[tor-talk] Hidden service security w. Apache/Win32

2012-02-19 Thread Fred Toben
Hello Everybody I am in the process of setting up a hidden service with Apache 2.2 under Windows. I run Apache (Win32) in a virtual machine and Tor in a separate virtual machine under VMware Workstation. VM 1 runs Apache and VM 2 runs Tor. VM 1 is connected to VM 2 through an internal host only

[tor-talk] Improving Usability of Tor Browser? A new TBB-simple?

2012-02-19 Thread Fabio Pietrosanti (naif)
Hi all, Here some consideration to create a new simplified TBB version. Something to provide the extreme simplicity a user may expect that may work having two TBB. Let's say that the basic need of this TBB-simple is just to "visit web pages anonymous, no frills". So something that works that wa

Re: [tor-talk] Hidden service security w. Apache/Win32

2012-02-19 Thread Karl Hakmller
On Sun, 19 Feb 2012 12:50:47 - "Fred Toben" wrote: > Hello Everybody > > I am in the process of setting up a hidden service with Apache 2.2 > under Windows. > > I run Apache (Win32) in a virtual machine and Tor in a separate > virtual machine under VMware Workstation. > > VM 1 runs Apache

[tor-talk] Hidden service security w. Apache/Win32

2012-02-19 Thread proper
> So far I haven't found any public info about the possible downsides of running a hidden service under Windows. Let's assume a fresh, clean windows installation. Have you found a list and description of all outgoing network connections, that will be made by that windows installation? I haven't fo

Re: [tor-talk] Improving Usability of Tor Browser? A new TBB-simple?

2012-02-19 Thread proper
> Hi all, > > Here some consideration to create a new simplified TBB version. For reference, there have been some thoughts already. https://blog.torproject.org/blog/firefox-private-browsing-mode-torbutton-and-fingerprinting https://wiki.mozilla.org/Security/Anonymous_Browsing > Something to provi

Re: [tor-talk] Hidden service security w. Apache/Win32

2012-02-19 Thread Gozu-san
It would be very dangerous to use Windows in any way for running hidden services! Run Linux and VirtualBox on your host machine. Ubuntu is probably best if you're new to Linux. Have your host machine access the Internet through a reputable multi-hop VPN service, and firewall it to prevent leaks.

Re: [tor-talk] Hidden service security w. Apache/Win32

2012-02-19 Thread Fred Toben
pro...@tormail.net wrote: >> So far I haven't found any public info about the possible downsides of > running a hidden service under Windows. > > Let's assume a fresh, clean windows installation. Have you found a list > and description of all outgoing network connections, that will be made by > t

[tor-talk] Tor directory servers

2012-02-19 Thread Bravo 76
Is there a list available on the Tor directory servers that my script could parse and get the latest exit routers along with their fingerprints? I've found this:http://dannenberg.ccc.de/tor/server/all.zBut it doesn't mention whether each one is an exit router And this:http://dannenberg.ccc.de

Re: [tor-talk] Hidden service security w. Apache/Win32

2012-02-19 Thread Ondrej Mikle
On 02/19/2012 05:05 PM, pro...@tormail.net wrote: > > [1] https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxyLeaks > [2] https://trac.torproject.org/projects/tor/wiki/doc/TorBOX > [3] > https://trac.torproject.org/projects/tor/wiki/doc/TorBOX#hostinghiddenservicesOPTIONAL Great how

Re: [tor-talk] Tor directory servers

2012-02-19 Thread Roger Dingledine
On Sun, Feb 19, 2012 at 07:06:35PM +, Bravo 76 wrote: > Is there a list available on the Tor directory servers that my script could > parse and get the latest exit routers along with their fingerprints? > > I've found this:http://dannenberg.ccc.de/tor/server/all.zBut it doesn't > mention whe

[tor-talk] Hidden service security w. Apache/Win32

2012-02-19 Thread proper
> Is the time sync spoofing even applicable to hidden services? > How can the MS time server tampering with the exit nodes be applicable to hidden services? It has nothing to do directly with Apache or the hidden service. For correct operation Tor needs the correct time and date. Windows will req

[tor-talk] How accurate does need the clock to be?

2012-02-19 Thread proper
Let's assume the time server is not trusted. How accurate does the clock have to be? Is +/- 30 minutes sufficient for Tor's correct operation? Do you see any risks if the user manually adjusts the clock on each restart? ___ tor-talk mailing list tor-tal

Re: [tor-talk] Tor directory servers

2012-02-19 Thread Bravo 76
> The correct way to do it is to fetch the descriptors and look at > their exit policy. Whether a given relay is an exit router is not a > boolean thing: > https://www.torproject.org/docs/faq.html.en#ExitPolicies > > Run your own Tor client (using Tor 0.2.2.x), and look in your datadir for > the

Re: [tor-talk] Tor directory servers

2012-02-19 Thread grarpamp
> The script would fetch the the latest tor exit node fingerprints and loop > through each one connecting to www.example.com.FINGERPRINT.exit via SOCKS5.A > failed connection means the fingerprint is discarded whereas successful ones > means it is added to a database of usable tor exit nodes. >

Re: [tor-talk] Tor directory servers

2012-02-19 Thread Karl Hakmiller
On Sun, 19 Feb 2012 19:06:35 + Bravo 76 wrote: > > > Is there a list available on the Tor directory servers that my script > could parse and get the latest exit routers along with their > fingerprints? > > I've found this:http://dannenberg.ccc.de/tor/server/all.zBut it > doesn't mention wh

Re: [tor-talk] How accurate does need the clock to be?

2012-02-19 Thread Larry
On 02/19/2012 02:17 PM, pro...@tormail.net wrote: > Let's assume the time server is not trusted. > > How accurate does the clock have to be? Is +/- 30 minutes sufficient for > Tor's correct operation? Do you see any risks if the user manually adjusts > the clock on each restart? > Why would you be

Re: [tor-talk] Tor directory servers

2012-02-19 Thread Justin Aplin
On 2/19/2012 10:23 PM, Karl Hakmiller wrote: On Sun, 19 Feb 2012 19:06:35 + Bravo 76 wrote: Is there a list available on the Tor directory servers that my script could parse and get the latest exit routers along with their fingerprints? I would hope such a list does not exist. The prospe