[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-talk] tor-talk Digest, Vol 42, Issue 79
From: tor-talk-request@xxxxxxxxxxxxxxxxxxxx
Subject: tor-talk Digest, Vol 42, Issue 79
To: tor-talk@xxxxxxxxxxxxxxxxxxxx
Date: Wed, 23 Jul 2014 06:24:31 +0000
Send tor-talk mailing list submissions to
tor-talk@xxxxxxxxxxxxxxxxxxxx
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
or, via email, send a message with subject or body 'help' to
tor-talk-request@xxxxxxxxxxxxxxxxxxxx
You can reach the person managing the list at
tor-talk-owner@xxxxxxxxxxxxxxxxxxxx
When replying, please edit your Subject line so it is more specific
than "Re: Contents of tor-talk digest..."
--Anexo de Mensagem Encaminhado--
From: delton.barnes@xxxxxxx
To: tor-talk@xxxxxxxxxxxxxxxxxxxx
Date: Tue, 22 Jul 2014 12:38:34 +0000
Subject: [tor-talk] Tor Browser usability - frequent broken connections
Hello,
I use Tor Browser for all web browsing as many of you probably do. A
frequent problem is you will be logged in to various sites and then the
connection will break. For instance, attempting to make any request
gives "Firefox could not establish a connection to the server at ...".
Changing identities will always rectify the problem, but doing so via
the onion button causes all open windows and tabs to be closed, which
means you have to log back in and then get back to whatever page you
were on. This is especially troublesome if you were filling out a form
or completing a multi-step process in a web application.
Is there a way to change identities or just circuits without closing
everything and without using an external application? I understand the
browser is closed and re-opened when you request a new identity to
prevent your identity from being associated with your prior identity,
but sometimes you do not need a new identity and just want to fix the
connection.
I do not think this a problem specific to me because it occurs on
multiple devices on multiple networks.
Thanks,
Delton
--Anexo de Mensagem Encaminhado--
From: delton.barnes@xxxxxxx
To: tor-talk@xxxxxxxxxxxxxxxxxxxx
Date: Tue, 22 Jul 2014 12:45:12 +0000
Subject: Re: [tor-talk] Tor Browser usability - frequent broken connections
Delton Barnes:
> I use Tor Browser for all web browsing as many of you probably do. A
> frequent problem is you will be logged in to various sites and then the
> connection will break. For instance, attempting to make any request
> gives "Firefox could not establish a connection to the server at ...".
> Changing identities will always rectify the problem, but doing so via
> the onion button causes all open windows and tabs to be closed, which
> means you have to log back in and then get back to whatever page you
> were on. This is especially troublesome if you were filling out a form
> or completing a multi-step process in a web application.
>
> Is there a way to change identities or just circuits without closing
> everything and without using an external application? I understand the
> browser is closed and re-opened when you request a new identity to
> prevent your identity from being associated with your prior identity,
> but sometimes you do not need a new identity and just want to fix the
> connection.
>
> I do not think this a problem specific to me because it occurs on
> multiple devices on multiple networks.
The FAQ answers my question:
https://www.torproject.org/docs/faq#NewIdentityClosingTabs
This ticket is for exactly the feature I'm seeking:
https://trac.torproject.org/projects/tor/ticket/9442
It's flagged tbb-easy, so maybe I'll try to implement.
Delton
--Anexo de Mensagem Encaminhado--
From: scott@xxxxxxxxxxxxxx
To: tor-talk@xxxxxxxxxxxxxxxxxxxx
Date: Tue, 22 Jul 2014 11:32:31 -0400
Subject: [tor-talk] Fwd: Tor and tlk.io
> Somebody told me of tlk.io. I have joined. I closed the window and when
> I was back I already had all settings as last time. I cleared the
> cookies and went back. I was like logged in, without ever logging in. I
> closed the window, cleaned up everything the delete all data can remove
> and 15 minutes after I reentered. I was still registered. New identity
> had no effect either. I had to close down Tor and start it again to lose
> the whatever that keeps identifying me.
>
> What is this? How do they do it? Are there other sites like that?
I'm using the latest version of the Tor Browser Bundle. It gives me this
prompt: http://imgur.com/ZGqzK4Z
http://www.propublica.org/article/meet-the-online-tracking-device-that-is-virtually-impossible-to-block
^- possibly related
Hello Scott and tor talkers!
I would like to kwow your opinion about this adblocker Chamaleon. It is usefull to improve our surface web privacy?
https://github.com/ghostwords/chameleon
Marcos Kehl (Brazil)
--Anexo de Mensagem Encaminhado--
From: joebtfsplk@xxxxxxx
To: tor-talk@xxxxxxxxxxxxxxxxxxxx
Date: Tue, 22 Jul 2014 11:14:02 -0500
Subject: Re: [tor-talk] Carnegie Mellon Kills Black Hat Talk About Identifying Tor Users -- Perhaps Because It Broke Wiretapping Laws
On 7/22/2014 3:30 AM, Eugen Leitl wrote:
> https://www.techdirt.com/articles/20140721/11362227955/carnegie-mellon-kills-black-hat-talk-about-identifying-tor-users.shtml
>
> Carnegie Mellon Kills Black Hat Talk About Identifying Tor Users -- Perhaps
> Because It Broke Wiretapping Laws
>
> from the questionable-legality dept
>
> There's some buzz in security circles today after it came out that a session
> at the upcoming Black Hat Conference entitled "You Don't Have to be the NSA
> to Break Tor: Deanonymizing Users on a Budget" by Michael McCord and
> Alexander Volynkin (both of whom work for Carnegie-Mellon University and
> CERT) had been pulled from the conference at the request of CMU.
>
> A Black Hat spokeswoman told Reuters that the talk had been canceled at the
> request of lawyers for Carnegie-Mellon University, where the speakers work as
> researchers. A CMU spokesman had no immediate comment.
Wiretapping? Please. Web sites (that want to) & their 3rd party
associates (trackers) track users from one end to the other.
More speculation. A good question is, *who requested* that the Carnegie
Mellon *lawyers* make a request to Black Hat to cancel the talk on
identifying Tor users?
We must ask, did Carnegie Mellon really think Tor Project would sue
them? Hardly.
Did they think the gov't would sue them on behalf of Tor Project? No.
Which entities would have the most to lose if this Tor weakness was exposed?
Which entities are most interested in cracking Tor?
That possibly resulted in certain people stopping their Tor use and / or
the weakness being patched, so possibly not as much valuable user info
was available?
The Disney Co? EFF.org? Amazon? No, not likely.
In any good investigation, detectives follow motive & money. *IF*... the
gov't is or could be involved in something (/not saying they are here,
but could be/), then the "means" is *almost always* there, if it's
important enough. As we saw from Snowden's documents the incredible,
unbelievable things they were able to do (at incredible expense & manpower).
Whether the gov't was involved in the talk being cancelled *aside*, we
can't forget that the programs detailed in Snowden's document, have NOT
stopped, or even slowed down.
Yes, officials appeared before Congress (more than once).
Yes, they were caught in bald faced lies (perjury?).
*No, nothing was done* / no action taken by anyone, to reign in or slow
down these programs (which literally cost a fortune in taxpayers' money).
--Anexo de Mensagem Encaminhado--
From: isis@xxxxxxxxxxxxxx
To: tor-talk@xxxxxxxxxxxxxxxxxxxx
Date: Wed, 23 Jul 2014 02:29:08 +0000
Subject: Re: [tor-talk] Fwd: Tor and tlk.io
Scott Arciszewski transcribed 0.9K bytes:
> > Somebody told me of tlk.io. I have joined. I closed the window and when
> > I was back I already had all settings as last time. I cleared the
> > cookies and went back. I was like logged in, without ever logging in. I
> > closed the window, cleaned up everything the delete all data can remove
> > and 15 minutes after I reentered. I was still registered. New identity
> > had no effect either. I had to close down Tor and start it again to lose
> > the whatever that keeps identifying me.
> >
> > What is this? How do they do it? Are there other sites like that?
Many sites use HTML5 canvas fingerprinting. Visiting either
https://github.com/isislovecruft or https://pad.riseup.net/p/Lb57JrCmVzBt
should trigger that little dialogue about "accessing the canvas" in TorBrowser
too.
> I'm using the latest version of the Tor Browser Bundle. It gives me this
> prompt: http://imgur.com/ZGqzK4Z
Can I ask you a question? When this dialogue (the http://imgur.com/ZGqzK4Z
one) comes up, what do you usually do? Do you click the "Allow in the Future"
button? Or click the little "X" in the corner? Or something else?
> http://www.propublica.org/article/meet-the-online-tracking-device-that-is-virtually-impossible-to-block
> ^- possibly related
TorBrowser is patched to block attempts by websites to access HTML5 canvases,
since there isn't much legitimate purpose for a site to do this, other than to
track you as that article you linked points out.
However, if you've already clicked the "Allow in the Future" button on the
little dialogue that comes down from the URL bar when a site attempts to do
this, there isn't currently an easy way to revoke the permission you gave. [0]
Additionally, there appears to be an issue in nsIPermissionManager (used by
TorButton when "New Identity" is clicked), because the permissions currently
aren't being cleared properly. [1]
For now, my best advice is to be very careful allowing any site to access
HTML5 canvases until we make it easier to revoke the permission. (In other
words, click the little "X" next time. :) )
[0]: https://bugs.torproject.org/12682
[1]: https://bugs.torproject.org/12683
--
ââ isis agora lovecruft
_________________________________________________________
GPG: 4096R/A3ADB67A2CDB8B35
Current Keys: https://blog.patternsinthevoid.net/isis.txt
--Anexo de Mensagem Encaminhado--
From: scott@xxxxxxxxxxxxxx
To: tor-talk@xxxxxxxxxxxxxxxxxxxx
Date: Tue, 22 Jul 2014 22:44:25 -0400
Subject: Re: [tor-talk] Fwd: Tor and tlk.io
Any time an option comes up that I don't want to think about, I immediately
deny it. Better safe than sorry.
On Tue, Jul 22, 2014 at 10:29 PM, isis <isis@xxxxxxxxxxxxxx> wrote:
> Scott Arciszewski transcribed 0.9K bytes:
> > > Somebody told me of tlk.io. I have joined. I closed the window and
> when
> > > I was back I already had all settings as last time. I cleared the
> > > cookies and went back. I was like logged in, without ever logging in. I
> > > closed the window, cleaned up everything the delete all data can remove
> > > and 15 minutes after I reentered. I was still registered. New identity
> > > had no effect either. I had to close down Tor and start it again to
> lose
> > > the whatever that keeps identifying me.
> > >
> > > What is this? How do they do it? Are there other sites like that?
>
> Many sites use HTML5 canvas fingerprinting. Visiting either
> https://github.com/isislovecruft or https://pad.riseup.net/p/Lb57JrCmVzBt
> should trigger that little dialogue about "accessing the canvas" in
> TorBrowser
> too.
>
> > I'm using the latest version of the Tor Browser Bundle. It gives me this
> > prompt: http://imgur.com/ZGqzK4Z
>
> Can I ask you a question? When this dialogue (the http://imgur.com/ZGqzK4Z
> one) comes up, what do you usually do? Do you click the "Allow in the
> Future"
> button? Or click the little "X" in the corner? Or something else?
>
> >
> http://www.propublica.org/article/meet-the-online-tracking-device-that-is-virtually-impossible-to-block
> > ^- possibly related
>
> TorBrowser is patched to block attempts by websites to access HTML5
> canvases,
> since there isn't much legitimate purpose for a site to do this, other
> than to
> track you as that article you linked points out.
>
> However, if you've already clicked the "Allow in the Future" button on the
> little dialogue that comes down from the URL bar when a site attempts to do
> this, there isn't currently an easy way to revoke the permission you gave.
> [0]
> Additionally, there appears to be an issue in nsIPermissionManager (used by
> TorButton when "New Identity" is clicked), because the permissions
> currently
> aren't being cleared properly. [1]
>
> For now, my best advice is to be very careful allowing any site to access
> HTML5 canvases until we make it easier to revoke the permission. (In other
> words, click the little "X" next time. :) )
>
> [0]: https://bugs.torproject.org/12682
> [1]: https://bugs.torproject.org/12683
>
> --
> ââ isis agora lovecruft
> _________________________________________________________
> GPG: 4096R/A3ADB67A2CDB8B35
> Current Keys: https://blog.patternsinthevoid.net/isis.txt
>
> --
> tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
> To unsubscribe or change other settings go to
> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
>
>
--Anexo de Mensagem Encaminhado--
From: griffin@xxxxxxxxxxxxx
To: tor-talk@xxxxxxxxxxxxxxxxxxxx
Date: Wed, 23 Jul 2014 02:24:25 -0400
Subject: Re: [tor-talk] I can't use tor in state university's campus network...
ttzeqq wrote:
>>> > I am in US.What can I do?
The easiest way to bypass such a restriction is to select Configure
when launching TorBrowser, select No when asked if you need to use a
proxy, then select Yes when asked if the firewall only allows access to
certain ports. Here are some screenshots to help:
http://imgur.com/a/gjKYP
> Patrick <apexcp@xxxxxxxxx> wrote:
>> Do a lot of universities block Tor?
This is usually a result of them restricting ports to 80 & 443 -- not
actually trying to block Tor. Amusingly, this was also the case when I
was doing a demo at the Tails launch party. Local network blocked all
ports but 443 and 80. Awkward.
best,
Griffin
--
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk