Re: [tor-talk] Iran cracks down on web dissident technology
On Mon, Mar 21, 2011 at 10:09:43PM -0700, Mike Perry wrote: Thus spake Joe Btfsplk (joebtfs...@gmx.com): On 3/21/2011 2:39 PM, Paul Syverson wrote: On Mon, Mar 21, 2011 at 02:06:04PM -0500, Joe Btfsplk wrote: Last comments for a while. (All I have time for, sorry.) I'm just going to respond to specific issues about system threats and the like. I don't pretend to know the answers, but know when to ask questions. For all I know, the US wants the enemy to use Tor for plotting, thinking they're anonymous, when they're not. No one's answering my specific questions, possibly because if they knew them, they'd be in top level govt positions, sworn to secrecy. For those doubting any of this has any merit, are you still waiting for them to find WMDs in Iraq? Despite Lucky closing the thread in response to your conspiracy theory in favor more productive matters, I didn't get enough sleep last night to be productive, so I feel like trying to inject some reason into this thread. I think you also did a nice job of finding the Tor relevance buried therein. I'll respond to those parts where I think I might have something to contribute. To distill your argument down, you've said so far: [snip] 4. Governments have inconceivable power. [snip] You seem to have somewhat independently argued that #4 means that Tor cannot be trusted against (any) large government(s). This, unfortunately, may be true for some governments. Extremely well funded adversaries that are able to observe large portions of the Internet can probably break aspects of Tor and may be able to deanonymize users. This is why the core tor program currently has a version number of 0.2.x and comes with a warning that it is not to be used for strong anonymity. (Though I personally don't believe any adversary can reliably deanonymize *all* tor users, for similar reasons as detailed here: http://archives.seul.org/or/dev/Sep-2008/msg00016.html but attacks on anonymity are subtle and cumulative in nature). The goal of Tor is to balance the interests of as many different parties as possible to provide distributed trust, and to raise the amount of resources that any one adversary must have before it can compromise the network. Academic research also focuses on ways to improve the network characteristics of tor to defend against wide-scale observation (think dummy traffic and Paul's topology research), but so far none of these approaches has proved either robust or lightweight enough to actually deploy. In fact, the best known way we have right now to improve anonymity is to support more users, and more *types* of users. See: http://www.freehaven.net/doc/wupss04/usability.pdf http://freehaven.net/~arma/slides-weis06.pdf Distributing trust is also not just the number and diversity of users (and relay providers) but how they are related in intentions and other things. When going up against The Man*, you can't just assume a uniform distribution on relays, users, and network links between those wrt likelyhood-of-being-run-by-a-hostile/resilience-to-attack/etc Which means numbers and even diversity isn't the whole picture. I go into more on this in Why I'm not an Entropist. It is also the basis of the trust-based routing we have been working on, which is basically how do you route if you consider the possibility that significant portions of the network might be under the view/control of your adversary even if the network has 1 relays. And since I'm really going to try to resist responding any more to this thread, Thanks Mike for your other message containing the stab at a soundbite-sized and coherent expression of what I was trying to say about how the non-tech-savvy could trust Tor with the best justification to effort ratio. [snip] Of course, it still is concerning that any entity that can fit into argument #4 might be able to break tor, but hey, it's still 0.2.x. We're working on it ;). Right. See above. -Paul *My name for a nation-state/organized-crime/your-favorite-big-scary adversary. Gratis to Nick for enthusiastically liking this name in a partially related discussion on trust based routing models and thus encouraging me to use it. ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Iran cracks down on web dissident technology
On 3/21/2011 6:38 PM, Al MailingList wrote: That's a very good point klaus. Joe - if you think the US Government is one big cohesive entity that funds projects consistently from a single pool of resources and money then I would politely suggest you may not have had much to do with them :P Don't think that at all. Don't believe I said anything that even suggested. I'm speaking in general terms. My comments also regard more than one govt. In any govt project, there could be one or dozens of depts involved. ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Iran cracks down on web dissident technology
On Tue, Mar 22, 2011 at 11:23 AM, Joe Btfsplk joebtfs...@gmx.com wrote: Why would any govt create something their enemies can easily use against them, then continue funding it once they know it helps the enemy, if a govt has absolutely no control over it? It's that simple. It would seem a very bad idea. Stop looking at it from a conspiracy standpoint consider it as a common sense question. Because it helps the government as well. An anonymity network that only the US government uses is fairly useless. One that everyone uses is much more useful, and if your enemies use it as well that's very good, because then they can't cut off access without undoing their own work. Sincerely, Watson Ladd ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
[tor-talk] Users profiling through personаl banners filtering settings
Too many users dislikes of annoying web elements -- banners, popups, scripts, strange frames. They use a tools to blocks that elements or change webpage rendering. Traditional programs for filtering is a local proxys -- privoxy or polipo are examples with close relation to Tor and used actively. This programs cannot filtering SSL-content and evil site can use mix of SSL-ed and non-SSL-ed banners, pop-ups, etc to determine a fact of using such proxy and trying to guess personal users filtering settings. The problem may be even worse, with or without using this proxy, even if users block contents within a browser itself (with Firefox plugins to block banners, and scripts). Not only sites, but mans in the middles, adversarial clusters of evil exit nodes can does parsing traffic and modifying web contents by injecting banners, misconfigured cookies, incorrect frames. Injected traffic for various sites, in different times and seances can be the way of revealing users with personal blocking rules. Data about blocking profiles of that users may be statistical processed and correlated. Is it a real threat? Should Tor users stop blocking contents selectively? Or they can use predefined and shared rules in analogy of Torbutton? ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] tor using SSH
Jim, I am unclear as to what you are saying.. you noticed port 22 traffic you weren't expecting on one of your machines.. Do you recall if that traffic was INITIATED from your machine or were you seeing UNSOLICITED incoming SYNs for port 22? Your machine, running a Tor client, initiates a connection to a machine on port 22. This is your situation as I understood it. All of the mentioned IPs are IPs of Tor nodes and all of them announcing port 22 as a listen port, e.g., Amunet9, a Tor router, accepts connections on port 22 and 80. By searching for one of the mentioned IP addresses at http://metrics.torproject.org/relay-search.html. , you can verify this. The traffic to port 22 is most likely Tor traffic and is therefore normal behavior. You can also download a list of current Tor nodes, but this list changes regularly (once an hour). You find a list here: http://torstatus.blutmagie.de/ip_list_all.php/Tor_ip_list_ALL.csv Probably, you only need to whitelist the guard nodes, but the mentioned list does not distinguish between the different types of nodes. --Benne ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] tor using SSH
Date: Tue, 22 Mar 2011 15:13:33 -0400 From: Andrew Lewman and...@torproject.org How are you detecting ssh activity? actual protocol analysis or tcp port 22? There are valid relays on tcp port 22 which your tor client may connect to in the normal operation of tor. having tshark capturing ALL packets coming/going from every interface, saving everything to logfiles. Then, using wireshark/tshark to scan logs, extracting port 22 sessions. Since this port 22 traffic is encrypted, all that can be [easily] determined is that normal tcp handshaking is working based upon tcp flags in headers (ie: SYN-SYN/ACK-ACK; RST-RST/ACK-ACK) in sequential session packets. I have tried no further to determine whether that data is some tor protocol or actually ssh protocol. I simply assumed ssh protocol as one(*) would expect by seeing port 22. (*) one who has only used tor and hasn't learned the internals (yet) ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] tor using SSH
From: Benedikt Westermann westerm...@q2s.ntnu.no Your machine, running a Tor client, initiates a connection to a machine on port 22. This is your situation as I understood it. All of the mentioned IPs are IPs of Tor nodes and all of them announcing port 22 as a listen port, e.g., Amunet9, a Tor router, accepts connections on port 22 and 80. By searching for one of the mentioned IP addresses at http://metrics.torproject.org/relay-search.html. , you can verify this. Aha! That is good to know. All of those IPs I specified earlier except one (81.0.225.25 = SERVFAIL) were resolvable by DNS to something that I could see, had a name implying a tor connection. The traffic to port 22 is most likely Tor traffic and is therefore normal behavior. When I start allowing a new (to me) service to run thru the firewall, and that service includes encrypted ssh traffic, I want to be prudent that new service isn't going to create a reverse-tunnel with the capacity to send back remote commands to a shell at my end. That concerns me greatly, as anyone in my position would expect. You can also download a list of current Tor nodes, but this list changes regularly (once an hour). You find a list here: http://torstatus.blutmagie.de/ip_list_all.php/Tor_ip_list_ALL.csv Probably, you only need to whitelist the guard nodes, but the mentioned list does not distinguish between the different types of nodes. --Benne ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk Until I learn exactly, what sorts of data are traversing that ssh pipe, then I am unlikely to remove the firewall block of port 22. ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Iran cracks down on web dissident technology
On 3/22/2011 3:57 PM, Michael Reed wrote: BINGO, we have a winner! The original *QUESTION* posed that led to the invention of Onion Routing was, Can we build a system that allows for bi-directional communications over the Internet where the source and destination cannot be determined by a mid-point? The *PURPOSE* was for DoD / Intelligence usage (open source intelligence gathering, covering of forward deployed assets, whatever). ... The short answer to your question of Why would the government do this? is because it is in the best interests of some parts of the government to have this capability... -Michael ___ Very interesting, Michael. You were a part of it (or knew of it) it was because govt intelligence (you are aware many - not me - call that an oxy moron:)) wanted a system they could use for various purposes, where the source destination can't be determined by one of the mid points? That does make sense. BTW, I never said conspiracy - others did. Besides, many use the word or concept incorrectly. A govt developing technology to use in defending the country isn't a conspiracy. Covering up illegal activities, for instance, would be a conspiracy (like Watergate). If some govt has figured out how to decode Tor traffic (or use it to great advantage) to thwart terrorists, that's not conspiracy. I'm going out on a limb to say that US intelligence does not believe Tor gives terrorists a great advantage - for what ever reason(s), or else they'd shut it down, or at least stop funding it. But then, we other countries continue supplying arms to groups in various conflicts, which they often shoot back at us. That said, it may be an earlier poster's comment about lack of foresight may apply. It would seem that enemies *might* benefit from it as much as govts, unless govts are capable of more than many think they are. No one, except people w/ high level clearance (perhaps various countries) knows the full answer to that, and they're not talking. They thought the A-bomb was a good idea no other country would get the technology. Huh. I was on the fence on that one. It *may* be much like other ideas, such as the famous introduction of cats to an island, where they had no natural enemies. It almost destroyed the island's eco system. http://edition.cnn.com/2009/WORLD/asiapcf/01/12/eco.macquarieisland/ For what did you think might happen sorts of things that individuals govts do, I now reference them as Introducing Cats to an Island principles. Ideas that sound good at 1st, except for forgetting to ask (and seriously ponder) the most important question of all, What's the worst that can happen if we... Hey, let's build nuclear reactors on major fault lines all over the world. Yeah, that sounds good. Good night Mrs. Calabash, wherever you are. ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
