[tor-talk] Tor 0.2.3.3-alpha is out

2011-09-03 Thread Roger Dingledine
Tor 0.2.3.3-alpha adds a new "stream isolation" feature to improve Tor's security, and provides client-side support for the microdescriptor and optimistic data features introduced earlier in the 0.2.3.x series. It also includes numerous critical bugfixes in the (optional) bufferevent-based networki

Re: [tor-talk] Dutch CA issues fake *.torproject.org cert (among many others)

2011-09-03 Thread andrew
On Sat, Sep 03, 2011 at 02:36:54PM -0400, ler...@gmail.com wrote 2.2K bytes in 43 lines about: : Is there a solution for this specific case? Someone claiming to be : Roger Dingledine included a PGP signature block in the msg that : started this thread. Nobody's responded "Hey! That wasn't me!!"

Re: [tor-talk] Dutch CA issues fake *.torproject.org cert (among many others)

2011-09-03 Thread andrew
On Sat, Sep 03, 2011 at 04:51:49PM -0400, ler...@gmail.com wrote 4.3K bytes in 111 lines about: : My understanding is that the issue is common to all 'secured' web : sites. HTTP is trivially subverted; HTTPS needs a valid cert or the : user clicking past a "No, I don't care about my security; go

Re: [tor-talk] Dutch CA issues fake *.torproject.org cert (among many others)

2011-09-03 Thread andrew
On Sat, Sep 03, 2011 at 02:27:47PM -0500, joebtfs...@gmx.com wrote 4.2K bytes in 84 lines about: : is about as technical as it gets. My 1st impression w/ the process : (& instructions on Tor page - verifying signatures) is, it will be : over the avg users' heads, or more trouble / effort than the

Re: [tor-talk] Dutch CA issues fake *.torproject.org cert (among many others)

2011-09-03 Thread Julian Yon
On 03/09/11 19:36, Lee wrote: > Is there a solution for this specific case? Someone claiming to be > Roger Dingledine included a PGP signature block in the msg that > started this thread. Nobody's responded "Hey! That wasn't me!!" or > "That's not my PGP sig!" so it seems safe enough to trust tha

Re: [tor-talk] Dutch CA issues fake *.torproject.org cert (among many others)

2011-09-03 Thread Lee
On 9/3/11, Joe Btfsplk wrote: [.. snip stuff addressed to others ..] > Lee: >> These are all rhetorical questions - right? > No. I understand Tor Project's main concern is Tor / TBB. I fail to > understand why the issue / problem being discussed is in any way limited > to Tor or a few software

Re: [tor-talk] Dutch CA issues fake *.torproject.org cert (among many others)

2011-09-03 Thread Joe Btfsplk
On 9/3/2011 11:00 AM, Netizio wrote: I'm just asking here - other than entities (gov'ts?) targeting anonymity software (for now) what prevents this issue from becoming widespread? If I download an update from MS - how do I know it's the authentic pkg from the real MS? There's no authentication (

Re: [tor-talk] Dutch CA issues fake *.torproject.org cert (among many others)

2011-09-03 Thread Lee
On 9/3/11, Joe Btfsplk wrote: > On 9/2/2011 4:46 PM, and...@torproject.org wrote: >> On Fri, Sep 02, 2011 at 01:31:53PM -0400, col...@averysmallbird.com wrote >> 4.5K bytes in 109 lines about: >> : According to a number of bloggers(1), torproject.org was include among >> those >> >> Here's another

Re: [tor-talk] Dutch CA issues fake *.torproject.org cert (among many others)

2011-09-03 Thread Julian Yon
On 03/09/11 15:59, Jim wrote: > I don't have a solution to this problem but I am raising it in case > somebody else does. It's great that you not only sign your packages but > that the page above also lists the fingerprints of the signing keys. > But in case of a man-in-the-middle attack (or a com

Re: [tor-talk] Dutch CA issues fake *.torproject.org cert (among many others)

2011-09-03 Thread Lee
On 9/3/11, Julian Yon wrote: > On 03/09/11 15:59, Jim wrote: >> I don't have a solution to this problem but I am raising it in case >> somebody else does. It's great that you not only sign your packages but >> that the page above also lists the fingerprints of the signing keys. >> But in case of

Re: [tor-talk] Dutch CA issues fake *.torproject.org cert (among many others)

2011-09-03 Thread Netizio
> I'm just asking here - other than entities (gov'ts?) targeting anonymity > software (for now) what prevents this issue from becoming widespread? > If I download an update from MS - how do I know it's the authentic pkg > from the real MS? There's no authentication (or even check sums) for > d/l

Re: [tor-talk] Dutch CA issues fake *.torproject.org cert (among many others)

2011-09-03 Thread Jim
Roger Dingledine wrote: Perhaps now is a great time for you to learn how to verify the signatures on Tor packages you download: https://www.torproject.org/docs/verifying-signatures I don't have a solution to this problem but I am raising it in case somebody else does. It's great that you not o

Re: [tor-talk] Dutch CA issues fake *.torproject.org cert (among many others)

2011-09-03 Thread Jim
Joe Btfsplk wrote: I'm just asking here - other than entities (gov'ts?) targeting anonymity software (for now) what prevents this issue from becoming widespread? If I download an update from MS - how do I know it's the authentic pkg from the real MS? There's no authentication (or even check s

[tor-talk] Verifying software signatures (Was: Dutch CA issues fake *.torproject.org cert (among many others))

2011-09-03 Thread Jeroen Massar
On 2011-09-03 15:39 , Joe Btfsplk wrote: > On 9/2/2011 4:46 PM, and...@torproject.org wrote: >> On Fri, Sep 02, 2011 at 01:31:53PM -0400, col...@averysmallbird.com >> wrote 4.5K bytes in 109 lines about: >> : According to a number of bloggers(1), torproject.org was include >> among those >> >> Here

Re: [tor-talk] Dutch CA issues fake *.torproject.org cert (among many others)

2011-09-03 Thread Joe Btfsplk
On 9/2/2011 4:46 PM, and...@torproject.org wrote: On Fri, Sep 02, 2011 at 01:31:53PM -0400, col...@averysmallbird.com wrote 4.5K bytes in 109 lines about: : According to a number of bloggers(1), torproject.org was include among those Here's another blogger for your list, https://blog.torproject

Re: [tor-talk] Tor Exit Node Operator Raided in USA.

2011-09-03 Thread Fabian Keil
Martin Fick wrote: > --- On Wed, 8/31/11, Fabian Keil wrote: > > Martin Fick > > wrote: > > > > > --- On Mon, 8/29/11, Matthew > > wrote: > > > > https://www.eff.org/deeplinks/2011/08/why-ip-addresses-alone-dont-identify-criminals > > > > > > > >      > > > > If you run an exit relay, conside

Re: [tor-talk] massive automated bridge requests: why?

2011-09-03 Thread Paolo Palmieri
> Over the past few months the number of bridge users has spiked, most > prominently in Italy, but also plenty in Spain, Brazil, Israel, and > others. > > It seems clear that somebody's unofficial Tor bundle automatically grabs > some bridges for its users, and that this somebody didn't understand

[tor-talk] massive automated bridge requests: why?

2011-09-03 Thread Roger Dingledine
Hi folks, Over the past few months the number of bridge users has spiked, most prominently in Italy, but also plenty in Spain, Brazil, Israel, and others. https://metrics.torproject.org/users.html#bridge-users https://metrics.torproject.org/users.html?graph=bridge-users&start=2011-06-05&end=2011-

[tor-talk] TorBridge + ttdnsd = Problem

2011-09-03 Thread Gitano
When I start ttdnsd with my Tor client in bridge mode, ttdnsd terminates within a few minutes. The last output before terminating is: ### selecting peer peer selected: -1 connecting to 94.75.228.29 on port 53 watching 2 file descriptors 1 file descriptors became ready received request of 34 bytes,