[tor-talk] Tor Weekly News — February 4th, 2014
Lunar
lunar at torproject.org
Wed Feb 5 12:28:49 UTC 2014
========================================================================
Tor Weekly News February 4th, 2014
========================================================================
Welcome to the fifth issue of Tor Weekly News in 2014, the weekly
newsletter that covers what is happening in the Tor community.
News from the browser team front
--------------------------------
Mike Perry has a detailed report [1] about what the growing Tor
Browser team has been up to. Among the good news, new fingerprinting
defenses are getting close to be merged for “screen resolution, default
character sets, site permissions, and local service enumeration”. Some
other changes that will reduce the attack surface include “disabling
addon update requests for addons that should not update, a potential fix
for a disk leak in the browser’s video cache, […], and a potential fix
to prevent the Flash plugin from being loaded into the browser at all
until the user actually requests to use it.”
Most censored users currently have to use a separate browser bundle
dubbed “pluggable transports bundle”. This has proven quite inconvenient
for both users and those trying to support them. Mike
reports progress on “unifying the pluggable transport bundles with the
official bundles, so that both censored and uncensored users can use the
same bundles. […] The progress is sufficient that we are very likely to
be able to deploy a 3.6-beta1 release in February to test these unified
bundles.”
Another important topic is how the privacy fixes in the Tor Browser
can benefit a wider userbase. The team has “continued the merge
process with Mozilla, and have worked to ensure that every patch of
ours is on their radar […]. Two patches, one for an API we require to
manage the Tor subprocess, and another to give us a filter to remove
potentially dangerous drag-and-drop events to the desktop have already
been merged. Next steps will include filing more bugs, continual
contact with their development team, and touching up patches as
needed.”
There are even more things to smile about in the report. Read it in full
for the whole picture.
[1]: https://lists.torproject.org/pipermail/tor-reports/2014-February/000438.html
Key revocation in next generation hidden services
-------------------------------------------------
It looks like every public-key infrastructure [2] struggles with how to
handle key revocation. Hidden services are no different. The current
design completely ignored preventing a stolen key from being reused by
an attacker.
With the on-going effort to create a new protocol for hidden
services [3], now seems to be a good time for George Kadianakis to raise
this issue [4]. In the past there was little control for the hidden
services operators over their secret key. The new design enables offline
management operations which include key revocation.
As George puts it, currently well-known solutions “are always messy and
don’t work really well (look at SSL’s OCSP [5] and CRLs [6]).” So how
can “the legitimate Hidden Service can inform a client that its keys got
compromised”?
In his email, George describes two solutions, one relying on the
directory authorities, the other on hidden service directories. Both
have drawbacks, so perhaps further research is necessary.
In the same thread, Nick Hopper suggested [7] a scheme that uses
multiple hidden service directories to cross-certify their revocation
lists. This gives more confidence to the user, since the adversary now
has to compromise multiple hidden service directories.
Please join the discussion if you have ideas to share!
[2]: https://en.wikipedia.org/wiki/Public-key_infrastructure
[3]: https://gitweb.torproject.org/torspec.git/blob/HEAD:/proposals/224-rend-spec-ng.txt
[4]: https://lists.torproject.org/pipermail/tor-dev/2014-January/006146.html
[5]: https://en.wikipedia.org/wiki/Online_Certificate_Status_Protocol
[6]: https://en.wikipedia.org/wiki/Certificate_revocation_list
[7]: https://lists.torproject.org/pipermail/tor-dev/2014-January/006149.html
Help needed to remove DNS leaks from Mumble
-------------------------------------------
Mumble [8] is a “low-latency, high quality voice chat software primarily
intended for use while gaming”.
It’s proven to be a reliable solution for voice chat among multiple
parties over Tor. Matt and Colin have worked on a documentation on how
to setup both the client and the server side [9] for Tor users.
But the client is currently safely usable only on Linux system with
torsocks and on Tails. On other operating systems, the Mumble client
will unfortunately leak the address of the server to the local DNS
resolver [10].
The changes that need to be made to the Mumble code are less trivial
than one would think. Matt describe the issue in more details in his
call for help [11]. Have a look if you are up to some C++/Qt hacking.
[8]: http://mumble.sourceforge.net/
[9]: https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/Mumble
[10]: https://github.com/mumble-voip/mumble/issues/1033
[11]: https://lists.torproject.org/pipermail/tor-dev/2014-January/006158.html
Monthly status reports for January 2014
---------------------------------------
The wave of regular monthly reports from Tor project members for the
month of January has begun. Damian Johnson [12] released his report
first, followed by reports from Philipp Winter [13], Sherief
Alaa [14], the Tor Browser team from Mike Perry [15], Colin C. [16], the
help desk [17], Matt [18]. Lunar [19], George Kadianakis [20], and Pearl
Crescent [21].
[12]: https://lists.torproject.org/pipermail/tor-reports/2014-January/000435.html
[13]: https://lists.torproject.org/pipermail/tor-reports/2014-January/000436.html
[14]: https://lists.torproject.org/pipermail/tor-reports/2014-February/000437.html
[15]: https://lists.torproject.org/pipermail/tor-reports/2014-February/000438.html
[16]: https://lists.torproject.org/pipermail/tor-reports/2014-February/000439.html
[17]: https://lists.torproject.org/pipermail/tor-reports/2014-February/000440.html
[18]: https://lists.torproject.org/pipermail/tor-reports/2014-February/000441.html
[19]: https://lists.torproject.org/pipermail/tor-reports/2014-February/000442.html
[20]: https://lists.torproject.org/pipermail/tor-reports/2014-February/000443.html
[21]: https://lists.torproject.org/pipermail/tor-reports/2014-February/000445.html
Miscellaneous news
------------------
Nick Mathewson came up [22] with a Python script [23] to convert the new
MaxMind GeoIP2 binary database to the format used by Tor for its
geolocation database.
[22]: https://lists.torproject.org/pipermail/tor-dev/2014-January/006157.html
[23]: https://github.com/nmathewson/mmdb-convert
Thanks to John Ricketts from Quintex Alliance Consulting [24] for
providing another mirror for the Tor Project’s website and software.
[24]: https://lists.torproject.org/pipermail/tor-mirrors/2014-February/000464.html
Abhiram Chintangal and Oliver Baumann are reporting [25] progress on
their rewrite [26] of the Tor Weather service.
[25]: https://lists.torproject.org/pipermail/tor-dev/2014-January/006142.html
[26]: https://github.com/baumanno/tor-weather-rewrite
Andreas Jonsson gave an update [27] on how Mozilla is moving to a
multi-process model for Firefox [28] and how this should positively
affect the possibility of sandboxing the Tor Browser in the future.
[27]: https://lists.torproject.org/pipermail/tor-talk/2014-January/031959.html
[28]: https://bugzilla.mozilla.org/show_bug.cgi?id=925570
As planned [29], to help “developers to analyze the directory protocol
and for researchers to understand what information is available to
clients to make path selection decisions”, Karsten Loesing has made [30]
microdescriptor archives available on the metrics website.
[29]: https://lists.torproject.org/pipermail/tor-dev/2014-January/006061.html
[30]: https://lists.torproject.org/pipermail/tor-dev/2014-January/006141.html
Christian has deployed [31] a test platform [32] for the JavaScript-less
version of Globe, a tool to retrieve information about the Tor network
and its relays.
[31]: https://lists.torproject.org/pipermail/tor-talk/2014-February/032012.html
[32]: https://globe-node.herokuapp.com/
In an answer to Shadowman’s questions about pluggable transports, George
Kadianakis wrote a detailed reply on how Tor manages pluggable
transports [33], both on the server side an on the client side.
[33]: https://lists.torproject.org/pipermail/tor-talk/2014-January/031984.html
Arthur D. Edelstein has advertised a GreaseMonkey script [34] to enable
Tor Browser to access YouTube videos without having JavaScript enabled.
Please be aware of the security risks that GreaseMonkey might
introduce [35] before using such a solution.
[34]: https://lists.torproject.org/pipermail/tor-talk/2014-February/032010.html
[35]: https://lists.torproject.org/pipermail/tor-talk/2014-January/031623.html
Andrew Lewman reports on his trip to Washington DC [36] where he met
Spitfire Strategies to learn about “Tor’s brand, media presence, and
ideas for the future”. For a short excerpt: “It’s interesting to get
critiques on all our past media appearances; what was good and what
could be better. Overall, the team there are doing a great job.”
[36]: https://lists.torproject.org/pipermail/tor-reports/2014-January/000434.html
Lunar accounted [37] for Tor’s presence at FOSDEM, one of the largest
free software event in Europe. The project had a small booth [38] shared
with Mozilla and there was even a relay operator meetup [39].
[37]: https://lists.torproject.org/pipermail/tor-reports/2014-February/000444.html
[38]: https://twitter.com/anthraxx42/status/429600652399247361
[39]: https://twitter.com/FrennVunDerEnn/status/429636610603233280
Yan Zhu has released [40] the first version of HTTPS Everywhere for
Firefox Mobile. A good news for users of the upcoming Orfox [41].
[40]: https://lists.eff.org/pipermail/https-everywhere/2014-February/001964.html
[41]: https://github.com/guardianproject/Orfox
Tor help desk roundup
---------------------
Users often want to know if Tor can make them appear to be coming from a
particular country. Although doing so can reduce one’s anonymity, it is
documented on our FAQ page [42].
Orbot users have noticed that installing Orbot to their SD storage can
cause Orbot to stop functioning correctly. Installing Orbot to the
internal storage has resolved issues for a few users.
[42]: https://www.torproject.org/docs/faq#ChooseEntryExit
News from Tor StackExchange
---------------------------
Rhin is looking for hidden services hosting services. Jens pointed them
to ahmia.fi [43] but it looks like no there are no gratis hidden
services hosters currently available.
[43]: https://tor.stackexchange.com/q/1402/88
Vijay kudal wanted to know how to change the current circuit within
shell scripts [44]. Jens Kubieziel gave an answer using expect and
hexdump [45].
[44]: https://tor.stackexchange.com/q/1438/1041
[45]: https://tor.stackexchange.com/a/1453/88
Roya saw check.torproject.org replying contradictory information [46]
with Atlas about the exit node being used. It seems to be a bug in check
occuring when multiple nodes are using the same IP address [47].
[46]: https://tor.stackexchange.com/q/1439/88
[47]: https://bugs.torproject.org/10499#comment:4
Upcoming events
---------------
Feb 8 | Aaron Gibson Presenting Tor @ New Media Inspiration 2014
| Prague, Czech Republic
| http://www.tuesday.cz/akce/new-media-inspiration-2014/
|
Feb 8 | Colin Childs Presenting Tor @ CryptoParty, Winnipeg
| Winnipeg, Canada
| http://wiki.skullspace.ca/CryptoParty
|
Feb 9 | Privacy SOS CryptoParty @ NorthEastern University in Boston
| Boston, Massachusetts, United States
| http://privacysos.org/party
This issue of Tor Weekly News has been assembled by Lunar, Matt Pagan,
qbi, George Kadianakis, Colin, Sandeep, Paul Feitzinger and
Karsten Loesing.
TWN is a community newsletter. It can’t rest upon a single pair of
shoulders at all times, especially when those shoulders stand behind a
booth for two days straight. So if you want to continue reading TWN, we
really need your help! Please see the project page [48] and say “hi” on
the team mailing list [49].
[48]: https://trac.torproject.org/projects/tor/wiki/TorWeeklyNews
[49]: https://lists.torproject.org/cgi-bin/mailman/listinfo/news-team
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: Digital signature
URL: <http://lists.torproject.org/pipermail/tor-talk/attachments/20140205/81407cec/attachment.sig>
More information about the tor-talk
mailing list