[tor-dev] HTTPS Server Impersonation

2013-09-30 Thread Rohit
Hi, I was thinking about proposal #203 (Avoiding censorship by impersonating an HTTPS server) and have a few thoughts. I'm not sure if I've understood how everything fits correctly but here goes: For each bridge, we give their identity fingerprint and a shared secret along with their IP

Re: [tor-dev] HTTPS Server Impersonation

2013-09-30 Thread Jeroen Massar
On 2013-09-30 13:01 , Ian Goldberg wrote: On Mon, Sep 30, 2013 at 01:03:14AM -0700, Rohit wrote: This should satisfy most goals. - A passive attacker wouldn't be able to distinguish between HTTPS-HTTPS traffic and Tor-Bridge. (Both use TLS) This seems false to me; it's not too hard to

Re: [tor-dev] HTTPS Server Impersonation

2013-09-30 Thread Tom Ritter
On 30 September 2013 07:01, Ian Goldberg i...@cs.uwaterloo.ca wrote: On Mon, Sep 30, 2013 at 01:03:14AM -0700, Rohit wrote: This should satisfy most goals. - A passive attacker wouldn't be able to distinguish between HTTPS-HTTPS traffic and Tor-Bridge. (Both use TLS) This seems false to me;

[tor-dev] Announcing liballium (A C Tor Pluggable Transports Utility Library)

2013-09-30 Thread Yawning Angel
Hello, For those aspiring Pluggable Transports authors out there, I've recently written a simple library that handles the Tor Pluggable Transport Configuration protocol. The idea is for this library to be the C/C++ equivalent to pyptlib (and maybe more, depending on how much time I have to work

[tor-dev] Criteria for prioritizing pluggable transport work

2013-09-30 Thread Roger Dingledine
Below is my first go at a list of criteria to consider when evaluating pluggable transports for readiness of deployment to users. The goal isn't to say that every transport has to pass each question -- rather, I'm hoping to fund a researcher-developer at some point soon to polish some of the

Re: [tor-dev] Torperf implementation considerations

2013-09-30 Thread Kevin Butler
Hi Karsten, Sathya, Hope you've both had great weekends, please see inline! Want to help define the remaining data formats? I think we need these formats: - file_upload would be quite similar to file_download, but for the GET POST performance experiment. Or maybe we can generalize

[tor-dev] Sponsor F: update; next meeting [in *two weeks*]

2013-09-30 Thread Tom Lowenthal
Today, at 1100 Pacific, we spent more than 90 minutes discussing [Sponsor F][]. Here's the summary. **READ THIS**: The next Sponsor F meeting will be held in a mere two weeks on **2013-10-14, at 1100h Pacific in #tor-dev**. This is a schedule change: from now on, the meetings will be every two

Re: [tor-dev] Sponsor F: update; next meeting [in *two weeks*]

2013-09-30 Thread Colin C.
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On 30/09/13 09:13 PM, Tom Lowenthal wrote: Today, at 1100 Pacific, we spent more than 90 minutes discussing [Sponsor F][]. Here's the summary. **READ THIS**: The next Sponsor F meeting will be held in a mere two weeks on **2013-10-14, at

Re: [tor-dev] Sponsor F: update; next meeting [in *two weeks*]

2013-09-30 Thread Matt Pagan
On Mon, 30 Sep 2013 19:13:37 -0700 Tom Lowenthal m...@tomlowenthal.com wrote: Today, at 1100 Pacific, we spent more than 90 minutes discussing [Sponsor F][]. Here's the summary. **READ THIS**: The next Sponsor F meeting will be held in a mere two weeks on **2013-10-14, at 1100h Pacific in