Re: PrivacyNow is a BadExit (was Re: PrivacyNow node has misconfigured OpenDNS account)
On Fri, 16 Apr 2010 00:04:06 -0400 zzzjethro...@email2me.net top-posted (again, please stop doing that): > Scott Bennett wrote: > > > "That is why tor is distributed with a complete set of documentation." > >Okay, great. I will read it but all I have in my Home Folder, in Library,= > is Vidalia. In earlier versions, there used to be folders for Tor, Privox= >y and Vidalia,=20 >so where do I find this documentation? I kept assuming you were referring= > to The Onion Router.doc but now I'm guessing you're not. > In your tor distribution, there should be a "doc" directory. The stuff you're looking for is all in the subdirectories called "design-paper", "spec", and "website", although there are also three man pages and a couple of .txt files in the doc directory itself. Scott Bennett, Comm. ASMELG, CFIAG ** * Internet: bennett at cs.niu.edu * ** * "A well regulated and disciplined militia, is at all times a good * * objection to the introduction of that bane of all free governments * * -- a standing army." * *-- Gov. John Hancock, New York Journal, 28 January 1790 * ** *** To unsubscribe, send an e-mail to majord...@torproject.org with unsubscribe or-talkin the body. http://archives.seul.org/or/talk/
Re: PrivacyNow is a BadExit (was Re: PrivacyNow node has misconfigured OpenDNS account)
On Thu, 15 Apr 2010 09:17:39 +0200 Sebastian Hahn wrote: >On Apr 15, 2010, at 9:11 AM, Scott Bennett wrote: > >> On Thu, 15 Apr 2010 08:25:07 +0200 Sebastian Hahn >> > > >> wrote: >>> On Apr 15, 2010, at 8:17 AM, Scott Bennett wrote: Unfortunate (IMO), the latest versions have the support for .exit either disabled or deleted, apparently leaving us no easy way to perform such tests. I've asked recently on this list whether some other easy way were available, but have been met with silence, so I assume that there still is none. >>> >>> If you want the functionality, feel free to set the AllowDotExit >>> config option >>> to 1. Note that this can't be recommended, because it opens you up >>> for >> >> That is what I have been doing in order to be able to test for >> exit >> misbehavior. However, the ChangeLog notes under "Minor bugfixes" for >> 0.2.2.9-alpha the following: >> >> - Resume handling .exit hostnames in a special way: originally we >> stripped the .exit part and used the requested exit relay. In >> 0.2.2.1-alpha we stopped treating them in any special way, meaning >> if you use a .exit address then Tor will pass it on to the exit >> relay. Now we reject the .exit stream outright, since that behavior >> ^^^ >> might be more expected by the user. Found and diagnosed by Scott >> ?? >> Bennett and Downie on or-talk. >> >> I understood the "Now we reject" part as meaning that the .exit >> support had >> been completely removed. I do not understand why that behavior >> "might be >> more expected by the user." In any case, the above note is why I've >> paused >> at 0.2.2.7-alpha while waiting to discover some fairly easy-to-use >> alternative >> method of testing exit behavior. > >Ah no, that's not what is meant here. The idea is that when .exit is >disabled, >we reject connections to some domain ending in .exit, instead of passing >that URL to the exit node. This is more expected behaviour because there >is no .exit tld currently, so people telling to to go to xyz.exit are >most likely >thinking that they are talking to a tor with the .exit functionality >enabled. > Great! Thanks for the clarification. I'll go ahead and upgrade soon. >> >>> attacks where the exit node can choose who your exit is going to be, >>> unless you use encrypted protocols when webbrowsing only. >>> >> Regarding the attack route you mention, I have some firefox plug- >> ins >> like NoRedirect and RefreshBlocker installed in addition to the >> recommended >> plug-ins (including QuickJava, NoScript, and Torbutton especially) >> that should >> help with automated stuff, and I'm in the habit of checking the >> actual URLs >> in links before using the links manually. In many cases, I don't >> even use >> firefox to get stuff from the links, but rather do a copy-and-paste >> to a >> wget(1) or some other downloader command in an xterm(1), so I have >> plenty of >> opportunity to notice that sort of interference. If those >> strategies still >> miss something, please do let me know. > >I suppose you still load images and possibly other resources, too; >those can be fetched from arbitrary locations unless disabled via >special-purpose addons like RequestPolicy. Hmmm...yes, some images load without intervention, although many do not. Okay, I'll change my habits, so that torrc will have it turned off by default, and I'll only turn it on (and send tor a SIGHUP) when I really need it. OTOH, thanks very much for the tip about RequestPolicy. I didn't know about that one, so I'll check into it. > > # This file was generated by Tor; if youedit it, comments will not > be pres= I think the comment may be a lie. It's most likely a torrc produced by vidalia, not tor. (Someone please correct me if I've forgotten some special case in which tor does rewrite a torrc.) >>> >>> I think it is more likely that the file was written by Tor, via the >>> SAFECONF >>> torctl command. >>> >> Okay, I guess I had forgotten tor implemented such a command, >> but who >> is issuing the command? Vidalia? >> Thanks for the information, Sebastian. > >Yes, Vidalia as the only Tor controller in a typical setup would be >issuing >the saveconf command. > Okay, so tor does the actual (re)write, but Vidalia is still the perpetrator as far as the OP should be concerned. :-) Thanks again. Scott Bennett, Comm. ASMELG, CFIAG ** * Internet: bennett at cs.niu.edu * ** * "A well regulated and disciplined militia, is at all times a good * * objection to the introduction of that bane of all
Re: PrivacyNow is a BadExit (was Re: PrivacyNow node has misconfigured OpenDNS account)
On Apr 15, 2010, at 9:11 AM, Scott Bennett wrote: On Thu, 15 Apr 2010 08:25:07 +0200 Sebastian Hahn > wrote: On Apr 15, 2010, at 8:17 AM, Scott Bennett wrote: Unfortunate (IMO), the latest versions have the support for .exit either disabled or deleted, apparently leaving us no easy way to perform such tests. I've asked recently on this list whether some other easy way were available, but have been met with silence, so I assume that there still is none. If you want the functionality, feel free to set the AllowDotExit config option to 1. Note that this can't be recommended, because it opens you up for That is what I have been doing in order to be able to test for exit misbehavior. However, the ChangeLog notes under "Minor bugfixes" for 0.2.2.9-alpha the following: - Resume handling .exit hostnames in a special way: originally we stripped the .exit part and used the requested exit relay. In 0.2.2.1-alpha we stopped treating them in any special way, meaning if you use a .exit address then Tor will pass it on to the exit relay. Now we reject the .exit stream outright, since that behavior ^^^ might be more expected by the user. Found and diagnosed by Scott ?? Bennett and Downie on or-talk. I understood the "Now we reject" part as meaning that the .exit support had been completely removed. I do not understand why that behavior "might be more expected by the user." In any case, the above note is why I've paused at 0.2.2.7-alpha while waiting to discover some fairly easy-to-use alternative method of testing exit behavior. Ah no, that's not what is meant here. The idea is that when .exit is disabled, we reject connections to some domain ending in .exit, instead of passing that URL to the exit node. This is more expected behaviour because there is no .exit tld currently, so people telling to to go to xyz.exit are most likely thinking that they are talking to a tor with the .exit functionality enabled. attacks where the exit node can choose who your exit is going to be, unless you use encrypted protocols when webbrowsing only. Regarding the attack route you mention, I have some firefox plug- ins like NoRedirect and RefreshBlocker installed in addition to the recommended plug-ins (including QuickJava, NoScript, and Torbutton especially) that should help with automated stuff, and I'm in the habit of checking the actual URLs in links before using the links manually. In many cases, I don't even use firefox to get stuff from the links, but rather do a copy-and-paste to a wget(1) or some other downloader command in an xterm(1), so I have plenty of opportunity to notice that sort of interference. If those strategies still miss something, please do let me know. I suppose you still load images and possibly other resources, too; those can be fetched from arbitrary locations unless disabled via special-purpose addons like RequestPolicy. # This file was generated by Tor; if youedit it, comments will not be pres= I think the comment may be a lie. It's most likely a torrc produced by vidalia, not tor. (Someone please correct me if I've forgotten some special case in which tor does rewrite a torrc.) I think it is more likely that the file was written by Tor, via the SAFECONF torctl command. Okay, I guess I had forgotten tor implemented such a command, but who is issuing the command? Vidalia? Thanks for the information, Sebastian. Yes, Vidalia as the only Tor controller in a typical setup would be issuing the saveconf command. Sebastian *** To unsubscribe, send an e-mail to majord...@torproject.org with unsubscribe or-talkin the body. http://archives.seul.org/or/talk/
Re: PrivacyNow is a BadExit (was Re: PrivacyNow node has misconfigured OpenDNS account)
On Thu, 15 Apr 2010 08:25:07 +0200 Sebastian Hahn wrote: >On Apr 15, 2010, at 8:17 AM, Scott Bennett wrote: >> Unfortunate (IMO), the latest versions have the support for .exit >> either disabled or deleted, apparently leaving us no easy way to >> perform >> such tests. I've asked recently on this list whether some other >> easy way >> were available, but have been met with silence, so I assume that there >> still is none. > >If you want the functionality, feel free to set the AllowDotExit >config option >to 1. Note that this can't be recommended, because it opens you up for That is what I have been doing in order to be able to test for exit misbehavior. However, the ChangeLog notes under "Minor bugfixes" for 0.2.2.9-alpha the following: - Resume handling .exit hostnames in a special way: originally we stripped the .exit part and used the requested exit relay. In 0.2.2.1-alpha we stopped treating them in any special way, meaning if you use a .exit address then Tor will pass it on to the exit relay. Now we reject the .exit stream outright, since that behavior ^^^ might be more expected by the user. Found and diagnosed by Scott ?? Bennett and Downie on or-talk. I understood the "Now we reject" part as meaning that the .exit support had been completely removed. I do not understand why that behavior "might be more expected by the user." In any case, the above note is why I've paused at 0.2.2.7-alpha while waiting to discover some fairly easy-to-use alternative method of testing exit behavior. >attacks where the exit node can choose who your exit is going to be, >unless you use encrypted protocols when webbrowsing only. > Regarding the attack route you mention, I have some firefox plug-ins like NoRedirect and RefreshBlocker installed in addition to the recommended plug-ins (including QuickJava, NoScript, and Torbutton especially) that should help with automated stuff, and I'm in the habit of checking the actual URLs in links before using the links manually. In many cases, I don't even use firefox to get stuff from the links, but rather do a copy-and-paste to a wget(1) or some other downloader command in an xterm(1), so I have plenty of opportunity to notice that sort of interference. If those strategies still miss something, please do let me know. >>> # This file was generated by Tor; if youedit it, comments will not >>> be pres= >> >> I think the comment may be a lie. It's most likely a torrc >> produced by >> vidalia, not tor. (Someone please correct me if I've forgotten some >> special >> case in which tor does rewrite a torrc.) > >I think it is more likely that the file was written by Tor, via the >SAFECONF >torctl command. > Okay, I guess I had forgotten tor implemented such a command, but who is issuing the command? Vidalia? Thanks for the information, Sebastian. Scott Bennett, Comm. ASMELG, CFIAG ** * Internet: bennett at cs.niu.edu * ** * "A well regulated and disciplined militia, is at all times a good * * objection to the introduction of that bane of all free governments * * -- a standing army." * *-- Gov. John Hancock, New York Journal, 28 January 1790 * ** *** To unsubscribe, send an e-mail to majord...@torproject.org with unsubscribe or-talkin the body. http://archives.seul.org/or/talk/
Re: PrivacyNow is a BadExit (was Re: PrivacyNow node has misconfigured OpenDNS account)
On Apr 15, 2010, at 8:17 AM, Scott Bennett wrote: Unfortunate (IMO), the latest versions have the support for .exit either disabled or deleted, apparently leaving us no easy way to perform such tests. I've asked recently on this list whether some other easy way were available, but have been met with silence, so I assume that there still is none. If you want the functionality, feel free to set the AllowDotExit config option to 1. Note that this can't be recommended, because it opens you up for attacks where the exit node can choose who your exit is going to be, unless you use encrypted protocols when webbrowsing only. # This file was generated by Tor; if youedit it, comments will not be pres= I think the comment may be a lie. It's most likely a torrc produced by vidalia, not tor. (Someone please correct me if I've forgotten some special case in which tor does rewrite a torrc.) I think it is more likely that the file was written by Tor, via the SAFECONF torctl command. Sebastian *** To unsubscribe, send an e-mail to majord...@torproject.org with unsubscribe or-talkin the body. http://archives.seul.org/or/talk/
Re: PrivacyNow is a BadExit (was Re: PrivacyNow node has misconfigured OpenDNS account)
On Wed, 14 Apr 2010 21:14:49 -0400 zzzjethro...@email2me.net wrote: >Thanks. This brings up a couple of questions. One, The Onion Router.doc re= >commends against choosing one's exit nodes. Is your recommendation I exclu= >de these naughty exit nodes, that are determined as such by Tor authoritie= >s? You may have missed a distinction there. ExcludeExitNodes does not choose your exit nodes, but rather tells your client which nodes *not* to use. > >The .doc (Section 4.9--Can I control what nodes I use for entry/exit?), sa= >ys,=20 >"We don't actually recommend you use these for normal use--you get the bes= >t security that Tor can provide when you leave the route selection to Tor.= >" If you agree, why do you do this? I am assuming that is part of what you= >r post implied or meant, i.e. that you do this in spite of Tor's recommend= >ation. There are two cases here to discuss. The first is when one is testing a particular exit that one suspects may be corrupted or dysfunctional in some other way that you find unacceptable. Until the most recent versions of tor, one could perform such a test by choosing the exit with the .exit notation in a host+domainname (e.g., some.website.com.privacynow.exit), which tells the client to build a circuit that uses PrivacyNow as the exit node. Unfortunate (IMO), the latest versions have the support for .exit either disabled or deleted, apparently leaving us no easy way to perform such tests. I've asked recently on this list whether some other easy way were available, but have been met with silence, so I assume that there still is none. The second case is when a malfunctioning exit has been affirmatively identified. In such a case, one should post a message either here or on tor-rel...@torproject.org to notify all subscribers to the selected list. The directory authority operators read these lists, and if they are in agreement about your complaint, they will assign a BadExit flag to the offending node. While you and others wait for them to notice your message and decide what, if anything, to do about it, you and others need a way to enforce exclusion of that node from the circuit route selection process for use as an exit node. The ExcludeExitNodes statements in torrc are used to accomplish that exclusion. Also, sometimes the authority operators may disagree with your evaluation of a particular case and therefore refuse to flag the exit node with a BadExit flag in the directory. You can still force your own client to abide by your evaluation and decision through use of the ExcludeExitNodes statement in torrc. W.r.t. the documentation you cite, it is worth noting that being far more reluctant to exclude misbehaving nodes from use as exits was a bigger issue in the days when the tor network only had, say, 200 or fewer exits running at any one time. Now that there are usually 400 - 700 exits running at any given time, there isn't much anonymity to be preserved by allowing the use of such exits, and there may be much to be lost, depending upon the situation. I've accumulated a fairly lengthy list of excluded exits, but I do go through it every year or two to see which excluded exit nodes a) are still around and running and b) have corrected whatever I had found objectionable, as well as c) which are no longer around and can be eliminated from the list anyway. When I find nodes that are no longer a problem, I remove them from my exclusions. > >Two, in my Home Folder/Library, I have two (2), torrc files. one is torrc,= > the other is torrc.orig.1 > >The first one (torrc), has: > ># This file was generated by Tor; if youedit it, comments will not be pres= I think the comment may be a lie. It's most likely a torrc produced by vidalia, not tor. (Someone please correct me if I've forgotten some special case in which tor does rewrite a torrc.) >erved ># The old torrc file was renamed totorrc.orig.1 or similar, and Tor will= > ignore it > # If set, Tor will accept connectionsfrom the same machine (localhost onl= >y) ># on this port, and allow thoseconnections to control the Tor process usin= >g ># the Tor Control Protocol (described incontrol-spec.txt). >ControlPort 9051 ># Store working data, state, keys, andcaches here. >DataDirectory /Users/zZ/.tor/ ># Where to send logging messages. Format is minSeverity[-maxSeverity] ># (stderr|stdout|syslog|file FILENAME). >Log notice stdout > > >The second (torrc.orig.1), has nothing in it.=20 >Which should I use? And, most importantly, what exactly do I write or ente= Not the empty one, obviously. :-) >r into this file?=20 >I really don't understand this: entry nodes nickname, nickname,... >This is where one does this, is it not? Please be exact, detailed and clea= >r. Unfortunately, what is clear to most of you goes way over my head :() That is why tor is distributed with a complete set of documentation. It would be well worth your time to read it. Remember, too, that the web site *stro
Re: PrivacyNow is a BadExit (was Re: PrivacyNow node has misconfigured OpenDNS account)
Hello Thanks. This brings up a couple of questions. One, The Onion Router.doc recommends against choosing one's exit nodes. Is your recommendation I exclude these naughty exit nodes, that are determined as such by Tor authorities? The .doc (Section 4.9--Can I control what nodes I use for entry/exit?), says, "We don't actually recommend you use these for normal use--you get the best security that Tor can provide when you leave the route selection to Tor." If you agree, why do you do this? I am assuming that is part of what your post implied or meant, i.e. that you do this in spite of Tor's recommendation. Two, in my Home Folder/Library, I have two (2), torrc files. one is torrc, the other is torrc.orig.1 The first one (torrc), has: # This file was generated by Tor; if youedit it, comments will not be preserved # The old torrc file was renamed totorrc.orig.1 or similar, and Tor will ignore it # If set, Tor will accept connectionsfrom the same machine (localhost only) # on this port, and allow thoseconnections to control the Tor process using # the Tor Control Protocol (described incontrol-spec.txt). ControlPort 9051 # Store working data, state, keys, andcaches here. DataDirectory /Users/zZ/.tor/ # Where to send logging messages. Format is minSeverity[-maxSeverity] # (stderr|stdout|syslog|file FILENAME). Log notice stdout The second (torrc.orig.1), has nothing in it. Which should I use? And, most importantly, what exactly do I write or enter into this file? I really don't understand this: entry nodes nickname, nickname,... This is where one does this, is it not? Please be exact, detailed and clear. Unfortunately, what is clear to most of you goes way over my head :() Do I go to Tor's list of naughty exit nodes for the addresses to input? I need lots of help here so I'm asking for your patience too. Thanks very much. -Original Message- From: Scott Bennett To: or-talk@freehaven.net; Runa Sandvik Sent: Wed, Apr 14, 2010 9:51 pm Subject: PrivacyNow is a BadExit (was Re: PrivacyNow node has misconfigured OpenDNS account) On Wed, 14 Apr 2010 13:34:47 +0200 Runa Sandvik wrote: >On Wed, Apr 14, 2010 at 1:31 PM, wrote: >> Hello > >Hi, > >> When you add the exit PrivacyNow to "your" ExcludeExitNodes list, is this >> done automatically inside of the Tor program afterwards, for any or all >> clients,=A0 or is this something I need to do also do in my torrc file? > >This is something that you will have to do in your torrc file as well. > Yes, I guess I kind of botched my first message on this. I should have also added a request that the directory authorities flag PrivacyNow as a "BadExit" because it clearly meets the definition of a bad exit. However, 1) any bad exits that I report I also add to my own torrc's ExcludeExitNodes list because a) I want it to take effect immediately and b) sometimes the authority operators appear to make exceptions for some misconfigured/miscreant nodes, and 2) I wasn't really awake yet when I was composing the alarm. PrivacyNow is a very high-performance node, and it will be a shame to lose it as an exit node. (A few hours ago, it was ranked by torstatus as the #44 node by throughput.) However, its owner/operator clearly does not want to be contacted about problems, so we aren't really left with much choice. In any case, it will still be a good entry or middle node for many, many circuits per second. So now I guess I should make the request. Unless the authorities know how to reach the operator of PrivacyNow to get his/her OpenDNS configuration fixed (or switched to Google's open name servers or something similar), will the authorities please flag PrivacyNow as a BadExit ASAP? Thanks. Scott Bennett, Comm. ASMELG, CFIAG ** * Internet: bennett at cs.niu.edu * ** * "A well regulated and disciplined militia, is at all times a good * * objection to the introduction of that bane of all free governments * * -- a standing army." * *-- Gov. John Hancock, New York Journal, 28 January 1790 * ** *** To unsubscribe, send an e-mail to majord...@torproject.org with unsubscribe or-talkin the body. http://archives.seul.org/or/talk/
PrivacyNow is a BadExit (was Re: PrivacyNow node has misconfigured OpenDNS account)
On Wed, 14 Apr 2010 13:34:47 +0200 Runa Sandvik wrote: >On Wed, Apr 14, 2010 at 1:31 PM, wrote: >> Hello > >Hi, > >> When you add the exit PrivacyNow to "your" ExcludeExitNodes list, is this >> done automatically inside of the Tor program afterwards, for any or all >> clients,=A0 or is this something I need to do also do in my torrc file? > >This is something that you will have to do in your torrc file as well. > Yes, I guess I kind of botched my first message on this. I should have also added a request that the directory authorities flag PrivacyNow as a "BadExit" because it clearly meets the definition of a bad exit. However, 1) any bad exits that I report I also add to my own torrc's ExcludeExitNodes list because a) I want it to take effect immediately and b) sometimes the authority operators appear to make exceptions for some misconfigured/miscreant nodes, and 2) I wasn't really awake yet when I was composing the alarm. PrivacyNow is a very high-performance node, and it will be a shame to lose it as an exit node. (A few hours ago, it was ranked by torstatus as the #44 node by throughput.) However, its owner/operator clearly does not want to be contacted about problems, so we aren't really left with much choice. In any case, it will still be a good entry or middle node for many, many circuits per second. So now I guess I should make the request. Unless the authorities know how to reach the operator of PrivacyNow to get his/her OpenDNS configuration fixed (or switched to Google's open name servers or something similar), will the authorities please flag PrivacyNow as a BadExit ASAP? Thanks. Scott Bennett, Comm. ASMELG, CFIAG ** * Internet: bennett at cs.niu.edu * ** * "A well regulated and disciplined militia, is at all times a good * * objection to the introduction of that bane of all free governments * * -- a standing army." * *-- Gov. John Hancock, New York Journal, 28 January 1790 * ** *** To unsubscribe, send an e-mail to majord...@torproject.org with unsubscribe or-talkin the body. http://archives.seul.org/or/talk/
