Re: [tor-talk] how to answer in tree (mailing list)?

2012-01-19 Thread proper
Am 2012-01-19 15:52, schrieb pro...@tormail.net: How to correctly answer into an existing tree? By correctly setting the In-Reply-To and References headers of your mail. In-Reply-To is to be set to the value of the Message-ID header (the message ID) of the mail you want to reply to.

Re: [tor-talk] tor-bundle , ssh , torsock howto ?

2012-01-20 Thread proper
On Fri, 20 Jan 2012 17:26:15 +0530 J. Bakshi baksh...@gmail.com wrote: Dear list, I have tor-browser-bundle running. how can I use ssh with the tor running inside this browser bundle ? I have installed torsocks already. Is torsocks is better ? Confused... Please help. Thanks well,

Re: [tor-talk] Tor Gateway and Tor Workstation by ra [was: remove any all links from torproject.com to JanusVM]

2012-01-21 Thread proper
On Fri, 20 Jan 2012 11:41:18 - pro...@tormail.net wrote: Is Ra's Tor gateway VM http://ra.fnord.at/2011/05/easy-and-secure-anonymous-internet-usage/ safe to use on trusted host machines? Many people (ra, JanusVM, me) are interested in deploying something ra calls 'Tor Workstation',

Re: [tor-talk] Tor Gateway and Tor Workstation by ra [was: remove any all links from torproject.com to JanusVM]

2012-01-21 Thread proper
Of course, TAILS is most secure when run as a LiveCD, which isn't possible with the Tor gateway+workstation VM setup. Not with the VM setup but my final goal is to use three cpu's. The goal of my instructions https://trac.torproject.org/projects/tor/wiki/doc/TorBOX is to be as portable as

Re: [tor-talk] tor-bundle , ssh , torsock howto ?

2012-01-21 Thread proper
On Fri, 20 Jan 2012 16:47:06 - pro...@tormail.net wrote: On Fri, 20 Jan 2012 17:26:15 +0530 J. Bakshi baksh...@gmail.com wrote: Dear list, I have tor-browser-bundle running. how can I use ssh with the tor running inside this browser bundle ? I have installed torsocks

Re: [tor-talk] IDEA: Compress traffic at exit

2012-01-21 Thread proper
Hi, it's me again. I got another idea. I don't understand what works and what has to be done exactly. I'm not an developer. I don't understand the technical background as well as needed to predict my changes to the specs. It's written in the form of a proposal, but it should not be

Re: [tor-talk] Talking to users, six months later

2012-01-21 Thread proper
It was all very interesting to read. Thank you! ___ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

Re: [tor-talk] Tor plus VPN (was re: Hi all!)

2012-01-22 Thread proper
Another advantage here is that it prevents Tor from seeing who you are behind the VPN. So if somebody does manage to break Tor and learn the IP address your traffic is coming from, but your VPN was actually following through on their promises (they won't watch, they won't remember, and they

Re: [tor-talk] IDEA: Compress traffic at exit

2012-01-22 Thread proper
Am 21.01.2012 15:39, schrieb pro...@tormail.net: 2) caching proxy Just like existing caching proxys. The exit server would safe bandwidth if they wouldn't always request all websites fresh but use a local cache. Also option for both, Tor-user and exit server if they wish to use the feature.

[tor-talk] leak through Antivirus Webscanner possible?

2012-01-29 Thread proper
Nowadays Antivirus software often includes a Webscanner, even free ones... The webscanner scans the tcp stream on the fly and may stop (or modify?) it. Perhaps he is sending back - over non anonymous channels - for remote analysis? Do you think legit Antivirus software may compromise anonymity?

[tor-talk] the wiki is dangerous for end users [was: TBB Users: We Need New Directions on Torifying Software! Solution Required!]

2012-02-02 Thread proper
The problem is not just this site https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO. Rather it's a problem with the wiki itself, for example also https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/WebBrowsers is outdated. No Tor end user should torify Firefox anymore. Few

[tor-talk] How to use Tor Browser without TBB Bundle?

2012-02-06 Thread proper
I am using a transparent proxy (all connections are forced through Tor). The Tor Browser isn't just Firefox, it contains many security related patches, settings and addons. Therefore I can't just go ahead and install the addons myself into normal Firefox. [1] There is even a patch to prevent Tor

[tor-talk] Adblock Plus and Ghostery should be included in Tor bundle

2012-02-12 Thread proper
Ghostery should not be added to TBB, it's not Free Software. No source code available. TBB would rely on a single company. If all that would not be the case, and if it's safe to implement, I'd be happy to see it in TBB. Same goes for Adblock Plus. If it's safe, it should come preinstalled with

[tor-talk] Adblock Plus and Ghostery should be included in Tor bundle

2012-02-13 Thread proper
But just curious, which part of Ghostery is closed source, because when I open up the xpi I don't see any binaries, but haven't looked at everything. Closed source is the opposite of Open Source, and Open Source is much more then just giving away the source code. It's about laws and licenses.

[tor-talk] Hidden service security w. Apache/Win32

2012-02-19 Thread proper
So far I haven't found any public info about the possible downsides of running a hidden service under Windows. Let's assume a fresh, clean windows installation. Have you found a list and description of all outgoing network connections, that will be made by that windows installation? I haven't

[tor-talk] Hidden service security w. Apache/Win32

2012-02-19 Thread proper
Is the time sync spoofing even applicable to hidden services? How can the MS time server tampering with the exit nodes be applicable to hidden services? It has nothing to do directly with Apache or the hidden service. For correct operation Tor needs the correct time and date. Windows will

[tor-talk] How accurate does need the clock to be?

2012-02-19 Thread proper
Let's assume the time server is not trusted. How accurate does the clock have to be? Is +/- 30 minutes sufficient for Tor's correct operation? Do you see any risks if the user manually adjusts the clock on each restart? ___ tor-talk mailing list

[tor-talk] Tales from the DNSCrypt: Linux Rising

2012-02-20 Thread proper
It's an interesting update and I hope it will widespread along all public DNS servers. I am not sure how Tor users could profit from it. Advantage: - Exit node can not spy or even worse, spoof and redirect any DNS requests. Disadvantage: - Single point of failure, OpenDNS could be forced to

Re: [tor-talk] Tor users trackable with common proxy?

2012-02-21 Thread proper
On 02/21/2012 06:48 PM, Andreas Krey wrote: On Tue, 21 Feb 2012 14:26:06 +, Daniel .koolfy Faucon wrote: ... Checking the software's signatures should ensure that you are not bootstrapping from harcoded malicious fake nodes or looking at the wrong nodes list, and obfsproxy makes sure

[tor-talk] bridges: stenography to hide Tor traffic

2012-02-21 Thread proper
From the FAQ https://trac.torproject.org/projects/tor/wiki/doc/TorFAQ#YoushouldusesteganographytohideTortraffic. First, in the current network topology, the Tor relays list is public and can be accessed by attackers. An attacker who wants to detect or block anonymous users could always just notice

[tor-talk] bridges - higher risks for hidden services?

2012-02-26 Thread proper
Is it still advisable for users of bridges to host hidden services? Especially for private obfuscated bridges. The bridge users have only a limited number of non-blocked bridge IP addresses. And if the bridge is compromised, isn't the the risk for de-anonymizing the hidden service higher?

Re: [tor-talk] Operating system updates / software installation behind Tor Transparent Proxy

2012-03-01 Thread proper
proper proper pro...@secure-mail.biz writes: [...] You can easily do so by separating traffic at user level (root vs. regular users). Why do we need a special package for such a simple task? That's not possible. Everything behind the transparent proxy, root or regular user, has only

Re: [tor-talk] Operating system updates / software installation behind Tor Transparent Proxy

2012-03-01 Thread proper
Ok, thanks for your reply! __ powered by Secure-Mail.biz - anonymous and secure e-mail accounts. ___ tor-talk mailing list tor-talk@lists.torproject.org

Re: [tor-talk] Operating system updates / software installation behind Tor Transparent Proxy

2012-03-02 Thread proper
snip But apt uses GPG (run with (necessarily) root privileges) to verify the files it downloads. Sucks to be a Debian user when someone finds another code-exec bug in GPG's parsing code. Indeed. Encrypted updates would be handy. I support http://brainstorm.ubuntu.com/idea/26541/. Or

Re: [tor-talk] Operating system updates / software installation behind Tor Transparent Proxy

2012-03-03 Thread proper
snip I'm more worried about the risks to user anonymity. It sucks to be the user reading about some sensitive subject when your apt cron job decides to poke every package source you install from. “Oh, that guy who keeps reading about Foozer's Disease must be in the Antarctica/McMurdo

Re: [tor-talk] Operating system updates / software installation behind Tor Transparent Proxy

2012-03-03 Thread proper
--- Ursprüngliche Nachricht --- Von: grarpamp grarp...@gmail.com Datum: 02.03.2012 07:45:20 An: tor-talk@lists.torproject.org Betreff: Re: [tor-talk] Operating system updates / software installation behind Tor Transparent Proxy On Thu, Mar 1, 2012 at 11:31 PM, Andrew Lewman

[tor-talk] Obtain real IP behind Tor transparent proxy; was: Operating system updates / software installation behind Tor Transparent Proxy

2012-03-03 Thread proper
The transparently proxied operating system does not know it's real external IP, only it's Tor exit IP. And can therefore never leak it's real external IP. I see this claim made all the time — is it actually true? Is Tor designed to withstand active attacks where Torified applications try

Re: [tor-talk] Operating system updates / software installation behind Tor Transparent Proxy

2012-03-03 Thread proper
On Sat, 03 Mar 2012 15:00:51 +, Maxim Kammerer wrote: On Sat, Mar 3, 2012 at 10:33, pro...@secure-mail.biz wrote: The transparently proxied operating system does not know it's real external IP, only it's Tor exit IP. And can therefore never leak it's real external IP. I see this

Re: [tor-talk] TBB Users: We Need New Directions on Torifying Software! Solution Required! (Still not solved, month #3)

2012-03-04 Thread proper
This is a repost of important question NOT solved within the last two months. This is my second attempt today to send this message. Is it being deleted by moderation because I don't think that is the case. Forget about tormail. I also left them. It's too often not online and in meanwhile

[tor-talk] Awareness for identity correlation through circuit sharing is almost zero.

2012-03-05 Thread proper
The users awareness for identity correlation through circuit sharing [0] is almost zero. There should be more clear warnings about it on torproject.org. People are frequently told to extensively use Google. They do so and will be affected. If you google the term [1] you will see that it has

Re: [tor-talk] Tor and HTTPS graphic

2012-03-06 Thread proper
Nice, I like it very much. It also demonstrates the need for DNSCrypt, then site.com would also disappear from a few places. Can you release the source code for the demonstration? That would allow other to build up on your work. Other things like DNSCrypt, distributed DNS, alternative web of

[tor-talk] How to contribute / takeover a sub project?

2012-03-06 Thread proper
I am interested in overtaking the project TorVM. [1] [2] [3] TorVM has been abandoned by it's original authors, no more development and discussions are going on for years. My project, TorBOX [4] offers the already same functionality. And it offers even more. Almost all key features are ready

Re: [tor-talk] How to contribute / takeover a sub project?

2012-03-06 Thread proper
I am delighted that you as one of the original TorVM developers, is answering this thread. If you are still interested in this project, you are invited to join us. My project, TorBOX [4] offers the already same functionality. not quite; some differences that drove the original Tor VM

Re: [tor-talk] How to contribute / takeover a sub project?

2012-03-06 Thread proper
On Tue, Mar 06, 2012 at 08:01:36PM +0100, pro...@secure-mail.biz wrote 1.2K bytes in 19 lines about: : Please tell me the requirements for overtaking the project. Generally, commit code. That's what we done. Everything is Open Source and documented.

Re: [tor-talk] How to contribute / takeover a sub project?

2012-03-06 Thread proper
On Tue, Mar 6, 2012 at 5:37 PM, pro...@secure-mail.biz wrote: ... Nowadays VirtualBox is fully Open Source. It was not in past, but now it is. There is a closed source extension package for VirtualBox with stuff like rdp, but that is not required. We use only the Open Source edition which

Re: [tor-talk] How to contribute / takeover a sub project?

2012-03-06 Thread proper
I am interested in overtaking the project TorVM. I'm not sure what you mean by 'taking over' the project. Besides having a copy of the source archived in svn we aren't associated with it. What I mean by taking over is, when you go on torproject.org, you see Our Projects... Additionally

Re: [tor-talk] How to contribute / takeover a sub project?

2012-03-07 Thread proper
On Tue, Mar 6, 2012 at 6:27 PM, pro...@secure-mail.biz wrote: ... What I mean by taking over is, when you go on torproject.org, you see Our Projects... note that Tor VM is not on that page. (taking over Tor VM would not grant you a spot ;) There are only spots for projects which are

Re: [tor-talk] Azureus cannot work with Tor

2012-03-22 Thread proper
On 22 March 2012 12:15, Robert Ransom rransom.8...@gmail.com wrote: On 2012-03-22, Michael Holzman mike1...@mail.ru wrote: Greetings, I'm a newbie trying to setup a working Azureus (aka Vuze)-Tor pair. Unfortunately,I cannot achieve that. Reading the documentation and searching

Re: [tor-talk] Designing a secure Tor box for safe web browsing?

2012-03-26 Thread proper
I'm curious about what resources proved to be limiting during your experiments, and what too demanding means in your usecases. Knowing these figures would make this report useful, to a degree, to draw conclusions for other usecases. Quoted from http://dee.su/liberte Moreover, some concepts

[tor-talk] Status/progress of TorRouter?

2012-03-29 Thread proper
What is the status of TorRouter? Any progress on the project? I've been monitoring the active trac tickets and wiki sites. There are no changes since a long time. Is the progress behind closed doors? What is up with that project? Became it to big, unmaintainable, time-consuming? Or what are

Re: [tor-talk] TorRouter - kickstarter

2012-03-29 Thread proper
Thanks Andrew for the detailed answer! We're pondering kickstarter as well as a for-profit I didn't know that page. Looks very well.. http://www.kickstarter.com That sounds like very reasonable plan. FreedomBox had a lot success using kickstarter. In a very short time they got loads of

Re: [tor-talk] obfsproxy

2012-03-29 Thread proper
Hi, is there any deb package or Ubuntu PPA repository for obfsproxy? If not - are there any plans for that? Regards, Matej Although compiling obfsproxy is as easy as it could be, I asked that questions myself.

Re: [tor-talk] Tor forum [WAS: Server/host for Tor forum in Iceland or Norway?]

2012-04-01 Thread proper
Hello Proper On Fri, March 30, Jef Heri jefheri1 at yahoo.com wrote: Hello list, I am interested in setting up a small Tor centric message board. On Sat, 3/31/12, pro...@secure-mail.biz pro...@secure-mail.biz wrote: Nice. You may be interested to report your plans

Re: [tor-talk] Designing a secure Tor box for safe web browsing?

2012-04-05 Thread proper
Can TorBOX be of any help for your plans? Because, while people can run Tails in a VM by themselves already, doing this certainly does not give them the same benefits as an integrated, pre-configured Live amnesic host OS + Tor routing VM + desktop VM Tails would: Alternative you could

Re: [tor-talk] Designing a secure Tor box for safe web browsing?

2012-04-06 Thread proper
Wow, TorBOX? Does that exist yet? Yes. https://trac.torproject.org/projects/tor/wiki/doc/TorBOX What is the fastest VM?  VMware is fastest. From my experience... ( means faster than) VMware (fastest) VirtualBox Qemu Bochs (slowest) Untested: KVM, Xen We choose VirtualBox, for reasons

Re: [tor-talk] problem with cache preferences in TBB

2012-04-15 Thread proper
Hi the IP anonymity test at http://ip-check.info/ suggests that browser.cache.memory.enable should be set to 'false'. in TBB from about:config I set it to false but on every restart it is set again to 'true' (however this is not the case for browser.cache.disk.enable which is also

Re: [tor-talk] Restarting Firefox

2012-04-16 Thread proper
It is really weird, that Vidalia closes by default, when you close Firefox. There is no option to change that. It does not make sense, if people are expected, to enable contributing to the Tor network using Vidalia. No one can be expected to leave Firefox running 24/7. Do we have a ticket about

Re: [tor-talk] Restarting Firefox

2012-04-16 Thread proper
The only safe way to start TBB is to run 'start-tor-browser'. Any other method will cause TBB to be in some odd state. Can you expand this please? Odd state in sense of no functionality or negative implications on anonymity? __ powered

Re: [tor-talk] Restarting Firefox

2012-04-16 Thread proper
I'm sorry because I haven't read the entire conversation up until now, but if people are using Ubuntu, what is stopping them from doing sudo apt-get install tor; Will conflict with Tor Browser Bundle. (SocksPort on same port.) configuring relaying in torrc Vidalia was made for less

Re: [tor-talk] Restarting Firefox

2012-04-16 Thread proper
I don't think that's a clean and easy solution. Your tool laying around on some third party server and barely anyone being aware and using it. Possible solutions: - As a intermediate fix: Simply change the Windows behavior, not to close Vidalia/Tor when Firefox is terminated. (Like already on

Re: [tor-talk] Restarting Firefox

2012-04-16 Thread proper
We make an assumption that if you are running some sort of unix, you can handle your package management system, or compile from source, and edit the torrc file. No good assumption. Using unix doesn't make you a geek. Ubuntu is one of the most widespread AND newbie friendly distribution.

Re: [tor-talk] Recommended method for routing all traffic through Tor on a GNU/Linux distro

2012-04-16 Thread proper
Hi! I've got tor exit relay running on a dedicated host! About to upgrade it in a week too! High five to everyone making this project a reality. Thanks for hosting an exit relay. I'm wanting all my apps on my desktop to use tor, what is the recommended method? polipo or privoxy + tor? Do

Re: [tor-talk] wget - secure?

2012-04-18 Thread proper
If you want to to do thoroughly like Robert Ransom, it all comes back to this ticket. https://trac.torproject.org/projects/tor/ticket/5553 __ powered by Secure-Mail.biz - anonymous and secure e-mail accounts.

Re: [tor-talk] Tor to VPN to Internet = Bad. Why?

2012-04-25 Thread proper
Recently, I'd come across some chatter that suggested that connecting to a VPN via TOR was not a good idea and, rather, the better idea was to connect to a VPN that then used Tor. I've not found any articles on the net that really discuss this issue. My concern stems from more of a curiosity

Re: [tor-talk] Debian install: Only Tor networking?

2012-04-25 Thread proper
I am making Debian machine and want to allow only networking over Tor (secure box with no leaks). How can I do this? https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy https://trac.torproject.org/projects/tor/wiki/doc/TorBOX

[tor-talk] Tor Browser disabling Javascript anonymity set reduction [WAS: Basic questions ...]

2012-05-13 Thread proper
https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEnabled The FAQ entry is very questionable. Disabling JavaScript by default, then allowing a few websites to run scripts, is especially bad for your anonymity: the set of websites which you allow to run scripts is very likely to uniquely

Re: [tor-talk] Pittsburgh Bombing Threats and Mix-Master

2012-05-17 Thread proper
Tell me if I am wrong, but I think it's not worth to bother with mixmaster, mixmion, remailing, etc. anymore. It's practically dead. Some remailing systems have been written by high profile people, some of them are now working on Tor. Due to high latency, remailers are theoretically more

[tor-talk] Technical Documentation for the TBB Update Notification Mechanism

2012-05-17 Thread proper
I know Tor Button fetches https://check.torproject.org/RecommendedTBBVersions but I couldn't find check.torproject.org within the Tor Button source code. How Tor Button comes to its decision to display https://check.torproject.org/?lang=en-USsmall=1uptodate=0 ? The script start-only-torbrowser

[tor-talk] anonymity: bridge users vs. entry guard users

2012-05-25 Thread proper
If I understand correctly, a bridge will be used as the first of three hops. While users in non-censored areas can will use a certain amount of entry guards, users in censored areas get only three bridges per mail. The entry guard users are more unlikely to suffer from unstable (goes offline)

Re: [tor-talk] apt-get over tor

2012-05-27 Thread proper
My very first considerations... What are the dangers of using apt-get over Tor? Is privoxy + Tor the safest way to go? I don't think so. What attacks are possible? 1. Some are documented in the Torify HOWTO. [1] 2. Stale mirror attack. [2] 3. What kind of software you have installed. [2]

[tor-talk] Tor 0.2.3 Alpha ready for redistributed projects?

2012-05-28 Thread proper
Is it safe to use the Tor 0.2.3 Alpha in redistributed projects for regular use? (Such as Tails or TorBOX.) Or should the alpha branch only be touched by testers and developers? Tor Stable is already labeled as experimental software and do not rely on it for strong anonymity. How much worse

Re: [tor-talk] How to get browser after closing it ?

2012-05-28 Thread proper
How can I start the tor browser after closing it ? villdila is still there but no option to start browser. https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO#UPDATEforTBBTorBrowserBundleusers

Re: [tor-talk] email over Tor / anonymity sets vs. source IPs (was: Torbutton-birdy version 0.0.2)

2012-05-29 Thread proper
I'd consider it as important to have all torbirdy stable users in one anonymity set as soon as there is a feature complete stable version. I consider the current version as experimental. Hrmm. Actually, if we can avoid revealing this anonymity set explicitly to mailing lists and

Re: [tor-talk] How to Control middle Nodes?

2012-05-31 Thread proper
My test, based on windows, so for VoIP clients I use Phonerlite, it use UDP. because of TOR is TCP based, I will use openvpn to transferring udp packet through TOR network. You should look around, if you can find a voice client supporting TCP. Tunneling Voip-UDP with OpenVPN over Tor-TCP

Re: [tor-talk] IPv6

2012-06-05 Thread proper
Tomorrow (June 6) IPv6 is officially out there. And will still take years until most ISPs in most countries offer it. What are the pros and cons of IPv6 regarding our privacy? Hosting bridges and relays will be easier, because less people are behind NAT. I hope for some more servers, there

[tor-talk] Repercussion from turning every Tor user into a hidden service?

2012-06-07 Thread proper
Would it stress the network too much, if everyone had a HiddenServicePort enabled? (For example, TBB or Tails were in the position to enable it for loads of users by default.) Would it improve the anonymity of people who really have hidden servers, if everyone had a hidden service running?

[tor-talk] How to force redirect each application through separate SocksPorts? (preventing identity correlation)

2012-06-11 Thread proper
Many applications, such as wget, apt-get, gpg, etc. do not speak socks, are unlikely to speak socks anytime soon, but support http. Privoxy or polipo are of no help. They provides only one http port, with the one big drawback: all http connections will be presses through the same SocksPort

Re: [tor-talk] How to force redirect each application through separate SocksPorts? (preventing identity correlation)

2012-06-11 Thread proper
freebsd-lis...@fabiankeil.de wrote: That's incorrect. Privoxy can change the forwarding settings based on tags: http://www.privoxy.org/user-manual/actions-file.html#CLIENT-HEADER-TAGGER Excuse me, if I misunderstood. It doesn't look like anyone done that ever before (and documented that

Re: [tor-talk] Repercussion from turning every Tor user into a hidden service?

2012-06-12 Thread proper
peter+...@metaverse.org wrote: To quote the hidden service FAQ https://www.torproject.org/docs/tor-hidden-service, If your computer isn't online all the time, your hidden service won't be either. This leaks information to an observant adversary., so yes. I don't think that applies here. 1.

Re: [tor-talk] Repercussion from turning every Tor user into a hidden service?

2012-06-12 Thread proper
peter+...@metaverse.org wrote: On 8/06/12 9:53 AM, Matthew Kaufman wrote: Great questions. And does hosting a hidden service exposé the machine to penetration attacks? Yes, if those services are vulnerable whether they're running as a Tor service or not. The other concern is that hidden

Re: [tor-talk] How to force redirect each application through separate SocksPorts? (preventing identity correlation)

2012-06-12 Thread proper
pro...@secure-mail.biz wrote: Many applications, such as wget, apt-get, gpg, etc. do not speak socks, are unlikely to speak socks anytime soon, but support http. [...] What other options left, to route, let's say, wget through port 9052, apt-get through SocksPort 9053, gpg through SocksPort

Re: [tor-talk] Force VirtualBox through Tor on Windows XP Host?

2012-06-19 Thread proper
malcolm.tur...@gmail.com wrote: How can I force VirtualBox to only use Tor? Host OS: Windows XP SP3 Guest OS: Windows XP SP3 Short answer: Not recommend. Long answer: You can not simply torify VirtualBox with torsocks or so. Easiest thing to use two Virtual Machines. One works as a

Re: [tor-talk] How to force redirect each application through separate SocksPorts? (preventing identity correlation)

2012-06-28 Thread proper
freebsd-lis...@fabiankeil.de wrote: pro...@secure-mail.biz wrote: freebsd-lis...@fabiankeil.de wrote: That's incorrect. Privoxy can change the forwarding settings based on tags: http://www.privoxy.org/user-manual/actions-file.html#CLIENT-HEADER-TAGGER Excuse me, if I

Re: [tor-talk] possible to identify tor user via hardware DRM?

2012-06-28 Thread proper
sch...@eff.org wrote: Similarly, having a GPS receiver in your phone does not mean that everyone you send an SMS to or everyone you call will learn your exact physical location. However, it does mean that if there's spyware on your phone, that spyware is able to use the GPS to learn your

Re: [tor-talk] possible to identify tor user via hardware DRM?

2012-06-28 Thread proper
sch...@eff.org wrote: One of the defenses people have talked about against hardware fingerprinting is running inside a virtual machine. Normally, software inside the virtual machine, even if it's malicious, doesn't learn much about the physical machine that hosts the VM. If you always use

Re: [tor-talk] How to force redirect each application through separate SocksPorts? (preventing identity correlation)

2012-06-30 Thread proper
Once either method has been configured correctly and tested it should work reliably until the environment changes. I am working on an anonymous operating system (TorBOX [1]) and made a modification to torsocks, called uwt [2]. Using uwt breaks down to sudo ip=127.0.0.1 port=9053 uwt

Re: [tor-talk] TorBirdy 0.0.7 released - testing and feedback requested!

2012-07-05 Thread proper
If you ever wanted to contribute something related to Tor, then TorBirdy is a good place to start because the project is relatively new. Therefore it's easy (from user's perspective) to learn everything about it and to stay up to date as it grows. Installation and usage is easy. The issue

[tor-talk] How to pin the SSL certificate for torproject.org?

2012-07-06 Thread proper
A malicious certificate for torproject.org has been given out at least twice by broken certificate authorities. (Comodo, DigiNotar, who is next...) To prevent that in future, I'd like to pin the SSL certificate's fingerprint. How can that be done? Running an own local CA or is there an easier

Re: [tor-talk] How to pin the SSL certificate for torproject.org?

2012-07-06 Thread proper
m...@dee.su wrote: On Fri, Jul 6, 2012 at 7:24 PM, pro...@secure-mail.biz wrote: I didn't even archive to get torproject.org's public key. That's what I used. openssl s_client -showcerts -connect www.torproject.org:443 /tmp/x.cert /dev/null But it doesn't contain the begin public key

Re: [tor-talk] How to pin the SSL certificate for torproject.org?

2012-07-06 Thread proper
Thanks to Maxim Kammerer I have now the torproject.org SSL public key. Does anyone know how to sign a certificate, without having the private key or certificate signing request? One post [1] implicates it's possible, but I haven't found out how. If I get this working, I'll add step by step

Re: [tor-talk] How to pin the SSL certificate for torproject.org?

2012-07-06 Thread proper
grarp...@gmail.com wrote: Fetchmail, msmtp, etc can all connect to a host, take that cert fingerprint, compare it to the one you've configured, and drop the connection if they differ. That may work against some adversaries but not against very clever adversaries. He can let the first

Re: [tor-talk] How to pin the SSL certificate for torproject.org?

2012-07-07 Thread proper
grarp...@gmail.com wrote: Fetchmail, msmtp, etc can all connect to a host, take that cert fingerprint, compare it to the one you've configured, and drop the connection if they differ. That may work against some adversaries but not against very clever adversaries. He can let the first

Re: [tor-talk] How to pin the SSL certificate for torproject.org?

2012-07-07 Thread proper
grarp...@gmail.com wrote: Fetchmail, msmtp, etc can all connect to a host, take that cert fingerprint, compare it to the one you've configured, and drop the connection if they differ. That may work against some adversaries but not against very clever adversaries. He can let the

Re: [tor-talk] hidden service on same location as public service

2012-07-08 Thread proper
jue...@yahoo.com wrote: i'm wonder if it makes any sense to allow users to access a public web server access normal at same time as hidden service on same machine? Yes. - saves exit bandwidth - will continue to work even if all exits are shut down - exit policy/ports do not matter - more

Re: [tor-talk] HTTPS to hidden service unecessary?

2012-07-09 Thread proper
HS + SSL makes sense: - stronger encryption Not looking too long for a good source... https://trac.torproject.org/projects/tor/wiki/doc/HiddenServiceNames If you decide to run a hidden service Tor generates an RSA-1024 keypair. The .onion name is computed as follows: first the SHA1 hash [...]

[tor-talk] hidden services 2.0 brainstorming

2012-07-11 Thread proper
I think the concept of hidden services has a lot potential. Not only because they are hidden. Let's face it: - You get a free domain for live. - You get transparent, free end to end encryption. No flawed root CA system. - That's something remarkable, isn't it? With some modifications/improvements

Re: [tor-talk] hidden services 2.0 brainstorming

2012-07-11 Thread proper
Rejo Zenger: Hi, - You get transparent, free end to end encryption. No flawed root CA system. Just curious, maybe I am overlooking something: how would this be better than a self-signed and self-generated certificate (apart from the user not being nagged with a warning)? Self-signed:

Re: [tor-talk] hidden services 2.0 brainstorming

2012-07-11 Thread proper
Fabio Pietrosanti (naif): Yo, i really appreciate such discussion about empowering TorHS, a lot of work still have to be done to make proper leverage of the capabilities that TorHS provide. On 7/11/12 5:36 PM, proper wrote: I think the concept of hidden services has a lot potential

Re: [tor-talk] hidden services 2.0 brainstorming

2012-07-11 Thread proper
tor-admin: Am Mittwoch, 11. Juli 2012, 17:43:52 schrieb Fabio Pietrosanti: Don't exaggerate, it still need a software client to access them, so the usability is heavily impacted. This imply that TorHS are not for general uses in the context of mutual anonymity . What about a Firefox/Chromium

Re: [tor-talk] Hiding the server

2012-07-12 Thread proper
Anthony Papillion: I know that Tor does a good job at protecting users from discovery but what about the server? Is it as hard to find as the clients? I'm thinking no. It's a wide question. What are you interested in? What do you want to know about? Server software, operating system security,

Re: [tor-talk] Hiding stuff

2012-07-13 Thread proper
antispa...@sent.at: I remember reading about installing more extensions as a bad thing as it might identify a Tor configuration from another. But can't this be hidden? Maybe. Would require development which no one wants to take. I know extensions can answer javascript requests. Is it

Re: [tor-talk] Hiding stuff

2012-07-13 Thread proper
antispa...@sent.at: On Fri, Jul 13, 2012, at 15:02, proper wrote: antispa...@sent.at: I remember reading about installing more extensions as a bad thing as it might identify a Tor configuration from another. But can't this be hidden? Maybe. Would require development which no one wants

Re: [tor-talk] Hiding stuff

2012-07-13 Thread proper
Praedor Atrebates: Would not cpu/system data get hidden if you ran tor browser inside an emulator? Depends on virtualizing platform and settings. For Virtual Box... try: cat /proc/cpuinfo Power off VM. Restart VM. Then run: VBoxManage modifyvm VMname --synthcpu on check again: cat

Re: [tor-talk] Hiding stuff

2012-07-13 Thread proper
antispa...@sent.at: On Fri, Jul 13, 2012, at 16:38, Praedor Atrebates wrote: My main interest in emulators and/or VMs is to be able to use tor browser but also leave some of the add-ons activated (javascript, flash) and STILL defeat tracking. Tor gives you ip X and the VM provides a

Re: [tor-talk] Hiding stuff

2012-07-13 Thread proper
antispa...@sent.at: On Fri, Jul 13, 2012, at 22:14, proper wrote: My non-offical project supports [1] that. Java and Flash do not leak IP or DNS. Even without leaking IP, they have far too much power for a far too small benefit. The ability to write or read the disk beyond the powers

Re: [tor-talk] Hiding stuff

2012-07-13 Thread proper
Praedor Atrebates: On 07/13/2012 06:22 PM, antispa...@sent.at wrote: On Fri, Jul 13, 2012, at 22:14, proper wrote: My non-offical project supports [1] that. Java and Flash do not leak IP or DNS. Even without leaking IP, they have far too much power for a far too small benefit. The ability

Re: [tor-talk] Hiding stuff

2012-07-14 Thread proper
antispa...@sent.at: On Fri, Jul 13, 2012, at 23:25, proper wrote: For people who really can't abstain from Flash / Java it's the best option I know of. It does sound wonderful. But it sure needs a powerful machine. A CPU designed for lower power consumption and thus battery maximisation

Re: [tor-talk] Hiding stuff

2012-07-14 Thread proper
antispa...@sent.at: On Fri, Jul 13, 2012, at 23:37, proper wrote: But what will never change is, the more anonymity/privacy/security you want, the more technical knowledge you'll need. We'll continue to provide loads of additional information to make it even more safe. Could you make

[tor-talk] Operating system updates / software installation behind Tor Transparent Proxy

2012-03-01 Thread proper proper
is not recommended -- automatic update installers are likely to leak information about the software they are trying to update, whether due to malicious design or due to lack of consideration for users' location privacy. proper: This is the reason why we want to make them over Tor. Those information would stay

Re: [tor-talk] Operating system updates / software installation behind Tor Transparent Proxy

2012-03-01 Thread proper proper
proper proper pro...@secure-mail.biz writes: I was told, to ask this question here. [3] Tor's transparent proxy feature is at the moment a bit complicated to take advantage off and therefore unpopular. That might change in the future, because a) documentation improves [1]; b

  1   2   >