Re: [tor-talk] Tor-fi: risks of mobile hotspot feature in Orbot 1.0.6

2011-11-03 Thread Roger Dingledine
On Thu, Nov 03, 2011 at 03:49:28PM -0400, Nathan Freitas wrote: > While is definitely a feature that has a cool factor to it and will get > some attention, I want to make sure we have thought through the > risks/downsides of utilizing this feature, so that we can communicate > them in any blogs, we

Re: [tor-talk] tor net questions

2011-11-15 Thread Roger Dingledine
On Tue, Nov 15, 2011 at 07:16:19PM +0100, audd wrote: > if TOr is p2p network, why all connection I see on the network-map comes > from in the middle of U.s.A? > the nodes I see are really geolocalised in that areas? Vidalia has one location for each country. So that's one dot for every relay in t

Re: [tor-talk] Run Tor as a bridge in the Amazon Cloud

2011-11-15 Thread Roger Dingledine
On Tue, Nov 15, 2011 at 05:29:12PM +, Runa A. Sandvik wrote: > >> A bridge should not specify the ?MyFamily? option. You won't run a > >> middle relay or an exit relay in the cloud, so this shouldn't be an > >> issue. > > > > As far as I understand, this is correct if you only run bridges (beca

Re: [tor-talk] Aurora tab loading status

2011-11-15 Thread Roger Dingledine
On Tue, Nov 15, 2011 at 05:01:48PM -0600, Joe Btfsplk wrote: > On one hand, I don't want to load up Aurora w/ all kinds of addons that > may interfere w/ Aurora's primary function. On the other, unless just > going to one or 2 sites & staying there, using stock Aurora is > irritating at best

Re: [tor-talk] tor net questions

2011-11-15 Thread Roger Dingledine
On Tue, Nov 15, 2011 at 08:15:25PM +0100, audd wrote: > but if it's so why GFW chinese censorship can track and deny access to > tor bridge? https://blog.torproject.org/blog/research-problems-ten-ways-discover-tor-bridges China is known to be doing #1, and recently suspected to be doing something

Re: [tor-talk] Vidalia for Iphone 3g

2011-11-17 Thread Roger Dingledine
On Thu, Nov 17, 2011 at 02:44:36PM -0500, Andrew Lewman wrote: > On Thursday, November 17, 2011 13:20:43 M wrote: > > Can anyone guide me to an eays tutorial for installing vidalia or any other > > TOR related application on my iphone 3g? > > There's Marco's packages, http://sid77.slackware.it/iph

[tor-talk] Tor 0.2.3.8-alpha is out

2011-11-24 Thread Roger Dingledine
Tor 0.2.3.8-alpha fixes some crash and assert bugs, including a socketpair-related bug that has been bothering Windows users. It adds support to serve microdescriptors to controllers, so Vidalia's network map can resume listing relays (once Vidalia implements its side), and adds better support for

Re: [tor-talk] How important is it that the MyFamily option be set correctly?

2011-12-05 Thread Roger Dingledine
On Sun, Dec 04, 2011 at 09:53:01PM -0600, Pascal wrote: > While looking through http://torstatus.blutmagie.de I noticed a couple > relays that appear to be related but were not listed in each others' > family. Out of curiosity I whipped up a quick Perl script to check all > relays with ident

Re: [tor-talk] Increase tor HS reachability

2011-12-05 Thread Roger Dingledine
On Mon, Dec 05, 2011 at 09:31:27PM +0100, Fabio Pietrosanti (naif) wrote: > sometimes it happen that some Tor HS it's difficult to be reached. > > I experienced a situation where from one Tor Client i've been able to > reach a Tor HS, while from another Tor Client i was not able to connect. > > T

Re: [tor-talk] Tor HS load balancing

2011-12-05 Thread Roger Dingledine
On Mon, Dec 05, 2011 at 09:07:25PM +0100, Fabio Pietrosanti (naif) wrote: > it would be possible to have a Tor HS running on two or more servers? > > I am wondering how does the network will behave in a situation like that > > a) Only one server will works > b) It will provide a sort of "load bal

[tor-talk] Tor 0.2.3.9-alpha is out

2011-12-08 Thread Roger Dingledine
Tor 0.2.3.9-alpha introduces initial IPv6 support for bridges, adds a "DisableNetwork" security feature that bundles can use to avoid touching the network until bridges are configured, moves forward on the pluggable transport design, fixes a flaw in the hidden service design that unnecessarily prev

Re: [tor-talk] New to List

2011-12-11 Thread Roger Dingledine
On Sun, Dec 11, 2011 at 12:15:18PM -0800, Erich Kroener wrote: > Here is my set-up and what I have done: Running v.0.2.2.34, Linux/Ubuntu > environ, Firefox of course with network.proxy.sock 'true' - all traffic > goes through SOCKS5. Connecting to network no problem. You should be using Torbutton

[tor-talk] Tor 0.2.3.10-alpha is out (security fix)

2011-12-16 Thread Roger Dingledine
Tor 0.2.3.10-alpha fixes a critical heap-overflow security issue in Tor's buffers code. Absolutely everybody should upgrade. The bug relied on an incorrect calculation when making data continuous in one of our IO buffers, if the first chunk of the buffer was misaligned by just the wrong amount. Th

Re: [tor-talk] Announcing the Tor Farsi blog

2011-12-20 Thread Roger Dingledine
On Tue, Dec 20, 2011 at 09:12:25PM +, Runa A. Sandvik wrote: > [1]: https://fa-blog.torproject.org/ Neat. I'm happy to see this moving forward! It looks like it pulls an image from a third-party site though: "https://fa-blog.torproject.org/";>https://s3.amazonaws.com/fa-blog.torproject.org/to

Re: [tor-talk] janusvm still safe?

2011-12-21 Thread Roger Dingledine
On Wed, Dec 21, 2011 at 04:43:54AM -0500, h...@safe-mail.net wrote: > http://janusvm.com/ last release from Jan-2010, almost got Jan-2012, new tor > version just been released... > > Is janusvm still safe? No, not safe. Probably has been unsafe to use for years. --Roger __

Re: [tor-talk] Tor Browser standalone without videla/tor bundle

2011-12-21 Thread Roger Dingledine
On Wed, Dec 21, 2011 at 12:21:58PM +0100, Sebastian G. wrote: > > Unfortunally it seams not possible if one is either using the > > Tor/Videla/Polipo bundle, as Tor/Videla will be already started then. > > > > Rather it's also not possible if one is using Tor as a transparent proxy > > or Vpn (Ja

Re: [tor-talk] Exit enclaves

2011-12-21 Thread Roger Dingledine
On Tue, Dec 20, 2011 at 03:04:10PM +0100, tor wrote: > Q1: Can the relay on the same node as the enclaved server also act as > a "normal" TOR exit node? Yes. > Q2: How is it ensured that requests to an enclaved server are always > routed through the TOR relay on the same machine? > >

Re: [tor-talk] Tor - 1-click-compile-version

2011-12-23 Thread Roger Dingledine
On Fri, Dec 23, 2011 at 07:18:58PM -0500, Chris wrote: > > Tor uses a set of currently 8 directory > > authorities (I operate one of them, gabelmoo), and uses them to > > bootstrap. Blocking them all is easy, and prevents bootstrapping for Tor > > clients that aren't using bridges, but if a bridge

Re: [tor-talk] How to uninstall?

2012-01-08 Thread Roger Dingledine
On Sun, Jan 08, 2012 at 11:20:48AM +, Len Hill wrote: > Since installing Tor, I've been having problems with my browsers > (Safari/Firefox/Chrome) in that I can't log in to any site that requires a > log-in signature/password. Other sites are OK. I don't know if it is Tor > that has caused th

Re: [tor-talk] A question about Tor & Hidden Services

2012-01-08 Thread Roger Dingledine
On Sat, Jan 07, 2012 at 01:45:10PM -0800, Kevin H. E. wrote: > I am wondering if it is possible to pass the hostname & private key on a > hidden service directly to the control socket, without writing it to the > hard drive (and without passing it to the process as a startup argument). Not current

Re: [tor-talk] Tor plus VPN (was re: Hi all!)

2012-01-21 Thread Roger Dingledine
On Sun, Jan 22, 2012 at 06:06:47AM +0100, Martin Hubbard wrote: > On 01/21/12 at 03:44 PM, Christopher J. Walters wrote: > > > 2. What is the best way to use a VPN with Tor to increase anonymity? > > You're not going to get better anonymity by using VPNs with >Tor. Anonymity is what Tor does ve

Re: [tor-talk] IDEA: Compress traffic at exit

2012-01-22 Thread Roger Dingledine
On Sat, Jan 21, 2012 at 02:39:53PM -, pro...@tormail.net wrote: > >This is about compressing traffic at the exit, where it's passed from > >outside the network through other relays to the client where it > >gets decompressed. > > > >The compression should happen on the fly. Yep

Re: [tor-talk] Could BACKLIT be implemented by Tor

2012-01-22 Thread Roger Dingledine
On Fri, Jan 20, 2012 at 08:48:38PM +0100, Sebastian G. wrote: > Could BACKLIT be implemented by Tor to protect it's users from traffic > analysis by traffic watermarking? > http://freehaven.net/anonbib/papers/backlit-acsac11.pdf It could be implemented by Tor. There's a lot of research remaining

Re: [tor-talk] IDEA: Compress traffic at exit

2012-01-22 Thread Roger Dingledine
On Fri, Jan 20, 2012 at 03:29:13PM -0500, Andrew Lewman wrote: > >The network has a high bandwidth usage due to it massive user-base. > >This idea should reduce the outgoing traffic of the exit and take > >much load from the mid-relay and the entry point. > > Lack of bandwidth isn't so

Re: [tor-talk] tor-bundle , ssh , torsock howto ?

2012-01-22 Thread Roger Dingledine
On Fri, Jan 20, 2012 at 11:20:56PM +0530, J. Bakshi wrote: > > tortunnel+ssh+proxychains. > > > torproxy is new to me. Where can I get this ? You don't want to use tortunnel or torproxy. Tortunnel is an independent implementation of a Tor client, which aims to provide better performance by screwi

Re: [tor-talk] Tor plus VPN (was re: Hi all!)

2012-01-22 Thread Roger Dingledine
On Sun, Jan 22, 2012 at 10:57:38AM -, pro...@tormail.net wrote: > With your permission, parts of this could be used in the torproject.org > wiki. Mailing list discussion would be linked. I am going to create a new > article related to Tor plus VPN. > > Can you agree with that? Sure, please do

[tor-talk] Tor 0.2.3.11-alpha is out

2012-01-23 Thread Roger Dingledine
Tor 0.2.3.11-alpha marks feature-freeze for the 0.2.3 tree. It deploys the last step of the plan to limit maximum circuit length, includes a wide variety of hidden service performance and correctness fixes, works around an OpenSSL security flaw if your distro is too stubborn to upgrade, and fixes a

Re: [tor-talk] Fwd: ANONdroid

2012-01-26 Thread Roger Dingledine
On Thu, Jan 26, 2012 at 10:35:20AM +0200, Maxim Kammerer wrote: > I see, so is that an optional feature that can be turned on by a MIX > router operator once served by a surveillance order? It seems to me > that it's an advantage over Tor, where relay operators can be served > with an order and som

Re: [tor-talk] tor-blocking sites

2012-02-06 Thread Roger Dingledine
On Mon, Feb 06, 2012 at 07:24:31PM +, Mr Dash Four wrote: > Initially, there was a small number of these in the wild, but now it > is widely spread - google is the main offender, but youtube (which > is, as we all know, google-owned) and now, wait for it, scroogle.org > (a site I use a lot) is

Re: [tor-talk] Help users in Iran reach the internet

2012-02-10 Thread Roger Dingledine
On Fri, Feb 10, 2012 at 12:41:50PM +0100, Jacob Appelbaum wrote: > Watch this graph for an idea of the censorship impact of directly > connecting Tor users: > https://metrics.torproject.org/users.html?graph=direct-users&start=2011-11-12&end=2012-05-10&country=ir&events=on&dpi=72#direct-users > > H

Re: [tor-talk] Help users in Iran reach the internet

2012-02-10 Thread Roger Dingledine
On Fri, Feb 10, 2012 at 10:30:21AM -0300, Javier Bassi wrote: > I'm running a middle node, should I switch? If you have to choose, I'd say stick with the middle node. After all, we need there to be a robust fast Tor network for people to get to. > Or my IP is already > blocked by the Iranian filt

Re: [tor-talk] Help users in Iran reach the internet

2012-02-10 Thread Roger Dingledine
On Fri, Feb 10, 2012 at 05:42:01PM +0400, Phillip wrote: > Tried running through the instructions, have everything set up, and then > I reach a stumbling block - when I try to add > > ServerTransportPlugin obfs2 exec /usr/local/bin/obfsproxy --managed > > to the torrc file (through Vidalia), it g

Re: [tor-talk] obfsproxy on CentOS 6 (help Iran)

2012-02-11 Thread Roger Dingledine
On Sun, Feb 12, 2012 at 03:31:56AM +0100, Ondrej Mikle wrote: > It's also possible to run obfsproxy with "stable" Tor, one just needs to > execute > it manually, like mentioned here: > https://trac.torproject.org/projects/tor/ticket/5009#comment:17 Please don't run an obfsproxy bridge with Tor 0.

[tor-talk] Tor 0.2.3.12-alpha is out

2012-02-13 Thread Roger Dingledine
Tor 0.2.3.12-alpha lets fast exit relays scale better, allows clients to use bridges that run Tor 0.2.2.x, and resolves several big bugs when Tor is configured to use a pluggable transport like obfsproxy. https://www.torproject.org/download/download (Packages coming eventually.) Changes in versi

Re: [tor-talk] Win32 expert bundle link broken

2012-02-15 Thread Roger Dingledine
On Wed, Feb 15, 2012 at 08:07:06PM -0500, Justin Aplin wrote: > The link to the win32 expert bundle on the project website is broken > and should be corrected to > https://www.torproject.org/dist/win32/tor-0.2.3.12-alpha-win32.exe Fixed. Thanks, --Roger __

Re: [tor-talk] Questions about NSA monitoring of Tor users.

2014-07-14 Thread Roger Dingledine
On Sat, Jul 12, 2014 at 11:14:30PM +, simonsn...@openmailbox.org wrote: > I would like to hear from those with personal knowledge and > experience such as Jacob, Roger, Mike, etc. You might want to read many of my answers on https://blog.torproject.org/blog/being-targeted-nsa > AIUI, from the

[tor-talk] Cancelled black hat talk

2014-07-21 Thread Roger Dingledine
Hi folks, Journalists are asking us about the Black Hat talk on attacking Tor that got cancelled. We're still working with CERT to do a coordinated disclosure of the details (hopefully this week), but I figured I should share a few details with you earlier than that. 1) We did not ask Black Hat o

Re: [tor-talk] Cancelled black hat talk

2014-07-21 Thread Roger Dingledine
On Mon, Jul 21, 2014 at 10:05:26PM +, Nusenu wrote: > > 1) We did not ask Black Hat or CERT to cancel the talk. We did (and > > still do) have questions for the presenter and for CERT about some > > aspects of the research > > Does that imply that the exploited "weakness" is not yet fully > un

Re: [tor-talk] Why does requesting for bridges by email require a Yahoo or Gmail address?

2014-07-24 Thread Roger Dingledine
On Thu, Jul 24, 2014 at 03:24:26PM -0500, Cypher wrote: > In light of the last year of disclosures by Edward Snowden, why is Tor > requiring that I establish an account with an email provider that is > completely out of my control and has a general history of complying with > law enforcement data r

Re: [tor-talk] Android app: Torrific

2014-07-27 Thread Roger Dingledine
On Sun, Jul 27, 2014 at 07:43:17PM +0200, CJ wrote: > Name / legal: > for now, I didn't get any answer from Andrew Lewman, who kindly > contacted me??? > I added mentions so that it's clear torrific isn't from Tor Project. > Maybe that's enough ??? as I don't get answer, I stick with it. We will >

Re: [tor-talk] Android app: Torrific

2014-07-27 Thread Roger Dingledine
On Sun, Jul 27, 2014 at 08:08:23PM -0300, Juan wrote: > So, the great defenders of 'free speech' and one would think > free/open software, are now claiming to own the combination > of letters "tor" and want to control any 'trademark' which > contains that word? Yes, when

Re: [tor-talk] Android app: Torrific (renamed to orWall)

2014-07-27 Thread Roger Dingledine
On Sun, Jul 27, 2014 at 11:58:07PM +0200, CJ wrote: > Oh, well, just got another name right now, I think it will also make >some smiles: orWall. Maybe with a "84" on its logo? > Just to be sure, nothing against this one I hope, if we put aside the >politics? I'm not US??? Sounds good to me! Thank

Re: [tor-talk] problem with tor in linux mint 17

2014-07-28 Thread Roger Dingledine
On Mon, Jul 28, 2014 at 11:06:56AM -0400, luo_...@yahoo.es wrote: > Jul 28 08:51:10.000 [warn] Problem bootstrapping. Stuck at 10%: > Finishing handshake with directory server. (DONE; DONE; count 10; > recommendation warn) This indeed means it isn't bootstrapping. My first thought is that you have

[tor-talk] (FWD) Tor 0.2.4.23 is released

2014-07-30 Thread Roger Dingledine
Here's a reminder for those of you who aren't on tor-announce to be on it. --Roger - Forwarded message from Roger Dingledine - Date: Wed, 30 Jul 2014 03:42:20 -0400 From: Roger Dingledine To: tor-annou...@lists.torproject.org Subject: Tor 0.2.4.23 is released Tor 0.2.4.23 b

[tor-talk] Tor 0.2.5.6-alpha is out

2014-07-30 Thread Roger Dingledine
Tor 0.2.5.6-alpha brings us a big step closer to slowing down the risk from guard rotation, and fixes a variety of other issues to get us closer to a release candidate. https://www.torproject.org/dist/ Changes in version 0.2.5.6-alpha - 2014-07-28 o Major features (also in 0.2.4.23): - Make

Re: [tor-talk] Cancelled black hat talk

2014-07-30 Thread Roger Dingledine
On Mon, Jul 21, 2014 at 06:58:44PM -0400, Roger Dingledine wrote: > I think I have a handle on what they did, and how to fix it. We've been > trying to find delicate ways to explain that we think we know what they > did, but also it sure would have been smoother if they'd

Re: [tor-talk] Cancelled black hat talk

2014-07-30 Thread Roger Dingledine
On Wed, Jul 30, 2014 at 10:05:20PM +, Nusenu wrote: > Surprised > to see the fix of a bug that was worth a tor security > advisory to be in the "Minor bugfixes" section of the changelog. The security advisory was that somebody had attacked real Tor users and perhaps deanonymized some of them,

Re: [tor-talk] Why make bad-relays a closed mailing list?

2014-07-31 Thread Roger Dingledine
On Thu, Jul 31, 2014 at 07:58:34PM +0200, Öyvind Saether wrote: > Too bad "ContactInfo email_address" in torrc isn't "ContactInfo > email_address gpgkey" or alternatively > > ContactEmail x@y > ContactKey numbers Hm? ContactInfo is just a string. You can set it however you like. Here's the stan

Re: [tor-talk] is torrc a manual page now? que?

2014-07-31 Thread Roger Dingledine
On Thu, Jul 31, 2014 at 08:18:07PM +0200, Öyvind Saether wrote: > Thank you for this secret information. Please consider adding it to the > MANUAL PAGE since I've had my torrc since 2008 and it's not got any of > that classified information in it. Well, it certainly isn't meant to be a secret. Yo

Re: [tor-talk] Why make bad-relays a closed mailing list?

2014-07-31 Thread Roger Dingledine
On Thu, Jul 31, 2014 at 04:12:33PM -0400, Philipp Winter wrote: > One good example is documented in a recent research paper [0]. Section > 5.2 describes how we chased a group of related malicious exit relays > over several months. At some point the attackers began to sample MitM > attempts and ta

Re: [tor-talk] 'relay early' attack logging at the infrastructure level?

2014-08-01 Thread Roger Dingledine
On Fri, Aug 01, 2014 at 09:37:02PM +, Nusenu wrote: > > On July 30th, 2014 arma said: It will indeed kill circuits if it > > sees an inbound (towards the client) relay_early cell. > > > > It doesn't have to decrypt the stream to see it, because whether a > > cell is relay or relay_early is a

[tor-talk] (FWD) ISC Update: StoryMaker

2014-08-01 Thread Roger Dingledine
An interesting-sounding success story of Tor in action -- and so well integrated that people barely even mention Tor. :) (Sorry for the horrible user-specific tracking links. You all get to be me I guess.) --Roger - Forwarded message from The ISC Project - Date: Fri, 1 Aug 2014 22:21:1

Re: [tor-talk] dutch police crawling hidden servers

2014-08-05 Thread Roger Dingledine
On Tue, Aug 05, 2014 at 03:09:29PM -0400, Andrew Lewman wrote: > Given the resources of a national police force, it seems probable they > can create a crawler to simply crawl every permutation of hidden service > addresses on port 80 alone. No, that's 2^80 addresses. Doing 2^80 lookups over Tor wi

Re: [tor-talk] Performance

2014-08-13 Thread Roger Dingledine
On Wed, Aug 13, 2014 at 03:18:23PM -0500, Joe Btfsplk wrote: > The Privoxy part of the chain could be an issue. What is your > reason for using Privoxy? > In general, I find Tor to be faster overall, since overhauls in > TorBrowser - when they stopped using Privoxy (& likely started other > speed

Re: [tor-talk] Wired Story on Uncovering Users of Hidden Services.

2014-08-13 Thread Roger Dingledine
On Wed, Aug 13, 2014 at 10:06:00AM +, blo...@openmailbox.org wrote: > If it's possible for the owner of a hidden service (whether the FBI > or a regular person) to install malware which grabs visitors' IPs, > then what is stopping any hidden service owner from doing this? See https://lists.tor

Re: [tor-talk] TOR tried to take a snapshot of my screen

2014-08-25 Thread Roger Dingledine
On Mon, Aug 25, 2014 at 11:22:27AM -0700, bm-2cvvnfwsftfx8dv12l8z8pjejmtrjyj...@bitmessage.ch wrote: > Mirimir wrote: > > Maybe Zemana is incorrectly flagging some aspect of HTML5 canvas > > spoofing by the Tor browser as taking a screen snapshot". > > The incident happend at different web pages

Re: [tor-talk] Third-parties tracking me on Tor

2014-08-25 Thread Roger Dingledine
On Mon, Aug 25, 2014 at 07:37:22PM -0400, ter...@safe-mail.net wrote: > I can't remember the Hidden Wiki's site address the link was on. The >HS site owner was in contact with me via tormail. Shortly after that I >picked up on some unusual activity and backed off. This site could have >been a setup

Re: [tor-talk] I have a quick question about security of tor with 3 nodes

2014-08-30 Thread Roger Dingledine
On Sun, Aug 31, 2014 at 12:28:06AM +0200, Aymeric Vitte wrote: > Two is probably enough, assuming the first one does not know it is > the first one, ie is not triggered by a CREATE_FAST request. No, I don't think this makes sense. It doesn't matter if the first hop knows it's first. It only matter

Re: [tor-talk] warns in logfile about onionskin length and non-OR circuit

2014-08-30 Thread Roger Dingledine
On Fri, Aug 29, 2014 at 06:47:57PM +0300, s7r wrote: > Anyone can explain what this warnings are and if they are reason for > concern? > > [warn] Unexpected onionskin length after decryption: 58 A relay operator on #tor irc channel also reported seeing these (unless that was you). It's harmless -

Re: [tor-talk] Tentative results of analysis of data on metrics.torproject.org

2014-09-03 Thread Roger Dingledine
On Wed, Sep 03, 2014 at 04:10:13PM -0700, Virgil Griffith wrote: > https://docs.google.com/document/d/1SaBK664SchhZOP9XBsB8KK63k4xlmMTlkhfF28f2204/pub Hi Virgil, Neat analysis! I think putting this up on the Tor blog, once it settles a bit, is a fine plan. You might also want to put it together

[tor-talk] What should our 31c3 talk be?

2014-09-08 Thread Roger Dingledine
The 31c3 talk proposals are due this coming Sunday: http://events.ccc.de/2014/07/12/31c3-call-for-participation-en/ I wonder what would be the most useful topic for this year? In brainstorming with folks on IRC, here are four options: 1) An update on pluggable transports: obfs3, obfs4,

Re: [tor-talk] socks connect

2014-09-10 Thread Roger Dingledine
On Wed, Sep 10, 2014 at 01:28:15PM +0200, Perforin wrote: > HI That's because the DNS requests are not made through Tor, so Pidgin > can't resolv the hidden service onion URL. You need Polipo or Privoxy > running, configure it with tunneling everything through Tor (don't > forget the DNS requests!!

Re: [tor-talk] 5 million dollar company close to shut down due to an exposure on the Dark Net

2014-09-11 Thread Roger Dingledine
On Thu, Sep 11, 2014 at 10:36:48PM +0200, John Pinkman wrote: > This is a story how powerful can tor make an otherwise vulnerable to >legal repercussions website. I agree with Lunar here -- this is a story of some jerk on the Internet, and Tor is barely in the picture. (One could argue that witho

Re: [tor-talk] Comcast looking for Tor traffic, contacting customers to threaten termination of service.

2014-09-13 Thread Roger Dingledine
On Sat, Sep 13, 2014 at 03:35:56PM -0700, The Doctor wrote: > "Reports have surfaced that Comcast agents have contacted customers > using Tor and instructed them to stop using the browser or risk > termination of service. A Comcast agent named Jeremy allegedly called > Tor an ???illegal service.???

Re: [tor-talk] What should our 31c3 talk be?

2014-09-13 Thread Roger Dingledine
On Tue, Sep 09, 2014 at 10:31:20AM -0400, Andrew Lewman wrote: > On 09/08/2014 08:05 PM, Roger Dingledine wrote: > > The 31c3 talk proposals are due this coming Sunday: > > http://events.ccc.de/2014/07/12/31c3-call-for-participation-en/ > > > > I wonder what would b

[tor-talk] Tor 0.2.4.24 and 0.2.5.8-rc are out

2014-09-23 Thread Roger Dingledine
Tor 0.2.4.24 fixes a bug that affects consistency and speed when connecting to hidden services, and it updates the location of one of the directory authorities. Tor 0.2.5.8-rc is the second release candidate for the Tor 0.2.5.x series. It fixes a bug that affects consistency and speed when connect

Re: [tor-talk] Tor 0.2.4.24 and 0.2.5.8-rc are out

2014-09-24 Thread Roger Dingledine
On Wed, Sep 24, 2014 at 10:19:37AM +0200, psilo wrote: > thanks for the update. Is there a reason why > deb.torproject.org/torproject.org delivers the 0.2.5.8-rc as stable and > not 0.2.4.24? Debian Jessie will come out soon, and we decided along with our fine Debian maintainer that getting Tor 0.

[tor-talk] (FWD) https://www.federalregister.gov/articles/2014/09/18/2014-22239/request-for-information-rfi-national-privacy-research-strategy

2014-10-03 Thread Roger Dingledine
The deadline for comments is Oct 17. This isn't going to fit on my plate in this timeframe, but if anybody here has partially written ideas that they want to put together into a submission, please do! --Roger - Forwarded message from Jed Crandall - Date: Thu, 02 Oct 2014 16:23:28 -0600

Re: [tor-talk] isp monitoring tor

2014-10-06 Thread Roger Dingledine
On Mon, Oct 06, 2014 at 07:02:06PM -0400, gary...@safe-mail.net wrote: > I'll read some documentation about these methods. Are there recommended > sources? > > > Tor is vulnerable to two general sorts of attacks. I agree with the number two, but I would have picked different attacks. The first i

Re: [tor-talk] Tor Relay Smartphone App

2014-10-11 Thread Roger Dingledine
On Sun, Oct 12, 2014 at 12:04:37AM +0100, 4dcb8...@opayq.com wrote: > Hi, yes it's called Orbot see here > > https://play.google.com/store/apps/details?id=org.torproject.android&hl=en_GB&referrer=utm_source%3Dgoogle%26utm_medium%3Dorganic%26utm_term%3Dorbot&pcampaignid=APPU_Hbc5VJLDFMjB7AaK9oBw >

Re: [tor-talk] Reasoning behind 10 minute circuit switch?

2014-10-14 Thread Roger Dingledine
On Tue, Oct 14, 2014 at 12:17:27PM -0400, Greg Norcie wrote: > I'm working on doing a study on user tolerance of delays (for > example, latency on Tor). > > During our discussion, a bit of a debate occured about the TBB's > circuit switching. I was wondering if there's any research that's > been d

Re: [tor-talk] Wrong links on Tor Browser download page

2014-10-16 Thread Roger Dingledine
On Thu, Oct 16, 2014 at 06:40:04PM +, gnubiferous wrote: > The Tor Browser download page seems to have the wrong links on it: > > https://www.torproject.org/download/download-easy.html > > Instead of linking to the newly-released version 4 it links to the > version 3.6.6 downloads which give

Re: [tor-talk] Wrong links on Tor Browser download page

2014-10-16 Thread Roger Dingledine
On Thu, Oct 16, 2014 at 07:34:27PM +, gnubiferous wrote: > Thanks, the page appears OK now. But there still seems to be a problem > somewhere, > because my new 4.0 Tor Browser is still flashing a yellow triangle at me on > startup, telling me it's out of date. Does it determine that by checkin

[tor-talk] Russian Tor exit relay messing with traffic

2014-10-23 Thread Roger Dingledine
Hi Josh, I tried to write this comment at the bottom of http://www.leviathansecurity.com/blog/the-case-of-the-modified-binaries/ but your comment system wouldn't let me write into the name and email address boxes. So I've written it here. """ Thanks for the detailed analysis! We've now set the Ba

Re: [tor-talk] recent firefox releases

2014-10-27 Thread Roger Dingledine
On Mon, Oct 27, 2014 at 09:48:55AM +0100, Gigi Bigio wrote: > as far as I understand, recent Firefox releases do not support anymore >Vidalia and its related possibility to browse anonymously. Though the >"onion" button is still present on the top left corner, it will not work, >as you know. Vidal

Re: [tor-talk] Can Tor run over Tor?

2014-10-30 Thread Roger Dingledine
On Thu, Oct 30, 2014 at 03:48:27PM +0100, Lars Luthman wrote: > > If so, has anyone ever thought about the pros/cons of this? Obviously, it's > > exponentially more inefficient. But is it any more secure? > > I have done it accidentally with a misconfigured transparent proxy that > sent its own To

Re: [tor-talk] Facebook brute forcing hidden services

2014-10-31 Thread Roger Dingledine
On Fri, Oct 31, 2014 at 12:23:02PM +, Mike Cardwell wrote: > https://www.facebook.com/notes/protect-the-graph/making-connections-to-facebook-more-secure/1526085754298237 > > So Facebook have managed to brute force a hidden service key for: > > http://facebookcorewwwi.onion/ > > If they have

Re: [tor-talk] Facebook brute forcing hidden services

2014-10-31 Thread Roger Dingledine
On Fri, Oct 31, 2014 at 08:54:27AM -0400, Roger Dingledine wrote: > I talked to them about this. The short answer is that they did the vanity > name thing for the first half of it ("facebook"), which is only 40 bits I've put up many other thoughts at https://blog.torproj

Re: [tor-talk] Tor and Anonymous browsing etc.

2014-11-07 Thread Roger Dingledine
On Fri, Nov 07, 2014 at 02:00:13PM -0500, Derric Atzrott wrote: > > Final question, what do you > > recommend for downloading movies,music etc?? I download alot lol. I > > like sites with lots of options. Fast, secure, etc.. [...] > I will just ignore your last question. I'm not going to help you

Re: [tor-talk] "Hidden Services" vs "Onion services"

2014-11-12 Thread Roger Dingledine
On Wed, Nov 12, 2014 at 03:39:05PM -0800, Virgil Griffith wrote: > I am working on fixing up some aspects of tor2web. I've heard talk of > using the term "onion service" or "tor service" instead of "hidden > service". I actually like both of these better than "hidden service" > (which I feel is t

Re: [tor-talk] Netflow analysis breaks Tor

2014-11-14 Thread Roger Dingledine
On Fri, Nov 14, 2014 at 06:20:16PM -0500, grarpamp wrote: > Professor Sambuddho Chakravarty, a former researcher at Columbia > University???s Network Security Lab and now researching Network > Anonymity and Privacy at the Indraprastha Institute of Information > Technology in Delhi, has co-published

Re: [tor-talk] ChatSecure Problem?

2014-11-14 Thread Roger Dingledine
On Fri, Nov 14, 2014 at 11:09:10PM -0300, Juan wrote: > just your opinion (baseless opinion as far as I'm concerned) > You are not trying to order me around, are you? Hi Juan, Remember that this list has many thousands of people on it. Using it for personal attacks and off-topic disc

Re: [tor-talk] Propsal for decentralization of the Tor network

2014-11-23 Thread Roger Dingledine
On Sun, Nov 23, 2014 at 05:07:42PM -0800, bm-2cuqbqhfvdhuy34zcpl3pngkplueeer...@bitmessage.ch wrote: > I have carefully checked trac and torproject.org website for proposals, > seen many interesting ones but not a single one to decentralize the Tor > network from the direcotry authorities. There a

Re: [tor-talk] Tor network too fast

2014-12-10 Thread Roger Dingledine
On Wed, Dec 10, 2014 at 10:05:36PM -0500, Griffin Boyce wrote: > Sieme wrote: > >I think so too. But what's the default policy now? 3 hops? > > It's three hops. 100ms is pretty short, but not ridiculously so. In particular, a lot of the slowness of Tor before (and still, if you get unlucky) is be

[tor-talk] Tor and solidarity against online harassment

2014-12-11 Thread Roger Dingledine
I'd like to draw your attention to https://blog.torproject.org/blog/solidarity-against-online-harassment https://twitter.com/torproject/status/543154161236586496 One of our colleagues has been the target of a sustained campaign of harassment for the past several months. We have decided to publish

Re: [tor-talk] Tor and solidarity against online harassment

2014-12-11 Thread Roger Dingledine
On Thu, Dec 11, 2014 at 10:29:04PM +, Gregory Maxwell wrote: > Is there a similarly strong statement that the software will never be > intentionally backdoored by the same parties that I can point people > to? I don't wish to deflect from the serious concern about online > harassment, but it s

Re: [tor-talk] Tor and solidarity against online harassment

2014-12-12 Thread Roger Dingledine
On Fri, Dec 12, 2014 at 03:23:42PM -0300, Juan wrote: > > You might like > > https://www.torproject.org/docs/faq#Backdoor > > > > We won't put backdoors in Tor. Ever. > > LOL! > > You work for the pentagon and are subjects of the US state. > > The US government has secret 'co

Re: [tor-talk] Tor and solidarity against online harassment

2014-12-12 Thread Roger Dingledine
On Fri, Dec 12, 2014 at 04:07:18PM +, Thomas White wrote: > 'to...establish...equal...rights for women' I am both very happy and very sad that we have involved the debate over the word feminism in this broader discussion. It sure seems to have a lot of different definitions for different commu

Re: [tor-talk] Fwd: Developing an open-source, user-friendly tool for avoiding stylometry; seeking input from community

2014-12-14 Thread Roger Dingledine
On Sun, Dec 14, 2014 at 11:14:37PM -0500, Alden Page wrote: > In the spirit of meeting the needs of the privacy community, I am > interested in hearing what potential users might have to say about the > design of such a tool. As of now, I envision this tool as a GUI > desktop application that provi

[tor-talk] Possible upcoming attempts to disable the Tor network

2014-12-19 Thread Roger Dingledine
The Tor Project has learned that there may be an attempt to incapacitate our network in the next few days through the seizure of specialized servers in the network called directory authorities. (Directory authorities help Tor clients learn the list of relays that make up the Tor network.) We are ta

Re: [tor-talk] Possible upcoming attempts to disable the Tor network

2014-12-20 Thread Roger Dingledine
On Sat, Dec 20, 2014 at 06:34:23PM -, russia...@mail2tor.com wrote: > Is it Russia? They put up a $110,000 bounty to take down Tor only about 5 > months ago: No, it's (probably) not Russia. Also, as I understand it, the Russian word in this situation was more like asking researchers to propos

Re: [tor-talk] Including Adblock to TBB to save bandwith

2014-12-21 Thread Roger Dingledine
On Mon, Dec 15, 2014 at 04:10:03PM +0100, intrigeri wrote: > Hi, > > Justaguy wrote (15 Dec 2014 13:44:05 GMT) : > > What if torbrowser would include adblock, this would reduce the amount of > > bandwith > > used, and thus increase the overal speeds @ tor > > See "5. No filters" in > https://www

Re: [tor-talk] Possible upcoming attempts to disable the Tor network

2014-12-21 Thread Roger Dingledine
On Sun, Dec 21, 2014 at 11:49:00PM +0100, Fabio Pietrosanti (naif) - lists wrote: > http://uptime.statuscake.com/?TestID=OY4sh1M6R6 Hi Naif, You list two in NL, even though there is only one v3 directory authority there. What is the other one (and also, why does your script think it's down)? Th

Re: [tor-talk] Possible upcoming attempts to disable the Tor network

2014-12-22 Thread Roger Dingledine
On Mon, Dec 22, 2014 at 02:03:04PM -0700, Mirimir wrote: > In light of recent posts from Thomas White and some node operators, I'm > wondering whether "seizure" might be looking more like "compromise". > There might be a range of attacks, from DDoSing to rooting, and perhaps > even the covert insta

Re: [tor-talk] TBB wants access to port 21

2015-01-09 Thread Roger Dingledine
On Fri, Jan 09, 2015 at 01:00:30PM +0100, Michal Zuber wrote: > Hi, > just wanna ask why TBB wants to access port 21? > Little Snitch screenshot https://imgur.com/qAs02k7 There's a relay there: https://atlas.torproject.org/#search/62.210.82.44 Tor relays can listen on whatever port they want to l

Re: [tor-talk] Yelp blocking Tor users from viewing entire site

2015-01-20 Thread Roger Dingledine
On Tue, Jan 20, 2015 at 03:16:43PM -0500, Greg Norcie wrote: > So today I noticed Yelp appears to be blocking Tor. > > I tried using multiple identities, but get a 503 error every time. > > Anyone else have this issue? > > This seems really overbroad... I could understand the argument > against

Re: [tor-talk] Which PTs shall we prioritize for inclusion in Tails?

2015-01-21 Thread Roger Dingledine
On Wed, Jan 21, 2015 at 11:06:01AM +0100, Philipp Winter wrote: > On Tue, Jan 20, 2015 at 10:26:12PM +0100, intrigeri wrote: > > Assuming an ideal world in which they involve an equal amount of work, > > among scramblesuit, meek, flashproxy and obfs4, which ones should we > > prioritize our efforts

Re: [tor-talk] Vidalia problem

2015-01-23 Thread Roger Dingledine
On Fri, Jan 23, 2015 at 11:32:17PM +0100, Grant Mills wrote: > I have a little problem...i was using like 2 months ago vidalia to >download with utorrent...but one day it stopped working.Everytime >i use torrent with vidalia working i get the "proxy connect error >offline".Someone know if it is a c

Re: [tor-talk] browser differences between 4.0.3 and 4.5a3? (typo fix)

2015-02-07 Thread Roger Dingledine
On Sat, Feb 07, 2015 at 06:37:54PM +, Tempest wrote: > i made significant typos in the last subject like. so, this is a > resend for clarification purposes. i've been trying to find a greater > detailed log on this but, so far, have been unsuccessful. are there > any configuration differences

Re: [tor-talk] No update of Tor Expert Bundle

2015-02-07 Thread Roger Dingledine
On Sun, Feb 08, 2015 at 05:34:35AM +, Moses wrote: > It seems the Windows version Tor Expert Bundle has not update for a > long time. Just wonder if it is still being maintained or it has been > deprecated? They actually do still exist. The current one is: https://www.torproject.org/dist/torbr

<    1   2   3   4   5   6   7   >