[tor-dev] ResearchEthics

2015-10-03 Thread grarpamp
https://trac.torproject.org/projects/tor/wiki/doc/ResearchEthics Any number of problems and obstacles to legitimate research areas exist with this... " Examples of unacceptable research activity It is not acceptable to run an HSDir, harvest onion addresses, and do a Web crawl of those onion serv

Re: [tor-dev] Proposal: Load-balancing hidden services by splitting introduction from rendezvous

2015-10-03 Thread Tim Wilson-Brown - teor
> On 3 Oct 2015, at 13:34, Tom van der Woerdt wrote: > ... > 3. Compatibility and security > > The implementation of these methods should, ideally, not change > anything in the network, and all control changes are opt-in, so this > proposal is fully backwards compatible. > > Controllers handlin

Re: [tor-dev] Proposal: HTTP header distinguish TBB users

2015-10-03 Thread grarpamp
On Sun, Oct 4, 2015 at 12:06 AM, Virgil Griffith wrote: >> That'll be half a BTC please, lol: 161JvwnowBsojF4rRcdjMRcztoLb7R1qkN > > My pleasure. You saved me half a BTC! Holy shit, somebody tipped me, on a LOL no less, this Bitcoin thing works! You, kind benevolent and most gracious Sir, are ge

Re: [tor-dev] Proposal: HTTP header distinguish TBB users

2015-10-03 Thread Virgil Griffith
> That'll be half a BTC please, lol: 161JvwnowBsojF4rRcdjMRcztoLb7R1qkN My pleasure. You saved me half a BTC! -V On Sun, Oct 4, 2015 at 3:59 AM grarpamp wrote: > On Sat, Oct 3, 2015 at 6:59 PM, Virgil Griffith wrote: > > You are correct my good sir! This is indeed the better way. Thank you

Re: [tor-dev] Proposal: HTTP header distinguish TBB users

2015-10-03 Thread grarpamp
On Sat, Oct 3, 2015 at 6:59 PM, Virgil Griffith wrote: > You are correct my good sir! This is indeed the better way. Thank you! That'll be half a BTC please, lol: 161JvwnowBsojF4rRcdjMRcztoLb7R1qkN > It's unclear to me how to make these rules only apply to the TBB version, > but judging by the

Re: [tor-dev] Proposal: HTTP header distinguish TBB users

2015-10-03 Thread Virgil Griffith
> TBB plugin: T2W-OE - tor2web onion everywhere. > Fork HTTPS-E. > Maintain list of known t2w's. > Plugin update from tpo. > Matching engine rewrites t2w URL's to onions in TBB before the fetch. You are correct my good sir! This is indeed the better way. Thank you! I made a pull request to HTTP

Re: [tor-dev] Proposal: HTTP header distinguish TBB users

2015-10-03 Thread grarpamp
> various wrote: > Yesterday Lief compellingly argued that if a TBB user accidentally clicks on > a link to my tor2web proxy (onion.link), that they should be redirected to > the .onion address. It hadn't occurred before that a Tor user might > accidentally click a onion.link URL TBB plugin: T2W-O

[tor-dev] Notes+Action Items from Hidden Service Fingerprinting session

2015-10-03 Thread Mike Perry
Our session on Friday about Hidden Service Fingerprinting wandered a lot. Ultimately, we concluded that it will be hard to fully defend against this attack without a more formally specified state machine that describes hidden service circuit usage fully. However, we may still be able to extend the

Re: [tor-dev] Proposal: HTTP header distinguish TBB users

2015-10-03 Thread Carlin Bingham
On Sun, 4 Oct 2015, at 01:13 AM, Tim Wilson-Brown - teor wrote: > >> On 3 Oct 2015, at 14:10, Virgil Griffith wrote: >> >> (2) If we (Tor Project) is going to ask MaxMind to do something special to >> distinguish TBB users, it seems reasonable we should make the same effort.  >> I know in the

Re: [tor-dev] Proposal: HTTP header distinguish TBB users

2015-10-03 Thread Moritz Bartl
On 10/03/2015 02:10 PM, Virgil Griffith wrote: > Now the trouble starts. If the TBB user gets to the tor2web backend I > check if they're coming from an Exit relay and redirect them---all > good. But a CDN (Fastly.com) sits in front of my backends and right now > it's unclear how to detect TBB at

Re: [tor-dev] Proposal: HTTP header distinguish TBB users

2015-10-03 Thread Marcin Cieslak
On Sat, 3 Oct 2015, Virgil Griffith wrote: > Now the trouble starts. If the TBB user gets to the tor2web backend I check > if they're coming from an Exit relay and redirect them---all good. But a > CDN (Fastly.com) sits in front of my backends and right now it's unclear > how to detect TBB at the

Re: [tor-dev] Proposal: HTTP header distinguish TBB users

2015-10-03 Thread Virgil Griffith
> Are we still trying to hide TBB users in the Mozilla browser crowd? My understanding of this, because we make the exit relays public, that the answer is "no". Correct me if I'm wrong. > Are we making it even easier to identify and block TBB users? Mildly so. But if an operator wants to block T

Re: [tor-dev] Proposal: HTTP header distinguish TBB users

2015-10-03 Thread Tim Wilson-Brown - teor
> On 3 Oct 2015, at 14:10, Virgil Griffith wrote: > > (2) If we (Tor Project) is going to ask MaxMind to do something special to > distinguish TBB users, it seems reasonable we should make the same effort. I > know in the past it's been proposed for TBB to include a special HTTP header, > e.

[tor-dev] Proposal: HTTP header distinguish TBB users

2015-10-03 Thread Virgil Griffith
Yesterday Lief compellingly argued that if a TBB user accidentally clicks on a link to my tor2web proxy (onion.link), that they should be redirected to the .onion address. It hadn't occurred before that a Tor user might accidentally click a onion.link URL, but yes I completely concur and I told Lie

Re: [tor-dev] Proposal: Load-balancing hidden services by splitting introduction from rendezvous

2015-10-03 Thread Tom van der Woerdt
Op 02/10/15 om 14:56 schreef Tim Wilson-Brown - teor: On 2 Oct 2015, at 14:43, Tom van der Woerdt mailto:i...@tvdw.eu>> wrote: Hi Tim, Thanks for your great comments, very much appreciated! Comments inline. Op 30/09/15 om 19:40 schreef Tim Wilson-Brown - teor: On 30 Sep 2015, at 17:27,

[tor-dev] Hello, the obfs4 bridge which I got on October 1st is blocked in China today.

2015-10-03 Thread Li Xiaodong
*Hello, the obfs4 bridge which I got on October 1st is blocked in China today. I think that the number of Tor bridges is limited. If China's firewall were to block all of Tor bridges, how Tor could work in China? Are there any better ways to connect to Tor network than bridges? Thank you very much