Re: [tor-bugs] #20495 [Metrics/Censorship analysis]: China blocking of meek, 2016-10-19

[Tor Bug Tracker & Wiki]

#20495: China blocking of meek, 2016-10-19
-+-
 Reporter:  dcf  |  Owner:
 Type:  task | Status:  new
 Priority:  Medium   |  Milestone:
Component:  Metrics/Censorship analysis  |Version:
 Severity:  Normal   | Resolution:
 Keywords:  censorship block cn meek |  Actual Points:
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by gk):

 Replying to [comment:3 dcf]:
 > I tested [https://ftp.mozilla.org/pub/firefox/releases/45.2.0esr/linux-
 x86_64/en-US/ Firefox 45.2.0esr] (the basis of current Tor Browser 6.0.5)

 Maybe just a minor thing but 6.0.5 is based on 45.4.0esr as well. Both the
 stable and the alphas are usually using the same Firefox version. The
 exception so far has been the migration to a new ESR then the alpha was
 one release earlier already on the new one.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #20495 [Metrics/Censorship analysis]: China blocking of meek, 2016-10-19

[Tor Bug Tracker & Wiki]

#20495: China blocking of meek, 2016-10-19
-+-
 Reporter:  dcf  |  Owner:
 Type:  task | Status:  new
 Priority:  Medium   |  Milestone:
Component:  Metrics/Censorship analysis  |Version:
 Severity:  Normal   | Resolution:
 Keywords:  censorship block cn meek |  Actual Points:
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by dcf):

 Some other countries show a decrease on or about the same time, though not
 to the same relative extent: us, ru, de, gb. (Notably absent is
 [https://metrics.torproject.org/userstats-bridge-
 combined.html?start=2016-09-01=2016-10-28=br br], which is way
 off the chart at the top.)

 One possibility is that this is another case of some botnet or other
 widespread software that used meek but then suddenly stopped. Perhaps
 China was simply more affected than other countries.

 [[Image(meek-by-country.png)]]

 {{{
 library(ggplot2)

 # https://metrics.torproject.org/userstats-combined-data.html
 x <- read.csv("userstats-combined.csv")
 x$date <- as.Date(x$date)
 x$avg <- ave((x$low + x$high)/2, x$country)

 p <- ggplot(x[x$node=="bridge" & x$transport=="meek" & x$avg>=50, ],
 aes(x=date, y=(high+low)/2, ymax=high, ymin=low, color=country,
 fill=country))
 p <- p + geom_ribbon(alpha=0.5)
 p <- p + geom_text(aes(label=country))
 p <- p + theme(legend.position="none")
 p <- p + coord_cartesian(xlim=c(as.Date("2016-09-01"),
 as.Date("2016-10-28")), ylim=c(0, 1500))
 p <- p + scale_x_date(date_breaks="1 month", date_minor_breaks="1 week")
 ggsave("meek-by-country.png", p, width=10, height=5, dpi=90)
 }}}

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #20495 [Metrics/Censorship analysis]: China blocking of meek, 2016-10-19

[Tor Bug Tracker & Wiki]

#20495: China blocking of meek, 2016-10-19
-+-
 Reporter:  dcf  |  Owner:
 Type:  task | Status:  new
 Priority:  Medium   |  Milestone:
Component:  Metrics/Censorship analysis  |Version:
 Severity:  Normal   | Resolution:
 Keywords:  censorship block cn meek |  Actual Points:
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by dcf):

 * keywords:  meek => censorship block cn meek


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #20495 [Metrics/Censorship analysis]: China blocking of meek, 2016-10-19

[Tor Bug Tracker & Wiki]

#20495: China blocking of meek, 2016-10-19
-+-
 Reporter:  dcf  |  Owner:
 Type:  task | Status:  new
 Priority:  Medium   |  Milestone:
Component:  Metrics/Censorship analysis  |Version:
 Severity:  Normal   | Resolution:
 Keywords:  meek |  Actual Points:
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by dcf):

 I tested [https://ftp.mozilla.org/pub/firefox/releases/45.2.0esr/linux-
 x86_64/en-US/ Firefox 45.2.0esr] (the basis of current Tor Browser 6.0.5)
 and [https://ftp.mozilla.org/pub/firefox/releases/45.4.0esr/linux-x86_64
 /en-US/ Firefox 45.4.0esr] (the basis of current Tor Browser 6.5a3)
 through a SOCKS proxy into China. In other cases, this has been enough to
 stimulate blocking, because the TLS fingerprint of meek is (supposed to
 be) the same as that of the underlying Firefox. However, I was not able to
 find any blocking.

 ||Firefox 45.2.0 ||https://a0.awsstatic.com/ ||not blocked ||
 ||Firefox 45.2.0 ||https://ajax.aspnetcdn.com/ ||not blocked ||
 ||Firefox 45.4.0 ||https://a0.awsstatic.com/ ||not blocked ||
 ||Firefox 45.4.0 ||https://ajax.aspnetcdn.com/ ||not blocked ||

 The TLS fingerprints of Firefox 45.2.0esr and 45.4.0esr differ slightly.
 45.4.0esr has one additional Signature Hash Algorithm. Oddly, the TLS
 fingerprint of meek in Tor Browser 6.5a3 is the same as that of Firefox
 45.2.0, despite Tor Browser 6.5a3 being based on Firefox 45.4.0.
  *
 [[doc/meek/SampleClientHellos#Firefox45.2.0esronDebianjessie2016-10-28|Firefox
 45.2.0esr]]
  *
 [[doc/meek/SampleClientHellos#Firefox45.4.0esronDebianjessie2016-10-28|Firefox
 45.4.0esr]]
  *
 
[[doc/meek/SampleClientHellos#TorBrowser6.5a3basedonFirefox45.4.0ESRonDebianjessie2015-10-28|Tor
 Browser 6.5a3 with meek]]

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #20495 [Metrics/Censorship analysis]: China blocking of meek, 2016-10-19

[Tor Bug Tracker & Wiki]

#20495: China blocking of meek, 2016-10-19
-+-
 Reporter:  dcf  |  Owner:
 Type:  task | Status:  new
 Priority:  Medium   |  Milestone:
Component:  Metrics/Censorship analysis  |Version:
 Severity:  Normal   | Resolution:
 Keywords:  meek |  Actual Points:
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by nikita):

 * cc: nikita (added)


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #20495 [Metrics/Censorship analysis]: China blocking of meek, 2016-10-19

[Tor Bug Tracker & Wiki]

#20495: China blocking of meek, 2016-10-19
-+-
 Reporter:  dcf  |  Owner:
 Type:  task | Status:  new
 Priority:  Medium   |  Milestone:
Component:  Metrics/Censorship analysis  |Version:
 Severity:  Normal   | Resolution:
 Keywords:  meek |  Actual Points:
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by dcf):

 Preliminary tests with Wget in two ASes in China worked. So if there is
 any blocking, it might be like other cases we've seen where it takes into
 account the TLS fingerprint.

 All these commands worked:
 {{{
 wget --no-check-certificate -O - https://72.21.81.200/ --header 'Host:
 az786092.vo.msecnd.net'
 wget -O - https://ajax.aspnetcdn.com/ --header 'Host:
 az786092.vo.msecnd.net'
 wget --no-check-certificate -O - https://52.84.246.240/ --header 'Host:
 d2zfqthxsdq309.cloudfront.net'
 wget -O - https://a0.awsstatic.com/ --header 'Host:
 d2zfqthxsdq309.cloudfront.net'
 }}}

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

[tor-bugs] #20495 [Metrics/Censorship analysis]: China blocking of meek, 2016-10-19

[Tor Bug Tracker & Wiki]

#20495: China blocking of meek, 2016-10-19
-+--
 Reporter:  dcf  |  Owner:
 Type:  task | Status:  new
 Priority:  Medium   |  Milestone:
Component:  Metrics/Censorship analysis  |Version:
 Severity:  Normal   |   Keywords:  meek
Actual Points:   |  Parent ID:
   Points:   |   Reviewer:
  Sponsor:   |
-+--
 There was a drop in bridge users on October 19 or 20, 2016:
 [[Image(userstats-bridge-country-cn-2016-07-30-2016-10-28.png)]]
 [https://metrics.torproject.org/userstats-bridge-
 country.html?start=2016-07-30=2016-10-28=cn link]

 The by-transport graph shows that almost all meek users disappeared:
 [[Image(userstats-bridge-combined-cn-2016-07-30-2016-10-28.png)]]
 [https://metrics.torproject.org/userstats-bridge-
 combined.html?start=2016-07-30=2016-10-28=cn link]

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs