[tor-dev] Connection padding set to 1 vs auto

2020-08-06 Thread proc...@riseup.net
Hi. I was wondering if setting the connection padding setting in torrc to 1 instead of auto has any benefit in protecting against a passive adversary outside the Tor network. ___ tor-dev mailing list tor-dev@lists.torproject.org https://lists.torproject

[tor-dev] Snowflake server and traffic analysis questions

2020-01-17 Thread proc...@riseup.net
Thanks Cecylia for your great explanation. ___ tor-dev mailing list tor-dev@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev

[tor-dev] Vanguard Plugin Options

2020-01-16 Thread proc...@riseup.net
Hi. We are rolling out the vanguard plugin for our users and wanted to understand some options we can enable. * In many parts of the Security README setting *circ_max_megabytes* is recommended. Though it is discouraged for usecases involving Onionshare and Securedrop which we support. What is a re

[tor-dev] Snowflake server and traffic analysis questions

2020-01-06 Thread proc...@riseup.net
Goal: We (Whonix) are researching optional bridge hosting for our users to thwart web fingerprinting. Snowflake makes the most sense since no NAT hole-punching is needed. Correct me if I'm wrong here because if that was possible with obfs4 or meek it would save a lot of work. We now know acting a

[tor-dev] Bridge benefits stackable?

2020-01-02 Thread proc...@riseup.net
Hi. We are considering allowing users to run their daemon (optionally) as a bridge in addition to client mode for increased traffic fingerprinting resistance [1]. Does running a bridge prevent you from using a bridge yourself? I've seen it mentioned that using bridges can protect users in event of

[tor-dev] Probability of Guessing a v3 Onion Address

2019-12-11 Thread proc...@riseup.net
Hi I was wondering what the mathematical probability of guessing an onion v3 address that is kept secret. Or asked differently: what is the entropy of v3 addresses if an adversary decides to bruteforce the entire keyspace? I am struggling to come up with a usecase for authenticated v3 services wh

[tor-dev] Enhanced Tor Browser sandboxing upstreaming

2019-08-24 Thread proc...@riseup.net
Hi. We aim to make enhanced sandboxing for Tor Browser widely available on Linux that's well maintained in the long term. We would appreciate it if TBB team provides the currently developed Apparmor and firejail profiles below from your repos and run unit testing and check/fix any breakages with up

Re: [tor-dev] TBB Memory Allocator choice fingerprint implications

2019-08-17 Thread proc...@riseup.net
*On Sat, 17 Aug 2019 at**21:17, Tom Ritter* mailto:tor-dev%40lists.torproject.org?Subject=Re%3A%20%5Btor-dev%5D%20TBB%20Memory%20Allocator%20choice%20fingerprint%20implications&In-Reply-To=%3CCA%2BcU71%3DPeZGCAJNsPQy9QpKY9%3Dwz3vPdW8QKruF_ZwyanoyYzQ%40mail.gmail.com%3E>> wrote: > On Sat, 17 Aug 20

[tor-dev] TBB Memory Allocator choice fingerprint implications

2019-08-17 Thread proc...@riseup.net
Question for the Tor Browser experts. Do you know if it is possible to remotely fingerprint the browser based on the memory allocator it is using? (via JS or content rendering) We are thinking of switching Tor Browser to use the minimalist and security oriented hardened_malloc written by Daniel Mi