://pad.riseup.net/p/BQl2W58RLurU_guard

It's probably not an exhaustive list and needs more work. Unfortunately I
won't have time to work on it during the weekend so I'll post it here in
case you find it useful.

Cheers!

[0]:
https://blog.torproject.org/blog/improving-tors-anonymity-changing-guard-parameters

___
tor-dev mailing list
tor-dev@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev


Re: [tor-dev] Incorporating your torsearch changes into Onionoo

2013-10-25 Thread Kostas Jakeliunas
On Wed, Oct 23, 2013 at 2:32 PM, Karsten Loesing kars...@torproject.orgwrote:

 On 10/11/13 4:05 PM, Kostas Jakeliunas wrote:

 Oops!  Sorry for the delay in responding!  Responding now.

  On Fri, Oct 11, 2013 at 12:00 PM, Karsten Loesing 
 kars...@torproject.orgwrote:
 
  Hi Kostas,
 
  should we move this thread to tor-dev@?
 
 
  Hi Karsten!
 
  sure.
 
 From our earlier conversation about your GSoC project:
  In particular, we should discuss how to integrate your project into
  Onionoo.  I could imagine that we:
 
   - create a database on the Onionoo machine;
   - run your database importer cronjob right after the current Onionoo
  cronjob;
   - make your code produce statuses documents and store them on disk,
  similar to details/weights/bandwidth documents;
   - let the ResourceServlet use your database to return the
  fingerprints to return documents for; and
   - extend the ResourceServlet to support the new statuses documents.
 
  Maybe I'm overlooking something and you have a better plan?  In any
  case, we should take the path that implies writing as little code as
  possible to integrate your code in Onionoo.
 
  Let me know what you think!
 
 
  Sounds good. Responding to particular points:
 
   - create a database on the Onionoo machine;
   - run your database importer cronjob right after the current Onionoo
  cronjob;
 
  These should be no problem and make perfect sense. It's always best to
 use
  raw SQL table creation routines to make sure the database looks exactly
  like the one on the dev machine I guess (cf. using SQLAlchemy
 abstractions
  to do that (I did that before)).
 
  Current SQL script to do that is at [1]. I'll look over it. For example,
  I'd (still) like to generate some plots showing the chances of two
  fingerprints having the same substring (this is for the intermediate
  fingerprint table.) (One axis would be substring length, another would be
  the possibility in (portions of) %.) As of now, we still use
  substr(fingerprint, 0, 12), and it is reflected in the schema.
 
  Overall though, no particular snags here.

 I don't follow.  But before we get into details here, I must admit that
 I was too optimistic about running your code on the current Onionoo
 machine.  I ran a few benchmark tests on it last week to compare it to
 new hardware, and those tests almost made it fall over.  We should not
 even think about adding new load to the current machine.

 New plan: can you run an Onionoo instance with your changes on a
 different machine?  (If you need anything from me, like a tarball of the
 status/ and out/ directories, I'm happy to provide them to you.)  I
 think we should run this instance for a while to see how reliable it is.
  And once we're confident enough, we'll likely have new hardware for the
 new Onionoo, so that we can move it there.


This sounds like a very good idea. Ok, I can try and do this. Sorry for
delaying my response as well, I'll try and follow up with what I need (if
anything).

  - make your code produce statuses documents and store them on disk,
  similar to details/weights/bandwidth documents;
 
  Right, so if we are planning to support all V3 network statuses for all
  fingerprints, how are we to store all the status documents? The idea is
 to
  preprocess and serve static JSON documents, correct (as in the current
  Onionoo)? (cf. the idea of simply caching documents: if we serve a
  particular status document, it gets cached, and depending on the query
  parameters (date range restriction, e.g.) it may be set not to expire at
  all.)
 
  Or should we try and actually store all the statuses (the condensed
 status
  document version [2], of course)?

 Let's do it as the current Onionoo does it.  This code does not exist,
 right?


I've done some small testing on a local system, it seems the Onionoo way is
plausible, since the generation of all the old(er) status etc. documents
needs to happen only once (obviously, but now I understand this means the
number of resulting status documents and their size is not such a big deal
after all.) I don't have good code for it as of yet.


   - let the ResourceServlet use your database to return the
  fingerprints to return documents for; and
   - extend the ResourceServlet to support the new statuses documents.
 
  Sounds good. I assume you are very busy with other things as well, so
  ideally maybe you had in mind that I could try and do the Java part? :)
  Though, since you are much more familiar with (your own) code, you could
  probably do it faster than me. Not sure.
  Any particular technical issues/nuances here (re: ResourceServlet)?

 Can you give it a try?  Happy to help with specific questions about
 ResourceServlet, and I'll try hard to reply faster this time.  Again,
 sorry for the delay!


Okay! I've been tinkering a bit, actually. Will see if I can produce
something decent and reliable.

Best wishes
Kostas.


  [1]: https://github.com/wfn/torsearch/blob/master/db/db_create.sql
  [2]:
 

[tor-dev] Development of an HTTP PT

2013-10-25 Thread dardok
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Hi, I am quite new in here but I am interested to help and improve the
TOR system. I am interested in PTs and particularly in developing a
HTTP PT.

I've read some papers [0],[1],[2],[3] and the ticket #8676 and I
consider that it would be a good idea to make an effort and try to
implement the HTTP PT as is stated in the ticket, that is using real
browser and server services.

After talking with asn, we conclude that a good point to start this
development may be to focus on the HTTP transport part, that is to
know how to control the browser or the server and how to embed the TOR
traffic into the HTTP protocol (requests and responses). Things such
as the data obfuscation, the delays in the communications and the
packet chopping won't be considered, because it may be used another PT
such Scramblesuit to do that task.

The CLIENT side:

TBB - Scramblesuit PT - HTTP PT - CENSOR NET

and the SERVER side:

CENSOR NET - HTTP PT - Scramblesuit PT - TOR bridge

The important is to know how to embed the TOR traffic already
obfuscated into the requests and responses to avoid suspicion. Also as
I said before, to know how to control a browser binary to make the
HTTP traffic from the client side as much traditional as possible, for
instance using a firefox binary or something like that. The same must
be applied to the server side, implementing a real NGINX server or an
Apache server on port 80 and writting some CGI to classify the traffic
incoming from the TOR clients through the HTTP requests. The same
server may have another CGI to write and send the HTTP responses to
those TOR clients with the traffic into them.

I would like to find someone interested to work on this topic.

Thanks and I wait for your comments or suggestions!

[0] http://www.owlfolio.org/media/2010/05/stegotorus.pdf
[1] http://www.cs.kau.se/philwint/pdf/wpes2013.pdf
[2] https://www.ieee-security.org/TC/SP2013/papers/4977a065.pdf
[3] https://github.com/sjmurdoch/http-transport/blob/master/design.md
-BEGIN PGP SIGNATURE-

iQEcBAEBCgAGBQJSarhoAAoJEFz9RJtDk2+MsnwH/2MugLeUH+EOc6bzyKJ25W/N
5Kf9w1YdU276z5eba6+fY38H6l3hwErT6TaiWcULiVra1JshLLWaTGHS9AiP4Nf3
QTUVjUMQNiqGkLvNBIkxwqe8MQo1d5GgEhul4fYzMKS46clhmkb6lILIfZ4bRDyc
8bctM8qOk7mLVkp9Ip+ehv/J6S4wmSNtKUIj88mUyfRDDXn/+r7OQx+FDoC/3YiL
XzFpaeofPgdWb35cieQvR2wWqWN3N5BRK1R7o0g02BfOYEXOxQ2KaIWUqJBiyKqo
uzSAkic1a5qDpJImAQhjAVrqZi1NKZbQQM+33caWm8T9fWkNojClQZ2PzbJn0os=
=zI1W
-END PGP SIGNATURE-
___
tor-dev mailing list
tor-dev@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev