[tor-dev] GoSC - Website Fingerprinting project

[Roger Dingledine]

On Mon, Mar 10, 2014 at 06:00:13PM +0100, Marc Juarez wrote:
> I'm a PhD student at COSIC (COmputer Security and Industrial
> Cryptography) in KU Leuven, Belgium. My research topic is related to
> network traffic analysis and I'm now focused in the more specific
> problem of website fingerprinting
> (http://homes.esat.kuleuven.be/~mjuarezm/).

Welcome!

>  However, I couldn't find any open project that tackles this
> problem in
> https://www.torproject.org/getinvolved/volunteer.html.en#Projects

We moved the 'research' ideas from the volunteer page to
https://research.torproject.org/ideas.html a while ago.

(Also, most of the research ideas don't have to do primarily with coding,
so they're not as suited for GSoC.)

> That
> is why I'd like to propose a GoSC project for the implementation of
> tools (packages, classes, etc.) that contribute in the development of a
> countermeasure against this attack.
[snip]
> I would like to have some feedback from the Tor developers about this
> project (advices, comments..). I plan to specify it in more detail in
> the application and to start coding some module that could be shown. But
> I would like to know if the underlying idea is something that could be
> of interest for the community.

It's definitely something that we need at some point. But I think your
first challenge will be finding a mentor with both the time and interest
to help you make it work.

It seems like some of the approaches would best be done inside Tor (as
modifications to the Tor program), and some of them would best be done
in a separate pluggable transport? Or should they all be done in a PT?
Can the bandwidth shaping in Scramblesuit (obfsproxy) be used as a
building block here?

It sounds like the implementation might be the easy part, compared to the
design part. And since GSoC is mostly about implementation, and we would
want to be confident you won't spend all summer distracted by design,
it would be best if your proposal includes a lot of the design.

> Also, as a PhD student I'm also committed with my research group during
> the summer so I would like to know if I could work as a part-time student.

That could be a problem -- gsoc wants to be a full time job, and we've had
bad experiences in the past with people who try to do two jobs at once.
Part of the goal of gsoc is let you focus so you can get integrated into
the Tor community (rather than supplementing your income to stay in your
research group).

--Roger