Exit enclaves and FQDNs

2007-09-25 Thread Gregory Maxwell
I'm working on setting up a number of nodes as exit enclaves. If I use a normal socks4 client (resulting in local DNS resolution) it works exactly as I would expect: All traffic to the exit host uses the exit host local tor node. If instead I use a client with privoxy and sock4a with DNS

Re: netscan from exit-node

2007-10-01 Thread Gregory Maxwell
On 10/1/07, Eugen Leitl [EMAIL PROTECTED] wrote: On Mon, Oct 01, 2007 at 04:31:19PM +0200, Muelli wrote: you are hosting by Hetzner, right? ;-) I get those automaticly generated netscan-mails frequently. Some times they shut down the single Tor IP, some time they shutdown the whole subnet.

Re: headers in email

2007-10-08 Thread Gregory Maxwell
On 10/8/07, Michael_google gmail_Gersten [EMAIL PROTECTED] wrote: On 10/6/07, Chris Jacobs [EMAIL PROTECTED] wrote: When email is remailed via TOR is it possible to add a header with a contact address for complaints, like in cypherpunk remailers? Hmm. Technically, yes. To do so, you have

Re: headers in email

2007-10-08 Thread Gregory Maxwell
On 10/8/07, Florian Reitmeir [EMAIL PROTECTED] wrote: Sure. thats a really good hidden service, As sender .. - i don't know where the server is, and who its operating.. You wouldn't really know that in any case. Or rather you'd know where you found out about it, and the same would be true.

Re: headers in email

2007-10-08 Thread Gregory Maxwell
On 10/8/07, Mike Cardwell [EMAIL PROTECTED] wrote: You could set up a gmail account via tor. Then point a stunnel at smtp.gmail.com port 465 over Tor using tsocks or something. Making sure you have a copy of their public cert first and that the stunnel validates it. I set this up and pointed

Re: Tor Defcon Talks

2007-10-15 Thread Gregory Maxwell
On 10/13/07, Robert Hogan [EMAIL PROTECTED] wrote: The defcon videos are up. I don't intend to troll... but wouldn't be ..er better if playing the videos didn't require using Flash? After all Tor users are advised not to have the flash plugin installed in their browser if they want tor to be

Re: Tor Defcon Talks

2007-10-15 Thread Gregory Maxwell
On 10/15/07, Alexander W. Janssen [EMAIL PROTECTED] wrote: On 10/15/07, Gregory Maxwell [EMAIL PROTECTED] wrote: I don't intend to troll... but wouldn't be ..er better if playing the videos didn't require using Flash? My mplayer plays downloaded Flash-videos just fine. I couldn't figure

Manual exit selection and HTTP host

2007-11-05 Thread Gregory Maxwell
It seems that when I use manual exit selection (http://somesite.com.somenode.exit/) that my browser is sending the node/exit name back in the HTTP request. This seems like a bad idea in general and moreover it breaks some sites vhosting configuration. Am I missing something?

Re: netstat reporting destinion IP address

2007-11-24 Thread Gregory Maxwell
On 11/24/07, anonym [EMAIL PROTECTED] wrote: [snip] Now, with this background information in mind I can go on to my actual questions for those of you who have managed to read all this (sorry for being so verbose): Why does this happen? Is netstat operating on a too high level to detect this

Re: storage privacy (was: Nice quiet, private, anonymous life??)

2007-12-04 Thread Gregory Maxwell
On Dec 4, 2007 3:35 PM, [EMAIL PROTECTED] wrote: A strong magnetic field close to the hard drive will completely destroy the data making it impossible to recover. I will also probably fuckup the drive mechanism, rendering the drive useless. If by strong you mean a super conducting magnet of

Re: What to do at IP number change?

2008-01-07 Thread Gregory Maxwell
On Jan 7, 2008 4:52 PM, [EMAIL PROTECTED] wrote: that's clear; i'm using TOR as a mix with a transparent local http proxy which uses an ISP proxy as parent proxy, so that the exit traffic goes through two proxies and with several numbers in the X_FORWARDED_FOR header ;-) That's good

Re: Child pornography blocking again

2008-01-24 Thread Gregory Maxwell
On Jan 24, 2008 10:11 PM, Kraktus [EMAIL PROTECTED] wrote: I just want to know if there is a technically feasible way of minimising one of the most harmful things Tor could potentially be used for. Nope. And if it's not technically feasible? Fine, I like Tor anyway, I won't stop running an

Re: Child pornography blocking again

2008-01-26 Thread Gregory Maxwell
On Jan 26, 2008 12:46 PM, Kraktus [EMAIL PROTECTED] wrote: Really, if I'd known my message was going to evoke this sort of response, I'd have entitled it 'Directory-distributed variables for exit lists'. It would have been better if you had, but you would have still received a negative

Re: Child pornography blocking again

2008-01-26 Thread Gregory Maxwell
On Jan 26, 2008 4:06 PM, maillist [EMAIL PROTECTED] wrote: Some f:ing paedophile is responsible for loosing all my computers and scaring my better half. Thanks a lot. Some f'ing paedophile is responsible for being a pervert, but the invasion of your home, the home of an innocent person, is the

Re: How to remove some useless nodes

2008-01-28 Thread Gregory Maxwell
On Jan 26, 2008 10:08 PM, Kraktus [EMAIL PROTECTED] wrote: On 26/01/2008, 孙超 [EMAIL PROTECTED] wrote: We in China use tor mainly for avoiding Great Fire Wall, which is a very strong internet censorship software operated by the government. So, if You can add ExcludeNodes NodeName1, NodeName2

Re: Defeat Exit Node Sniffing?

2008-03-02 Thread Gregory Maxwell
On Sun, Mar 2, 2008 at 6:34 PM, Michael_google gmail_Gersten [EMAIL PROTECTED] wrote: [snip] Here's a simple idea. Just as search engines added a robots.txt file, how about a web server providing a torexit.txt file, which is simply the list of tor exit nodes that the server considers close

Re: Firefox sends your uptime

2008-04-05 Thread Gregory Maxwell
On Sat, Apr 5, 2008 at 6:01 AM, .FUF [EMAIL PROTECTED] wrote: Mozilla Firefox sends your computer's uptime while establishing TLS (SSL) connection. This could be used to correlate anonymous traffic with non-anonymous (e.g. LAN traffic) by correlating intercepted uptime values (or to search

Re: Firefox sends your uptime

2008-04-19 Thread Gregory Maxwell
On Sun, Apr 20, 2008 at 12:05 AM, Mike Perry [EMAIL PROTECTED] wrote: Thus spake .FUF ([EMAIL PROTECTED]): Incidentally, this was filed as Firefox Bug https://bugzilla.mozilla.org/show_bug.cgi?id=405652. They have a fix in the 3.0 branch. I requested backport into FF2.0. It looks like the

Re: Google's Chrome Web Browser and Tor

2008-09-05 Thread Gregory Maxwell
On Fri, Sep 5, 2008 at 11:08 AM, Nick Mathewson [EMAIL PROTECTED] wrote: I dig what I've heard of the Chrome architecture, but it seems clear that, like every other consumer browser, it's not suitable for anonymous browsing out-of-the-box. The real question will be how easy it is to adapt it

Re: Reduced Tor Traffic [was: Re: peculiar server...]

2008-09-09 Thread Gregory Maxwell
On Tue, Sep 9, 2008 at 8:02 PM, Lucky Green [EMAIL PROTECTED] wrote: [snip] Also interesting to me is the overall reduced amount of traffic over the last few months that I have been seeing with my middleman nodes. The most likely explanation is that the overall Tor network capacity is exit

Re: same first hops

2008-10-08 Thread Gregory Maxwell
On Wed, Oct 8, 2008 at 4:50 PM, M [EMAIL PROTECTED] wrote: Is there any reason i get the same first hope for a number of days? Even when i form a new identity in vidalia, i still get the same first hops. i dont feel comfortable with that. It increases your security.

Re: same first hops

2008-10-08 Thread Gregory Maxwell
On Wed, Oct 8, 2008 at 11:23 PM, M [EMAIL PROTECTED] wrote: Thanx Gregory and F.Fox...understood the concept. Just one note though: Tor (like all current practical low-latency anonymity designs) fails when the attacker can see both ends of the communications channel. For example, suppose the

Re: same first hops

2008-10-08 Thread Gregory Maxwell
On Wed, Oct 8, 2008 at 11:34 PM, M [EMAIL PROTECTED] wrote: On Thu, Oct 9, 2008 at 6:31 AM, Gregory Maxwell [EMAIL PROTECTED] wrote: On Wed, Oct 8, 2008 at 11:23 PM, M [EMAIL PROTECTED] wrote: Thanx Gregory and F.Fox...understood the concept. Just one note though: Tor (like all current

Re: same first hops

2008-10-08 Thread Gregory Maxwell
On Wed, Oct 8, 2008 at 11:50 PM, M [EMAIL PROTECTED] wrote: ok understood, so in actuality he would have to be observing 3 things: 1) The user' s computer (timing and size) 2) the first hop ((timing and size) 3) the last hop ((timing, size and anythign else) He would have to be observing

Re: Limiting hops

2008-11-18 Thread Gregory Maxwell
On Tue, Nov 18, 2008 at 6:46 AM, Erilenz [EMAIL PROTECTED] wrote: * on the Mon, Nov 17, 2008 at 01:05:27PM -0800, Marc Erickson wrote: I use Tor on my laptop to encrypt wireless packets when connecting to an unsecured wireless network. Is there a way to limit the number of hops the packets

UK internet filtering

2008-12-06 Thread Gregory Maxwell
http://community.zdnet.co.uk/blog/0,100567,10009938o-2000331777b,00.htm?new_comment I've confirmed the reports of UK ISPs censoring Wikipedia using some UK tor exists.

Re: UK internet filtering

2008-12-06 Thread Gregory Maxwell
On Sat, Dec 6, 2008 at 8:39 PM, [EMAIL PROTECTED] wrote: On Sat, Dec 06, 2008 at 07:49:58PM -0500, [EMAIL PROTECTED] wrote 0.2K bytes in 4 lines about: : I've confirmed the reports of UK ISPs censoring Wikipedia using some : UK tor exists.

Re: UK internet filtering

2008-12-07 Thread Gregory Maxwell
On Sun, Dec 7, 2008 at 8:09 PM, [EMAIL PROTECTED] wrote: Hi, only few countries are on the list at opennet. An example is finland: http://lapsiporno.info/suodatuslista/?lang=en An interesting point is that finland censors some GB and many US sites, because of child porn. It's

Re: technical solution for censorship [was: UK internet filtering]

2008-12-08 Thread Gregory Maxwell
On Mon, Dec 8, 2008 at 8:05 AM, Benjamin S. [EMAIL PROTECTED] wrote: Am Samstag, den 06.12.2008, 19:49 -0500 schrieb Gregory Maxwell: http://community.zdnet.co.uk/blog/0,100567,10009938o-2000331777b,00.htm?new_comment I've confirmed the reports of UK ISPs censoring Wikipedia using some UK

Re: technical solution for censorship [was: UK internet filtering]

2008-12-08 Thread Gregory Maxwell
On Mon, Dec 8, 2008 at 4:07 PM, Scott Bennett [EMAIL PROTECTED] wrote: [snip] That some people have found tor to be helpful in bypassing censorial regimes' efforts is one of the nicer unintended consequences of tor's design, but such use is fallout from, not motivation for, the design. I

Re: Maximize Anonymity Services but Minimize 'Abuse Like' Behaviors...

2009-01-02 Thread Gregory Maxwell
On Fri, Jan 2, 2009 at 11:43 AM, Erik Heidt erik.he...@artofinfosec.com wrote: [snip] - Permitting exit to key informational resources (e.g. wikipedia services) - Permitting exit to top 5 or 10 web mail services (e.g. google mail, hotmail, yahoo, etc.) And manage to make yourself look like

Re: SMTPD Hidden Server

2009-01-10 Thread Gregory Maxwell
On Sat, Jan 10, 2009 at 11:28 PM, gabrix gab...@gabrix.ath.cx wrote: Hi list ! I host a public postfix server . I wish to make it tor hidden , but i need some advices on how to make it as open as possible , i mean no authentication required and spam free (does spam torify its junk ?) Spam

Re: Bridge scanning resistance

2009-03-19 Thread Gregory Maxwell
People are unlikely to spend $$ to give their fake https sites real ca signed certs. Its easy to test for, impossible to fake, and given how the browser vendors handle self signed certs someone could claim they are trying to defeat security risks by blocking self signed webservers. So I would

Re: News from my Tor Server raid

2009-03-26 Thread Gregory Maxwell
On Thu, Mar 26, 2009 at 12:07 PM, pho...@rootme.org wrote: On Thu, Mar 26, 2009 at 10:46:05AM +0100, morph...@morphium.info wrote 0.4K bytes in 13 lines about: : On the SAME day, a letter of the state attorney was sent to me : (arrived yesterday), stating I can pick my things they raided

Fwd: [Wikitech-l] Planning to tighten TorBlock settings

2009-04-03 Thread Gregory Maxwell
FYI— -- Forwarded message -- From: Brion Vibber br...@wikimedia.org Date: Fri, Apr 3, 2009 at 5:44 AM Subject: [Wikitech-l] Planning to tighten TorBlock settings To: Wikimedia developers wikitec...@lists.wikimedia.org en.wikipedia.org and others have seen a rash of abuse coming

Re: Fwd: [Wikitech-l] Planning to tighten TorBlock settings

2009-04-03 Thread Gregory Maxwell
On Fri, Apr 3, 2009 at 11:28 AM, 7v5w7go9ub0o 7v5w7go9u...@gmail.com wrote: Thank you for bringing this up!         How sad for us all! I sure hope that the Tor community can quickly effect some sort of short term solution. The precedent of destination sites restricting Tor access - even

Re: Fwd: [Wikitech-l] Planning to tighten TorBlock settings

2009-04-03 Thread Gregory Maxwell
On Fri, Apr 3, 2009 at 12:34 PM, Paul Syverson syver...@itd.nrl.navy.mil wrote: On Fri, Apr 03, 2009 at 12:03:53PM -0400, Gregory Maxwell wrote: To solve this issue I believe that TOR needs a strong pseudo-anonymous system built in and available to users.  Something where Wikipedia can block

Re: SCTP

2009-06-03 Thread Gregory Maxwell
On Wed, Jun 3, 2009 at 10:07 AM, Scott Bennett benn...@cs.niu.edu wrote:     This may seem to some like beating a dead horse, but SCTP really is coming to the Internet.  It just looks too useful to die like OSI did.  The more I find out about it, the more it looks like a really good match for

Re: SCTP

2009-06-03 Thread Gregory Maxwell
On Wed, Jun 3, 2009 at 10:26 AM, Camilo Viecco cvie...@anml.iu.edu wrote: I would wait until it can ubiquitously work behind NATs. (Only FreeBSD has NAT SCTP support  and it was committed on Feb 2009). Everyone else thinking that way is why it never will.

Re: Firefox video tag

2009-06-30 Thread Gregory Maxwell
On Tue, Jun 30, 2009 at 6:02 PM, Erilenzeril...@gmail.com wrote: Hi, Firefox 3.5 was released today. Has anyone investigated the new video tag that it supports with regards to whether or not it can cause leaks with Tor? video and audio should have exactly the same attack surface as img has.

Safe destinations

2009-07-02 Thread Gregory Maxwell
There are many people who would like to run tor exits but whom don't because of the inevitable flood of abuse complaints. At the same time, there are a great many high traffic destinations on the internet which have little to no complaint potential because they are effectively read-only or are

Re: Safe destinations

2009-07-04 Thread Gregory Maxwell
On Sat, Jul 4, 2009 at 3:03 PM, Peter Hultqvistp...@endnode.se wrote: The forward DNS is problematic since they can be spoofed by pointing any domain to a server that does not belong to one. Second, I believe that ptr lookup is very limited but I'm not that knowledgeable in that area. One way

Re: Comcast throws down gauntlet to residential accounts

2009-08-10 Thread Gregory Maxwell
On Mon, Aug 10, 2009 at 2:39 PM, Scott Bennettbenn...@cs.niu.edu wrote: [snip] business-class service, but it seems unlikely to be any cheaper.  Verizon's residential service does not currently have a cap, but I don't know whether they prohibit listening on ports accessable from the Internet.

Re: IPv6

2009-08-16 Thread Gregory Maxwell
On Sun, Aug 16, 2009 at 2:54 AM, James Brownjbrownfi...@gmail.com wrote: When does the tor team intend to include supporting IPv6 in the Tor? And do they intend do it in principle? Do you mean making IPv6 connections via Tor or using IPv6 as a transport for TOR? These things are serve distinct

Re: More important: Bridges or ORs

2009-09-02 Thread Gregory Maxwell
On Wed, Sep 2, 2009 at 3:47 PM, Arjann6bc23cpc...@list.nospam.xutrox.com wrote: Maybe the FAQ should advise people with a static IP address to run a relay instead of a bridge? If the IP address of your bridge is static, an ISP or government that filters Tor will eventually find the address and

Re: Why you need balls of steel to operate a Tor exit node

2009-09-10 Thread Gregory Maxwell
On Thu, Sep 10, 2009 at 10:51 AM, and...@torproject.org wrote: In general, these sorts of stories are the exception, not the norm.  I ran an exit-node, and still do, for over 5 years.  I've had my share of abuse complaints and dmca threat letters, but a simple response has taken care of all

Re: I Write Mass Surveillance Software

2009-09-16 Thread Gregory Maxwell
On Wed, Sep 16, 2009 at 5:01 PM, Rich Jones r...@anomos.info wrote: http://www.reddit.com/r/IAmA/comments/9kwph/i_am_a_guy_who_writes_covert_software_that_runs/ Thoughts? also, I realized that two of the posts I've made this this list have now been reddit-related. Sorry about that. But I'd

Re: Tor server nami taken by the German Police

2009-09-29 Thread Gregory Maxwell
On Wed, Sep 30, 2009 at 12:34 AM, John Case c...@sdf.lonestar.org wrote: No, no - I understand what the behavior in meatspace is like - I wonder what the behavior looks like on the network. Take carding ... presumably that all takes place on 443, as carders use online merchants to either test

Re: Reduce hops when privacy level allows to save Tor network bandwidth

2009-11-17 Thread Gregory Maxwell
On Tue, Nov 17, 2009 at 9:03 AM, Andrew Lewman and...@torproject.org wrote: People who don't want strong anonymity should use VPNS, single-hop proxy providers, or setup an ssh tunnel somewhere. I thought there were plans to offer officially offer a length-two mode? In particular the current

Re: single hop proxy?

2009-11-18 Thread Gregory Maxwell
On Wed, Nov 18, 2009 at 6:17 PM, moris blues mo...@oleco.net wrote: hi, can someone tell me what it mean: letting Tor be used as a single hop proxy makes exit nodes a more attractive target for compromise? What is a songle hop Proxy, i know only my Onion Proxy. And how do this attack work?

Re: HTML5 deanonymization attacks

2009-11-19 Thread Gregory Maxwell
On Thu, Nov 19, 2009 at 12:10 PM, Marco Bonetti marco.bone...@slackware.it wrote: DeepSec 2009 is on, this morning I gave the talk on new HTML5 features and how do they affect Tor browsing, if you're interested in the presentation with some sample code for the attacks go to

Re: The Case for Banning Reduced Hop Count Implementations

2009-11-22 Thread Gregory Maxwell
On Mon, Nov 23, 2009 at 12:29 AM, Lucky Green shamr...@cypherpunks.to wrote: [snip] seeking higher anonymity. The end state, if lower than three hop implementations are permitted to use the Tor network, is that Tor's network performance will acceptable only to users of lower hop clients. I

Re: The Case for Banning Reduced Hop Count Implementations

2009-11-23 Thread Gregory Maxwell
On Mon, Nov 23, 2009 at 10:05 AM, Paul Syverson syver...@itd.nrl.navy.mil wrote: [snip] So, reducing the number of hops means that exit nodes have significantly more information about connection origins. Reducing hops to one means that they know everything about the origin of a connection (up

Re: AN idea of non-public exit-nodes

2009-11-25 Thread Gregory Maxwell
On Tue, Nov 24, 2009 at 8:05 PM, Ted Smith ted...@gmail.com wrote: On Tue, 2009-11-24 at 19:49 -0500, Roger Dingledine wrote: See especially point #1: even if we didn't tell clients about the list of relays directly, somebody could still make a lot of connections through Tor to a test site

Re: AN idea of non-public exit-nodes

2009-11-25 Thread Gregory Maxwell
On Wed, Nov 25, 2009 at 1:08 PM, Paul Syverson syver...@itd.nrl.navy.mil wrote: Two words: Hidden service Okay. I'm now running a HTTP forwarder to LJ as a hidden service. Email me for the hidden service address and port number. ... I'll be posting the mapping of the LJ accounts and passwords

Re: filling a network with Tor traffic

2010-03-12 Thread Gregory Maxwell
On Fri, Mar 12, 2010 at 6:24 AM, Eugen Leitl eu...@leitl.org wrote: On Thu, Mar 11, 2010 at 01:39:26PM -0500, Andrew Lewman wrote: On Thu, 11 Mar 2010 17:38:25 +0100, Eugen Leitl eu...@leitl.org wrote: :Any suggestions for making Tor filling up 2-3 /24 networks, :so that it doesn't break

Re: Automated threat messages force limitation of Exit Policy (Softlayer)

2010-06-23 Thread Gregory Maxwell
On Wed, Jun 23, 2010 at 9:03 AM, Jon torance...@gmail.com wrote:  I don't know if this will help or not, but in the states, my ISP provider calls me when they get a complaint. They tell me what the complaint was about, I get the ports the issues came thru and what they were. All except the

Re: A suggestion to TOR [a proxy server]

2010-07-25 Thread Gregory Maxwell
On Sun, Jul 25, 2010 at 5:58 PM, Moritz Bartl t...@wiredwings.com wrote: That being said, you should look into the bridge concept. http://www.torproject.org/bridges.html.en Bridge-relays do no good for people who can't load the tor software. That is specifically what I was responding to.

Re: A suggestion to TOR [a proxy server]

2010-07-25 Thread Gregory Maxwell
On Sun, Jul 25, 2010 at 7:33 PM, Kory Kirk kory.k...@gmail.com wrote: I think this can be achieved with a Java applet. So maybe when JTor is finished. A relay could host a web server, and have the Java applet on it. The applet would need to be signed, and could be further verified by a

Re: A suggestion to TOR [a proxy server]

2010-07-25 Thread Gregory Maxwell
On Sun, Jul 25, 2010 at 9:31 PM, Kory Kirk kory.k...@gmail.com wrote:   Torbutton is just a firefox extension. I have no idea how it could be shipped including tor itself.  In my experience with windows machines in computer labs, you are able to install firefox extensions without the

Re: Restricted Exit Policy Port Suggestions?

2010-08-11 Thread Gregory Maxwell
On Wed, Aug 11, 2010 at 11:52 AM, Mike Perry mikepe...@fscked.org wrote: [snip] Sometimes, you just need to pick your battles. If you believe the DMCA is bullshit and want a full exit policy, I think the practical answer is Go outside the US for bandwidth. Or, be prepared to provider-hop for a

Re: DuckDuckGo now operates a Tor exit enclave

2010-08-14 Thread Gregory Maxwell
On Sat, Aug 14, 2010 at 11:09 AM, Geoff Down geoffd...@fastmail.net wrote: On Sat, 14 Aug 2010 09:20 -0400, Ted Smith ted...@gmail.com wrote: An exit enclave is when a service operates a Tor exit node with an exit policy permitting exiting to that service. Tor will automagically extend

Re: DuckDuckGo now operates a Tor exit enclave

2010-08-14 Thread Gregory Maxwell
On Sat, Aug 14, 2010 at 12:19 PM, morphium morph...@morphium.info wrote: An exit enclave is when a service operates a Tor exit node with an exit policy permitting exiting to that service. Tor will automagically extend circuits built to that host from three hops to four, such that your traffic

Re: DuckDuckGo now operates a Tor exit enclave

2010-08-15 Thread Gregory Maxwell
On Sun, Aug 15, 2010 at 2:46 PM, Ted Smith ted...@gmail.com wrote: On Sun, 2010-08-15 at 17:40 +0200, Michael Scheinost wrote: 2. Why is it offering HTTP If duckduckgo.com really cares for the anonymity and privacy of its users, why do they offer unencrypted HTTP? Even if tor users are

Re: Tor Project 2008 Tax Return Now Online

2010-08-16 Thread Gregory Maxwell
On Mon, Aug 16, 2010 at 11:32 PM, Julie C ju...@h-ck.ca wrote: The larger threat that I see is the Tor Project is absolutely ... dare I say it? ... PATHETIC AT MARKETING ITSELF. Something has been bugging me the last couple days about the bigger picture of the funding issue that came to light

Re: TLS NPN (Next Protocol Negotiation)

2010-08-17 Thread Gregory Maxwell
On Tue, Aug 17, 2010 at 2:08 AM, Seth David Schoen sch...@eff.org wrote: [snip] I'm tempted to reply pointing out that _all_ uses of TLS represent at least potential support for a threat model in which a network operator is the adversary whom users are trying to defend against. So there's not

Tor + SELinux sandbox = leak proof without VM overhead?

2010-08-21 Thread Gregory Maxwell
Greetings, I've searched my copy of the lists and can't find any discussion of this. If there has been, please direct me to it. I think it's obvious that the best way of using tor is running your torrified apps in a VM which can only access the outside world via TOR. This provides the highest

Re: [Bulk] Re: The team of PayPal is a band of pigs and cads!

2010-08-24 Thread Gregory Maxwell
On Tue, Aug 24, 2010 at 3:31 PM, David Carlson carlson...@sbcglobal.net wrote: If I understand that correctly, it means that my ISP can tell that I am having a secure communication with, say, Paypal, even if the contents of my communication is encrypted.  Is that correct?  Wouldn't I be lost in

Re: Google and Tor.

2010-08-25 Thread Gregory Maxwell
On Wed, Aug 25, 2010 at 11:31 AM, Matthew pump...@cotse.net wrote: People are running automated datamining queries _via tor_ in order to gain control of more IPs and avoid being blocked. What is a datamining query exactly?  Is this what I would call typing some text into the search box and

Re: Tor seems to have a huge security risk--please prove me wrong!

2010-08-29 Thread Gregory Maxwell
On Sun, Aug 29, 2010 at 3:54 AM, Mike Perry mikepe...@fscked.org wrote: [snip] Any classifier needs enough bits to differentiate between two potentially coincident events. This is also why Tor's fixed packet size performs better against known fingerprinting attacks. Because we've truncated the

Tcpcrypt and tor

2010-08-29 Thread Gregory Maxwell
Tcpcrypt (http://tcpcrypt.org/) proposes a new extension to TCP to enable opportunistic encryption with optional authentication. From a features and performance perspective, it's probably exactly what we need to get away from the almost-everything-in-the-clear Internet that we have today.

Re: When is the 'MyFamily' setting unnecessary?

2010-09-12 Thread Gregory Maxwell
On Sun, Sep 12, 2010 at 6:53 PM, and...@torproject.org wrote: On Sun, Sep 12, 2010 at 02:38:18PM +0200, tor...@ymail.com wrote 1.1K bytes in 31 lines about: If it is technically not necessary, because tor would never use certain nodes in one circuit. I would understand people running 20

Re: When is the 'MyFamily' setting unnecessary?

2010-09-12 Thread Gregory Maxwell
On Sun, Sep 12, 2010 at 9:40 PM, Robert Ransom rransom.8...@gmail.com wrote: That's the wrong approach.  The config file should contain a random secret key shared among all relays in a family, and the relays should publish in their descriptors a public key derived from that secret key along

Re: When is the 'MyFamily' setting unnecessary?

2010-09-12 Thread Gregory Maxwell
On Mon, Sep 13, 2010 at 12:11 AM, Robert Ransom rransom.8...@gmail.com wrote: There we go— Perhaps the signature could be shipped only to the directory authorities but left out of the published descriptors, no? No, the client needs to see it in the relay/bridge descriptor. they'd need to be

Re: The best way to run a hidden service: one or two computers?

2010-09-20 Thread Gregory Maxwell
On Fri, Sep 17, 2010 at 10:41 PM, Robert Ransom rransom.8...@gmail.com wrote: If your hidden service really needs to be annoying to find, run it: * using only well-written, secure software, * in a VM with no access to physical network hardware, * on a (physical) computer with no non-hidden

Re: What about private Public Keys

2010-10-18 Thread Gregory Maxwell
On Mon, Oct 18, 2010 at 2:37 PM, thomas.hluch...@netcologne.de wrote: Maybe this subject has already been discussed here. Given, an attacker succeeds to break into a large number of tornodes and gets a copy of the secret keys from all those nodes. This would increase the chance to decrypt

Re: leaker-optimized versions of Tor

2010-12-08 Thread Gregory Maxwell
On Wed, Dec 8, 2010 at 10:11 AM, Mitar mmi...@gmail.com wrote: Hi! Relaxing the realtime constraint, adding random delays, more hops and also chaff trafic in a Tor derivate would arguably make such attacks more difficult. I am asking just about more hops. Why would more hops be necessary?

Re: Adding voip to torchat

2010-12-18 Thread Gregory Maxwell
On Sat, Dec 18, 2010 at 4:55 AM, xhdhx johncalis...@gmail.com wrote: I figured the lgical thing to add to torchat would be voip .Is there any move to that end , can anyone give me pointers as to probable protocols , packages that can be ported to torchat .Or how abt getting ekiga to do the

Re: 27C3 on Tor

2010-12-28 Thread Gregory Maxwell
On Tue, Dec 28, 2010 at 11:29 PM, Roger Dingledine a...@mit.edu wrote: [snip] What I'm really looking forward to is learning what modifications to Tor might slow down the attack. For example, what happens if we move to a 1024 byte cell by default, or if we randomly add some extra cells

Re: Tor uses swap?

2011-01-04 Thread Gregory Maxwell
OT, I know, but this is information that all tor node operators should have. On Tue, Jan 4, 2011 at 8:25 AM, andr...@fastmail.fm wrote: I sure would LOVE to know an easy way to encrypt my swap.  My plan had been to do a fresh reinstallation of Ubuntu 10.04 on my dual-boot machine but I got to

Re: Tor uses swap?

2011-01-04 Thread Gregory Maxwell
On Tue, Jan 4, 2011 at 12:11 PM, Steve Crook st...@mixmin.net wrote: On Tue, Jan 04, 2011 at 10:13:00AM -0500, Gregory Maxwell wrote: swap /dev/sda9 /dev/urandom swap,cipher=aes-lrw-plain,size=256 Same solution as I use but with slightly different options.  Mine are: cipher=aes-cbc

Re: Is gatereloaded a Bad Exit?

2011-01-29 Thread Gregory Maxwell
On Sat, Jan 29, 2011 at 9:56 PM, grarpamp grarp...@gmail.com wrote: I dont see how to recognize if the traffic is recorded? I know people who record exit traffic, lots of it. And they do all sorts of things with it too. Does that news trouble you? If so, you need to readjust your thinking.

Re: Is gatereloaded a Bad Exit?

2011-01-31 Thread Gregory Maxwell
On Mon, Jan 31, 2011 at 11:30 AM, Andrew Lewman and...@torproject.org wrote: [snip] If we're going to start censoring Tor exits based on impressions, we might as well start blocking Tor relays that are rumoured to be run by national intelligence agencies, criminal organizations, martians, and

Re: Is gatereloaded a Bad Exit?

2011-01-31 Thread Gregory Maxwell
On Mon, Jan 31, 2011 at 8:08 PM, mi nt m...@sdf.lonestar.org wrote: These people should not be Tor nodes. Mike, I respectfully disagree. Anyone willing to allow traffic should be node. The tor project homepage makes no 'rules' when it comes to running a node. If you're willing to allow any

Re: Is gatereloaded a Bad Exit?

2011-02-10 Thread Gregory Maxwell
On Fri, Feb 11, 2011 at 12:58 AM, John Case c...@sdf.lonestar.org wrote: I think these reasons should be worked around or ignored. I think you, and others on that side of this argument have a very, very myopic view of the constraints and non-technical decisions that go into running a

Re: Is gatereloaded a Bad Exit?

2011-02-12 Thread Gregory Maxwell
On Sat, Feb 12, 2011 at 5:35 PM, John Case c...@sdf.lonestar.org wrote: That's fair. Instead of stressing the boundless set of pros, I will discuss a single, specific pro, and that is the idea that open, arbitrary systems provide a foundation upon which to build surprising and unexpected

Re: Excluding exit nodes

2011-02-13 Thread Gregory Maxwell
On Sun, Feb 13, 2011 at 11:39 AM, Tomasz Moskal ramshackle.industr...@gmail.com wrote: [snip] Would you recommend using not Tor connection when one is forced to use unencrypted protocols? I think I'm safer using Tor even with unencrypted traffic that using regular connection but again I can be

Re: Scroogle and Tor

2011-02-13 Thread Gregory Maxwell
On Sun, Feb 13, 2011 at 2:09 PM, scroo...@lavabit.com wrote: [snip] I'm getting to the point where I'm tempted to offer my two exit node lists (yesterday plus today, and previous six days plus today) to the public. If I had more confidence in the lists currently available to the public, I

Re: Scroogle and Tor

2011-02-13 Thread Gregory Maxwell
On Sun, Feb 13, 2011 at 9:34 PM, Andrew Lewman and...@torproject.org wrote: I've talked to a few services that do one of the following: - Run a Tor exit enclave, which would only allow exit through Tor to  your webservers.  There are a few services that run a tor client and  simply block

Re: Is gatereloaded a Bad Exit?

2011-02-14 Thread Gregory Maxwell
On Mon, Feb 14, 2011 at 4:32 PM, John Case c...@sdf.lonestar.org wrote: Hello Julie, On Mon, 14 Feb 2011, Julie C wrote: I suppose the anarchist genes in me are not strong enough. I have to agree with Mike Perry's arguments, given his credibility, and his clearer perspective than most of the