Re: [tor-talk] 2 hop mode for people that only want to use Tor for censorship circumvention to conserve bandwidth and decrease latency?
Thanks Nathan. While it's true VPNs have downsides, if bandwidth (and not anonymity) is the top priority, Tor may not be the solution for that person. Even if we drastically increase the number of nodes in the network, it's hard to imagine Tor (with 3 hops) will be able to have less latency than a single hop VPN. (But yes, I agree we are too often quick to push people to VPNs) // Greg Norcie (nor...@cdt.org) Staff Technologist Center for Democracy & Technology District of Columbia office (p) 202-637-9800 PGP: http://norcie.com/pgp.txt /***/ On Mon, Jun 13, 2016 at 10:16 AM, Nathan Freitas <nat...@freitas.net> wrote: > On Mon, Jun 13, 2016, at 08:55 AM, Greg Norcie wrote: > > If your main concern is merely circumvention (and you're not worried > > about > > retaliation for circumventing), you might be better off using a VPN. > > > > Unlike Tor, there is no globally published list of all VPN services, so > > you > > could probably find one that isn't blocked by your country. Most services > > take Bitcoin if payment is an issue... I'd look askance at any "free" > > VPN. > > I know you weren't saying this, Greg, but I do often feel that we are > too quick to push people who only want circumvention, and not anonymity, > away from using Tor. Also, increasingly with DPI / traffic > fingerprinting, we are seeing VPN protocols being blocked in places like > China, and thus the VPNs are adopting traffic obfuscation methods like > Meek and ObfsProxy as part of their software. > > From Ars, a great thorough assessment of all the downsides to a VPN: > > "The impossible task of creating a “Best VPNs” list today: Our writer > set out to make a list of reliable VPNs; turns out the task is > complicated." > > > http://arstechnica.com/security/2016/06/aiming-for-anonymity-ars-assesses-the-state-of-vpns-in-2016/ > > Best, > Nathan > -- > tor-talk mailing list - tor-talk@lists.torproject.org > To unsubscribe or change other settings go to > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk > -- tor-talk mailing list - tor-talk@lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] 2 hop mode for people that only want to use Tor for censorship circumvention to conserve bandwidth and decrease latency?
Hi there, If your main concern is merely circumvention (and you're not worried about retaliation for circumventing), you might be better off using a VPN. Unlike Tor, there is no globally published list of all VPN services, so you could probably find one that isn't blocked by your country. Most services take Bitcoin if payment is an issue... I'd look askance at any "free" VPN. /****/ Greg Norcie (nor...@cdt.org) Staff Technologist Center for Democracy & Technology District of Columbia office (p) 202-637-9800 PGP: http://norcie.com/pgp.txt /***/ On Sun, Jun 12, 2016 at 3:56 PM, gdfg dfgf <torrio...@net.hr> wrote: > I have read the proposal for non hidden .onion services for sites that > don't need anonymity but want to use Tor's end to end encryption and > authentication, for example Facebook. > > Could the same be done for people that are more interested in censorship > circumvention then in anonymity to decrease latency and conserve bandwidth > so instead of building 3 hop circuits they could build 2 hop circuits? > > entry node---> exit node ---> website > > bridge- --> exit node ---> website > > -- > tor-talk mailing list - tor-talk@lists.torproject.org > To unsubscribe or change other settings go to > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk > -- tor-talk mailing list - tor-talk@lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] CloudFlare blog post
So the post seems to weigh heavily towards proof of work in Tor Browser, rather than running .onion sites. (Which apparently attract less malicious traffic? Interesting tidbit) My question: why not simply move to using SHA-256? The main point in the blog seemed to be that that using .onion sites is not workable due to the use of SHA-1. Since the Tor Project has limited resources, it seems like switching hashes and asking websites to use .onion addies would create less work for the devs but have a similar effect to a proof of work module in Tor Browser. However, I may be missing something important, and if so please feel free to enlighten me :) // Greg Norcie (nor...@cdt.org) Staff Technologist Center for Democracy & Technology District of Columbia office (p) 202-637-9800 PGP: http://norcie.com/pgp.txt *CDT's Annual Dinner (Tech Prom) is April 6, 2016. Don't miss out!learn more at https://cdt.org/annual-dinner <https://cdt.org/annual-dinner>* /***/ On Thu, Mar 31, 2016 at 2:04 PM, Andreas Krey <a.k...@gmx.de> wrote: > On Thu, 31 Mar 2016 11:27:24 +, Joe Btfsplk wrote: > ... > > >What I wonder is how they want to make a difference using .onion > addresses > > >for their customers - tor crawlers can take that redirect just so. > > Andreas, sorry - don't understand part of your comment. > > "It would be quite a lot of effort to do... *what?*... this way... - > > sorry, it won't work any better." > > They said that automatically providing cloudflared sites with > onion addresses would make it easier to detect nonmalicious > tor use, but I wonder why they expect that the bad guys don't > immediately use the onion instead of the plain site as well. > > ... > > I've seen Cloudflare on low value target sites, like wood screw mfg info > > sites & similar. Unless other screw mfgs are sabotaging them, I doubt > > much malicious activity is directed at such sites. > > This is simply the default setting, I guess. CF isn't just > a abuse shield, it is first a CDN. There are sites where > there is nothing relevant to harvest, and there are sites > where there is, but they all use couldflare for different > reasons, and get the scraper protection for free, and not > necessarily on their intention. > > > 94% is saying essentially ALL Tor traffic / requests are "per se" > > malicious or use inordinate amt of resources. That leaves me & 6% of > > users that aren't. > > Users != Traffic. > > > Maybe ? he's counting crawler *individual* requests - page by page - as > > malicious? They might make many more requests than real users, thus the > > 94% claim? > > Quite probably. > > ... > > His statement(s) & reasoning about blocking Tor still seem strange. As > > they say, "follow the money trail." "Money trumps all other reasons / > > motives." > > Tell that the authors of the software this mailing list is for. > > > I still say trackers aren't going to pay sites for TBB traffic. Don't > > say, "You're using Tor - get lost" - bad for public relations. Instead, > > play dumb & covertly discourage (some) Tor users - so they access the > > site w/ unhardened browsers. > > Tracking is not cloudflare's business, it's the business of the site owner. > > > Can't sites tell the difference in actions of crawlers & real users? > > Not as easily as just using cloudflare as a front. Heck, my colleague > has cloudflare in front of one of his sites, even though there was > probable more traffic for setting that up than the site on a good day. > > > I'm sure some use browsers other than TBB for crawling & malicious > > activity. Can't sites block / time-out crawlers from continuing to > > access entire site, once it becomes apparent - regardless of which > browser? > > Yes. That would lock out the entire exit, and with the crawling > density this apparently basically never gives tor users access. > > This is also what cloudflare does, just over longer time, and > giving a captcha instead of an reject. > > > I get "time outs" from making 2 very narrow term searches in < 2 min. or > > so, on some sites I'm registered on & participated - for a long time. > > Why can't sites do the same w/ crawlers' rapid, repeated requests? > > Crawlers would immediately get smart and stretch their requests out? > > Andreas > > -- > "Totally trivial. Famous last words." > From: Linus Torvalds <torvalds@*.org> > Date: Fri, 22 Jan 2010 07:29:21 -0800 > -- > tor-talk mailing list - tor-talk@lists.torproject.org > To unsubscribe or change other settings go to > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk > -- tor-talk mailing list - tor-talk@lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] rant - just want a bit of music
Another option is a VPN, if you're more concerned about choosing your country than strong anonymity. Astrill has a good UI for picking which country your traffic is to come from. On Mon, Apr 6, 2015 at 1:09 AM, Yuri y...@rawbw.com wrote: On 04/05/2015 21:50, Zenaan Harkness wrote: I am presently in New Zealand, and when I try to view in firefox or download with youtube-dl, some a Capella music, half the time I get a message from Google saying SME (Sony Music Entertainment) has blocked this track in my country. Surely solving the ready-access to censored content problem would be a good start for our freedom lovin' community? Example a capella failures to download: $ youtube-dl 'https://www.youtube.com/watch?v=Toga5cWRi0klist= PLBCnvBvQEJRpdirUvR1CKLMhESI7whlWM' -i [youtube:playlist] Downloading playlist torsocks helps command line programs like this. Add the rule to deny NZ exit nodes in your torrc, then 'torsocks youtube-dl https' Yuri -- tor-talk mailing list - tor-talk@lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk -- /***/ *Greg Norcie (nor...@cdt.org nor...@cdt.org)* *Staff Technologist* *Center for Democracy Technology* 1634 Eye St NW Suite 1100 Washington DC 20006 (p) 202-637-9800 PGP: http://norcie.com/pgp.txt Fingerprint: 73DF-6710-520F-83FE-03B5 8407-2D0E-ABC3-E1AE-21F1 /***/ -- tor-talk mailing list - tor-talk@lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Firefox Hello and privacy
It's based on WebRTC, so I'd suggest reading about that to get some insight. Greg Norcie (gnor...@indiana.edu) PhD Student, Security Informatics Indiana University On 1/28/15 5:16 PM, Lara wrote: I have checked the net high and low. And the talk is mostly about where you find the smiley icon to put on the bar. How does it work? How does it respect privacy? Do you know anything about this new thing? -- tor-talk mailing list - tor-talk@lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Torbirdy
Which is worse (assuming someone isn't worried about violence being directed at them): Using TorBirdy, or plain old SMTP? -- Greg Norcie (gnor...@indiana.edu) PhD Student, Security Informatics Indiana University On 1/26/15 4:33 AM, Vignesh Prabhu wrote: Hi, Cypher: A few months ago, I seem to remember the general advice being not to use Torbirdy. But I see the software was updated only a few months ago so I assume it's in active development. Can I assume Torbirdy is safe to use? From what I understand there are two main issues still pending which might lead to compromise of user's identity and unless that is fixed, it is not completely safe to use Torbirdy. The issues are: https://trac.torproject.org/projects/tor/ticket/6314 https://trac.torproject.org/projects/tor/ticket/6315 @Sukhbir, please correct me if I am wrong. Regards, Vignesh Prabhu Powered by BigRock.com -- tor-talk mailing list - tor-talk@lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Did the CMU team out Silk Road 2 to the FBI?
It's uncommon, but not unheard of, for someone to think just because a paper contains no classified information, they can publish it without running it past the agency they work for. Often after being informed they can be sanctioned, there is not enough time to get approval before the conference, so the paper is withdrawn. -- Greg Norcie (gnor...@indiana.edu) PhD Student, Security Informatics Indiana University On 1/23/15 5:10 PM, Mirimir wrote: On 01/23/2015 02:12 PM, Greg Norcie wrote: Correct me if I'm wrong, but doesn't CERT contract out to federal agencies sometimes? -- Greg Norcie (gnor...@indiana.edu) PhD Student, Security Informatics Indiana University I've read that, but haven't researched the question. But if the CMU team had been funded to deanonymize SR2, or even illicit hidden service sites generally, why would they have scheduled a presentation at Black Hat? But of course, this is entirely speculative. On 1/21/15 5:59 PM, Mirimir wrote: OK, so this is very interesting: | The court documents refer to a source that provided reliable | IP addresses for Tor hidden services between January and July | of 2014, leading them back to both the servers and 78 different | people doing business on the site. | | According to a Tor blog post, someone during that period was | infiltrating the network by offering new relays, then altering | the traffic subtly so as to weaken Tor's anonymity protections. | By attacking the system from within, they were able to trace | traffic across the network, effectively following the server | traffic back to their home IP. In July, Tor noticed the bug and | published an update to fix it — but for six months, certain | hidden services were badly exposed, and the Silk Road 2 appears | to have been one of them. | || OK, almost certain: CERT Tor deanon attack was FBI source: || https://t.co/JKwWD2E3VK SR2 server, 78 vendor IPs, Jan-July 2014 || — Nicholas Weaver (@ncweaver) January 21, 2015 | | So who carried out the attack? Already, researchers are pointing | to a Black Hat presentation this summer that promised to outline | a similar attack, but was controversially cancelled at the last | minute. The researchers, working for CMU's CERT Center described | similar capabilities and performed their research over a nearly | identical span of time: January to July of 2014. If the | researchers were also helping the FBI investigate criminal | activity on Tor, it would explain why law enforcement might | not want their methods getting out to the community at large. https://www.theverge.com/2015/1/21/7867471/fbi-found-silk-road-2-tor-anonymity-hack -- tor-talk mailing list - tor-talk@lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Blockchain down.
Is that common behavior - blocking Tor users from the normal site if they have a .onion? Seems like not the most user friendly design decison. -- Greg Norcie (gnor...@indiana.edu) PhD Student, Security Informatics Indiana University On 1/22/15 11:34 AM, blo...@openmailbox.org wrote: https://blockchainbdgpzk.onion/wallet has been down since yesterday. It just says quota exceeded. Very annoying especially since you cannot use the non .onion site if you are using Tor! -- tor-talk mailing list - tor-talk@lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Did the CMU team out Silk Road 2 to the FBI?
Correct me if I'm wrong, but doesn't CERT contract out to federal agencies sometimes? -- Greg Norcie (gnor...@indiana.edu) PhD Student, Security Informatics Indiana University On 1/21/15 5:59 PM, Mirimir wrote: OK, so this is very interesting: | The court documents refer to a source that provided reliable | IP addresses for Tor hidden services between January and July | of 2014, leading them back to both the servers and 78 different | people doing business on the site. | | According to a Tor blog post, someone during that period was | infiltrating the network by offering new relays, then altering | the traffic subtly so as to weaken Tor's anonymity protections. | By attacking the system from within, they were able to trace | traffic across the network, effectively following the server | traffic back to their home IP. In July, Tor noticed the bug and | published an update to fix it — but for six months, certain | hidden services were badly exposed, and the Silk Road 2 appears | to have been one of them. | || OK, almost certain: CERT Tor deanon attack was FBI source: || https://t.co/JKwWD2E3VK SR2 server, 78 vendor IPs, Jan-July 2014 || — Nicholas Weaver (@ncweaver) January 21, 2015 | | So who carried out the attack? Already, researchers are pointing | to a Black Hat presentation this summer that promised to outline | a similar attack, but was controversially cancelled at the last | minute. The researchers, working for CMU's CERT Center described | similar capabilities and performed their research over a nearly | identical span of time: January to July of 2014. If the | researchers were also helping the FBI investigate criminal | activity on Tor, it would explain why law enforcement might | not want their methods getting out to the community at large. https://www.theverge.com/2015/1/21/7867471/fbi-found-silk-road-2-tor-anonymity-hack -- tor-talk mailing list - tor-talk@lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] New to this list
If you're interested in free literature on anonymity, AnonBib is a great resource: http://www.freehaven.net/anonbib/ I suggest reading some of the founational papers. Considering your technical background Tor: The Second-Generation Onion Router is a good place to start. It has a link on to a free HTML version on Anonbib: https://svn.torproject.org/svn/projects/design-paper/tor-design.html If you click the star next to the title of the paper on AnonBib, it takes you to the Google Scholar page. You can see who has cited the paper, and what GS considers to be related literature. You can repeat that process for any papers that catch your eye. Have fun! PS: If you want to search on Google Scholar easily, one simple way is to append !gsc to your query when searching with DuckDuckGo. Google has the link to it buried a bit in the current UI. -- Greg Norcie (gnor...@indiana.edu) PhD Student, Security Informatics Indiana University On 1/23/15 1:34 PM, Philipp Winter wrote: On Fri, Jan 23, 2015 at 01:17:30PM -0500, Kevin wrote: Hello. I am a programmer and computer security specialist, to name a few things. I am on this list because I have learned of onion botnets and I felt that this would be a good place to research ways to combat them. I hope to gather some meaningful info as well as engage in some tor talk! This paper might be a good start: http://fc14.ifca.ai/papers/fc14_submission_152.pdf Cheers, Philipp -- tor-talk mailing list - tor-talk@lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Craigslist now blocking all Tor IPs? Template for anyone:
I (and a few other friends) have noticed Padmapper's results seem less complete than usual lately. Coincidence? -- Greg Norcie (gnor...@indiana.edu) PhD Student, Security Informatics Indiana University On 1/20/15 12:50 AM, Seth wrote: On Mon, 19 Jan 2015 21:31:31 -0800, Libertas liber...@mykolab.com wrote: I recall Craigslist blocking Tor in September. I imagine they are doing this to thwart scrapers, massive collateral damage to privacy seekers though. -- tor-talk mailing list - tor-talk@lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] foxnews blockade
It also might be used by someone collecting content in preparation for a lawsuit: http://money.cnn.com/2015/01/20/media/paris-mayor-sue-fox-news/ (Headline: Paris mayor: We intend to sue Fox News) -- Greg Norcie (gnor...@indiana.edu) PhD Student, Security Informatics Indiana University On 1/19/15 2:51 PM, Michael O Holstein wrote: not just you .. the 404 is 403 : You don't have permission to access http://www.foxnews.com/404error/; on this server. sarc They probably figured their target audience is lucky their trailer park permits DVB dishes, and that anyone using TOR to get there was going to SQL inject some truthiness. /sarc From: tor-talk tor-talk-boun...@lists.torproject.org on behalf of Robert Watson rob...@gillecaluim.com Sent: Monday, January 19, 2015 2:46 PM To: tor-talk@lists.torproject.org Subject: [tor-talk] foxnews blockade I've configured a squid/privoxy/tor setup and have been testing. I'm unable to visit www.foxnews.com Access Denied but foxnews isn't listed in the ListofServicesBlockingTor. Is this just me and a misconfigured setup or are other people getting the same problem -- tor-talk mailing list - tor-talk@lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk -- tor-talk mailing list - tor-talk@lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] TBB restore closed tabs
Do you mean that if you opened a tab in private mode, turned it off, then hit CTRL-SHIFT-T the tab would open? It's normal behavior for Firefox (the code TBB is based on) to allow restoration of tabs within the private browsing window. (Though we can certainly discuss the pros and cons of that design decision) -- Greg Norcie (gnor...@indiana.edu) PhD Student, Security Informatics Indiana University On 1/6/15 11:00 AM, SecTech wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Hi, I don't know wheather this was fixed until now or not, maybe it's not a bug, it's a feature. When I closed some tabs in TBB I could reopen them by pressing Ctrt+Shift+T regardless you are in private mode or not. When you search in about:config for browser.sessionstore.max_tabs_undo and set the variable to 0 TBB won't reopen your closed tabs anymore. - -- SecTech t...@firemail.de GPG-ID: 0x364CFE05 -BEGIN PGP SIGNATURE- iQIcBAEBCgAGBQJUrAazAAoJENR4jiM2TP4FfNsQAOAK0qLdny+wTOv4fM4UX5UD YYdaFPZ+FXEMoboV+MPUBU3e8o1uqYfgZafca9x+l9pZgdQoiuaGobHUUF05dJAs wN6dAGn4uTZVyTpJCwi6iyKWLkSEEFiW5xO/JwPD/dUryqM0+l5Phgj23zrY5lLy z7kY5uV0NWs94RyOQbRDN7A30EEwuCSNRdZP/AfEMFFJ9EaYWfYkG147PW0Z23Qj B7IEEhANg5h6vsUVH42/cugbmfPjhYWB2XXcY3gYoNAnNeCG3KpXiRNYrVf335Od AssbScEMLOVRO+/f48RgI2Nnv+bxYA8HXAFJOh0xfJ1MTu0Fo3aGoEtuIHJAE3N1 6QYVHCiHm7oGcFR7SJ8MWaFRr5ghrrky0Q0keOfi5zSYakoQUN2D0KLUCSZz6dLm Lgs3Qom9Q0TT1rI9Flqe22iHlmRyThQbTo9CoCc1JJ54tNAwdxTpIQkGAq0XJXez YnFyEEZo7dzRU207xvb5n/mEmvupS6hAe2Ut+XB5cI4OjRcBbwu3M1R5qaz1hVjj ZzYsOUXHHIEE3b+ryWCDQXlqWvPC6U1wNkQBo9orR6CNO4uLATls/NhfGb4mMASS fYv0hfCsnjvNpD7NZBRmHOJDJ8DPJJawvasUMWoc02ZBWgmxuhK1yUbeLNSdK1p0 rwrhZtTTKHPPRUD0K+3t =0Pel -END PGP SIGNATURE- -- tor-talk mailing list - tor-talk@lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Including Adblock to TBB to save bandwith
Also, from a less philosophical POV, adding any add-ons increases attack surface. -- Greg Norcie (gnor...@indiana.edu) PhD Student, Security Informatics Indiana University On 12/15/14, 10:10 AM, intrigeri wrote: Hi, Justaguy wrote (15 Dec 2014 13:44:05 GMT) : What if torbrowser would include adblock, this would reduce the amount of bandwith used, and thus increase the overal speeds @ tor See 5. No filters in https://www.torproject.org/projects/torbrowser/design/#philosophy Cheers, -- intrigeri -- tor-talk mailing list - tor-talk@lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Reasoning behind 10 minute circuit switch?
Thanks for the detailed reply! On 10/14/14, 5:10 PM, Roger Dingledine wrote: On Tue, Oct 14, 2014 at 12:17:27PM -0400, Greg Norcie wrote: I'm working on doing a study on user tolerance of delays (for example, latency on Tor). During our discussion, a bit of a debate occured about the TBB's circuit switching. I was wondering if there's any research that's been done to arrive at the 10 minute window for circuit switching, or if that was number picked arbitrarily? It was alas picked arbitrarily. As Nick notes, it used to be 30 seconds, and then when we started getting users, all the relays complained of running at 100% cpu handling circuit handshakes. We changed it to 10 minutes, and the complaints went away -- at least until the botnet showed up. We've had an open research question listed for years now -- see bullet point 4 on https://research.torproject.org/ideas.html Right now Tor clients are willing to reuse a given circuit for ten minutes after it's first used. The goal is to avoid loading down the network with too many circuit creations, yet to also avoid having clients use the same circuit for so long that the exit node can build a useful pseudonymous profile of them. Alas, ten minutes is probably way too long, especially if connections from multiple protocols (e.g. IM and web browsing) are put on the same circuit. If we keep fixed the overall number of circuit extends that the network needs to do, are there more efficient and/or safer ways for clients to allocate streams to circuits, or for clients to build preemptive circuits? Perhaps this research item needs to start with gathering some traces of what requests typical clients try to launch, so you have something realistic to try to optimize. Also note that if a stream request times out (or for certain similar failures), you move to a new circuit earlier than the 10 minute period. So it might be that users actively browsing will switch much more often than every 10 minutes. Somebody should study what happens in practice. The future plan is to isolate streams by domain, not by time interval: https://trac.torproject.org/projects/tor/ticket/5752 But of course there are some tricky engineering and security considerations there. And lastly, see https://trac.torproject.org/projects/tor/ticket/5830 for a standalone related analysis/research project that I wish somebody would do. :) --Roger -- tor-talk mailing list - tor-talk@lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
[tor-talk] Reasoning behind 10 minute circuit switch?
Hi all, I'm working on doing a study on user tolerance of delays (for example, latency on Tor). During our discussion, a bit of a debate occured about the TBB's circuit switching. I was wondering if there's any research that's been done to arrive at the 10 minute window for circuit switching, or if that was number picked arbitrarily? Thanks for the help. -Greg -- tor-talk mailing list - tor-talk@lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Harvard student used Tor to send bomb threats, gets caught by old-fashioned policework
Had the perp not invoked his right to remain silent, I'm pretty sure he wouldn't have been convicted. - Greg On 1/4/14, 4:42 PM, Bobby Brewster wrote: the perp confessed to guilt during interview. not sure if there's been any further action since then. My point was that presumably the authorities assumed that the perp would be using the university network to make the threats and hence checked to see who had connected to a known Tor IP entry node. Had the perp used a Starbucks network, mobile dongle, or hijacked wifi connection then no such connection would have been made. Also, am I right to think that if he had used a bridge then the IP logged would have been the bridge IP rather than the Tor entry node IP? Is this traceable? Are bridge addresses public? Thanks. On Saturday, January 4, 2014 7:41 PM, Tempest temp...@bitmessage.ch wrote: Bobby Brewster: Three points about this story. First, if the student had used a VPN then the network would only have seen his VPN IP not the entry node IP. Right? right. Second, who is to say that the 'real' perp was not using a different non-University network? the perp confessed to guilt during interview. not sure if there's been any further action since then. Third, I was under the impression that the case against Jeremy Hammond also involved correlating Tor entry node activity with Tor exit node activity on the target websites. However, having just looked at the inditement, I may be wrong as Tor is not mentioned. Perhaps I read it in a news story rather than a court file? law enforcment was monitoring when he was logged into the tor network, in addition to getting information from monsegur as to when he supposedly logged off. the totality of the evidence against hammond may never be reported since he plead guilty rather than going to trial. -- tor-talk mailing list - tor-talk@lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Appearing American
Is the anonymity offered by a modified Tor utilizing only nodes in the USA actually more anonymous than a VPN? I thought utilizing a subset of nodes was considered a bad idea? (I've seen people ask how to restict their traffic to using the top X% fastest nodes and get replies explain why this is suboptimal) -Greg On 8/18/13 5:05 PM, mick wrote: On Sun, 18 Aug 2013 10:32:13 -0700 Gordon Morehouse gor...@morehouse.me allegedly wrote: Your best bet if you *need* an American IP is to use a VPN. I'm sorry Gordon but I think this needs to be said. On a list devoted to tor, recommending a VPN is not ideal. Whilst a commercial VPN might buy you a geo specific location, at best it buys you /very/ limited anonymity and privacy. But, yes, if all you are concerned about is (say) a US IP so that you can view Hulu, it might be acceptable. It depends upon your use case. Best Mick - Mick Morgan gpg fingerprint: FC23 3338 F664 5E66 876B 72C0 0A1F E60B 5BAD D312 http://baldric.net - -- tor-talk mailing list - tor-talk@lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] So what about Pirate Browser?
Disagreeing w/ the Vidalia removal seems like the only logical reason I can think of. I admittedly haven't used it (since it's Windows only) but from their page and the NYT article I read, it sounds like it doesn't seem to do anything that the TBB doesn't already do. They says its Tor + FoxyProxy, with no mention of assistance finding bridges or other features to aid circumvention. -Greg On 8/10/13 12:15 PM, Griffin Boyce wrote: On 08/10/2013 12:49 PM, Jerzy Łogiewa wrote: Hello! It looks that The Pirate Bay will enter secure browser market, http://torrentfreak.com/pirate-bay-releases-pirate-browser-to-thwart-censorship-130810/ http://piratebrowser.com/ I do not understand why they do the same as TBB. Anyone know? -- Jerzy Łogiewa -- jerz...@interia.eu Maybe they didn't agree with the recent removal of Vidalia? In the end, it probably has more to do with marketing than trying to increase the privacy of their users. I also don't understand why they're releasing it as an exe and not a zip. Seems like an odd choice, considering the obvious exploit possibilities of an exe. ~Griffin -- tor-talk mailing list - tor-talk@lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
[tor-talk] extension works in FF, fails in TBB
Hi all, My name is Greg Norcie, I'm a PhD student at Indiana University, working on a project focusing on improving Tor usability. This is a follow up to a paper looking at usability issues with the Tor Browser Bundle. (http://petsymposium.org/2012/papers/hotpets12-1-usability.pdf). The research group I'm leading is currently working on tweaking the Tor Browser Bundle to test solutions to the issues we noted in a formal lab study. (Our previous paper simply suggested changes, but did not scientifically validate our suggestions) One issue we noted was people feeling Tor was slow. Now, this is a function of how Tor works - traffic passed through a series of nodes will always have more latency than a direct connection. So we are experimenting with a custom extension that pops up a message to TBB users when a delay is detected, to see if reframing the delay makes users tolerate the latency better. However, we have hit a snag. While in a normal, run of the mill Firefox install w/ the same extensions as the TBB, our extension functions - delays are detected and a pop up box appears. However, when we install our custom extension in the Tor Browser Bundle, it fails to work. We initially thought this might be because our extension was utilizing Javascript, but disabling NoScript doesn't fix thes issue. We're at a bit of a loss as to how to solve this issue, and are reaching out to the Tor developer community to see if anyone might be able to offer some insight as to what could be causing this failure. Our lead developer recently left the project, so we're struggling to get things on track in time for PETS) The extension in question is available at the following URL (password is cryptoparty - our uni's MegaUpload clone requires a password for all files): https://www.slashtmp.iu.edu/files/download?FILE=gnorcie%2F1700EHKJOv Any help anyone can provide would be greatly appreciated. (And of course, it goes without saying we will be making our code available to the Tor community) Thanks for reading, have a great day. Sincerely, Greg Norcie PhD Student - Security Informatics Indiana University ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] upgrading procedure for TBB
One idea would be to put links to all your bookmarks in a simple html
file, and then keep that open in a tab. I used to do this back in the
days before tabs or awesomebars.
--
Greg Norcie (g...@norcie.com)
GPG key: 0x1B873635
On 11/24/12 1:16 PM, and...@torproject.is wrote:
On Sat, Nov 24, 2012 at 12:44:59PM +0100, tag...@gmail.com wrote 1.1K bytes
in 31 lines about:
: I'm surprised to see this 'rm -rf' command in a recommendation. I
: thought you recommend to just unpack the tar file to preserve bookmarks..
We recommend you run TBB as is, not modify it. Personally, I keep my
bookmarks in a separate file and copy and paste between it and TBB if
I need something.
: Has that alternative approach ('tar xzf' without prior 'rm -rf')
: negative side effects?
I don't know. Maybe Mike or someone can answer better.
___
tor-talk mailing list
tor-talk@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] What are good crypto and security mail lists?
Stanford's Liberation Technology mailing list is pretty interesting. https://mailman.stanford.edu/mailman/listinfo/liberationtech -- Greg Norcie (g...@norcie.com) GPG key: 0x1B873635 On 11/15/12 8:54 PM, Landon Hurley wrote: Cryptography@randombit is generally good for the first. Without knowing the area of security you're interested in, I'd recommend Full Disclosure; generally things get side tracked often enough that only a cursory on topic reference is needed and the discussions can be interesting. Hth, Landon Original Message From: Jerzy Łogiewa jerz...@interia.eu Sent: Thu Nov 15 16:06:50 EST 2012 To: tor-talk@lists.torproject.org Subject: [tor-talk] What are good crypto and security mail lists? I have some off topic questions for a crypto or security list- what are some good (not tor only) list to join? ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] What's written to HD?
If you're on a Live CD, everything should stay in the RAM, unless you really jump through hoops to write to the HD. In that case (barring a cold boot attack, which is far fetched), any data you downloaded will be gone. On a normal PC anything saved or opened is stored on the HD though. Live CDs are special, everything runs in RAM. -- Greg Norcie (g...@norcie.com) GPG key: 0x1B873635 On 11/11/12 3:19 PM, Dan Hughes wrote: Hello, Does browsing with TBB installed on the HD or a USB stick and downloading files (.PDFs, SM vids etc.;)) to a USB stick (but not opening online) result in the content of what's browsed or downloaded being written to the HD at all? If TBB does leave 'content evidence' on the HD, other than Tails are there any easy ways (i.e. for the technically challenged) to run Tor (TBB) from within a liveCD or VM to prevent this? ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] misconfigured mailing list (mailman software) for torproject discloses passwords in plaintext (stores too?)
As long as the password isn't used elsewhere, it's not a huge deal - security savvy users probably just use a throwaway password. The main threat here is if you are reusing passwords. Preset passwords might be a good idea, but I think in the grand scheme of things, it's a minor issue. Is this behavior that is easily changed in Mailman? -- Greg Norcie (g...@norcie.com) GPG key: 0x1B873635 On 11/9/12 8:25 PM, and...@torproject.is wrote: On Fri, Nov 09, 2012 at 06:09:36PM -0500, mfi...@mfisch.com wrote 0.7K bytes in 16 lines about: : Upon signing up for the mailing list on the list server, my password was emailed to me in plaintext. In the year 2012 this is extremely bad security practice. At the very least the sign-up page should warn users to make the password unique. Right. This is the default mailman process. Getting mailman to improve their defaults hasn't worked so far. : The password may also be stored in reverseable format. : : I used a unique random password for this mailing list, I'm going to guess however a significant portion of the mailing list either uses this password in other locations, a significant subset of them probably can't trust their mailbox to be secure. A significant number of people join via email, not the web interface, and therefore mailman picks a password for them. What's more secure mailing list software that is in debian repos and works for non-technical users? ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Unsigned Mac OS X binary for TorBrowser
Maybe crosspost to Libtech? A lot of EFF people read there, and there's a lot of people with a legal/policy background who could give some good insights. -- Greg Norcie (g...@norcie.com) GPG key: 0x1B873635 On 11/10/12 11:30 AM, Matthew Fisch wrote: I think the idea of getting an organization such as the EFF (with credibility Apple couldn't afford to deny) to sign off on the binaries sounds like the only plausible solution -- though I understand the politics of this aren't exactly trivial. I didn't realize legal kung-fu was necessary when you don't plan to submit to the app store. This type of thing is something that should be investigated long-term however especially considering the Mountain Lion default of denying unsigned binaries, and the Tor Project's mission of increasing use of Tor by mainstream users to increase credibility of the project. All that said, there is a simple short-term fix: A warning and subtle protest of Apple's closed gatekeeper methodology should be included in the OS X download webpage. This is actually a great technology to protect users computers from privacy invasions by rogue software, it's just in Apple's blood to exert a bit more control than desktop users find comfortable. Also, uploaded some screenshots to google drive to highlight the simple but unintuitive workaround, once the application is added to the gatekeeper exception list no further warnings will be produced: https://docs.google.com/folder/d/0B1pT3gU1bGZiYWVaQTFVR05QUmc/edit ^^ three images labelled step 1, 2 and 3. Also, I think it's important not to totally discredit the gatekeeper technology. If users turn this off they significantly increase risk exposure to their machines despite any idealogical concerns. -Matt Matthew Fisch mfi...@mfisch.com ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] check.torproject.org
Working for me. -- Greg Norcie (g...@norcie.com) GPG key: 0x1B873635 On 11/9/12 12:38 PM, Joe Btfsplk wrote: On 11/9/2012 9:49 AM, The Doctor wrote: Did something go pear-shaped with check.torproject.org? I've not been able to get it to respond (through the TBB or otherwise) for the past day or so. It's down for me too. You could use another What's my IP lookup site, that gives name / location of server. ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Unsigned Mac OS X binary for TorBrowser
I guess it comes down to risk calculus: Which has a worse outcome: training users to ignore security warning from OSX, or the chilling effects an Apple NDA could have on the project. (I don't pretend to know the answer myself.) -- Greg Norcie (g...@norcie.com) GPG key: 0x1B873635 On 11/9/12 6:25 PM, Roger Dingledine wrote: On Fri, Nov 09, 2012 at 06:05:58PM -0500, Matthew Fisch wrote: TorProject should be registered as an Apple software developer, and the binary should be signed, both to increase credibility of the torproject and the safety of users. I agree with you about the 'safety of users' side. But I'm not so clear on the 'credibility' side. Last I checked, to become an official Apple developer, they required you to sign an NDA *in order to see the agreement they would then ask you to sign*. We at Tor aren't big on signing blanket broad NDAs with large corporations, so you can see why we'd be hesitating (to put it nicely). I imagine we're not the only ones. --Roger ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Mailing list question
Idea: An explicit [Profit] tag would easily allow those who wish to opt out to have their mail readers do so. -- Greg Norcie (g...@norcie.com) GPG key: 0x1B873635 On 11/4/12 7:13 AM, adrelanos wrote: and...@torproject.is: On Fri, Nov 02, 2012 at 11:23:49PM -0400, grarp...@gmail.com wrote 0.7K bytes in 17 lines about: : Would people mind seeing marked announcements : for free, non-profit or commercial [any level of] services that : could be useful to anonymous peoples? I can : think of some [any levels] clearnet services today which just : don't have Tor friendly or good quality or strong : policies or right payment ideas, etc. So would not mind : seeing them here myself. I think it's worth the experiment. If it gets out of control, we can stop it. As long they are marked in the title (or similar) and can be easily filtered, why not. I am looking forward to it. : To maybe 10%, how many subscribers are there here? As of right now, Sun Nov 4 11:44:16 UTC 2012, 1,341. ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Download speed
It can depend on your exit node (and the path leading to said exit node.) Can you visit https://check.torproject.org/ and see if it says you are using Tor? If it says you are using Tor, you probably just have a rather good connection. -- Greg Norcie (g...@norcie.com) GPG key: 0x1B873635 On Mon Oct 29 13:50:23 2012, Junior Jr wrote: When I use the Tor Browser Bundle and will download a file my speed can reach 300 or 400 kb. I think something is wrong, because that is the speed of a normal connection. It is normal to download at a rate so high? Something is wrong? OBS: Im from the latins and i use google translator. Forgive my poor english. ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Porn make the world more free: Tor Porn Bundle?
Your idea has sound logic - but doesn't the current TBB support this use case? (Without attracting negative media attention?) If you are suggesting a Flash-enabled TBB to allow these youths to view videos, that could end badly - Flash can be used to deanonymize users. If said users are so oppressed that viewing erotica could get them arrested, that's a serious problem. -- Greg Norcie (g...@norcie.com) GPG key: 0x1B873635 On 10/21/12 3:48 AM, Fabio Pietrosanti (naif) wrote: Hi, i've been at internet governance forum (in italy) yesterday and starteddiscussing a topic with several internet freedom/policy activists: porn make the world more free It seems a joke, but it maybe an important consideration. A teenager (12-18 yo) in 2012 use internet porn websites for masturbation. That's a real facts, i expect, almost everywhere. In places like Saudi, a 14th years old young have a strong need of masturbate like in any other place in the world. But he don't have access to internet porn with his broadband internet access. In the Saudi example there are already now people providing paid (and risky) access to porn for masturbation's needs: http://arabnews.com/jailed-facilitating-porn-site-access This as an example of a real need that stimulate people in finding circumvention methods. So, when a teenager in Saudi need to masturbate he have to find out a censorship circumvention tool. From a marketing perspective this is a clearly definable need . Ok, how can we think to make out of it (masturbation and porn) something good for freedom of speech? Imho we may think to create something like Tor Porn Bundle: A version of TBB specifically designed to provide easy access to Porn. Then promote it trough custom targeted campaigns across all Arab World (and language/countries where internet porn is censored). Which would be the main result in mid-term? That most teenagers (and also non teenagers, but probably in minor part) in that closed-society will learn, understand and start using censorship circumvention tool for an important, basic need: Masturbate! We should not underestimate the relevance of this need because it fit along with the Basic human needs, like eating. So the effort and perceived rewards that a person have working on the path to satisfy that need is very high. In that hypothetical Torn Porn Bundle, we may deliver a pre-populated in-language list of porn websites. But also some free in language media website and other free / non censored information sources and social networking tools. That way, after masturbation, the user will be able to have a clear and simple path to start accessing the web in a free way. As a side node i would like to remind that the porn industry is valued billion of USD. If porn industry would became partners of freedom of speech players, it could means a lot of money for investment in campaigning and technology development, because it would means opening new markets to them. Opening a new market means having new consumer that means they would be able to calculate the economic ROI of an investment. * Porn supported the development of internet backbone * Porn developed early internet multimedia streaming technologies * Porn may make the world more free -naif ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] TB download improvement
Hi, I did a Tor usability study recently, though admittedly with participants who were English speakers (though a large chunk were not US citizens and did not speak English as a first language). We termed a failure to DL the TBB as download clarity, and found it was the one of the least cited usability issues. I think the current UI is well tested and conveys information well. However, off the top of my head, two small tweaks could solve the OP's issues: 1.) Include small windows, apple, and tux logos on the download link on the main tor page... these could serve as a symbolic cue that it is a download link. 2.) Once on the download page, in the drop down list of languages that is defaulted to English include a US and UK flag. Include flags from representative countries in each language[1]. This is a common design pattern on sites being accesed by many people speaking many languages (eg: transit sites based in Europe) Personally, I wouldn't go beyond very minor tweaks to the current interface without a lab study showing that a statistically significant number of non-English speakers had trouble DLing Tor. -- Greg Norcie (g...@norcie.com) GPG key: 0x1B873635 [1] Admittedly this could get harder for say, Arabic - how do you pick one country? This would probably want to be debated as to minimize offense to nations not featured. On 10/15/12 3:20 PM, Andrew Lewman wrote: On Sun, 14 Oct 2012 21:33:01 +0200 (CEST) Outlaw out...@omail.pro wrote: Hey there, Tor devs :) IMHO present torproject.org is very difficult for average internet user. For those who don`t know english well, it is almost impossible to find proper link. Hmm, the large purple and orange 'Download tor' button on the index page was missed? We spent three months testing website designs based on real user feedback and usability testing. The green box and purple download button were designed to catch your eye first, and testing proves it works. The testing included barely English-speaking users by design. I think it is the question of resources - to provide multilingual website up to date, which Tor team just doesn`t have. So I have two suggestions that require minimal effort: We had one, and it was mostly out of date and giving incorrect advice in many languages. See https://trac.torproject.org/projects/tor/ticket/6851 for the current discussion about re-enabling website translations. 1. Easy one. Make a static link like https://torproject.org/download/torbrowser-win-latest.exe; No. This is a bad idea because then everyone thinks they have the latest tor, all the time. When people ask for support, they explain they have the latest tor, when really their version is 3 years out of date. Our answer to this is a secure updater, codenamed thandy. See https://gitweb.torproject.org/thandy.git/blob/HEAD:/specs/thandy-spec.txt for the details. We just received some funding to implement this over the next year. 2. A bit harder. Make a page for each language and OS with script that starts downloading latest release: http://torproject.org/download/win/de; for example. Advantage of this method will be that you can provide some message, like version or other important stuff. We have this already. When you click the big download button on the homepage, you are sent to https://www.torproject.org/download/download-easy.html.en. There are language drop-downs for the 13 TBB translations. People like one big red button DOWNLOAD and nothing else, Consider Tor as a sophisticated as a formula 1 race car. Just because you have a drivers license and can drive a nice sedan on the street doesn't mean you can hop into a formula 1 car and even get out of the pit lane without killing yourself. People who don't want to read the warnings, and just want to download and run, are dangerous. They will de-anonymize themselves. At best, they disclose they wanted privacy, at worst, they get arrested, tortured, and killed while their family is blacklisted for life. We are working on improving the usability of Tor to help users make smart decisions. Research takes time and thought. The same process goes for the website. Our website is free software, with the repository located at https://svn.torproject.org/svn/website/trunk/. Feel free to submit patches of your ideas to improve the usability of the site. Thanks for the feedback. ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] TB download improvement
On 10/16/12 3:29 PM, Andrew Lewman wrote: On Tue, 16 Oct 2012 14:55:02 -0400 Greg Norcie g...@norcie.com wrote: 1.) Include small windows, apple, and tux logos on the download link on the main tor page... these could serve as a symbolic cue that it is a download link. We had these in the past and people didn't recognize their own OS or what they were. Those interviewed thought they were just odd icons. However, I'm open to trying again. Maybe we have a new userbase. I'd say as long as they didn't actively confuse users, they'd be a good addition. Users who don't understand them will not be harmed, but those who do recognize them will be helped. 2.) Once on the download page, in the drop down list of languages that is defaulted to English include a US and UK flag. Include flags from representative countries in each language[1]. This is a common design pattern on sites being accesed by many people speaking many languages (eg: transit sites based in Europe) We had this in the past. The problem we ran into is people getting really angry, or thoroughly confused, at the flag not matching their language. You noted this in your footnote too. I don't have a good option for this. Suggestions, advice, and patches welcome. Making the language drop down larger can possibly help. Could you put a graphic that says language in several languages? (Whatever the top 5/10 most used are). Even if someone isn't in that set, they've probably seen similar design choices in airports etc denoting the same phrase in many languages. -- Greg Norcie (g...@norcie.com) GPG key: 0x1B873635 ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Iran's Green Movement - URGENT ALERT - Please RT
Stanford's Liberation Technology list would probably be a better home for this: https://mailman.stanford.edu/mailman/listinfo/liberationtech A lot of Tor people also read it, as well as others who would value this info. -- Greg Norcie (g...@norcie.com) GPG key: 0x1B873635 On 8/23/12 3:48 PM, SiNA Rabbani wrote: You are right. I am hoping it reaches my Tor friends all at once. --SiNA On Aug 23, 2012 12:45 PM, HardKor hardkor.i...@gmail.com wrote: Isen't this mailing list reserved to topics related with the Tor Project ? HardKor On Thu, Aug 23, 2012 at 9:39 PM, SiNA Rabbani s...@redteam.io wrote: Mir Hossein Mousavi, former presidential candidate during the 2009 elections and leader of the Green Movement under illegal house arrest for approximately 18 months, was transferred to a cardiac hospital in down town Tehran under extreme security measures accompanied by his wife Zahra Rahnavard. 526 days after his illegal house arrest, Mir Hossein Mousavi who was reportedly suffering from extreme chest pain was reportedly transferred this morning, Thursday August 23rd, 2012, under extreme security measures to the Coronary Care Unit (CCU) at a cardiac hospital in central Tehran. It has been reported that security agents arrived at the hospital the night before Mousavi?s transfer, installing security cameras throughout the hospital. According to the same reports the security apparatus assigned to Mir Hossein Mousavi and his wife Zahra Rahnavard at the hospital includes tens of IRGC agents, security agents and plain clothes officers. The hospital personnel working in the unit where Mousavi has been admitted, have not been allowed to leave the building and Mousavi is said to be banned from all visitation. It has been reported that as a result of a blocked coronary artery, Mousavi under went a three hour angiogram. Upon completion of the operation, Mousavi was transferred back to the CCU unit where he is likely to remain for a longer period of time. In the event that Mousavi?s hospitalization is prolonged, there is speculation that he will be kept in isolation in a separate unit in the hospital. Source: Kaleme: http://kaleme.org/1391/06/02/klm-110814/ ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Tor as ecommerce platform
Compressed sensing techniques? We should keep in mind the barrier for introducing scientific evidence in US courts is pretty vast. They still use MD5 hashes on forensic images, because case law specifically says MD5 is acceptable. Some crazy new correlation attack might be possible... but using it as evidence in court would be quite difficult. -- Greg Norcie (g...@norcie.com) GPG key: 0x1B873635 On 8/11/12 6:59 PM, Gregory Maxwell wrote: On Sat, Aug 11, 2012 at 1:54 PM, Mike Perry mikepe...@torproject.org wrote: But from the paper, it sounds like the BTC flow to Silk Road itself is quite large and might be measurable or at least can be approximated from the website itself... [snip] Unless I understood the paper, their measurements appear to be based on watching listings go up and down, which only provides a upper bound on the public activity. The problem is that even with mixes and batching, bitcoin provides a Global Passive Adversary for free, which can be used to map and measure total BTC flow through the network to various sinks (eigenvectors + eigenflow). Based on the established dogma that still rules the Tor threat model, BTC cannot win!!!1 for this reason. When Bitcoin is correctly used the sources and sinks are one-time-use pseudonymous locations and the standard operational practices for private— much less, I'm a target for wealthy adversaries— usage is to run bitcoin over tor. the most obvious vulnerable points are on the goods and inexplicable income ends— like in cash. With poor use the activity could be very vulnerable to correlation via compressed sensing techniques. I and the other developers have found it to be surprisingly hard to convince Bitcoin users how non-private their activity can be, even with pointing them to public tracking sites. Regardless, I still expect the high profile trouble making users to eventually succumb to fairly boring police work rather than fancy technical analysis, as usual. At least, not when you're a substantial and atypical chunk of the BTC flow versus norm. This is what I really responded to correct. In the last 4 hours the Bitcoin network processed 291,326 BTC in transactions— about 3.3million USD at the current trading prices. In _four hours_. And this doesn't include the significant amount of off-network BTC changing hands inside exchanges and bank like services, though it may well be double counting coin that effectively moved multiple times. (Which cant be measured, because it's not always the same coins moving even if its the same 'value' moving, or the opposite). As long as at least the parties are trusted to not doublespend against their counter parties (bad dealing which can be trivially proven to ensure that a cheater's reputation is destroyed) it's perfectly possible to perform unbounded amounts of party to party transactions totally invisibility to the network too, or to form join transactions which concurrently settle multiple parties in a single act, and other weirdness which makes even estimating the true activity level difficulty. Bitcoin transactions are just a few hundred bytes, and there often is no need to make them public in a hurry. I can think of little else of value which could be made more immune to timing analysis, if people cared to do so. I already think these estimates of underground black-market volumes are exaggerated, but it's impossible to know for sure. But the data simply does not suggest that this is a substantial chunk of the activity. Like Tor, Bitcoin suffers from a fair amount of people eager to play up the most controversial uses: Some do so to attack it, some because it resonates with their juvenile desire to 'stick it to the man', but most importantly: its a lot more exciting to present it by emphasizing those things, regardless of how (in-)significant they are or how much many of the users and developers wish they'd go away. Whatever the reasons, skepticism is healthy all around. Like I said, it will be very interesting to watch. It's almost like some aliens came down from space and double-dog-dared the ballsiest, craziest, most aggro humans on the planet to try to solve timing correlation attacks and then called them all pussies, threw the bitcoin source code at their feet, and then flew off. You know, because they needed that shit to interact with our violent monkey society at a safe enough distance and everybody else on this planet had given up. The bad Sci Fi just writes itself. ;) If you had any doubts before: Welcome to the future. ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Tor as ecommerce platform
I think (but could be wrong) that you can look at a bitcoin's history and see who's given to whom and use that data to trace who the person is, if they weren't careful. (Eg: if they bought from a bitcoin exchange in the US which could have it's logs subpoenaed) Anyways, those drugs have to get delivered somehow. I could see them tracing it that way - old fashioned detective work. Also there's the comedy option that Silk Road is a giant sting operation. The FBI has infiltrated other illicit markets (mostly carding forums). I saw a talk by the FBI agent who was profiled in Poulsen's book. He's not the most technical guy in the world, but he's _damn_ good at undercover work. As in, he convinced a carder forum to change their hosting to an FBI controlled server, where they then siphoned up IPs and then went to Eastern Europe and worked with the local authorities to have the main carders prosecuted. -- Greg Norcie (g...@norcie.com) GPG key: 0x1B873635 ... a related question is How much 'Illegal/Questionable' traffic through exits actually *is* law enfocement? It's not all of it, of course. Might not even be most of it. Unless they have automated crawlers... Still, it is a little surprising they can't trace bitcoin yet, though. Maybe they can. I think my bet is also on Silk Road not surviving in the long run for that reason... It's very interesting to watch, for sure. It's like we're getting an extra season of The Wire, except in a much weirder world that couldn't possibly exist except in some Sci Fi novel. ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
Re: [tor-talk] Advices for a Newbie
The thing about security is you need to understand, well, everything. Networks, programming, psychology... you name it. I think Eric S Raymond's essay on How To Be A Hacker is pretty useful: http://www.catb.org/~esr/faqs/hacker-howto.html Start making small projects for yourself. Install linux. Set up a web server. Do some LAMP programming and set up a dynamic site. In the course of learning basic systems admin skills, you'll pick up a lot of security knowledge. -- Greg Norcie (g...@norcie.com) GPG key: 0x1B873635 On 7/29/12 7:22 PM, Pedro wrote: Hi everyone. My name is Pedro, I'm 21 and i live in Brazil. I've been on TOR for a while and now i'm interested in studying the network. Do you guys know some articles to learn more about Internet security, privacy and technical details about the subject. I'm a newbie on the topic, so it would be nice to start from the basics of networks and such. What do you guys recommend ? ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
