Re: [tor-talk] New to list and questions about exit nodes

2013-10-25 Thread Roger Dingledine
On Fri, Oct 25, 2013 at 06:01:51PM +1030, DeveloperChris wrote: An acquittance of mine created a tor exit node, I know little detail more than that other than he was banned by services such as skype and ebay. and apparently the machine he used was hacked. Now I know he is very security

Re: [tor-talk] TOR network topology

2013-10-25 Thread Roger Dingledine
On Fri, Oct 25, 2013 at 12:17:57PM +, Mads Tinggaard Pedersen wrote: I am a student writing my master's thesis. I am, among other things, analyzing the degree of anonymity in a network and would like to investigate real life examples of TOR networks. However, all I could find is

Re: [tor-talk] tor browser bundle uninstalled

2013-10-25 Thread Roger Dingledine
On Fri, Oct 25, 2013 at 08:54:15PM +0100, e-letter wrote: Readers, For some unknown reason, after installing an extension, the firefox browser failed to start with the tor network activated. The error log stated something about a port process being open. Totally depends what extension you

Re: [tor-talk] tor available for the iphone 5?

2013-10-25 Thread Roger Dingledine
On Fri, Oct 25, 2013 at 05:24:27PM -0400, Nathan Freitas wrote: On Fri, Oct 25, 2013 at 8:40 PM, Tim Wilson twilson4...@yahoo.com wrote: Is there a tor version available for the iphone 5? Thank you See the Onion Browser open-source project and iOS app in iTunes. The best option at the

Re: [tor-talk] New to list and questions about exit nodes

2013-10-25 Thread Roger Dingledine
On Sat, Oct 26, 2013 at 10:25:45AM +1030, DeveloperChris wrote: I appreciate the links. I am trying to come up to speed in double quick time. I have some pretty big plans where I hope to convince lots of people too join Tor. but I cannot in all good conscience, if it opens them up to any form

[tor-talk] Roger's status report, September/October 2013

2013-10-17 Thread Roger Dingledine
Six things I did in September/October 2013: 1) Released Tor 0.2.4.17-rc: https://lists.torproject.org/pipermail/tor-talk/2013-September/029857.html including writing the fix to prioritize NTor handshakes so Tor 0.2.4.x remains usable despite the five million new bot users:

Re: [tor-talk] New paper : Users Get Routed: Traffic Correlation on Tor by Realistic Adversaries

2013-10-16 Thread Roger Dingledine
On Sun, Sep 01, 2013 at 10:10:56PM -0400, Roger Dingledine wrote: On Mon, Sep 02, 2013 at 11:35:22AM +1000, Erik de Castro Lopo wrote: Hi all, Heads up on a new paper suggesting that its possible to unmask Tor users using traffic correlation: http://www.ohmygodel.com

Re: [tor-talk] funnel many computers through one TBB?

2013-10-15 Thread Roger Dingledine
On Fri, Oct 11, 2013 at 09:45:16PM +0200, Moritz Bartl wrote: On 10/11/2013 08:32 PM, Rhona Mahony wrote: Friend J doesn't want to install a Tor Browser Bundle on each of the 50 computers in his company. Can he install one TBB on his router and configure it so that it sends his employees'

Re: [tor-talk] Guard failing very large number of circuits

2013-10-07 Thread Roger Dingledine
On Mon, Oct 07, 2013 at 06:17:32PM -0400, grarpamp wrote: But I don't see that initial bump reflected in the below cutoff field. Though I do think I see fewer entries now than in an earlier run. Is CircuitBuildTimeout the right knob? Should I bump NumEntryGuards and auto-distribute load

[tor-talk] Guardian Tor article

2013-10-04 Thread Roger Dingledine
Just to start off the new media frenzy thread. http://www.theguardian.com/world/2013/oct/04/tor-attacks-nsa-users-online-anonymity http://www.theguardian.com/world/interactive/2013/oct/04/tor-high-secure-internet-anonymity

Re: [tor-talk] Guardian Tor article

2013-10-04 Thread Roger Dingledine
On Fri, Oct 04, 2013 at 11:38:10AM -0400, Roger Dingledine wrote: (Did I miss any good links?) Ah, yes I did: http://www.theguardian.com/world/2013/oct/04/nsa-gchq-attack-tor-network-encryption --Roger -- tor-talk mailing list - tor-talk@lists.torproject.org To unsusbscribe or change other

Re: [tor-talk] Silk Road taken down by FBI

2013-10-03 Thread Roger Dingledine
On Thu, Oct 03, 2013 at 03:25:23PM -0400, The Doctor wrote: On 10/03/2013 01:49 PM, Ahmed Hassan wrote: One question is still remain unanswered. How did they locate Silkroad server before locating him? They had full image of the server before his arrest. Not sure. One hypothesis (and

Re: [tor-talk] Silk Road taken down by FBI

2013-10-03 Thread Roger Dingledine
On Thu, Oct 03, 2013 at 08:12:25AM -0700, Gordon Morehouse wrote: Here's my one teensy thing that bothers me, this bit of speculation from Ars Technica: The Tor Project, whose software enabled the Silk Road, noticed a significant spike in usage in late August and was unable to explain it.

Re: [tor-talk] Silk Road taken down by FBI

2013-10-03 Thread Roger Dingledine
On Thu, Oct 03, 2013 at 08:58:57PM +, mirimir wrote: So they did have the server before they knew who he was. Careful there -- while I assume they didn't lie in their affidavit, it's quite reasonable to assume that they investigated all sorts of things, all sorts of ways, and then afterwards

Re: [tor-talk] Silk Road taken down by FBI

2013-10-03 Thread Roger Dingledine
On Fri, Oct 04, 2013 at 02:11:26AM +, mirimir wrote: On 10/04/2013 01:54 AM, Juan Garofalo wrote: I'm wondering if I got this right: The NSA is supposed to be concerned only with 'national security' issues and can't spy on 'ordinary Americans'. In practice the NSA spies on

[tor-talk] Tor 0.2.5.1-alpha is out

2013-10-02 Thread Roger Dingledine
Tor 0.2.5.1-alpha introduces experimental support for syscall sandboxing on Linux, allows bridges that offer pluggable transports to report usage statistics, fixes many issues to make testing easier, and provides a pile of minor features and bugfixes that have been waiting for a release of the new

Re: [tor-talk] Silk Road taken down by FBI

2013-10-02 Thread Roger Dingledine
On Thu, Oct 03, 2013 at 01:34:37AM +, mirimir wrote: Wow. I just read the complaint :8 He was unfathomably stupid. Words cannot express how stupid he was. This has absolutely no relevance to the Tor network. We just put up a statement on the blog which basically says that:

Re: [tor-talk] Silk Road taken down by FBI

2013-10-02 Thread Roger Dingledine
On Wed, Oct 02, 2013 at 11:17:08PM -0400, Jonathan D. Proulx wrote: :https://blog.torproject.org/blog/tor-and-silk-road-takedown In many ways this is (or should be) a PR win for Tor. 1) No technical vulnerabilities were used (AFAWK) - this should be welcome news to Tor users 2)

Re: [tor-talk] (no subject)

2013-09-25 Thread Roger Dingledine
On Wed, Sep 25, 2013 at 05:32:32PM -0400, Nathan Suchy wrote: Yes. You can download the Tor browser bundle which works fine on all major linux distributions... Right. https://www.torproject.org/projects/torbrowser.html.en#downloads On Sep 25, 2013 4:31 PM, Robert K kjtre...@rocketmail.com

Re: [tor-talk] (no subject)

2013-09-25 Thread Roger Dingledine
On Wed, Sep 25, 2013 at 11:17:20PM +0100, Bernard Tyers - ei8fdb wrote: This is true, but people will use what they can if they have difficulties. Anything that helps people installed TBB must be useful, right? No? As one example, if you're an activist in country X you maybe shouldn't get TBB

Re: [tor-talk] Tor companies

2013-09-23 Thread Roger Dingledine
On Mon, Sep 23, 2013 at 01:14:17PM -0700, coderman wrote: in addition The Tor Project, Inc. there appears to be related: Tor Solutions Corporation - Tor Solutions Corporation in Walpole, MA is a private company categorized under Website Design Services. Our records show it was established in

Re: [tor-talk] development interests

2013-09-23 Thread Roger Dingledine
On Mon, Sep 23, 2013 at 08:24:40PM -0400, David Green wrote: I have -- for my own reasons -- stopped advancing my OS X machine's OS at Tiger. I enjoy working with it and doing my small-time programming. I have been exposed to 'tor' in the recent past and would really like to use it on my

Re: [tor-talk] Your computer is too slow...

2013-09-14 Thread Roger Dingledine
On Sat, Sep 14, 2013 at 07:36:34PM +0200, Sebastian Pfeifer wrote: I now upgraded to Version 0.2.4.17-rc but it still crashes somehow, but without writing anything related to the logfiles. Sep 14 10:26:05.000 [notice] Performing bandwidth self-test...done. Sep 14 11:19:58.000 [notice] Circuit

Re: [tor-talk] Updating Tor Browser Bundle

2013-09-11 Thread Roger Dingledine
On Wed, Sep 11, 2013 at 10:58:53AM +0100, Graham Todd wrote: But does it use vanilla Firefox, or one of the variants such as Iceweasel or IceCat? Vanilla. I'm attempting to keep my distro totally free Vanilla Firefox is free. Unless you count people with trademarks as non-free, in which case

Re: [tor-talk] Tor browser can be fingerprinted

2013-09-11 Thread Roger Dingledine
On Wed, Sep 11, 2013 at 12:50:41PM -0400, Marthin Miller wrote: 1024bit RSA keys which can be cracked in a few hours I believe this to be false currently. (But that doesn't mean we shouldn't fix it, because it will become true some time in the next few decades, and we don't know when that will

Re: [tor-talk] Updating Tor Browser Bundle

2013-09-10 Thread Roger Dingledine
On Tue, Sep 10, 2013 at 06:12:40PM -0400, Nathan Suchy wrote: Because chrome does not use Tor for DNS and that's an issue. Is there a functional reason Tor uses Firefox for the TBB? I personally like Chromium, so I have the Tor packages installed in Ubuntu and use that system wide

Re: [tor-talk] The reasoning behind the 'exit' flag definition

2013-09-09 Thread Roger Dingledine
On Mon, Sep 09, 2013 at 07:25:06PM +, tagnaq wrote: I'd like to understand why the exit flag is defined as it is. The current definition can be found in the directory spec [1]: Exit -- A router is called an 'Exit' iff it allows exits to at least two of the ports 80, 443, and 6667

[tor-talk] Tor 0.2.4.17-rc is out

2013-09-05 Thread Roger Dingledine
Tor 0.2.4.17-rc is the third release candidate for the Tor 0.2.4.x series. It adds an emergency step to help us tolerate the massive influx of users: 0.2.4 clients using the new (faster and safer) NTor circuit-level handshakes now effectively jump the queue compared to the 0.2.3 clients using TAP

Re: [tor-talk] Many more Tor users in the past week?

2013-09-04 Thread Roger Dingledine
On Tue, Sep 03, 2013 at 11:06:54PM -0700, Asa Rossoff wrote: Timeline through August 31 Hi Asa, Thanks for the timeline! Here are a few notes. * February, a dramatic, roughly ten-fold decrease in Syrian directly connnecting Tor users. This was a censoring event I believe. The vanilla Tor

[tor-talk] Roger's status report, August 2013

2013-09-03 Thread Roger Dingledine
Six things I did in August 2013: 1) Wrote a security advisory for the Old Tor Browser Bundles vulnerable issue: https://lists.torproject.org/pipermail/tor-announce/2013-August/89.html and then posted it to the blog and helped to manage the confusion there (700+ comments!)

Re: [tor-talk] New paper : Users Get Routed: Traffic Correlation on Tor by Realistic Adversaries

2013-09-03 Thread Roger Dingledine
On Mon, Sep 02, 2013 at 03:22:33PM +, adrelanos wrote: Roger Dingledine: And we really should raise the guard rotation period. If you do their compromise graphs again with guards rotated every nine months, they look way different. TBB releases are more frequent than every nine months

Re: [tor-talk] Roger's status report, August 2013

2013-09-03 Thread Roger Dingledine
On Tue, Sep 03, 2013 at 05:17:49PM +0100, Graham Todd wrote: Until this year, I was a student at the University of Kent, and you can find the at: http://www.kent.ac.uk where I know some members of the Computer Science Laboratory were very interested in Tor, which was the reason I got

Re: [tor-talk] New paper : Users Get Routed: Traffic Correlation on Tor by Realistic Adversaries

2013-09-01 Thread Roger Dingledine
On Mon, Sep 02, 2013 at 11:35:22AM +1000, Erik de Castro Lopo wrote: Hi all, Heads up on a new paper suggesting that its possible to unmask Tor users using traffic correlation: http://www.ohmygodel.com/publications/usersrouted-ccs13.pdf Code here: http://torps.github.io/

Re: [tor-talk] Contents of PirateBrowser 0.6b

2013-08-31 Thread Roger Dingledine
On Sat, Aug 31, 2013 at 12:35:19AM -0400, krishna e bera wrote: On 13-08-31 12:25 AM, Roger Dingledine wrote: On Fri, Aug 30, 2013 at 04:29:18PM +, Matt Pagan wrote: # Configured for speed Just for the record, the three lines here don't help speed much (or maybe at all

Re: [tor-talk] Tor and Financial Transparency

2013-08-31 Thread Roger Dingledine
On Fri, Aug 30, 2013 at 08:41:13AM -0400, Ted Smith wrote: Until you can find a better funding source in the US than the DoD, that's a reality we'll all have to live with. You should try calling your congressperson and asking them to support legislation to defund the military-industrial

Re: [tor-talk] Many more Tor users in the past week?

2013-08-31 Thread Roger Dingledine
On Sun, Sep 01, 2013 at 03:40:02AM +, mirimir wrote: On 08/31/2013 08:22 AM, grarpamp wrote: Are these requests keyed to and counted towards unique clients whether by ip Which is another thought, graphs are made from logs. If they're based on ip, and new ip's are showing up, just

Re: [tor-talk] Contents of PirateBrowser 0.6b

2013-08-30 Thread Roger Dingledine
On Fri, Aug 30, 2013 at 04:29:18PM +, Matt Pagan wrote: # Configured for speed Just for the record, the three lines here don't help speed much (or maybe at all). ExcludeSingleHopRelays 0 This first line says it's ok to use relays that allow you to make one-hop circuits. Roughly speaking,

Re: [tor-talk] Many more Tor users in the past week?

2013-08-29 Thread Roger Dingledine
On Thu, Aug 29, 2013 at 11:59:55PM -0400, Collin Anderson wrote: Firstly congratulations Tor; secondly this seems pretty solvable with math and what not. I downloaded the direct connecting users csv and created a spreadsheet between the start of the month and the end. It seems that it was the

Re: [tor-talk] Default clients to be non-exit relay LibTech x

2013-08-28 Thread Roger Dingledine
On Wed, Aug 28, 2013 at 12:41:58PM -0700, Percy Alpha wrote: Every client has to download the full list of relays (consensus) periodically. In areas with little connectivity, this already puts a high burden on clients. Griffin pointed out Tor could download only a portion of relays. Done

[tor-talk] Many more Tor users in the past week?

2013-08-27 Thread Roger Dingledine
Hi folks, Check out https://metrics.torproject.org/users.html (for posterity, the longer-term link will be https://metrics.torproject.org/users.html?graph=direct-usersstart=2013-05-29end=2013-08-27country=allevents=off#direct-users ) The number of Tor clients running appears to have doubled

Re: [tor-talk] Inquiry about Vidalia/Tor bundle

2013-08-26 Thread Roger Dingledine
On Mon, Aug 26, 2013 at 05:58:22PM -0500, Missouri Anglers wrote: I downloaded and installed PirateBrowser which is a Firefox browser configured to use vidalia/tor. Not quite -- it is a bundle that includes a variety of software including Firefox, Vidalia, and Tor, configured in the way they

Re: [tor-talk] Isn't it time to ADMIT that Tor is cracked by now??

2013-08-25 Thread Roger Dingledine
On Sun, Aug 25, 2013 at 05:05:26PM -0400, hi...@safe-mail.net wrote: The US feds did actually take down FH, which was a HIDDEN SERVICE! They found it and arrested the admin! Period! Reminds me of my response when in 2011 some Dutch police broke into a hidden service:

Re: [tor-talk] Run the shell script

2013-08-23 Thread Roger Dingledine
On Fri, Aug 23, 2013 at 08:31:26AM -0400, krishna e bera wrote: On 13-08-23 06:46 AM, ? wrote: Thanks much Seth for your effort and help but sadly I got the error Permission denied. I've googled and found chmod +x start-tor-browser but didn't worked, I think I've to chmod

Re: [tor-talk] Can I use a non-Tor exit node?

2013-08-22 Thread Roger Dingledine
On Thu, Aug 22, 2013 at 03:56:27PM -0600, Jim wrote: ziggy wrote: I use a service that doesn't allow Tor. But I'd like to use Tor anyway, except at the end of the path where, hopefully, there is a way to use an exit that won't be detected as Tor. Is something like that possible? I'm

Re: [tor-talk] obfsproxy failure: obfs3

2013-08-14 Thread Roger Dingledine
On Wed, Aug 14, 2013 at 08:46:32AM -0700, lee colleton wrote: The packaged version of tor complains about support for faster OpenSSL: Aug 14 15:26:52.000 [notice] Tor 0.2.4.16-rc (git-dcf6b6d7dda9ffbd) opening log file. Aug 14 15:26:52.000 [notice] We were built to run on a 64-bit CPU, with

Re: [tor-talk] obfsproxy failure: obfs3

2013-08-14 Thread Roger Dingledine
On Wed, Aug 14, 2013 at 09:08:03AM -0700, lee colleton wrote: There's a more serious issue in that my server doesn't appear to be reachable. I've opened tcp:443,9001 along with the two specifiedobfsproxy ports Aug 14 15:26:58.000 [notice] Bootstrapped 100%: Done. Aug 14 15:26:58.000

[tor-talk] Updated Why JavaScript is enabled FAQ entry

2013-08-12 Thread Roger Dingledine
Hi folks, I rewrote our two FAQ entries on JavaScript-in-TBB, and merged them into one: https://www.torproject.org/docs/faq#TBBJavaScriptEnabled Did I leave out any important points, or are there ways to make the issues clearer? (Please don't turn this into a you should change the default you

Re: [tor-talk] So what about Pirate Browser?

2013-08-10 Thread Roger Dingledine
On Sat, Aug 10, 2013 at 07:29:39PM +, Matthew Finkel wrote: The one thing I always think about when I hear about the comparison of censorship circumvention vs. anonymity[0] is something I once heard (maybe from Jake or Roger, I apologies for not having a citation), Jake and I tried to

Re: [tor-talk] So what about Pirate Browser?

2013-08-10 Thread Roger Dingledine
On Sat, Aug 10, 2013 at 08:03:38PM +0200, Randolph D. wrote: urgh, another Firefox mashup? Well, at least they didn't try to shmush the word Tor into the name. More power to them, I say. Though I would also recommend that they get in touch with Mike, Erinn, and others about the Tor Browser

[tor-talk] Tor 0.2.4.16-rc is out

2013-08-10 Thread Roger Dingledine
Tor 0.2.4.16-rc is the second release candidate for the Tor 0.2.4.x series. It fixes several crash bugs in the 0.2.4 branch. https://www.torproject.org/dist/ Changes in version 0.2.4.16-rc - 2013-08-10 o Major bugfixes: - Fix a bug in the voting algorithm that could yield incorrect results

Re: [tor-talk] Secure email with limited usable metadata

2013-08-09 Thread Roger Dingledine
On Fri, Aug 09, 2013 at 06:50:08AM -0400, grarpamp wrote: here's to hoping TorMail stays dormant... ..I don't agree. It will be a long time before anything replaces traditional email worldwide. While I don't really have an opinion on whether this service should stay dormant, I do hope they

Re: [tor-talk] Tor Check Problem?

2013-08-08 Thread Roger Dingledine
On Thu, Aug 08, 2013 at 08:10:31PM -0400, Webmaster wrote: anyone know whats going on with tor check? Sorry, your query failed or an unexpected response was received. A temporary service outage prevents us from determining if your source IP address is a Tor https://www.torproject.org/

Re: [tor-talk] Javascript vs privacy?

2013-08-07 Thread Roger Dingledine
On Wed, Aug 07, 2013 at 09:28:17AM +0200, Jon Tullett wrote: is there scope for better communicating to a user (such as in the Tor browser homepage) that JS is enabled to improve their browsing experience and enhance privacy, but it may open them to (another) attack and here's how it can be

Re: [tor-talk] Verifying Tor packages.

2013-08-07 Thread Roger Dingledine
On Wed, Aug 07, 2013 at 02:32:47PM +0200, Frithjof wrote: Neither sha1 sums, nor PGP signatures depend on the file name of the file to be verified. This allows some kind of replay attack: If I can get a user to download from my side, I could choose an old version of the TBB with some known

Re: [tor-talk] HS drop

2013-08-05 Thread Roger Dingledine
On Mon, Aug 05, 2013 at 01:27:25AM -0400, grarpamp wrote: On Sun, Aug 4, 2013 at 12:42 AM, grarpamp grarp...@gmail.com wrote: Noting what is apparently a very large drop in the number of onions online. Still checking... Estimating dropout at about 400 onions or 1/3 of total. How are you

[tor-talk] Tor security advisory: Old Tor Browser Bundles vulnerable

2013-08-05 Thread Roger Dingledine
SUMMARY: This is a critical security announcement. An attack that exploits a Firefox vulnerability in JavaScript [1] has been observed in the wild. Specifically, Windows users using the Tor Browser Bundle (which includes Firefox plus privacy patches [2]) appear to have been targeted.

[tor-talk] Help wanted: bug when using a public relay as a bridge?

2013-07-31 Thread Roger Dingledine
Long ago we had a bug where your Tor client would crash or assert if you configure a public relay to be your bridge: https://trac.torproject.org/projects/tor/ticket/1776 We think we accidentally got rid of the problem when we switched to the microdescriptor design in Tor 0.2.3.x. I've asked Nick

Re: [tor-talk] Youtube becoming unusable

2013-07-29 Thread Roger Dingledine
On Mon, Jul 29, 2013 at 10:11:42PM -0400, krishna e bera wrote: In the last few weeks, i have encountered captchas almost every session i go onto Youtube. Is this a consequence of the decision to raise the required bandwidth bar for fast relays, so that more connections come from fewer exits?

Re: [tor-talk] NSA, Tempora, PRISM And Company always know who is behind Tor?

2013-07-18 Thread Roger Dingledine
On Fri, Jul 19, 2013 at 01:54:24AM +0200, F Fake wrote: NSA, Tempora, PRISM And Company can always look who is behind Tor? No. They know the real IP of every Tor user every time they use Tor? Probably not. Your first question was Can Tor defeat NSA, Tempora, PRISM? and the answer to that is

Re: [tor-talk] NSA, Tempora, PRISM And Company always know who is behind Tor?

2013-07-18 Thread Roger Dingledine
On Thu, Jul 18, 2013 at 09:31:21PM -0300, Juan Garofalo wrote: They know the real IP of every Tor user every time they use Tor? Probably not. Why not? Don't they monitor enough internet traffic to know what the users are doing? Don't all ISPs either work for the NSA, or let the

Re: [tor-talk] Hidden Service Scaling --- How bad is it?

2013-07-18 Thread Roger Dingledine
On Fri, Jul 19, 2013 at 01:09:23AM +, Andrew F wrote: I read on the tor blog that Hidden services do not scale well and there are several potential attack vectors on hidden services. Also, they are very slow.How slow are we talking? https://trac.torproject.org/projects/tor/ticket/2554

Re: [tor-talk] Would Conflux have a positive effect against website fingerprinting?

2013-07-16 Thread Roger Dingledine
On Sun, Jul 14, 2013 at 11:28:25AM -0700, Mike Perry wrote: Supposing it is applied does it help to prevent website fingerprinting to a high extend? (high extend = being costly to circumvent by adversaries) This was my estimation, too. Against passive adversaries, it should do quite well,

Re: [tor-talk] Tor 0.2.4.15-rc is out -- please test!

2013-07-13 Thread Roger Dingledine
On Wed, Jul 03, 2013 at 02:05:14PM -0400, Roger Dingledine wrote: Tor 0.2.4.15-rc is the first release candidate for the Tor 0.2.4.x series. It fixes a few smaller bugs, but generally appears stable. Please test it and let us know whether it is! https://www.torproject.org/dist/ (Next step

Re: [tor-talk] Will Tor affect Internet Explorer? (newbie question)

2013-07-13 Thread Roger Dingledine
On Sat, Jul 13, 2013 at 02:48:40PM -0700, Scott MacLeod wrote: How does Tor/Vidalia handle the issue of one's computer recording one's own key strokes unbeknownst to the end user Not at all. Tor is a socks proxy, and Tor Browser Bundle is that plus a Firefox fork which, if you use it correctly,

Re: [tor-talk] Will Tor affect Internet Explorer? (newbie question)

2013-07-13 Thread Roger Dingledine
On Sat, Jul 13, 2013 at 08:09:04PM -0400, Gabrielle DiFonzo wrote: Socks proxy? Firefox fork? Can somebody give me a glossary? It's great that there are so many new people learning about Tor these days. But on the other hand, Tor (like security in general) is still one of those things that takes

Re: [tor-talk] Should I warn against Tor?

2013-07-06 Thread Roger Dingledine
On Sat, Jul 06, 2013 at 12:46:17PM +0200, Jens Lechtenboerger wrote: 1. If you are using Tor, you should assume that all your network traffic gets stored, analyzed, and de-anonymized by intelligence agencies. I don't want to tell you to stop worrying, but depending on how much you think these

Re: [tor-talk] TorWall - experimental transparent Tor proxy for Windows

2013-07-05 Thread Roger Dingledine
On Thu, Jul 04, 2013 at 08:34:35PM -0700, reqrypt wrote: In a nutshell, TorWall does two things: 1) It (transparently) reroutes all HTTP traffic through the Tor anonymity network; and 2) It blocks all non-Tor traffic (including DNS) to and from your computer. Neat! Bastik pointed out the

Re: [tor-talk] [Question] Making private Tor network

2013-07-04 Thread Roger Dingledine
On Thu, Jul 04, 2013 at 09:59:11PM +0900, ÀÌÈ¿¼® wrote: I am making private Tor network which consist of 5 nodes. So I installed Tor browser to onion proxy and onion routers I thought that Tor network would be generated, because private network that I made has three onion routers and a

[tor-talk] Tor 0.2.4.15-rc is out

2013-07-03 Thread Roger Dingledine
Tor 0.2.4.15-rc is the first release candidate for the Tor 0.2.4.x series. It fixes a few smaller bugs, but generally appears stable. Please test it and let us know whether it is! https://www.torproject.org/dist/ (Next step is clearly to get more user-usable bundles available with this version,

Re: [tor-talk] How intensely do you use Tor?

2013-07-03 Thread Roger Dingledine
On Wed, Jul 03, 2013 at 07:43:47PM +, anonymous coward wrote: I think for certain things it does not make much sense to use Tor, for example for online banking. When I connect to my bank I am not anonymous anway. When I use ebay, I am not anonymous either, they have my adress, Paypal knows

Re: [tor-talk] Vidalia error message with TorBirdy

2013-07-02 Thread Roger Dingledine
On Tue, Jul 02, 2013 at 09:27:23PM +, anonymous coward wrote: Hello, I start Tor with Vidalia. And I use TorBirdy with Thunderbird. Sometimes I see a message from Vidalia: This is from the Vidalia log: Jul 02 22:34:44.907 Application request to port 143: this port is commonly used

Re: [tor-talk] Webpage autorefresh weakens onion routing

2013-07-02 Thread Roger Dingledine
On Tue, Jul 02, 2013 at 06:45:24PM -0700, Mark Yaler wrote: Let's say you open webpage X, which automatically refreshes every minute. But the user doesn't immediately realize this problem. Variations of this attack are in various research papers, e.g.

[tor-talk] Tor 0.2.4.13-alpha is out

2013-06-16 Thread Roger Dingledine
Tor 0.2.4.13-alpha fixes a variety of potential remote crash vulnerabilities, makes socks5 username/password circuit isolation actually actually work (this time for sure!), and cleans up a bunch of other issues in preparation for a release candidate. https://www.torproject.org/dist/ Changes in

Re: [tor-talk] Anonymity of Leaking Servers (Was Re: [tor-dev] Trawling for Tor Hidden Services: Detection, Measurement, Deanonymization)

2013-05-27 Thread Roger Dingledine
On Mon, May 27, 2013 at 06:19:06PM -0700, Micah Lee wrote: I agree, most of the time leak sites don't need as much anonymity from hidden services. See also https://gitweb.torproject.org/torspec.git/blob/HEAD:/proposals/ideas/xxx-encrypted-services.txt (especially motivation 2) --Roger

[tor-talk] PETools workshop submissions due May 15

2013-05-13 Thread Roger Dingledine
PETools: Workshop on Privacy Enhancing Tools July 9, 2013, Bloomington, Indiana, USA Held in conjunction with PETS 2013 http://petools.soic.indiana.edu/ The goal of this workshop is to discuss the design of privacy tools aimed at real-world deployments. This workshop will bring together privacy

Re: [tor-talk] HTML5 video and Tor anonymity.

2013-05-01 Thread Roger Dingledine
On Wed, May 01, 2013 at 06:16:49PM +, Andrew F wrote: Thanks noel, Is there a way to sandbox flash and make it safe? Keep an eye on (and please contribute to!) https://trac.torproject.org/projects/tor/ticket/7680 and its subtickets. --Roger ___

Re: [tor-talk] Tor's reputation problem with pedo, some easy steps the community could take

2013-04-29 Thread Roger Dingledine
On Mon, Apr 29, 2013 at 08:51:32PM +0200, Guido Witmond wrote: However, given the nature of onion sites, I don't know how the police investigators could track and take down the source without defeating the anonymity of Tor.

Re: [tor-talk] Tor's reputation problem with pedo, some easy steps the community could take

2013-04-29 Thread Roger Dingledine
On Mon, Apr 29, 2013 at 03:30:37PM -0400, Chris Patti wrote: What about simply scouring all the directories, removing links to the pedo sites? Please do! That said, you're already falling into a trap when you say all the directories. I know the person who ran the hidden wiki -- he shut it down

Re: [tor-talk] NPA to urge Internet providers to block users of hijacking software [Tor]

2013-04-22 Thread Roger Dingledine
On Sun, Apr 21, 2013 at 05:33:00PM -0500, bgw wrote: via: http://mainichi.jp/english/english/newsselect/news/20130418p2a00m0na013000c.html The National Police Agency (NPA) is poised to urge Internet service providers to voluntarily block communications if an anonymous software system

Re: [tor-talk] anonymity at the outset

2013-04-15 Thread Roger Dingledine
On Mon, Apr 15, 2013 at 04:40:42AM -0400, eli wrote: Something's been bothering me since I began contributing bandwidth to the Tor network. Now that I've been running a bridge for awhile and feel more or less confident of what I'm doing, I guess I can ask what may be a dumb question. The

[tor-talk] Roger's status report, Mar 2013

2013-04-10 Thread Roger Dingledine
Five things I did in March 2013: 1) Released Tor 0.2.4.11-alpha: https://lists.torproject.org/pipermail/tor-talk/2013-March/027563.html 2) Attended the tech@state conference in DC, where various groups that the US State Dept is funding got together to talk. I was on a panel about circumvention

[tor-talk] Tor 0.2.4.11-alpha is out

2013-03-11 Thread Roger Dingledine
Tor 0.2.4.11-alpha makes relay measurement by directory authorities more robust, makes hidden service authentication work again, and resolves a DPI fingerprint for Tor's SSL transport. https://www.torproject.org/dist/ Changes in version 0.2.4.11-alpha - 2013-03-11 o Major features (directory

Re: [tor-talk] How easy are Tor hidden services to locate?

2013-03-06 Thread Roger Dingledine
On Wed, Mar 06, 2013 at 01:12:47AM -0600, Anthony Papillion wrote: I'm involved in a project that will ultimately run a website as a hidden service. Because of the content if the site (not child porn or gambling) we're concerned about how easy a Tor connected server is to find. Hidden

Re: [tor-talk] How easy are Tor hidden services to locate?

2013-03-06 Thread Roger Dingledine
On Wed, Mar 06, 2013 at 03:46:51PM -0300, Juan Garofalo wrote: Hidden services are definitely weaker than regular Tor circuits, a) because the adversary can induce them to speak, Care to elaborate on that? You mean timing attacks (based on the fact that hidden servers 'speak' to clients?) ?

Re: [tor-talk] Fwd: Starting out: Project Coordinator

2013-03-05 Thread Roger Dingledine
On Tue, Mar 05, 2013 at 02:46:28AM +, adrelanos wrote: So if somehow the time between posting a patch, reviewing a patch and merging a patch could be reduced, that would be awesome. That is certainly one of the challenging points. Once upon a time when there was roughly 1 Tor developer, we

[tor-talk] Roger's status report, Feb 2013

2013-03-05 Thread Roger Dingledine
Five things I did in February 2013: 1) Released Tor 0.2.4.10-alpha: https://lists.torproject.org/pipermail/tor-talk/2013-February/027233.html 2) Explained the remaining items from SponsorF Year3 to Karsten: https://trac.torproject.org/projects/tor/wiki/org/sponsors/SponsorF/Year3 3) Helped Nick

Re: [tor-talk] Where can I get Tor without the browser?

2013-02-21 Thread Roger Dingledine
On Fri, Feb 22, 2013 at 01:08:37AM +0100, Robin Kipp wrote: Am I just missing something here, or is there really no other wway of obtaining a 'plain' binary of Tor for Mac OS? Download the Tor Browser Bundle for OS X, unpack it, and use the Tor binary that you find inside. (In Linux, it's in the

Re: [tor-talk] Another Hidden Service question

2013-02-12 Thread Roger Dingledine
On Tue, Feb 12, 2013 at 09:11:33AM +, Nathan Freitas wrote: Does the fact that my actual IP address has changed (say my Tor client moves from a 3G to a wifi connection), or by extension, by Tor client has stopped and started, have any impact on the availability of a Hidden Service I am

[tor-talk] Roger's status report, Jan 2013

2013-02-06 Thread Roger Dingledine
Five things I did in January 2013: 1) Continued my rampage to teach law enforcement groups about Tor, including a US DEA talk, a Dutch regional police talk, a Belgian FCCU talk, and a Dutch KPN talk; and my parallel rampage to document and publish the results:

Re: [tor-talk] Vidalia Network Map list blank

2013-02-04 Thread Roger Dingledine
On Mon, Feb 04, 2013 at 07:49:15AM -, ratl...@tormail.org wrote: Tails 0.16 - Vidalia relays list is blank at start and with continued use without a refresh. Bug is identical in previous versions. https://trac.torproject.org/projects/tor/ticket/6483 It's fixed in Vidalia 0.2.21, but

[tor-talk] Tor 0.2.4.10-alpha is out

2013-02-04 Thread Roger Dingledine
Tor 0.2.4.10-alpha adds defenses at the directory authority level from certain attacks that flood the network with relays; changes the queue for circuit create requests from a sized-based limit to a time-based limit; resumes building with MSVC on Windows; and fixes a wide variety of other issues.

Re: [tor-talk] TOR Fone - p2p secure and anonymous VoIP tool

2013-02-03 Thread Roger Dingledine
On Sun, Feb 03, 2013 at 01:49:50PM +, adrelanos wrote: I haven't seen TOR Fone discussions on this list. Description (selection by adrelanos, see TOR Fone homepage [1] for original text). Ugh! Another project using the Tor name in a confusing way (which will make people think it is

Re: [tor-talk] Tor relay on small and cheap devices

2013-01-21 Thread Roger Dingledine
On Sun, Jan 20, 2013 at 04:28:13PM -0800, Mike Perry wrote: it's unlikely that the network could support enough of these tiny relays to actually make any substantial capacity difference, and they may actually harm overall performance rather than help it. See also

[tor-talk] Tor 0.2.4.9-alpha is out

2013-01-15 Thread Roger Dingledine
Tor 0.2.4.9-alpha provides a quick fix to make the new ntor handshake work more robustly. https://www.torproject.org/download Changes in version 0.2.4.9-alpha - 2013-01-15 o Major bugfixes: - Fix backward compatibility logic when receiving an embedded ntor handshake tunneled in a

Re: [tor-talk] TBB as a deb (was Re: Tor 0.2.4.8-alpha is out)

2013-01-15 Thread Roger Dingledine
On Tue, Jan 15, 2013 at 07:28:34PM -0500, Micah Lee wrote: Are there plans to release the Tor Browser Bundle as a package in Tor's official repos, e.g. http://deb.torproject.org/torproject.org/? This would make keeping an up-to-date TBB much more convenient. It sure would make things more

Re: [tor-talk] Project idea: TorBox

2013-01-14 Thread Roger Dingledine
On Mon, Jan 14, 2013 at 11:23:17PM +0100, Morgan Andreasson wrote: *The TorBox* First thought: we try not to mash the word 'Tor' together with generic other words: https://www.torproject.org/docs/trademark-faq#combining See e.g. a previous TorBOX: http://sourceforge.net/projects/torbox/ *What

[tor-talk] Tor 0.2.4.8-alpha is out

2013-01-14 Thread Roger Dingledine
Tor 0.2.4.8-alpha introduces directory guards to reduce user enumeration risks, adds a new stronger and faster circuit handshake, and offers stronger and faster link encryption when both sides support it. https://www.torproject.org/download Changes in version 0.2.4.8-alpha - 2013-01-14 o Major

Re: [tor-talk] Telex Circumvention tool

2012-12-29 Thread Roger Dingledine
On Sun, Dec 30, 2012 at 02:55:02AM +, adrelanos wrote: Telex https://telex.cc/ Circumvention tool. Concept looks promising. Has never been discussed here. Why not? Does anyone know more? I am interested what the status and progress is. Unfortunately, my mailing list subscription

Re: [tor-talk] Roger's status report, Nov 2012

2012-12-26 Thread Roger Dingledine
On Wed, Dec 19, 2012 at 02:49:12AM -0800, Mike Perry wrote: Thus spake Roger Dingledine (a...@mit.edu): Six big things I did in November: 1) Attended the NSF PI meeting for our new grant (joint with Georgia Tech and Princeton). Met dozens of professors and renewed connections

[tor-talk] Tor 0.2.4.7-alpha is out

2012-12-25 Thread Roger Dingledine
Tor 0.2.4.7-alpha introduces a new approach to providing fallback directory mirrors for more robust bootstrapping; fixes more issues where clients with changing network conditions refuse to make any circuits; adds initial support for exiting to IPv6 addresses; resumes being able to update our

<    1   2   3   4   5   6   >