Re: [tor-dev] Projects to combat/defeat data correlation

2014-01-16 Thread David Stainton
Yeah I guess if the PT doesn't draw attention and the bridge IP is not known then one's Tor traffic may be somewhat obscured. What about bananaphone? Do you mean the bananaphone PT? It is trivially detectable... more so than say... a transport like obfs3 who's output looks like pseudo random noise

Re: [tor-dev] Review of Proposal 147: Eliminate the need for v2 directories in generating v3 directories

2014-01-16 Thread Nick Mathewson
On Wed, Jan 15, 2014 at 7:08 AM, Karsten Loesing wrote: [...] > I talked to Roger on IRC, and here's why this proposal may indeed be > overkill: > > As of January 2013, there is only a single version 3 directory authority > left that serves version 2 statuses: dizum. moria1 and tor26 have been >

Re: [tor-dev] Review of Proposal 147: Eliminate the need for v2 directories in generating v3 directories

2014-01-16 Thread Nick Mathewson
On Wed, Jan 15, 2014 at 9:15 PM, Roger Dingledine wrote: > On Wed, Jan 15, 2014 at 01:08:03PM +0100, Karsten Loesing wrote: >> I talked to Roger on IRC, and here's why this proposal may indeed be >> overkill: >> >> As of January 2013, there is only a single version 3 directory authority >> left th

Re: [tor-dev] Projects to combat/defeat data correlation

2014-01-16 Thread Griffin Boyce
Ximin Luo wrote: In my understanding, the anonymity set doesn't apply to use of PTs since this is only at the entry side. The exit side does not know[1] what PT the originator is using, so is unable to use that information to de-anonymise. [1] at least, in theory should not know, perhaps some

Re: [tor-dev] Dusting off dir-spec.txt

2014-01-16 Thread Nick Mathewson
On Tue, Jan 14, 2014 at 1:56 PM, Karsten Loesing wrote: [...] > (Let me know if you prefer this review to happen in a ticket rather than > here.) > Thanks, Karsten! I think it should ideally be a ticket? -- Nick ___ tor-dev mailing list tor-dev@list

Re: [tor-dev] Projects to combat/defeat data correlation

2014-01-16 Thread Kevin P Dyer
On Wed, Jan 15, 2014 at 7:16 PM, Jim Rucker wrote: > [snip] > > From my understanding (please correct me if I'm wrong) Tor has a weakness in > that if someone can monitor data going into the relays and going out of the > exit nodes then they can defeat the anonymity of tor by correlating the size

Re: [tor-dev] Projects to combat/defeat data correlation

2014-01-16 Thread Ximin Luo
> I imagine the anonymity set would be much smaller for these combined > transports... fewer people using them. In my understanding, the anonymity set doesn't apply to use of PTs since this is only at the entry side. The exit side does not know[1] what PT the originator is using, so is unable to

Re: [tor-dev] Projects to combat/defeat data correlation

2014-01-16 Thread David Stainton
In that case would it then look like zero in $(organizational unit of harvard) using tor and one in $(organizational unit of harvard) using scramble suit? I like the idea of the tor pluggable transport combiner... wherein we could wrap a pseudo-random appearing obfuscation protocol (such as obfs3,

Re: [tor-dev] Proposal 225: Strawman proposal: commit-and-reveal shared rng

2014-01-16 Thread Kang
I don't think that a solution which uses DKG is overkill, I think it would be more secure. The more all-or-nothing security provided by DKG based schemes seems preferable to the sliding-scale-of-influence provided by coin flipping ones. Then again I don't know that much about coin flipping protocol

Re: [tor-dev] Projects to combat/defeat data correlation

2014-01-16 Thread Malard Joel
Sounds like a challenging problem, good luck. In the case of the Harvard exam, the administration may have used some meta data that may not be under your control, listing out all student taking an exam that day, asking teachers for a shortlist of their class jerks and clowns, checking for rep

Re: [tor-dev] Projects to combat/defeat data correlation

2014-01-16 Thread Matthew Finkel
On Wed, Jan 15, 2014 at 09:16:20PM -0600, Jim Rucker wrote: > Are there any projects in Tor being worked in to combat data correlation? > For instance, relays the send/recv constant data rates continuously - > capping data rates and padding partial or non-packets with random data to > maintain the

[tor-dev] Using MaxMind's GeoIP2 databases in tor, BridgeDB, metrics-*, Onionoo, etc.

2014-01-16 Thread Karsten Loesing
Hi devs, you probably know that we use MaxMind's GeoIP database in various of our products (list may not be exhaustive): - tor: We ship little-t-tor with a geoip and a geoip6 file for clients to support excluding relays by country code and for relays to generate by-country statistics. - BridgeD

Re: [tor-dev] Anyone wanting to write some Weather-tight code?

2014-01-16 Thread Abhiram Chintangal
Hello Norbert and Karsten, I have added a couple of attachments to the projects wiki-page. The first one, is a UML diagram of the data-models being used in the current weather. It should gives us a good idea about the current implementation. The second attachment is the Design Document from the c

Re: [tor-dev] Projects to combat/defeat data correlation

2014-01-16 Thread Andreas Krey
On Wed, 15 Jan 2014 21:16:20 +, Jim Rucker wrote: > There was a story in the news recently of a Harvard student who used Tor to > send a bomb threat to Harvard in order to cancel classes so he wouldn't > have to take a test. He was apprehended within a day, which puts into > question the anonym