[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-talk] badfamilies: searching for undeclared families (detection method: contactInfo)
- To: "tor-talk@xxxxxxxxxxxxxxxxxxxx" <tor-talk@xxxxxxxxxxxxxxxxxxxx>
- Subject: [tor-talk] badfamilies: searching for undeclared families (detection method: contactInfo)
- From: Nusenu <nusenu@xxxxxxxxxxxxxxx>
- Date: Sat, 28 Mar 2015 15:14:22 +0000
- Cc: nick@xxxxxxxxx, abuse@xxxxxxxxxxxxxxxxxxxx, abuse@xxxxxxxxxxxxxxxxxxxxxxxxxxx, admin@xxxxxxxxxxxxxxxxxxx, noc@xxxxxxxxx
- Delivered-to: archiver@xxxxxxxx
- Delivery-date: Sat, 28 Mar 2015 11:14:51 -0400
- Dkim-signature: v=1; a=rsa-sha256; c=relaxed/simple; d=openmailbox.org; h=content-transfer-encoding:content-type:content-type:subject :subject:mime-version:from:from:date:date:message-id:received; s=openmailbox; t=1427555668; bh=0HAyo7qyPRmG37wpsE1FzK0T1cN5+iT nSj767NMQDR0=; b=dt1vWT4TC3eSbqyfKNu1nQ8HH5QOSMfwsHgk8p3Wtui8Biq jLlyLwemEBTGpRifzHKXNdg+j/swprVmqmQB26BpytxVa6ucCSaHyd/byhabH5TM 8Uf0a7ndx3e9hmgD+LF+EPQNQ0XOkOieyTtOE/fsm0X0MMTp/2lZvEViFknA=
- List-archive: <http://lists.torproject.org/pipermail/tor-talk/>
- List-help: <mailto:firstname.lastname@example.org?subject=help>
- List-id: "all discussion about theory, design, and development of Onion Routing" <tor-talk.lists.torproject.org>
- List-post: <mailto:email@example.com>
- List-subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk>, <mailto:firstname.lastname@example.org?subject=subscribe>
- List-unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-talk>, <mailto:email@example.com?subject=unsubscribe>
- Reply-to: tor-talk@xxxxxxxxxxxxxxxxxxxx
- Sender: "tor-talk" <tor-talk-bounces@xxxxxxxxxxxxxxxxxxxx>
-----BEGIN PGP SIGNED MESSAGE-----
(if you are on CC you might want to jump to the URL and have a look at
your relays' MyFamily config)
as a tor client one probably doesn't wish to use relays from one
entity only when creating circuits. So it might make sense to find
This first very simple approach uses contactInfo data to detect
myfamily misconfiguration - so it detects potential families that are
not "hiding" on purpose.
The last column shows the number of relays which have the given
contact string and the 3th column shows the number of family members
this relay has (in a perfect setup these numbers match).
This is obviously a non-perfect approach and might contain false
positives since everyone can set a contactInfo string on his relay as
Should this list worry you?
The two biggest undeclared families (by relay count) - perfect-privacy
& torpids run relays in over 30 distinct /16 netblocks but they don't
seem to run any exits which makes it currently impossible to create
exiting circuits through them exclusively.
torservers.net on the other hand seems to have a current guard
probability of 0% according to compass, but as one can see in the
atlas graphs that is not always the case. Additionally torservers runs
only in 8 distinct /16 netblocks. I guess the odds are low for one to
create a circuit through torservers only - depending on your currently
selected guard node.
In contrast here the hitlist (by relay count) of *perfectly* declared
10 Felix <zwiebel ta quantentunnel tod de>
8 Frenn vun der Enn
7 TEN <abuse-team _at_ tor-exit-node _dot_ org>
I heard about a few of them an know that some are using central
management tools to keep MyFamily in sync: ansible or puppet. That is
probably the reason why they are in good shape.
The good news is that at least one of the big operators not having
perfect MyFamily setup yet might start using a central management as well.
Looking forward to find actually hiding families aka (slow) sibyl
-----BEGIN PGP SIGNATURE-----
-----END PGP SIGNATURE-----
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to