Re: [tor-talk] 4 relays advertising >1000 MByte/s each

2016-02-03 Thread Roger Dingledine
On Wed, Feb 03, 2016 at 11:00:16PM +, nusenu wrote: > All 4 relays with that kind of advbw disappeared from consensus on > 2016-01-31 18:00:00. > > If you have some insights on whether dirauths removed them or not, feel > free to let us know. The directory authorities didn't do anything; I no

Re: [tor-talk] ExcludeExitNodes and ExitNodes, which has a higher priority within Tor?

2016-02-10 Thread Roger Dingledine
On Wed, Feb 10, 2016 at 03:18:37PM +0800, Hongyi Zhao wrote: > If I used the same node in ExcludeExitNodes and ExitNodes, Tor will > use this node as the exit node or not? In other words, which has a > higher priority within Tor? ExcludeExitNodes is supposed to take priority over ExitNodes. See

Re: [tor-talk] How to make the Tor service to stop faster?

2016-02-15 Thread Roger Dingledine
On Mon, Feb 15, 2016 at 10:26:51PM +0100, Andreas Krey wrote: > > > It is just the nicer way to say goodbye to clients - I guess. > > Also, tor then has a chance to gracefully shut down circuits so > that at least short-lived connections don't break by the shutdown. Yes, this is it. Once you star

Re: [tor-talk] Tor Weekly News ??? February 15th, 2016

2016-02-16 Thread Roger Dingledine
On Tue, Feb 16, 2016 at 11:50:58PM +, CANNON NATHANIEL CIOTA wrote: > On 2016-02-16 15:04, TWN wrote: > >Correction: the Network Team Meeting is Feb 17 13:30 UTC. > > How to access meeting? These meetings are on irc. In the original mail, you can see that it says "#tor-dev, irc.oftc.net". So t

Re: [tor-talk] Bad exit/bad relay list

2016-02-17 Thread Roger Dingledine
On Thu, Feb 18, 2016 at 12:36:53AM +0100, Flipchan wrote: > Does anyone have or know where i can find a list with bad exits/relays There aren't great resources for this I think. The simple answer is that you can look at your cached consensus file, and the ones labelled BadExit are the bad exits,

Re: [tor-talk] large increase in .onion domains

2016-02-18 Thread Roger Dingledine
On Thu, Feb 18, 2016 at 05:45:26AM -0500, Scfith Rise up wrote: > Here is the exact link: > https://metrics.torproject.org/hidserv-dir-onions-seen.html > > it jumped from 4 to 6 in the past day or two. > > Since the metrics are based on the number of relays acting as hidden >services w

Re: [tor-talk] Large spike in .onion addresses - port scan?

2016-02-20 Thread Roger Dingledine
On Sat, Feb 20, 2016 at 02:28:37AM -0600, CANNON NATHANIEL CIOTA wrote: > With the large sudden spike in hidden services addresses, any way to > view what the newly registered .onion addresses are or at least a > list of hidden services during the suspected time frame? No, there is no easy way to

Re: [tor-talk] Thoughts on Tor router hardware

2016-02-24 Thread Roger Dingledine
On Wed, Feb 24, 2016 at 01:22:01PM -0500, Nathan Freitas wrote: > On Tue, Feb 23, 2016, at 03:46 PM, Rob van der Hoeven wrote: > > My conclusions are that running Tor on the router can enhance both > > security and usability. It further opens new possibilities for expanding > > the Tor-network and

Re: [tor-talk] large increase in .onion domains

2016-02-29 Thread Roger Dingledine
On Sun, Feb 28, 2016 at 12:01:54PM -0500, Scfith Rise up wrote: > Now the spike is up to over 8 domains. The Tor Project has had more >than a few days now to analyze this, This is true, but we don't know anything more than we did, and until something changes we will continue to not know. My an

Re: [tor-talk] .onion name gen

2016-03-04 Thread Roger Dingledine
On Fri, Mar 04, 2016 at 05:24:34PM -0700, Mirimir wrote: > Right, _very_ difficult to find! > > But, let's say that one were found. Or occurred by chance. Am I correct > that HSdirs would go with the server that had announced most recently? Yes. http://tor.stackexchange.com/questions/13/can-a-hi

Re: [tor-talk] Interview Study on Anonymity and Peer Production

2016-03-06 Thread Roger Dingledine
On Sun, Mar 06, 2016 at 01:11:26PM +, Bernard Tyers wrote: > HI Andrea, > > Is it possible to share the learnings and output from this research? > > I am a usability of privacy tools researcher and designer and would be very. You can see some of the results in this 32c3 video: https://media.

Re: [tor-talk] Why does parameter "StrictExitNodes" exist?

2016-03-09 Thread Roger Dingledine
On Thu, Mar 10, 2016 at 08:07:44AM +0100, Ben Stover wrote: > Assume I specified in "torrc" file > > ExitNodes {fr},{de],{ca} > > According to Tor docs that means that the exit nodes should always (?) be in > one of the three countries. > > On the other hand there is another parameter "StrictEx

Re: [tor-talk] Why does parameter "StrictExitNodes" exist?

2016-03-10 Thread Roger Dingledine
On Thu, Mar 10, 2016 at 02:39:20PM -0800, Green Dream wrote: > By default (i.e., StrictNodes is false) Tor will bypass your declared > ExitNodes if it needs to do so in order for traffic to reach its > destination. Imagine the scenario where all the exit nodes in your > ExitNodes criteria have stri

Re: [tor-talk] tor-onions on gmane

2016-03-11 Thread Roger Dingledine
On Fri, Mar 11, 2016 at 02:04:28PM +, Oskar Wendel wrote: > Is there any chance for tor-onions mailing list to be available through > Gmane? I read Tor lists with Gmane, as it's way more convenient to use > a newsreader than to read lists with email, but the list is still not > there... Thi

Re: [tor-talk] Traffic shaping attack

2016-03-18 Thread Roger Dingledine
On Sat, Mar 19, 2016 at 04:02:53AM +0100, coderman wrote: > On 3/19/16, Oskar Wendel wrote: > >... > > Let's set up a service in a way that it will modulate the traffic, so the > > download would look like: > > [ some distinct signaling here...] > > yes; it's a traffic confirmation attack, and by

Re: [tor-talk] Reload "torrc" without restart TorBrowser possible? Reload every 600 seconds?

2016-03-19 Thread Roger Dingledine
On Wed, Mar 16, 2016 at 01:59:21PM +0100, Ben Stover wrote: > When I start TorBrowser the current "torrc" file is read. > > Now assume I change the instructions in "torrc". > > Do I have to exit and restart TorBrowser to get the new "torrc" instructions > working? On Windows, yes. On other ope

Re: [tor-talk] Why my tor-assigned IP address differs from that of exit node ?

2016-03-19 Thread Roger Dingledine
On Wed, Mar 16, 2016 at 08:26:17AM +, jb wrote: > sometimes when I start the browser and execute "Test Tor Network Settings" > on Welcome Page, I get an IP address that differs from that of exit node (as > displayed thru Torbutton). > Why does it happen, and is it something to worry about or a

Re: [tor-talk] Traffic shaping attack

2016-03-19 Thread Roger Dingledine
On Sat, Mar 19, 2016 at 11:02:44AM +, Oskar Wendel wrote: > Let's assume that the service is extremely popular, with over 6 terabytes > of traffic each day, and a gigabit port almost constantly saturated. This assumed scenario seems extremely unlikely to be happening in practice. First becaus

Re: [tor-talk] Religion provides statistical proof of the Creation of our civilization. This is .. really ... the Apocalypse. Today, see Eden and Exodus in superposition.

2016-03-29 Thread Roger Dingledine
On Sun, Mar 27, 2016 at 11:45:56AM -0400, Adam M. Dobrin wrote: > Subject: INFO4U Religion provides statistical proof of the Creation of our Sorry for the disturbance everyone. Yes indeed, this thread is off-topic. I've removed the original poster from the list. --Roger -- tor-talk mailing list

Re: [tor-talk] Innocent Seattle Exit Operators And Privacy Advocates Raided

2016-04-04 Thread Roger Dingledine
On Mon, Apr 04, 2016 at 12:04:44AM -0400, krishna e bera wrote: > Somewhere is a piece of advice from TorProject recommending people not > to run an exit node from home for the above and other reasons. Actually it's EFF's Tor legal faq: https://www.torproject.org/eff/tor-legal-faq ("Should I run a

Re: [tor-talk] Can't find the Link - How to install and run a Tor ExitNode?

2016-04-10 Thread Roger Dingledine
On Mon, Apr 11, 2016 at 02:34:45AM +0200, tor_t...@arcor.de wrote: > i have no link to the equipment and software or installation guide which is > needed to provide a Tor ExitNode. the bags at the #wewillrebuild pic aren't > good enough even for a presentation. i searched the wiki which is full o

Re: [tor-talk] Comments on https://www.torproject.org/docs/faq.html.en

2016-04-18 Thread Roger Dingledine
On Mon, Apr 18, 2016 at 06:39:33AM -0700, Ryan Carboni wrote: > 1. "Tor does provide a partial solution in a very specific situation, > though. When you make a connection to a destination that also runs a > Tor relay, Tor will automatically extend your circuit so you exit from > that circuit. So fo

Re: [tor-talk] 1 Million People use Facebook over Tor

2016-04-22 Thread Roger Dingledine
On Sat, Apr 23, 2016 at 11:41:09AM +1000, Peter Tonoli wrote: > This is a real success story for Tor I agree! Thank you Alec and other security people at Facebook for seeing the value in secure communications, and also for being willing to stand up and talk about numbers. For those who are now t

Re: [tor-talk] Comments on https://www.torproject.org/docs/faq.html.en

2016-04-22 Thread Roger Dingledine
On Wed, Apr 20, 2016 at 05:27:17PM +, lukep wrote: > I'd prefer the FAQ entry to be updated rather than removed. It gives me a > little confidence in the site Hi lukep, Nothing will happen with the FAQ unless somebody updates it. I put some instructions in my previous mail: """ The second be

Re: [tor-talk] 'Refresh tor browser' - and then it wasn't one anymore.

2016-05-04 Thread Roger Dingledine
On Wed, May 04, 2016 at 07:00:36AM +0200, Andreas Krey wrote: > Hi all, > > I just had the TBB ask me something to the lines > of 'refresh tor browser?', and I sleepily said > yes, and now the browser apparently has lost > the addon that is the tor process underneath, > and just says 'the proxy se

Re: [tor-talk] "Sorry. You are not using Tor."

2016-05-05 Thread Roger Dingledine
On Thu, May 05, 2016 at 07:47:08AM +, eliaz wrote: > I'm currently running a bridge via torbrowser (I know, it's not > recommended. Indulge me). When I checked torbrowser tonight, trying to > open check.torproject.org I got me an error "Sorry. You are not using > Tor" and an apparent IPv6 addr

Re: [tor-talk] Where is the Tor source code? [Was Re: FBI harassing Tor devs]

2016-05-06 Thread Roger Dingledine
On Fri, May 06, 2016 at 02:34:52PM +, Jonathan Wilkes wrote: > Is there a link to the source code for _Tor_ on http://www.torproject.org/ > home > page? Go to https://www.torproject.org/download/download and click on 'source code'. > Also-- it'd be nice if there were a clear link to a git r

Re: [tor-talk] Pluggable Transports and DPI

2016-05-11 Thread Roger Dingledine
On Wed, May 11, 2016 at 07:40:17PM -0700, David Fifield wrote: > Justin helped me by running some tests and we think we know how this > Cyberoam device is blocking meek connections. It blocks TLS connections > that have the Firefox 38's TLS signature and that have an SNI field that > is one of our

Re: [tor-talk] Tor Design : Differents keys used for connection.

2016-05-19 Thread Roger Dingledine
On Thu, May 19, 2016 at 10:13:54PM +0200, Brieuc Barthélemy wrote: > In point 4 (Page 4) the article talks about differents keys: > - A long term identity key: to sign TLS certificate, OR route descriptor > and to sign directories. > - A short-term onion key: used to decrypt requests from users. >

Re: [tor-talk] Ntop nDPI 1.8 with enhanced Tor protocol dissector

2016-05-31 Thread Roger Dingledine
On Wed, Jun 01, 2016 at 08:05:22AM +0200, Fabio Pietrosanti (naif) - lists wrote: > the cool ntop project (www.ntop.org) has released it's opensource DPI > (Deep Packet Inspection) engine with enhanced Tor protocol dissector and > support http://www.ntop.org/ndpi/released-ndpi-1-8/ . > > They do

Re: [tor-talk] Question for those who say "Tor is pwned"

2016-06-20 Thread Roger Dingledine
On Mon, Jun 20, 2016 at 06:52:17PM -0500, Anthony Papillion wrote: > > http://www.ohmygodel.com/publications/usersrouted-ccs13.pdf > > So basically you're saying that Tor is actually pretty darn secure if > you don't use it every single time you connect to the Internet or for > extended periods of

Re: [tor-talk] Anyone got the sourcecode for "CensorSpoofer"

2016-07-07 Thread Roger Dingledine
On Fri, Jul 08, 2016 at 01:13:23AM +0200, Flipchan wrote: > Hi im writing a whitepaper atm , and im working on a proxy/code for that > whitepaper and it would help/be good to look at the source code for the > CensorSpoofer if anyone got it,i cant seem to find it anywhere > > https://people.cs.u

Re: [tor-talk] Tor routing algorithm questions

2016-07-07 Thread Roger Dingledine
On Thu, Jul 07, 2016 at 10:57:00PM +, Patrick Schleizer wrote: > scenario A) > > Let's assume someone's Tor client picked an entry guard on IP > AAA.BBB.CCC.EEE. And then [without knowing and/or by chance] tried to > make a torified connection to [1] IP AAA.BBB.CCC.EEE. > > - Would Tor use th

Re: [tor-talk] Practical deanonymization using CPU load covert channels

2016-07-15 Thread Roger Dingledine
On Fri, Jul 15, 2016 at 11:18:38AM -0400, Ethan White wrote: > Also, unfortunately, I'm going to be away from all things internet > for the next week or so, and thus unable to answer many > questions. Sorry for essentially commiting and leaving. Neat! Hopefully that away-from-the-net part means yo

Re: [tor-talk] A community concern that needs to be addressed,

2016-08-18 Thread Roger Dingledine
On Thu, Aug 18, 2016 at 08:49:04PM -0400, myz...@openmailbox.org wrote: > I feel like Tor has become increasingly user-friendly > and the Tor Browser Bundle is by far less 'intimidating' to perform > first time configuration than it was a few years ago. Yay! Sign me up. There are many millions of

Re: [tor-talk] tor 0.2.8.5-rc connecting to 18.0.0.1

2016-08-18 Thread Roger Dingledine
On Fri, Aug 19, 2016 at 04:05:07AM +0100, land...@tutanota.com wrote: > I'd like to ask why is tor-win32-0.2.8.5-rc.zip and > torbrowser-install-6.5a2_en-US.exe connecting to 18.0.0.1 ? >[...] > is tor 0.2.8.5-rc binding a socket to 18.0.0.1 ? or is it something else?  if > so why is this not on

Re: [tor-talk] Tor Bridge vs Tor Exit?

2016-08-20 Thread Roger Dingledine
On Sat, Aug 20, 2016 at 12:58:55AM -0700, George Grantham wrote: > I've heard that Tor Bridges and Tor exits are both within serious demand. > > At this point in time within the Tor Network, are Tor Bridges with obfs4 > pluggable transports at a greater need, or are Tor exit nodes? I think exit r

Re: [tor-talk] Running a relay for some months

2016-09-17 Thread Roger Dingledine
On Sat, Sep 17, 2016 at 09:46:48PM +0200, Tor Dev wrote: > I see now. My apologies! I pressed the button indeed multiple times, but the > window with the mail didn???t close after pressing the button. Even disabling > GPG signatures made no difference. After a few minutes I force quitted my > ma

Re: [tor-talk] benefits of onion services (was Re: getting Tor to be default browser)

2016-09-18 Thread Roger Dingledine
On Sun, Sep 18, 2016 at 10:34:45PM -0400, Random User wrote: > What is your basis for saying that HS .onion sites are "likely harder to > attack" than "public HTTPS" sites? Well, one feature is that the onion service design limits the surface area to only that service. So you can't break in by e.g

Re: [tor-talk] Tor Browser 6.0.5 Released Early

2016-09-19 Thread Roger Dingledine
On Mon, Sep 19, 2016 at 12:27:52PM -0400, Random User wrote: > I'm just wondering what accounts for TB 6.0.5 being released at least > several days ahead of the date announced (20 Sept.) https://blog.torproject.org/blog/tor-browser-605-released has your answer (and is also the page that Tor Browse

Re: [tor-talk] How do i check the archives?

2016-09-20 Thread Roger Dingledine
On Tue, Sep 20, 2016 at 05:51:50PM -0400, grarpamp wrote: > It would *greatly* help readers if the full raw maildir > or mbox archives could be provided for download. > Thus seeding their MUA's and search tools and indexes. Here's a tarball I just made from the seul.org archives: http://seul.org/~

Re: [tor-talk] Wily repository

2016-09-21 Thread Roger Dingledine
On Wed, Sep 21, 2016 at 05:21:10AM -0400, 128Ko wrote: > Some month ago, i have installed tor on Ubuntu Wily with the methode > described here : > https://www.torproject.org/docs/debian.html.en It looks like your Ubuntu version is end-of-life: https://en.wikipedia.org/wiki/Ubuntu_version_history#

Re: [tor-talk] Authority Search and 4th Amendment

2016-10-09 Thread Roger Dingledine
On Sun, Oct 09, 2016 at 03:10:06PM +0200, tort...@arcor.de wrote: > Second, some readers argued that a Tor user loses a reasonable expectation of > privacy in IP addresses because the user must disclose his true IP address to > Tor. I think this reasoning represents a deep misunderstanding of ho

Re: [tor-talk] Tor and macOS Sierra

2016-10-29 Thread Roger Dingledine
On Fri, Oct 28, 2016 at 06:39:03PM +0200, tort...@nym.hush.com wrote: > Thanks, Flipchan! Nope, as far as I can see, I am not running > anything else on that port... > > http://tinypic.com/r/212d2xc/9 > > Still "could not connect to Tor control port"... > > Any idea? It is possible you are hitt

Re: [tor-talk] ShellCode-Exploit deleivery over TOR

2016-11-12 Thread Roger Dingledine
On Sat, Nov 12, 2016 at 11:54:35PM +0100, John Doe wrote: > Maybe it is also a false positive. Have to check this. Right -- my assumption whenever I hear of strange antivirus behavior is that the antivirus program is mis-tuned. After all, one of their main techniques is to look in every file and s

Re: [tor-talk] TorChat for Android

2016-11-12 Thread Roger Dingledine
On Sun, Nov 13, 2016 at 02:57:15AM +0100, arrase wrote: > Is there an app like TorChat for Android? The idea of ??TorChat is > interesting but the current implementation is very basic for normal use Careful! You should be aware that "TorChat" is not made or endorsed or anything by the Tor peop

Re: [tor-talk] Orbot control port

2016-11-14 Thread Roger Dingledine
On Sun, Nov 13, 2016 at 08:05:06PM +0100, arrase wrote: > Orbot control port is randomized every run, is there a way to know the port > by other app? I would like to write an app who manages his own hidden > service. Check out the ControlPortWriteToFile torrc option. You can instruct Tor to write

Re: [tor-talk] Will Quantum computing be the end of Tor and all Privacy?

2016-11-28 Thread Roger Dingledine
On Mon, Nov 28, 2016 at 05:44:15PM +0100, Flipchan wrote: > I dont think so, quantum 4times at fast so we just need to generate 4times as > strong keys the entropy will just be bigger, But as Long as we are not useing > like 56 bit des keys its okey No, it's way more complicated than this. The

Re: [tor-talk] Javascript exploit

2016-11-29 Thread Roger Dingledine
On Tue, Nov 29, 2016 at 09:55:23PM -, firstwa...@sigaint.org wrote: > This is an Javascript exploit Thanks. I pointed some folks on irc to this mail, and Daniel Veditz (Mozilla Security Team) said "the Firefox team was sent a copy of that this morning. We've found the bug being used and are wo

Re: [tor-talk] Javascript exploit

2016-11-30 Thread Roger Dingledine
On Wed, Nov 30, 2016 at 12:08:00PM +, Georg Koppen wrote: > FWIW: We plan to release 6.0.7 with the patch Mozilla developed in a > couple of hours. Updates to the alpha and hardened series will we > provided as well thereafter. Update: * The blog post about the 6.0.7 Tor Browser update will g

Re: [tor-talk] Javascript exploit

2016-11-30 Thread Roger Dingledine
On Wed, Nov 30, 2016 at 02:28:52PM -0500, Roger Dingledine wrote: > * The blog post about the 6.0.7 Tor Browser update will go up any > moment. I see that the Tor Browser team has already put the packages in > https://dist.torproject.org/torbrowser/6.0.7/ And there it

Re: [tor-talk] Ahmia search engine works normally again

2016-12-08 Thread Roger Dingledine
On Thu, Dec 08, 2016 at 02:06:30PM -0500, scfith riseup wrote: > First, not sure why you want to list .onion domains. The key here is that > they are HIDDEN services. But I am sure you have reasons. Actually, that's part of the reason for the shift into calling them "onion services" -- many peopl

[tor-talk] How to unsubscribe (was Re: confusion over verification instructions for build verification on Mac OS X)

2016-12-12 Thread Roger Dingledine
On Tue, Dec 13, 2016 at 04:33:16AM +, Jedd Casella wrote: > unsubscribe >[...] > tor-talk mailing list - tor-talk@lists.torproject.org > To unsubscribe or change other settings go to > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk These instructions are at the bottom of every

Re: [tor-talk] Mirai Botnet Relocates To Onions

2016-12-17 Thread Roger Dingledine
On Sat, Dec 17, 2016 at 10:59:37PM -0700, Mirimir wrote: > > "Try to shut down .onion 'domains' over Tor," he boasted, knowing that > > nobody can. > > OK. However, it's not hard to scan for connections to Tor servers. And > you don't expect them for random devices. But maybe Mirai is setup to > u

Re: [tor-talk] 33c3 and tor?

2016-12-26 Thread Roger Dingledine
On Tue, Dec 20, 2016 at 02:37:19PM +0100, fatal wrote: > And will there be a tor relay operators meetup? Julius reserved a workshop room for us on day 2, from 21:30 to 23:00, in Hall B: https://events.ccc.de/congress/2016/wiki/Session:Tor So you should feel free to come by and we'll talk about w

Re: [tor-talk] 33c3 and tor?

2016-12-27 Thread Roger Dingledine
On Tue, Dec 27, 2016 at 08:35:55PM +0100, x333 x333 wrote: > > Julius reserved a workshop room for us on day 2, from 21:30 to 23:00, > > in Hall B: > > > > https://events.ccc.de/congress/2016/wiki/Session:Tor > > Why did you choose to make it at the same time as phw's censorship talk takes > plac

Re: [tor-talk] List of ways to attack Tor

2017-01-04 Thread Roger Dingledine
On Thu, Jan 05, 2017 at 12:25:20PM +1030, windows95@national.shitposting.agency wrote: > I'm tasked with doing a short report on the ways in which Tor can be > attacked. > I've brainstormed and done research for few hours and this is the > list I've come up with. > Is there anything big that I've

Re: [tor-talk] [GetTor] Simple way of getting Tor countering TorProject.org and its mirrors censorship using the Internet Archive's Wayback Machine

2017-01-06 Thread Roger Dingledine
On Fri, Jan 06, 2017 at 03:58:53PM -0300, ilv wrote: > We also trust other providers like > Google and Dropbox, so I don't see why we couldn't trust archive.org. Sounds like a great addition! I wouldn't want to use that logic to add *any* website, but I think we like archive.org at least as much

[tor-talk] Tor 0.3.0.2-alpha is out!

2017-01-23 Thread Roger Dingledine
(Also, Tor 0.2.9.9 is out. If you didn't know, you should subscribe to the tor-announce list and/or read the Tor blog!) Tor 0.3.0.2-alpha fixes a denial-of-service bug where an attacker could cause relays and clients to crash, even if they were not built with the --enable-expensive-hardening optio

Re: [tor-talk] TAILS people

2017-01-24 Thread Roger Dingledine
On Tue, Jan 24, 2017 at 03:44:15PM -0800, I wrote: > The requested URL /torrents/files/tails-i386-2.10~rc1.torrent was not found > on this server. Probably because you don't want the release candidate. https://blog.torproject.org/blog/tails-210-out https://tails.boum.org/install/download/ http

Re: [tor-talk] Published bridge?

2017-02-05 Thread Roger Dingledine
On Sun, Feb 05, 2017 at 08:15:07PM +0100, Maxxer wrote: > A couple of days ago I've set up a new bridge. I've tested it in my config > and works fine Great! Thanks for setting up a bridge. :) >, but I've doubts it's getting published on the bridge > database. > > I've configured it on both IPv4

Re: [tor-talk] What is preventing Bridge Enumeration?

2017-02-15 Thread Roger Dingledine
On Wed, Feb 15, 2017 at 12:10:05PM -0500, Philipp Winter wrote: > On Wed, Feb 15, 2017 at 02:32:32PM +0100, BVpTuvb AVMV wrote: > > What is preventing an attacker to start up a few mid-nodes and > > enumerating all IPs and substracting those from the list of publicly > > known entry-nodes to get a

Re: [tor-talk] A Pluggable Transport based on i2p?

2017-03-15 Thread Roger Dingledine
On Wed, Mar 15, 2017 at 06:20:53AM -0400, Lolint wrote: > Hi, > > Could it be possible to implement a pluggable transport using i2p? The way > this could work > is that a server would function as a bridge node, and will also have the i2p > router installed, > and the client will connect to this

Re: [tor-talk] A Pluggable Transport based on i2p?

2017-03-15 Thread Roger Dingledine
On Thu, Mar 16, 2017 at 01:44:06AM +0100, m.aj...@tuta.io wrote: > I was playing with the SAM protocol of I2Pd. When I typed some control > characters by pressing some Ctrl+Alphabet keys in telnet window, the I2Pd on > the other side crashed with a seg fault. It really freaked me out. This conce

[tor-talk] Stipends available for the Privacy Enhancing Technologies Symposium

2017-05-16 Thread Roger Dingledine
Hi tor-talk! The PETS conference is where all of the academic privacy / anonymity experts gather each year: https://petsymposium.org/ This year it's in Minneapolis, July 18-21. Please consider joining us -- and if you do, be sure to stay for the hike on July 22, which is where many interactions a

Re: [tor-talk] Use of TBB behind a physically isolated Tor router?

2017-05-21 Thread Roger Dingledine
On Sun, May 21, 2017 at 09:50:14PM +, CANNON wrote: > Tor browser bundle is generally recommended for privacy due to > its ability to blend in more with other people by having a > commonly shared browser fingerprint. Right. For more on what Tor Browser does (and doesn't do) at the application

[tor-talk] Is the recent growth in Ukrainian users confusing google's geoip?

2017-06-17 Thread Roger Dingledine
Motivated by a blog post comment: https://blog.torproject.org/comment/269237#comment-269237 It looks like a growing number of connections from Tor exits are being treated by Google as being Ukrainian. Anecdotally, I've experienced it too -- Google news keeps wanting to give me Ukrainian news. Fo

Re: [tor-talk] Beware of insecure mobile Tor apps such as Orion/Torion

2017-07-18 Thread Roger Dingledine
On Tue, Jul 18, 2017 at 11:30:44AM -0400, InterN0T wrote: > The developer basically took Mike Tigas' iOS app and introduced several > vulnerabilities to it that could be used to track users To be clear, right now there are no ios apps that are on par with the protections that Tor Browser provides

Re: [tor-talk] My ISP, university, etc. just sent me a DMCA notice. What should I do?

2017-07-20 Thread Roger Dingledine
On Thu, Jul 20, 2017 at 11:19:06PM +, Paul Templeton wrote: > I got a cold caller email for the TOR mirror I have... > > >> Hi Paul, > > >>I appreciate you're busy but I just wanted to follow up on the email I sent > >>you the other day. I've included a copy below for reference. It's a sta

Re: [tor-talk] tor 0.3.0.9 release notes

2017-07-22 Thread Roger Dingledine
On Sat, Jul 22, 2017 at 05:34:49PM +0200, Udo van den Heuvel wrote: > On 22-07-17 17:25, krishna e bera wrote: > > On 22/07/17 08:14 AM, Udo van den Heuvel wrote: > >> Where can I find the tor ReleaseNotes for 0.3.0.9 that actually mention > >> details about changes in 0.3.0.9? > > > > These? > >

Re: [tor-talk] Motivations for certificate issues for onion services

2017-08-09 Thread Roger Dingledine
On Wed, Aug 09, 2017 at 03:53:59PM -0700, Seth David Schoen wrote: > There was also > a long-standard concern about cryptographic strength mismatch in the > sense that the cryptography used by onion services was weaker than the > cryptography that's now used in TLS. (I think this concern was mis

Re: [tor-talk] Is DNS required to connect to an entry node?

2017-08-17 Thread Roger Dingledine
On Thu, Aug 17, 2017 at 11:02:54PM +0200, Aeris wrote: > > Every time you enter a URL in the browser address line, your browser > > requests the IP address of that URL from the DNS server. You can > > instead enter the IP address yourself along with the webpage requested. > > You could also just m

Re: [tor-talk] MTor (multicast tor), is it going to be released?

2017-08-23 Thread Roger Dingledine
On Mon, Aug 21, 2017 at 11:49:22PM -0700, Yuri wrote: > Here is the white paper with MTor design: > https://www.degruyter.com/downloadpdf/j/popets.2015.2016.issue-2/popets-2016-0003/popets-2016-0003.pdf > > And here is an implementation based on tor-0.2.3.25: > https://github.com/multicastTor/mul

Re: [tor-talk] TBB User Agent - how decided?

2017-08-26 Thread Roger Dingledine
On Sat, Aug 26, 2017 at 04:57:45PM -, blo...@openmailbox.org wrote: > How did TBB project people decide on the user agent which is: > > Mozilla/5.0 (Windows NT 6.1; rv:52.0) Gecko/20100101 Firefox/52.0 > > Panopticlick shows 1 in 30 browsers use it. I assume it's the most generic at > this m

Re: [tor-talk] Neal Krawetz's abcission proposal, and Tor's reputation

2017-08-30 Thread Roger Dingledine
On Wed, Aug 30, 2017 at 03:07:37PM +0100, Ben Tasker wrote: > So his suggestion is portrayed as not sacrificing much, but actually > sacrifices quite a lot. This is a really important point. Thinking of onion space right now as the sum total of all that it can be is cutting off all of the future i

Re: [tor-talk] Tor users in US up by nearly 100,000 this month

2017-09-01 Thread Roger Dingledine
On Fri, Sep 01, 2017 at 08:08:30PM -0700, Seth David Schoen wrote: > I'd be happy to ask CloudFlare if they'd be willing to share this data > (maybe in relative rather than absolute numeric terms, like "the number > of people successfully completing a CAPTCHA per day from a Tor exit > node on Septe

Re: [tor-talk] Advertised Bandwidth in tor atlas

2017-09-17 Thread Roger Dingledine
On Sun, Sep 17, 2017 at 06:36:12PM +0200, tor-l...@jluehr.de wrote: > I'm running > https://atlas.torproject.org/#details/D91F0F2683A264D8A6FDA7736D75FBC327F3F4F5 > > Atlas shows, that the advertised bandwidth is around 54 KiB/s. > > The machine is running in a data center (hetzner) having: > >

Re: [tor-talk] "recently-used.xbel" file in TBB directory, stores data on accessed, downloaded files

2017-09-18 Thread Roger Dingledine
On Mon, Sep 18, 2017 at 01:34:49PM -0500, Joe Btfsplk wrote: > Why is there a *"recently-used.xbel"*, file in my Tor Browser installation > directory - in path shown and  labeled as file TYPE: "XBEL bookmarks" > recording ACTUAL local file names, dates, times - they were accessed AND > some DOWNLOA

Re: [tor-talk] can't connect data bases and scientific journals

2017-09-19 Thread Roger Dingledine
On Fri, Sep 15, 2017 at 04:24:45PM -0400, Benjamin Sullivan wrote: > I have breaking news Sorry for the disturbance everybody. This person is off-topic for tor-talk, and I have set the person's "moderated" bit. (A good thing too, since it caught a half dozen further emails before they made it out

Re: [tor-talk] "the bad Tor like CP or drugs"

2017-09-19 Thread Roger Dingledine
On Sun, Sep 17, 2017 at 10:08:54PM -0400, Random User wrote: > Take the example of a photo of a child I also set the "moderated" bit on this person. Please take your dog whistles elsewhere. This is not what Tor is for or about. Sorry for the distraction everyone. --Roger -- tor-talk mailing li

Re: [tor-talk] Multiplexing TCP streams within a circuit similar to EWMA

2017-10-05 Thread Roger Dingledine
On Thu, Oct 05, 2017 at 03:18:07PM +0300, Yasir Al-Agl wrote: > I've been working for some time on Tor multiplexing and circuit scheduling > from a security perspective. I stumbled across the great work of Tang and > Goldberg and their implementation of EWMA (2010), and while their main > purpose w

Re: [tor-talk] Why Tor can't load on my Linux?

2017-10-10 Thread Roger Dingledine
On Tue, Oct 10, 2017 at 01:38:23PM -0400, grarpamp wrote: > Seems like either unset/remove "DisableNetwork" in your torrc, It is definitely not this. Tor Browser uses DisableNetwork when it first starts to make sure that your Tor doesn't try to interact with the network before you've selected 'co

Re: [tor-talk] Need a stable .onion address hosted by the Tor project.

2017-10-25 Thread Roger Dingledine
On Wed, Oct 25, 2017 at 07:22:18PM +0200, Rob van der Hoeven wrote: > > Keep in mind the false positives caused by crappy networks that just > > resolve _all_ domains and then serve ads, a captive portal, etc. on > > whatever IP address. Checking the https://check.torproject.org/api/ip > > response

Re: [tor-talk] Ongoing client problem

2017-10-29 Thread Roger Dingledine
On Sun, Oct 29, 2017 at 06:48:00PM +, George wrote: > The route to determining the issue probably comes down to this error: > > Oct 29 12:50:06.000 [info] onion_skin_ntor_client_handshake(): Invalid > result from curve25519 handshake: 4 Right. That message comes when you tried to do a circuit

Re: [tor-talk] [tor-announce] Tor Browser 7.0.9 is released

2017-11-03 Thread Roger Dingledine
On Fri, Nov 03, 2017 at 08:47:51PM +0100, Nicolas Vigier wrote: > Note: Tor Browser 7.0.9 is a security bugfix release for macOS and > Linux users only. Users on Windows are not affected and stay on Tor > Browser 7.0.8. >[...] > The bug got reported to us on Thursday, October 26, by Filippo Cavalla

Re: [tor-talk] What is mean "Guard context default"

2017-11-04 Thread Roger Dingledine
On Sat, Nov 04, 2017 at 04:32:48PM +0200, Andre Wingor wrote: > I'm under harassment, always under watching. At several year I have > accumulated a collection of bad (aggressive) tor hosts and networks.I > append those to torrc > https://goo.gl/XKdEoT (google docs) You're probably not doing yourse

Re: [tor-talk] CCC self-organised session - Tor research presentation

2017-12-28 Thread Roger Dingledine
On Thu, Dec 28, 2017 at 07:39:42PM +0200, Andre Wingor wrote: > On 12/28/17, COLLIER Ben wrote: > > initial findings from my sociological research on Tor at a self-organised > > so it is easy to recover all secret users of ! > good try, officer Ben Hello angry person who fears science, This is

Re: [tor-talk] some websites are blocking me now

2018-01-08 Thread Roger Dingledine
On Mon, Jan 08, 2018 at 03:25:09PM -0800, jbclem wrote: > Since I started using Tor browser I can't reach certain websites. > www.craigslist.org is a good example. I get an error message that "this ip > has been automatically blocked". > > I wonder if using Tor is causing this, or if I've be

Re: [tor-talk] Using a public relay as a bridge?

2018-01-12 Thread Roger Dingledine
On Fri, Jan 12, 2018 at 04:25:58PM +0100, Marco Gruß wrote: > the other day I just for the fun of it tried using a public > relay as a non-obfuscated bridge - it actually works. There are actually still some subtle bugs, e.g. https://trac.torproject.org/1776 (I know it's closed, but I think that's

Re: [tor-talk] catastrophe: ip-api.com sees me

2018-01-29 Thread Roger Dingledine
On Mon, Jan 29, 2018 at 12:38:32PM +0200, Anon Hyde wrote: > ip-api.com sees me, it means not only one > Why he sees my ip in the Chrome and Opera, but under TBB does not > What is the matter?!! Nothing is the matter, and everything sounds like it's working as intended? Using any browser with Tor

Re: [tor-talk] Tor 4

2018-03-18 Thread Roger Dingledine
On Sun, Mar 18, 2018 at 07:40:01AM -0400, Wanderingnet wrote: > 'Do it yourself' is in my view one of the astounding problems with Linux and > the anon-sec issue. Dear Wanderingnet, Please consider that there are many thousands of people on this list, and while a variety of discussion topics are

Re: [tor-talk] Who controls Tor's DNS Traffic?

2018-05-13 Thread Roger Dingledine
On Fri, May 11, 2018 at 03:08:54AM +0500, Roman Mamedov wrote: > "Level 3" on the charts is most likely the notorious 4.2.2.2...4.2.2.6. > Those absolutely should not be used, aside from all the other reasons outlined > in the article, they also hijack NXDOMAIN results for monetization of the > us

Re: [tor-talk] Cannot access tor onion sites via FF

2018-07-07 Thread Roger Dingledine
On Sat, Jul 07, 2018 at 11:19:49PM -0400, David Niklas wrote: > Hello, > I'm running firefox 61.0.1. I am trying to access the media outlet > defcon's onion site. https://media.defcon.org/ points me to: > http://m6rqq6kocsyugo2laitup5nn32bwm3lh677chuodjfmggczoafzwfcad.onion/ > > I have network.dns

Re: [tor-talk] Cannot access tor onion sites via FF

2018-07-08 Thread Roger Dingledine
On Sun, Jul 08, 2018 at 06:35:40PM -0400, David Niklas wrote: > 2. Where is the source code? Building Tor Browser is ugly because of another critical feature that it provides: reproducible, aka deterministic, builds. You can read more about that feature here: https://reproducible-builds.org/ and t

Re: [tor-talk] How do tor users get past the recapacha and it's super short 2min exemption

2018-07-11 Thread Roger Dingledine
On Tue, Jul 10, 2018 at 06:44:26PM -0700, Mirimir wrote: > For example, how did Facebook come around to have an > onion? Was it just that Alec Muffett championed it? Did complaints from > excluded users play a role? Positive or negative? They did some internal measurements and realized that the n

Re: [tor-talk] Firewall setting in Tor Browser not working?

2018-08-01 Thread Roger Dingledine
On Wed, Aug 01, 2018 at 04:06:27PM +0200, Cristian Consonni wrote: > I have a couple of questions about the "Tor Network settings" in Tor > browser. > > Tor browser can be configure to use bridges and/or pluggable transport > if needed. However it may happen that these PT are exposed on port that

Re: [tor-talk] Tor 0.3.4.6-rc is released

2018-09-07 Thread Roger Dingledine
On Tue, Aug 07, 2018 at 08:09:10PM -0400, Nick Mathewson wrote: > Changes in version 0.3.4.6-rc - 2018-08-06 > Tor 0.3.4.6-rc fixes several small compilation, portability, and > correctness issues in previous versions of Tor. This version is a > release candidate: if no serious bugs are found

Re: [tor-talk] website typos (was re: Tor 0.3.4.6-rc is released)

2018-09-08 Thread Roger Dingledine
On Sat, Sep 08, 2018 at 09:07:17AM +0100, Colin Baxter wrote: > There's a typo in https://www.torproject.org/docs/tor-doc-unix. That > page says "src/or/tor" runs tor directly from the git directory. The > path should be "src/app/tor" Thanks -- I've fixed it. (Actually, it wasn't wrong yet: that

Re: [tor-talk] Questions about Directory Authority Servers

2018-10-15 Thread Roger Dingledine
On Mon, Oct 15, 2018 at 08:08:03PM +, panoramix.druida wrote: > From my understanding when a Tor proxy is started it downloads a list of > relays from one of the ten Directory Authority Servers listed here: > https://metrics.torproject.org/rs.html#search/flag:authority > > Am I right? Almos

Re: [tor-talk] Tor VoIP PBX Architecture Discussion

2018-10-22 Thread Roger Dingledine
On Mon, Oct 22, 2018 at 05:13:39PM +0100, Iain Learmonth wrote: > It might also be that half-duplex communication (even if implemented > with humans saying "over") could bring benefits as this would allow you > to increase the buffer sizes without having people talking over each other. Reminds me

<    1   2   3   4   5   6   7   >