Re: [tor-talk] Pluggable Transports and DPI

2016-05-11 Thread Roger Dingledine
On Wed, May 11, 2016 at 07:40:17PM -0700, David Fifield wrote: > Justin helped me by running some tests and we think we know how this > Cyberoam device is blocking meek connections. It blocks TLS connections > that have the Firefox 38's TLS signature and that have an SNI field that > is one of our

Re: [tor-talk] Pluggable Transports and DPI

2016-05-11 Thread Blake Hadley
On 5/11/16 10:40 PM, David Fifield wrote: > Another solution is to change the front domain to something else, for > exmaple using google.com instead of www.google.com. Would it be feasible for a future release of meek to do this automatically? Just cycle through subdomains till one works? Google

Re: [tor-talk] Pluggable Transports and DPI

2016-05-11 Thread David Fifield
On Sun, May 08, 2016 at 01:37:47PM -0700, David Fifield wrote: > With the meek blocking, it might be that they are doing some kind of > timing analysis, or it might be that we screwed up something simple like > the TLS signature. Could you try it in these configurations? > Tor Browser 5.5.5

Re: [tor-talk] Security Analysis of Instant Messenger TorChat

2016-05-11 Thread Blake Hadley
On 5/11/16 10:26 AM, Arnis wrote: > I don't mind, but please note that TorChat is not developed by Tor dev > team. Forgive me, I had confused TorChat with Tor Messenger. -- tor-talk mailing list - tor-talk@lists.torproject.org To unsubscribe or change other settings go to https://lists.torprojec

Re: [tor-talk] Security Analysis of Instant Messenger TorChat

2016-05-11 Thread Arnis
On 05/11/2016 05:23 PM, Blake Hadley wrote: On 5/11/16 10:14 AM, Arnis wrote: On 05/11/2016 05:09 PM, moosehad...@gmail.com wrote: On May 11, 2016, at 10:00 AM, Arnis wrote: The work shows that although the design of TorChat is sound, its implementation has several flaws, which make TorChat

Re: [tor-talk] Security Analysis of Instant Messenger TorChat

2016-05-11 Thread Blake Hadley
On 5/11/16 10:14 AM, Arnis wrote: > On 05/11/2016 05:09 PM, moosehad...@gmail.com wrote: >>> On May 11, 2016, at 10:00 AM, Arnis wrote: >>> >>> The work shows that although the design of TorChat is sound, its >>> implementation has several flaws, which make TorChat users >>> vulnerable to imperso

Re: [tor-talk] Security Analysis of Instant Messenger TorChat

2016-05-11 Thread moosehadley
> On May 11, 2016, at 10:00 AM, Arnis wrote: > > The work shows that although the design of TorChat is sound, its > implementation has several flaws, which make TorChat users vulnerable to > impersonation The impersonation vulnerability mentioned here is inherent; it requires compromising th

Re: [tor-talk] Security Analysis of Instant Messenger TorChat

2016-05-11 Thread Arnis
On 05/11/2016 05:09 PM, moosehad...@gmail.com wrote: On May 11, 2016, at 10:00 AM, Arnis wrote: The work shows that although the design of TorChat is sound, its implementation has several flaws, which make TorChat users vulnerable to impersonation The impersonation vulnerability mentioned her

[tor-talk] Security Analysis of Instant Messenger TorChat

2016-05-11 Thread Arnis
FYI: http://kodu.ut.ee/~arnis/torchat_thesis.pdf Abstract TorChat is a peer-to-peer instant messenger built on top of the Tor network that not only provides authentication and end-to-end encryption, but also allows the communication parties to stay anonymous. In addition, it prevents third par