-
silent 31C3 preroll titles
-
applause
-
Roger: Okay, hi everybody! I’m Roger
Dingledine, and this is Jake Appelbaum.
-
And we’re here to tell you more
about what’s going on with Tor
-
over the past year. We actually wanted
to start out asking Laura to give us
-
a little bit of context from her
perspective, about Citizenfour,
-
and the value of these sorts
of tools to journalists.
-
applause
-
Laura: So. Am I live? Okay. Roger and Jake
asked me to say a few things about Tor,
-
and what does it mean for investigative
journalists. And I can say that certainly
-
the work that I’ve done, on working with
disclosures by Edward Snowden, and
-
first communicating with him would not
have been possible. Without the work
-
that these 2 people do. And that everybody
[does] who contributes to the Tor network.
-
So I’m deeply grateful to everyone here.
-
applause
-
When I was communicating with Snowden
for several months before I met him
-
in Hongkong we talked often about the Tor
network, and it’s something that actually
-
he feels is vital for online
privacy. And, to sort of
-
defeat surveillance. It’s really our
only tool to be able to do that. And
-
I just wanted to tell one story about what
happens when journalists don’t use it.
-
I can’t go into lots of details, but
there’s a very well known investigative
-
journalist who was working on a story.
He had a source. And the source was
-
in the Intelligence community. And he had
done some research on his computer,
-
not using Tor. And I was with him when
he got a phone call. And on the phone,
-
the person was saying: “What the fuck were
you doing looking up this, this and this?”
-
And this is an example of what
happens when Intelligence agencies
-
target journalists. So without Tor
we literally can’t do the work that
-
we need to do. So thank you,
and please support Tor! Thanks!
-
applause
-
Roger: Well, thank you!
continued applause
-
Jacob: So to follow-up on what Laura
has just said: We think it’s important
-
to really expand, not just into the
technical world, or to talk about
-
the political issues in some abstract
sense. But also to reach out to culture.
-
So in this case, this is a picture in the
Reina Sofia which is one of the largest
-
museums in Spain. And that in the middle
is Mason Juday, and Trevor Paglen,
-
and that’s me on the right. And the only
time you’ll ever find me on the right!
-
And so it is the case that this is
a Tor relay. It’s actually 2 Tor relays
-
running on the open hardware device
Novena, made by bunny and Sean.
-
And it’s actually running as a middle
relay now, but it may in some point
-
with one configuration change become
an exit relay. And it is the case that
-
the Reina Sofia is hosting this Tor relay.
So, now, if… so we live in capitalism…
-
applause
-
So it is the case that if the Police wanna
seize this relay they got to buy it
-
like every other piece
of art in the museum.
-
laughter and applause
-
And part of the reason that we’re
doing this kind of stuff – at least
-
that piece of art which I did with Trevor
and Mason and Leif Ryge who is also
-
in this room, and Aaron Gibson, also in
this room – is because we think that
-
culture is important. And we think that
it’s important to tie the issue of anonymity
-
not just as an abstract idea but as an
actual thing that is representative
-
not only of our culture but of the world
we want to live in, overall. For all the
-
cultures of the world. And so, for that
reason we also have quite recently
-
been thinking a lot about social norms.
And it is the case that there’s a person
-
in our community, and many persons in our
community that have come under attack.
-
And have been deeply harassed.
And we think that that sucks!
-
And we don’t like that. Even though we
promote anonymity without any question,
-
i.e. no backdoors ever, and we’ll
get back to that in a minute,
-
it is the case that we really
want to promote ‘being
-
excellent to each other’. In the
sort of spirit of Noisebridge!
-
applause
-
And it’s still a little bit American-centric
but you can get the basic idea.
-
It applies to Europe as well. Just replace
‘First Amendment’ with some of your local law.
-
Or a local constitutional right. It isn’t
the case that we’re saying that you
-
shouldn’t have the right to say things.
But we are saying “Get the fuck out
-
of our community if you’re going
to be abusive to women!”
-
applause and cheers
-
And you’ll note that I used the word
‘Fuck’ to say it. And I’m sorry about that.
-
Because the point is we all make mistakes.
And we want to make sure that while
-
it’s true that we have transgressions we
want to make sure that we can find
-
a place of reconciliation, and we can
work towards conflict resolution.
-
And it’s important at the same time to
recognize that there are people who’s
-
real lives are harmed by harassment
online. In this case one of the people
-
is in this audience. And I hope that they
won’t mind being named. But we want
-
to give her a shoutout and say
that we stand behind her 100%.
-
Roger: Yeah, so, …
-
applause
-
So one of our developers on core Tor,
Andrea, has been harassed on Twitter
-
and elsewhere, really a lot more
than should happen to anybody.
-
And there are a couple of points
to make here. One of them is:
-
She’s a woman, and women online
have been harassed for basically
-
since ‘online’ has existed. Not just
women, other minorities, pretty much
-
all over the place. Especially recently
things have been getting worse.
-
The other important point to realize:
she’s not just being attacked because
-
she happens to be there. She’s being
attacked because they’re trying to attack
-
the Tor project and all the other people
in Tor. So, yes, she may be the focus
-
of some of the attacks but we - the rest
of the Tor community, the rest of the
-
security community - need to stand up
and take on some of this burden of
-
communicating and interacting,
and talking about these issues.
-
We can’t just leave it
to her to defend herself.
-
applause
-
Jacob: And so we want to set a particular
standard which is that there are
-
lots of journalists that have a lot of
questions. And we really think that
-
there are a lot of legitimate questions to
ask. E.g. I think it sucks that we take
-
Department of Defense money, sometimes.
And sometimes I also think it’s good that
-
people have the ability to feed
themselves, and have the ability
-
to actually have a home and a family. Now,
I don’t have those things, really. I mean
-
I can feed myself, but I don’t have a home
or a family in the same way that, say,
-
the family people on side of Tor do. And
they need to be paid. It is the case that
-
that is true. And that raises questions.
Like I, personally, wouldn’t ever take
-
CIA money. And I think that nobody should.
And I don’t think the CIA should exist.
-
But we have a diversity…
-
applause
-
…we have a diversity of funding because
we have a diversity of users. And so that
-
raises a lot of questions. And I think
people should ask those questions.
-
And Roger, and the rest of the Tor
community feels that way, too. But
-
it’s important that we don’t single out
a specific person. And, in particular,
-
to single out Andrea, again. She
does not deserve all the heat about
-
some of the decisions that the
Tor project as a non-profit makes.
-
She is a developer who is integral to
Tor. If it was not for her a significant
-
portion of Tor would not exist. It
would not be as bug free as it is.
-
And it would not be getting better all the
time. So we want people to reach out
-
to this alias, if they actually want
to talk, and have a forum where
-
the whole of Tor can really respond, and
think about these things in a positive way,
-
and really engage with the press. In a way
that we can manage; because at the moment
-
we get, I would say, 5 (on
average) press requests every day.
-
That’s really a lot. And it is also the
case that 4 of those requests
-
are very well phrased, extremely
reasonable questions. And one of them is,
-
you know: “Why to
choose to run Tor?” And
-
we should address all of them. We
really should. And at the same time
-
we have to recognize that some of these
people that are kind of harassing,
-
they might trigger me. That one will
trigger me, and I would probably
-
write back with something kind of shitty.
So we want to distribute the work in a way
-
where people will be nice. Even to the
people that are unreasonable. Because
-
at the core – we need to be held to
account, and we need people to look to us
-
about these things, and to ask us these
hard questions. And so this is the address
-
to reach out to: [press@torproject.org].
Not harassing Andrea online on Twitter.
-
Not coming after individual developers.
Not posting crazy stuff on the mailing list.
-
Wait until we’ve actually talked to you,
then post the crazy stuff on the mailing list.
-
Or wherever you’re going to post it. And
then hopefully we can actually answer
-
the questions in a good faith-, helpful
way. There’s no reason to talk about
-
conspiracy theories, we can just
talk about the business plans.
-
And into that point wanna make it clear:
-
stop being an asshole to people in the
community. But this is not negotiable.
-
We’re not saying because we don’t want
you to harass people that we’re going
-
to backdoor Tor. That will never happen.
You will find a bullet in the back of my head
-
before that happens. And maybe Roger’s,
too. Depending on the order of operations.
-
laughter and applause
-
Roger: Okay, so we’re going to talk
a little bit about the various things
-
we’ve done over the past year. To
give you a very brief introduction to Tor:
-
Tor is an anonymity system. You’ve got
Alice, the client over there. She builds
-
a path through 3 different relays
around the world. And the idea is
-
that somebody watching her local
network connection can’t figure out
-
what destination she’s going to. And
somebody watching the destinations
-
can’t figure out where she’s coming
from. And we have quite a few relays
-
at this point. Here’s a… the red line is
the graph of the number of relays
-
we’ve had over the past year. For those
of you who remember ‘Heartbleed’
-
you can see the big drop in April when
we removed a bunch of relays that
-
had insecure keys. But this is not the
interesting graph. The interesting graph
-
is ‘capacity over the past year’. And
we’ve gone from a little over 6 GBps
-
of capacity up to more
than 12 GBps of capacity.
-
applause
-
And as long as we can make the difference
between those 2 lines big enough then
-
Tor performance is pretty good. But we rely
on all of you to keep on running relays,
-
and make them faster etc. so that we
can handle all the users who need Tor.
-
Okay, another topic. Deterministic
builds. Mike Perry and Seth Schoen
-
did a great talk a few days ago. So you
should go watch the stream on that!
-
The very short version is: We have
a way of building Tor Browser so that
-
everybody can build Tor Browser
and produce the same binary.
-
And that way you don’t have to worry about
problems on your build machine and you can
-
actually check that the program we give
you, really is based on the source code
-
that we say that it is.
-
Jacob: And this is of course important
because we really don’t want to be
-
a focal point where someone comes
after us and says: “You have to produce
-
a backdoored version”. So it’s very
important because we do receive
-
a lot of pressure, from a lot of different
groups. And we never want to cave.
-
And here’s how we think it is the
case that we will never cave:
-
Free Software, open specifications,
reproducible builds,
-
things that can be verified
with cryptographic signatures.
-
That will not only keep us honest
against the – what do you call it –
-
the angels of our better nature.
I don’t believe in angels. But anyway.
-
The point is that it will keep us honest.
But it will also keep other people at bay.
-
From trying to do something harmful to
us. Because when something happens
-
you will be able to immediately find it.
And Mike Perry, by the way, is incredible.
-
He probably hates that I’m saying his name
right now. Sorry, Mike! Are you here?
-
laughter
Bastard! laughs
-
But Mike Perry is a machine. He also
has a heart! But he’s a machine.
-
And he’s incredible. And he has been
working non-stop on this. And he is really
-
ground-breaking in not only doing
this for Firefox but really thinking
-
about these hard problems, and
understanding that if he was just building
-
this browser by himself, and he was
doing it in a non-verifiable way
-
that it would really, actually be
a serious problem. Because we distribute
-
this software. And so, I mean
there is a reason that the NSA
-
calls Mike Perry a “worthy adversary”.
And it is because he’s amazing!
-
applause
So let’s give it up for Mike Perry!
-
ongoing applause
-
Roger: Not only that, but his work, along
with Bitcoin’s work has pushed Debian
-
and Fedora, and other groups to work
on reproducible builds as well. So,
-
hopefully the whole security
community will get better!
-
applause
-
Jacob: And to the point about Citizenfour.
One of the things that’s been happening
-
quite recently is that really respectable
nice people like the people at Mozilla
-
have decided that they really want
us to work together. Which is great.
-
Because we wanted to, and we have
respected their work for a very long time.
-
And so Tor is now partnering with Mozilla.
And that means that Mozilla, as a group,
-
will be running Tor relays. At first
middle nodes, and then, hopefully,
-
we believe, exit relays. And that is
huge because Mozilla is at the forefront
-
of doing a lot of work for end users. Just
everyday regular people wanting privacy.
-
Things like DoNotTrack e.g.
are a way to try to experiment.
-
Things like the Tor Browser a way to
experiment even further. To really bring
-
Privacy-by-Design. And it’s amazing
that Mozilla is doing that. And
-
we’ve made a partnership with them, and
we’re hopeful, cautiously optimistic even,
-
that this is going to produce some very
good results where our communities can
-
sort of fuse, and give Privacy-by-Design
software to every person on the planet
-
with no exceptions whatsoever.
-
applause
-
Now we also have a couple of things
that we would like to talk about,
-
just generally, that are a little bit
technical. But at the same time
-
we wanna keep it accessible because
we think that this talk, well, it’s useful
-
to talk about technical details. The most
important thing is somebody who has
-
never heard of the Tor community before,
who watches this video, we want them
-
to understand some of the
details, and enough, let’s say,
-
technical understanding that they’ll be
able to go and look it up if they want to,
-
but they’ll also understand we’re not
just glossing over, completely.
-
So, pluggable transports are very
important. Right now, the way
-
that Tor works is that we connect with an
SSL/TLS connection. The protocol SSL/TLS,
-
one of the 2, depending on the client
library, and the server library. And
-
that looks like an SSL connection, for
the most part. But as some of you know
-
there are people on this planet
they collect SSL and TLS data,
-
about everything flowing across the
internet. That’s really a problem.
-
It turns out we thought in some cases
that it was just censorship that mattered.
-
But it turns out broad classification
of traffic is really, actually, a problem
-
not just for blocking but also for later
doing identification of traffic flows.
-
So I’ve already lost the non-technical
people in the audience, so, let me
-
rephrase that and say: We have these other
ways of connecting to the Tor network.
-
And they don’t look just like a secure
banking transaction. They look instead
-
like DNS, or HTTP – that is your regular
web browsing or name resolution.
-
And we have a lot of different pluggable
transports. And some of them are cool.
-
Some of them make it look like you’re
connecting to Google. When in fact you’re
-
connecting to the Tor Project. And it’s
because you, in fact, are connecting
-
to Google. Leif Ryge, are you
in the room, here? Maybe, no?
-
This is really… you guys,
and your anonymity!
-
laughter
It is the case…
-
he showed this to me, I mentioned this to
some other people and David Fifield,
-
I think, either independently rediscovered
it. There’s also the GoAgent people
-
that discovered this. You can connect
to Google with an SSL connection,
-
and the certificate will say:
dadada.google.com. And you of course
-
verify it. And it is of course signed,
probably by Adam Langley, personally.
-
And… maybe it’s just the Google
CAs. And then you give it a different
-
HTTP host header. So you say: actually
I wanna talk to Appspot. I wanna talk
-
to torbridge.appspot.com.
And inside of the TLS connection,
-
which looks like it’s a connection to
Google which is one of the most popular
-
websites on the internet you then make
essentially an encrypted connection
-
through that. And then from there
to the Tor network. Using Google,
-
but also Cloudflare – they don’t
just provide you with captchas!
-
laughter and applause
laughs
-
Poor Cloudflare guy! We were joking
we should stand outside his office
-
and make him answer
captchas to get in the door!
-
laughter and applause
-
All of those people clapping wish you
would solve the Cloudflare captcha issue!
-
So it also works with other compute
clusters. And other CDNs.
-
And so this is really awesome because
it means that now you can connect
-
through those CDNs to the Tor network,
using Meek (?) and other pluggable transports
-
like that. So that’s a huge win.
And deploying it by default
-
– I think we have another slide for that…
-
Roger: Nope, that’s it!
We’ve got a different one, yes.
-
So, one of the neat things about Meek (?) is:
because it works on all these different
-
sorts of providers – Akamai
and all the CDNs out there –
-
a lot of those are still reachable from
places like China. Lots of our pluggable
-
transports don’t work so well in China,
but meek does, at this point.
-
So there are a lot of happy users.
Here’s a graph of an earlier
-
pluggable transport that we had,
called ‘obfs3’. It still works in China,
-
and Iran, and Syria and lots
of places around the world.
-
But the sort of blue/aqua line is
-
how much use we’ve seen of
obfs3. And you can tell exactly
-
when we put out the new Tor browser
release that had obfs3 built-in
-
and easy-to-use by ordinary people.
So one of the really important pushes
-
we’ve been doing is trying to make
– rather than trying to explain
-
how pluggable transports work, and
teach you everything – just make them
-
really simple. Make them part of Tor
browser, you just click on “My Tor
-
isn’t working so I wanna use some
other way to make my Tor work”.
-
And we’ve got 10.000 people at this
point who are happily using obfs3.
-
I think a lot of them are in
Syria and Iran at this point.
-
applause
-
Something else we’ve been doing over
the past year is working really hard
-
on improving the robustness,
and testing infrastructure,
-
and unit tests for the core Tor
source code. So Nick Mathewson
-
and Andrea Shepard in particular
have been really working on robustness
-
to make this something we can rely
on, as a building block in tails,
-
in Tor browser, in all the other
applications that rely on Tor.
-
So in the background things were
getting a lot stronger. Hopefully that
-
will serve us very well
in the battles to come.
-
applause
-
Jacob: So this fine gentleman
who was a teen heartthrob
-
on Italian television many years ago…
-
Arturo: Thank you for doxing me!
Jacob: Sorry.
-
both laugh
-
If only you’d been using Tor!
-
Arturo: Yeah, TV over Tor. So…
A project that we started a couple
-
of years ago with Jake is sort of related
I guess to the Tor project’s goals of
-
increasing privacy and having a better
understanding on how people’s lives
-
are impacted through technology. And this
project is called OONI, or the ‘Open
-
Observatory of Network Interference’. And
what it is, before being a piece of software
-
is a set of principles, and best practices
and specifications written in English
-
for how it is best to conduct network
related measurements. That sort of
-
measurements that we’re interested in
running have to do with identifying
-
network irregularities. These are symptoms
that can be a sign of presence of
-
surveillance or censorship, on the network
that you’re testing. And we use
-
a methodology that has been peer-reviewed,
of which we have published a paper.
-
It’s implemented using free software. And
all of the data that we collect is made
-
available to the public. So that you can
look at it, analyze it and draw your
-
own conclusions from it.
applause
-
And so we believe that this effort is
something that is helpful and useful
-
to people such as journalists, researchers,
activists or just simple citizens that are
-
interested in being more aware, and have
a better understanding that is based
-
on facts instead of just anecdotes, on
what is the reality of internet censorship
-
in their country. And we believe that
historical data is especially important
-
because it gives us an understanding of
how these censorship and surveillance
-
apparatuses evolve over time. So
I would like to invite you all to run
-
Ooniprobe today, if you copy and paste
this command line inside of a Debian-based
-
system. Obviously… perhaps you should
read what is inside it before running it.
-
applause
-
But once you do that you will have
a Ooniprobe setup and you will be
-
collecting measurements for your country.
If instead you would like to have
-
an actual hardware device we have a very
limited number of them. But if you’re
-
from an interesting country and you’re
interested in running Ooniprobe
-
we can give you a little Raspberry Pi with
an LCD screen that you can take home,
-
connect to your network and adopt
a Ooniprobe in your home network.
-
To learn more about this you should come
later today at Noisy Square, at 6 P.M.
-
to learn more about it.
-
Roger: Thank you!
-
applause
-
Jacob: And, just to finish up here,
I mean, OONI is a human rights
-
observation project which Arturo and
Aaron Gibson – also somewhere in the room,
-
I’m sure he won’t stand up so I won’t even
ask him. It’s great! Because we went from
-
a world where there was no open
measurement, with only secret tools,
-
essentially, where people acted like
secret agents, going in the countries
-
to do measurements. There wasn’t really
an understanding of the risks that
-
were involved, how the tests function,
where non-technical people could have
-
reasonable explanations. And now we have
open measurement tools, we have open data
-
standards, we have really like a framework
for understanding this as a human right
-
to observe the world around you. And then
also to share that data, and to actually
-
discuss that data, what it means. And to
be able to set standards for it.
-
And hopefully that means that people have
informed consent when they engage
-
in something that could be risky, like running
Ooni in a place like… that is dangerous
-
like the United States or Cuba,
or something like China.
-
applause
And so, Arturo personally though, is
-
the heart and soul of Ooni. And it is
really important that we see that
-
the Tor community is huge. It’s really
huge, it’s made up of a lot of people
-
doing a lot of different things. And part
of Ooni is Tor. We need Tor to be able
-
to have a secure communications channel
back to another system, we need that
-
so that people can log into these
Ooniprobes e.g. over Tor Hidden Services.
-
That kind of fusion of things where we
have anonymity but at the same time
-
we have this data set that is in some
cases identifying, in some cases
-
it’s not identifying, depending on the
test. We need an anonymous communications
-
channel to do that kind of human rights
observation. And so… just so we can
-
make Arturo a little… feel a little
appreciated I just wanna give him
-
another round of applause, for making this
human rights observation project.
-
applause
Jacob joins the applause
-
Roger: So I encourage all of you not only
to run Ooniprobe in interesting places,
-
and in boring places because they might
become interesting. But also to help write
-
new tests, and work on the design of these
things, so that we can detect and notice
-
new problems on the internet more quickly.
Something else we’ve been up to over
-
the past year is Tor Weekly News. We were
really excited by Linux Weekly News etc.
-
and… so every week there’s a new
blog post and mail that summarizes
-
what’s happened over the past week.
We encourage you to look at all these.
-
A special shout-out to harmony and
lunar for helping to make this happen
-
over the past year. Thank you!
-
applause
-
Jacob: Finally there’s a Tor list you can
be on, that you really wanna be on!
-
Roger: Being on lists is good. One of the
other features we’ve been really excited
-
about over the past year: EFF has been
helping with Outreach. EFF ran
-
a Tor relay challenge to try to get a lot
of people running relays. And I think
-
they have several thousand relays that
signed up because of the relay challenge.
-
Pushing a lot of traffic.
So that’s really great!
-
applause
-
And at the same time not only did they
get a lot of more people running relays
-
but they also did some great advocacy
and outreach for getting more exit relays
-
in universities, and basically teaching
people why Tor is important. We all need
-
to be doing more of that! We’ll
touch on that a little bit more later.
-
So you all I hope remember what was
going on in Turkey, earlier this year.
-
Here’s a cool graph of Tor use in Turkey
when they started to block Youtube
-
and other things. Then people realized,
I need to get some tools to get around
-
that censorship. But you probably
weren’t paying attention when Iraq
-
filtered Facebook, and suddenly a lot of
people in Iraq needed to get some sort
-
of way to get around their censorship. So
there are a bunch of interesting graphs
-
like this on the Tor Metrics project, of
what’s been going on over the past year.
-
Jacob: And we actually…
– if you could go back, yeah.
-
One thing that’s really interesting about
this is: Karsten Loesing who is, I think,
-
also not going to stand up, maybe you
will? Are you here? I don’t see you,
-
Karsten? No? No, okay. He does all
the metrics, this anonymous, shadowy
-
metrics figure. And if you go to
metrics.torproject.org you’ll see
-
open data that is properly anonymized
– you would expect that from us –
-
as well as actual documents that explain
the anonymity, the counting techniques,
-
that explain the privacy conserving
statistics. And you can see these graphs,
-
you can generate them based on certain
parameters. If you are interested
-
in seeing e.g. geopolitical events,
and how they tie in to the internet,
-
this project is part of what inspired
Ooni. This is how we get statistics
-
and interesting things about the Tor
network itself. From Tor clients,
-
from Tor relays, from Tor bridges.
And it tells you all sorts of things.
-
Platform information, version number of
the software, which country someone
-
might be connecting from etc. Where
they’re hosted… If you are interested
-
looking at this website and finding spikes
like this you may in fact be able to
-
find out that there is a censorship event
in that country, and we haven’t noticed it.
-
There are a lot of countries in the world
if we split it up by country. And sometimes
-
50.000 Tor users fall off the Tor network
because another American company has sold
-
that country censorship equipment. We
need help finding these events, and then
-
understanding their context. So if in your
country something like that happens
-
looking at this data can help us not only
to advocate for anonymity in such a place
-
but it can help us to also technically
realize we need to fix a thing,
-
change a thing… And it’s through this
data that we can have a dialog
-
about those things. So if you have no
technical ability at all but you’re
-
interested and understand where you
come from – look at this data set, try
-
to understand it, and then reach out to us
and hopefully we can learn about that.
-
That’s how we learn about this, that’s how
we learned about the previous thing.
-
And many years ago we gave a Tor talk
about how countries and governments
-
and corporations try to censor Tor. And
of course, a lot has happened since then.
-
There’s a lot of those things, and very
difficult to keep up with them. So
-
we really need the community’s help to
contextualize, to explain and define
-
these things.
-
Roger: Okay. Next section of the talk,
‘things that excited journalists over
-
the past year’. That actually turned out
to be not-so-big a deal. And we’re gonna
-
try to blow through a lot of them quickly,
so that we can get to the stuff that
-
actually was a big deal. So I guess in
August or something there was going to be
-
a Blackhat talk about how you can
just totally break Tor, and then
-
the Blackhat talk got pulled. Turns out
that it was a group at CMU who were
-
doing some research on Tor. And I begged
them for a long time to get a little bit
-
of information about what attack they had.
Eventually they sent me a little bit of
-
information. And then we were all
thinking about how to fix it. And then
-
Nick Mathewson, one of the Tor developers,
said: “Why don’t I just deploy
-
a detection thing on the real Tor network,
just in case somebody is doing this?” And
-
then it turns out somebody was doing this.
And then I sent mail to the Cert (?) people
-
saying: “Hey, are you, like, are you like
running those 100 relays that are doing
-
this attack on Tor users right now?” And
I never heard back from them after that.
-
So that’s sort of a… this is a sad
story for a lot of different reasons.
-
But I guess the good news is we identified
the relays that were doing the attack,
-
we cut them out of the network, and we
deployed a defense that will first of all
-
make that particular attack not
work anymore. And also detect it
-
when somebody else is trying
to do an attack like this.
-
Jacob: This, of course, is…
-
applause
-
This is a hard lesson, for 2 reasons.
The first reason is that that it’s awful
-
to do those kinds of attacks on the real
Tor network. And there’s a question about
-
responsibility. But the second lesson is
that when these kinds of things happen,
-
and we have the ability to actually
understand them we can respond to them.
-
It’s really awful that the talk
was pulled, and it is really awful
-
that these people were not able to give
us more information. And it’s also really
-
awful that they were apparently carrying
out the attack. And there were lots
-
of open questions about it. But in general
we believe that we’ve mitigated the attack
-
which is important. But we also
advocated for that talk to go forward.
-
Because we think that, of course, the
answer to even really frustrating speech
-
is more speech! So we wanna know more
about it. It somehow is very disturbing
-
that that talk was pulled. And they should
be able to present their research,
-
even if there’s anger on our face it’s
important for our users to know as much
-
as we can, so that we can move
forward with protecting Tor users.
-
Roger: Okay, so, another exciting
topic from a couple of months ago:
-
Russia apparently put out
a call-for-research work…
-
loud splashing noise from Jake
opening a loaded water bottle
-
…to come up with attacks on Tor.
Jacob: It’s another attack on Tor!
-
Roger: Enjoy your water, Jake.
I hope that was worth it. laughs
-
Jacob: laughs It was really
worth it. Was very thirsty.
-
Roger: So Russia put out a
call-for-research proposals
-
on attacking Tor. Somebody mistranslated
that phrase from Russian into ‘prize’,
-
or ‘bounty’, or ‘contest’. And then we had
all these articles, saying “Russia is
-
holding a contest to break Tor” when
actually, no, they just wanted somebody
-
to work on research on Tor attacks.
So this would be like the U.S. National
-
Science Foundation holds a contest
for Tor research. That’s not actually
-
how government funding works.
Mistranslations cause a lot of
-
exciting journalist articles but as
far as I can tell it turned out to be
-
basically nothing. Also it was basically
‘no money’. So, maybe something
-
will come of this, we’ll see. Something
else that’s been bothering me a lot,
-
lately: Cryptowall, now called
‘Cryptolocker’. So, there are jerks
-
out there who break into your
mobile phone of some sort,
-
give you malware, viruses, something
like that. They encrypt your files,
-
and then they send you basically a ransom
note saying “We’ve encrypted your file,
-
if you want it back send some Bitcoin over
here!” So this is bad, so far. But then
-
the part that really upsets me is they
say: “And if you don’t know how to do this
-
go to our website torproject.org and
download the Tor Browser in order
-
to pay us”. Fuck them! I do not want
people doing this with our software!
-
applause
-
Jacob: Yeah, fuck them. I mean I don’t
really have a lot to contribute to that.
-
I mean it’s really… Hidden Services have
a really bad rap, and it’s frustrating,
-
right? There’s a… of course this
quantitative and qualitative analysis
-
that we can have here. And the reality
of the situation is that one Globaleaks
-
leaking interface is ‘one.onion’ (?), for
example. What is the value of that?
-
Versus 10.000 Hidden Services run by these
jerks? And it’s very hard to understand
-
the social value of these things, except
to say that we really need things like
-
Hidden Services. And jackasses like this
are really making it hard for us to defend
-
the right to publish anonymously. And so,
if you know who these people are please
-
ask them to stop! I don’t even know
what the ask is there. But they really
-
should stop. Or maybe there’s some
interesting things that you can do.
-
I don’t know. But we really, really
don’t like that this is someone’s
-
first introduction to Tor! That they think
that we’re responsible for this. We
-
most certainly are not responsible for
these things. We certainly do not deploy
-
malware. And Hidden Services are actually
very important for a lot of people.
-
These people are not those people!
-
applause
-
Roger: Another ‘exciting’ story,
a month or 2 ago, was,
-
“81% of Tor users can be de-anonymized…”
and then some more words, depending on
-
which article you read. So it turns out
that one of our friends, Sambuddho, who is
-
a professor in India now, did some work
on analyzing traffic correlation attacks
-
in the lab. He found, in the lab, that
some of his attacks worked sometime,
-
great… And then some journalists found it,
and said: “Ah! This must be the reason why
-
Tor is insecure today”. So he wrote
an article, it got Slashdot, it got
-
all the other news stories. And suddenly
everybody knew that Tor was broken
-
because “81% of Tor users…”.
So it turns out that Sambuddho himself
-
stood up and said actually: “No, you
misunderstood my article”. But
-
that didn’t matter because nobody listened
to the author of the paper at that point.
-
So I guess there’s a broader issue that
we’re struggling with here, in terms of
-
how to explain the details of these
things because traffic correlation attacks
-
are a big deal. They probably do work
if you have enough traffic around
-
the internet, and you’re looking at the
right places. You probably can do
-
the attack. But that paper did not do the
attack. So I keep finding myself saying:
-
“No no no, you’re misunderstanding the
paper, the paper doesn’t tell us anything,
-
but the attack is real! But the paper
doesn’t tell us anything”. And this is
-
really confusing to journalists because
it sounds like I’m disagreeing with myself
-
with these 2 different sentences. So we
need to come up with some way to
-
be able to explain: “Here are all of the
real attacks, that are really actually
-
worrisome, and it’s great that researchers
are working on them. And they probably
-
are a big deal, in some way. But no, that
paper that you’re pointing at right now
-
is not the reason why they’re a big
deal”. We also saw this in the context
-
of an NSA paper which was published
a couple of days ago, thanks to
-
some other folks.
Jacob: Sad, ‘some other folks’!
-
Roger: ‘Some other folks’. I won’t specify
-
exactly which other folks. And they
similarly had a traffic correlation attack.
-
And in the paper it’s really a bad one.
It’s the same as the paper that was
-
published in 2003, in the open literature.
There was a much better paper
-
published in 2004, in the open literature,
that apparently these folks didn’t read.
-
So I don’t wanna say traffic correlation
attacks don’t work, but all these papers
-
that we’re looking at don’t show…
aren’t very good papers.
-
Jacob: So one of the solutions to a lot
of journalists that don’t understand
-
technology is that it’s actually quite
easy to be a journalist by comparison
-
to being a technologist. It’s possible
to write about things in a factually
-
correct way, sometimes you don’t always
reach the right audiences, that can
-
actually be difficult. It depends. So you
have to write for different reading
-
comprehension levels, e.g. And we tried
to write for people who understand
-
the internet. At least when I write as
a journalist. And so, when I sometimes
-
take off my Tor hat I put on my journalistic
hat. And part of the reason is that
-
in order to even tell you about some
of the things that we learn, if I don’t
-
put on my journalistic hat I get a nice
pair of handcuffs. So it’s very important
-
to have journalistic protection so that we
can inform you about these things.
-
So e.g. it is the case that XKeyscore
rules – we published some of them.
-
Not ‘we’, Tor. But me and this set of
people at the top, of this by-line here.
-
In NDR. Some of you know NDR, it’s a very
large German publication. I also publish
-
with Der Spiegel, as a journalist. In this
case we published XKeyscore rules.
-
Where we specifically learned an important
lesson. And the important lesson was,
-
even if you’re a journalist explaining
things exactly technically correctly
-
– people will still get it wrong. It’s just
not the journalists that get it wrong.
-
It’s the readers. Very frustrating.
-
People decided that because the NSA
definitely has XKeyscore rules that is
-
rules for surveilling the internet, where
they’re looking at big traffic buffers.
-
TEMPORA e.g. the British surveillance
system that is built on XKeyscore.
-
With a – probably – week-long buffer of
all internet traffic. That’s a big buffer,
-
by the way. Doing these XKeyscore
rules, running across that traffic set,
-
they would find that people were
connecting to directory authorities.
-
One of those directory authorities is
mine, actually, quite ironically. And
-
then Sebastian Hahn, and other people
in this audience. And some people said:
-
“Oh, don’t use Tor because the NSA will
be monitoring you!” That is exactly
-
the wrong take-away. Because there are
XKeyscore rules on the order of tens of
-
thousands, from what we can tell.
So everything you do is going through
-
these giant surveillance systems. And
what you’ll learn when you monitor
-
someone using Tor is that they’re
using Tor potentially, in that buffer.
-
Which is different than ‘they learn
for sure that you were going to
-
the Chaos Computer Club’s web site’,
or that you were going to a dating site.
-
So it’s the difference between ‘they learn
some keeny (?) bit of information about you’,
-
that you’re using an anonymity
system, versus ‘they learned exactly
-
what you were doing on the internet’. Now
if there were only a few XKeyscore rules
-
at all, and it was just that about Tor
then that conclusion people reach
-
would be correct. But it’s exactly not
true. The XKeyscore system is so powerful
-
that if you have a logo for a company,
so anyone here that runs a company,
-
and you put a logo inside of a document,
the XKeyscore system can find that logo
-
in all of the documents flowing across the
internet in real-time. And alert someone
-
that someone has sent a .DOC or a PDF with
that image inside of it. And alert them.
-
So that they can intercept it. So the
lesson is not “Don’t use Tor because
-
XKeyscore may put your metadata into
a database, in the so-called ‘corporate
-
repositories’”. The lesson is “Holy shit,
there’s this gigantic buffering system
-
which has search capabilities that even
allow you to search inside of documents.
-
Really, really advanced capabilities where
they can select that traffic and put it
-
somewhere else”. “Use an anonymity
system!” And also: “Look, they’re
-
targeting anonymity systems, even in the
United States, which, at least for the NSA
-
they’re not supposed to be doing those
kinds of things”. They literately were
-
caught lying here. They’re doing
bulk internet surveillance even
-
in the United States. Using these
kinds of systems. That’s really scary.
-
But the real big lesson to take away from
that is, actually, that they’re doing this
-
for all the protocols that they can
write fingerprints for. And they have
-
a generic language where they can actually
describe protocols. And so we published
-
a number of those, we = NDR. And I would
really recommend you read and understand
-
that. But the lesson, again, is not
“Oh no, they’re going to detect you’re
-
using Tor”. We have never said that Tor
can e.g. protect you against someone
-
seeing that you’re using it. Especially in
the long term. But rather the point is
-
exactly the scariest point. This mass
internet surveillance is real. And
-
it is the case that it is real-time.
And it’s a real problem.
-
applause
-
Roger: If you’re using Tor they see that
you’re using Tor. If you’re not using Tor
-
they see exactly where you’re going.
You end up in a list of people who went
-
to ‘this’ website, or ‘this’ website,
or used ‘this’ service, or sent
-
‘this’ document. And the diversity of
Tor users is part of the safety, where,
-
just because they know you’re using
Tor doesn’t tell them that much.
-
One of the other things I’ve been
wrestling with after looking at a bunch
-
of these documents lately is the whole
‘how do we protect against pervasive
-
surveillance’. And this is an entire talk
on its own. We’ve been doing some
-
design changes. We pushed out some changes
in Tor that protect you more against
-
pervasive surveillance. We – for the
technical people out there – we’ve reduced
-
the number of guard relays that you use
by default from 3 to 1. So there are
-
fewer places on the internet that get to
see your Tor traffic. That’s a good start.
-
One of the other lessons we’ve been
realizing: The internet is more centralized
-
than we’d like. So it’s easy to say
“Oh, we just need more exit relays,
-
and then we’ll have more protection
against these things”. But if we put
-
another exit relay in that same data
sensor (?) in Frankfurt that they’re
-
already watching that’s not actually going
to give us more safety against these
-
pervasive surveillance adversaries.
Something else I realized: so we used
-
to talk about how Tor does these two
different things. We’ve got anonymity,
-
we’re trying to protect against somebody
trying to learn what you’re doing, and
-
we’ve got circumvention, censorship
circumvention. We’re trying to protect
-
against somebody trying to prevent
you from going somewhere.
-
But it turns out in the surveillance
case they do deep packet inspection
-
to figure out what protocol you’re
doing, to find out what you’re up to.
-
And in the censorship case they do
deep packet inspection to figure out
-
what protocol you’re using, to decide
whether to block it. So it’s actually…
-
these fields are much more related
than we had realized before. And
-
it took us a while, I’m really happy that
we have these documents to look at,
-
so that we have a better understanding
of how this global surveillance
-
and censorship works. Long ago, so in
2007, I ended up doing a talk at the NSA,
-
to try to convince them that we were not
the bad guys. And you can read the notes
-
that they took about my talk at the
NSA. Because they’re published
-
in the Washington Post. So I encourage you
to go read what the NSA thought of my talk
-
to them. That same year I ended up going
to GCHQ, to give a talk to them, to try
-
to convince them that we were not the
bad people. And I thought to myself:
-
“I don’t want to give them anything
useful. I don’t want to talk about
-
anonymity, because I know they’re going
to try to break anonymity. So I’m going
-
to give them a talk that has nothing to do
with anything that they should care about.
-
I’m going to talk about the censorship
arms race in China, and DPI, and stuff
-
like that, that they shouldn’t care
about at all”. Boy, were we wrong!
-
applause
-
So the other thing to think about here,
there are a bunch of different pluggable
-
transports that could come in handy
against the surveillance adversary.
-
We have, so far, been thinking of
pluggable transports in terms of
-
‘there’s somebody trying to censor your
connection, they’re doing DPI, or they’re
-
looking for addresses, and they’re trying
to block things’. One of the things
-
we learned from this past summer’s
documents: imagine an adversary
-
who builds a list of all the public Tor
relays. And then they build a list of
-
all of the IP addresses that connect
to those Tor relays. Now they know
-
all the bridges, and many of the users.
And now they build a list of all the
-
IP addresses that connect to those IP
addresses. And they go a few hops out,
-
and now they know all the public relays,
all the bridges, all the users, all of
-
the other things that are connected to
Tor. And they can keep track of which ones
-
they should log traffic for, for the next
6 months, rather than the next week.
-
That’s a really scary adversary. Some of
the pluggable transports we’ve been
-
working on could actually come in handy
here. So ‘Flash proxy’ is one of the ones
-
you heard about in last year’s talk. The
basic idea of a Flash proxy is to get
-
users running web browsers to volunteer
running web-RTC, or something like that
-
to basically be a short-lived bridge
between the censored user and
-
the Tor Network. So the idea is that you
get millions of people running browsers,
-
and then you can proxy from inside China,
or Syria, or America, or wherever
-
the problem is, through the browser into
the Tor Network. But from the surveillance
-
perspective suddenly they end up with
an enormous list of millions of people
-
around the world that are
basically buffering the Tor user
-
from the Tor Network. So if they
start with this list of IP addresses,
-
and they’re trying to build a list of
everything, now they end up
-
with millions of IP addresses
that have nothing to do with Tor.
-
And they have to realize, at the time
they’re watching, that they want to go
-
one more hop out. So I don’t
know if that will work. But this is
-
an interesting research area that more
people need to look at: How can we,
-
against an adversary who’s trying to build
a list of everybody who has anything to do
-
with Tor, how can we have
Tor users not end up on that list.
-
What sort of transports or tunneling
through Google app spot (?),
-
or other tools like that can we use
to break that chain, so it’s not as easy
-
for them to track down
where all the users are.
-
Okay, Silk Road 2, we’ve had a lot
of questions about. I think it’s called
-
Operation Onimous (?). I actually talked
to an American law enforcement person
-
who was involved in this. And he
told me, from his perspective, exactly
-
how it happened. Apparently the
Silk Road 2 guy wrote his name down
-
somewhere. So they brought him in,
and started asking him questions. And
-
as soon as they started asking him
questions he started naming names.
-
And they counted up to 16 names, and
they went and arrested all those people,
-
and collected their computers. And then
they put out a press release, saying
-
that they had an amazing Tor attack.
-
applause
-
So there are a couple of lessons here. One
of them is: Yes, it’s another case where
-
opsec failed. But the other lesson that
we learn is: These large law enforcement
-
adversaries are happy to use press spin
and lies, and whatever else it takes
-
to try to scare people away from
having safety on the internet.
-
Jacob: This is a really… to me,
especially, if I take off my Tor hat
-
and put on my journalistic hat, as if
I can actually take off hats etc., but
-
it’s really terrifying that journalists
don’t actually ask hard questions
-
about that. You know, the Europol people
that spoke to the press, they talked
-
about this as if they had some incredible
attack, they talked about 0-day,
-
they talked about how, you know,
they had broken Tor, “You’re not safe
-
on the Dark Web”. We don’t even use the
term ‘Dark Web’. That’s how you know
-
that they’re full of shit. But it’s…
applause
-
That’s sort of like when people have Tor
in all caps (?)(?)(?)(?)(?)(?), dark web,
-
that kind of stuff, this is a bad sign. But
the way they talk about it, it was clear
-
that they, as far as we can tell, they
don’t have that. But they really hyped it.
-
As much as they possibly could. I mean,
it is, effectively, and I think it is even
-
technically a psychological operation
against the civilian population. They
-
want to scare you into believing that Tor
doesn’t work. Because, in fact, it does work,
-
and it is a problem for them. So any time
they can ever have some kind of win-it-all
-
they always spin it as if they’re great,
powerful adversaries, and it’s
-
us-versus-them. And that’s exactly wrong.
It is not us-versus-them. Because we all
-
need anonymity. We all absolutely need
that. And they shouldn’t be treating us
-
as adversaries. They, in fact, are also
Tor users, quite ironically. So it is
-
interesting though, because they know that
they haven’t done that. But they don’t
-
want you to know that they haven’t done
that. In fact, they want you to know
-
the opposite. Of course we could be
wrong. They could have some
-
super-secret exploit, but as far as we can
tell that just is not the case. So, what’s
-
to be learned from this? We used to think
it was just American law enforcement
-
that were scary jerks. Now it’s also
European. I don’t know if that’s
-
the right buzzing(?). But hopefully some
of you will go and work at Europol,
-
and tell us what’s really going on.
-
applause
-
Roger: Speaking of Hidden Services. We
have a new design in mind, that will have
-
some stronger crypto properties, and make
it harder to enumerate Hidden Services.
-
It won’t solve some of the big anonymity
questions that are still open research
-
questions. But there are a lot of
improvements we’d like to make,
-
to make the crypto more secure, and
performance changes etc. And we’d been
-
thinking about doing some sort of crowd
funding, kickstarter-like thing, to make
-
Hidden Services work better. We’ve got
a funder who cares about understanding
-
Hidden Services, but that’s not the same
as actually making them more secure.
-
So we’d love to chat with you after this
about how to make one of those
-
kickstarters actually work.
-
Jacob: Right, so, if you have questions
we have some amount of time for questions.
-
And while you line up at the microphone
I’ll tell you a quick story. So if you
-
have questions please line up at the
microphone, so we can do this.
-
This is a picture of a man who was
assassinated in San Francisco.
-
His name is Harvey Milk. Anybody
here – ever hear of Harvey Milk?
-
applause
-
Great. Harvey Milk was basically the
first out-gay politician in, I think,
-
the United States. He was a city council
member in San Francisco. And this was
-
during a huge fever pitch apora (?) where…
basically it was the battle between:
-
“Are people who are gay people or not?”
And what he said is: Go home and
-
tell your brothers, your mothers, your
sisters, your family members and
-
your co-workers that you’re gay. Tell
them that, so that when they advocate
-
for violence against gay people, when
they advocate for harm against you
-
that they know they’re talking about you.
Not an abstract boogieman. But someone
-
that they actually know, and that they
love. We need every person in this room,
-
every person watching this video later to
go home and talk about how you needed
-
anonymity, for 5 or 10 minutes. How you
needed it every day to do your job.
-
We need people to reach out. Now that’s
a sad story with Harvey Milk which is
-
that he and mayor Moscone of San
Francisco were actually killed by
-
a very crazy person, that was also in city
government, in the American traditional
-
extreme gun violence. He was shot and
killed. And that person actually got away
-
with it. The so-called ‘Twinkie defense’.
So we’re not trying to draw that parallel.
-
Just to be clear please don’t shoot us and
kill us! Not even funny, unfortunately.
-
But to understand that we are really
under threat, a lot of pressure. There’s
-
a lot of pressure. We get pressure from
law enforcement investigation agencies
-
to backdoor Tor, and we tell them:
“No”, and that takes a lot of stress
-
and dumps it on us. And we need support
from a lot of people, to tell them
-
to back off. It can’t just be us that
say that. Or we will lose some day.
-
And there are also very scary adversaries
that do not care at all about the law.
-
Not that those guys care about the law but
really don’t care about the law at all.
-
And we need people to understand how
important anonymity is, and make sure
-
that that goes into every conversation.
So really, go home and teach your friends
-
and your family members about your
need for anonymity. This lesson
-
from Harvey Milk was very useful. It is
the case that now, in California where
-
there is a huge fever pitch (?) battle about
this that you can e.g. be gay and be
-
a school teacher. That was one of the
battles that Harvey Milk helped win.
-
applause
-
So, with that I think
that we have time for…
-
Herald: Yeah, we have like 10 minutes left
for questions. So, thank you so much
-
for the talk! It’s really inspiring.
Thank you for keeping up the work!
-
applause
-
Really! Although you do this every year
it never gets old. And I think your…
-
every year you give people the chance to
leave the Congress with a feeling of hope
-
and purpose. So, thank you so much for
everything you do and every minute
-
you spend on this project. So we start
with a question from the internet.
-
applause
-
Jacob: We’d like to take a few questions
from the internet all at once,
-
if possible, so we can try to answer
them as quickly as possible.
-
Signal Angel: Okay.
Herald: Alright.
-
Signal Angel: So, the first one: Yesterday
you said that SSH is broken. So
-
what should we use to safely
administrate our Tor relays?
-
Jacob: Hah! That’s great. So,
first of all! Next set of questions!
-
Signal Angel: So the next one is: How much
money would be needed to get independent
-
from Government funding,
and is that even desired?
-
Jacob: Ah, do you want me to do both?
Roger: Sure.
-
Jacob: Okay.
Signal Angel: Hope so.
-
Jacob: Okay. First question: Consider
using a Tor Hidden Service, and then
-
SSH’ing into that Tor Hidden Service.
Composition of cryptographic components
-
is probably very important. A detail about
SSH: We don’t know what is going on.
-
We only know what was claimed in those
documents. That’s a really scary claim.
-
This creates a political problem. The U.S.
Congress and other political bodies
-
should really be asking the secret
services if they really have a database
-
called CAPRI OS where they store
SSH decrypts. And how they populate
-
that database. Because that is critical
infrastructure. We can’t solve that problem
-
with the knowledge that we have right now.
But we know now: There is a problem.
-
What is that problem? So, composition
of those systems: It seems to be,
-
the documents say that they haven’t broken
the crypto in Tor Hidden Services. So
-
put those two together. And also consider
that cryptography only buys you time.
-
It really isn’t the case that all the
crypto we have today is going to be good
-
maybe in 150 years. If Sci-Fi quantum
computers ever come out, and they
-
actually work, Shor’s algorithm and
other things really seem to suggest
-
we have a lot of trouble ahead. And the
second part, about money: Yeah, we would
-
love to replace Government funding. I mean
at least I would. But that isn’t to say
-
that we don’t respect that there are
people that do fund us to do good things.
-
We do take money from agencies who e.g.
the Department of Human Rights and Labor,
-
at the State Department. They’re sort of
like the advertising arm for the
-
gun-running part of the State Department,
as Julian Assange would say. And they
-
actually care about Human Rights. They
care that you have access to anonymity.
-
It’s weird because the State Department
– the rest of it – might not care. But,
-
we really, really would like to off-set
that money. But we’d like to grow.
-
We’d like to be able to hire 100 people
in this room to work on this full-time.
-
Because the planet needs anonymity. But
that requires that we find that money.
-
And the best place at the moment is by
writing grant proposals. And that is how
-
we have in fact done that. And that
allows us also to operate openly.
-
So we don’t have e.g. clearances. And we
try to publish everything we can about it.
-
And if you ever write a FOIA we always
tell the agency that has received the
-
Freedom Of Information request: Give the
requestor everything. Give it all to them.
-
We have nothing to hide about this, we
want you to see that. We want you to see
-
that when a government agency has paid
us money that we have done it for THIS
-
line item, and THIS line item. And we’ve
done it as well as we could do it, and
-
it is in line with the open research, and
we have really done a good thing,
-
that helps people.
-
Roger: So I’d love to diversify our
funding. I’d love to have foundations,
-
I’d love to have the EFF model where
individuals fund because we do great things
-
– look at what we did over the past year –
and in fact, right here: Look at what we
-
did over the past year. We’ve done so
amazing things, we’re gonna do some more
-
amazing things next year. We need your
help to actually make all of this happen.
-
Jacob: Anybody here
a Bitcoin millionaire?
-
Because we now take Bitcoin!
-
applause
-
Herald: Alright, let’s take
a question from microphone 1.
-
Question: Just a short question:
is there a follow-up on the
-
Thomas White tor-talk mailing list thing?
-
Roger: So, Thomas White runs a few exit
relays. Some of them are quite large,
-
I’m very happy he does that. It is quite
normal for exit relays to come and go.
-
He is in England, and as far as I can tell
England is not a very good place to be
-
these days. But he’s trying to fix his
country from inside which is really great.
-
Basically the short version is: It’s not
a big deal. He runs some exit relays,
-
somebody tries to take them down, there
are 6000 relays in the network right now,
-
they go up and down, it’s normal.
-
Question: Is this related to the Tor
blog post, that Thomas White thing,
-
where you said there’s an upcoming…
-
Roger: It is unrelated, except for the
fact that everybody was watching.
-
So then, when he wrote a tor-talk mail
saying “Hey, I’m concerned about my
-
exit relays”, suddenly all the journalists
said: “Oh my god, they must be
-
the same thing!” So, no, unrelated!
-
Jacob: There are a lot of people that
have been attacking the Tor network.
-
You’ve probably seen there’ve been
Denial-of-Service attacks, and things
-
like that on the Tor directory
authorities. This is what I was saying
-
one or two slides ago when I said “Please
tell people the value of Tor, and that
-
you need it”. Because when people do
Denial-of-Service attacks, when they see
-
servers, we really need, in a peer2peer
network way, to draw up more relays
-
to actually increase the bandwidth
capacity, to increase the exit capacity.
-
And it’s very important to do that. Right?
I mean it’s very, very serious that
-
those things happen. But it’s also
important that the design of the network
-
is designed with the expectation that
thieves will steal computer systems,
-
that jerks will denial-of-service them
etc. So if you can run an exit relay,
-
thank you! Thank you for doing that.
Next question?
-
applause
Herald: Yeah. Let’s take a question
-
from microphone 2.
-
Question: First of all a quick shoutout to
your Ooni friend. Please don’t ask people
-
to run arbitrary code over the internet.
Curl-piper’s age (?) is not good style.
-
Roger: There’s a deb (?) that we’re working
on also that should be a lot better.
-
Jacob: Yeah, ‘apt-get install ooniprobe’
will also work.
-
Question: Do you have any plans
of implementing IPv6, finally?
-
Jacob: So there is IPv6, so Linus
Nordberg, one of the finest Tor people
-
I’ve ever met, he, in fact, helped add
IPv6 support, initial IPv6 support
-
to the Tor network. So, e.g. you can,
in fact, exit through the Tor network
-
with IPv4 or IPv6. It is the case that the
Tor relays in the network still all need
-
IPv4, not just IPv6. My Tor directory
authority which runs in California,
-
it has an IPv4 and an IPv6 address,
so if you have an IPv6 address you can
-
bootstrap, you can connect to that.
You could do some interesting
-
pluggable-transport stuff as well. So
that is on the road map. This is another
-
example of: If you really care about that
issue please send us your Bitcoins!
-
And it would be really fantastic because
we really want that! But right now,
-
you can use Tor as a v4-v6 gateway.
You really can do that, and we would
-
encourage that. It’s another example
of some kind of neat feature of Tor
-
which you would never think an
anonymity system would have.
-
Roger: And in Iran, right now, where IPv6
is not censored because the soft…
-
the censorship stuff they have from
America and Europe didn’t think
-
to censor IPv6…
laughter and applause
-
applause
-
so you can use a bridge right now in Iran
that connects over IPv6. Works great.
-
Jacob: Yeah. Next question?
Herald: Alright, microphone 4!
-
Question: So we heard lots of really
encouraging success stories about Tor
-
working against a global passive
adversary. But we know that Tor
-
wasn’t designed for this use case.
The question is: What needs to happen
-
in order for Tor to actually being
able to handle this, officially?
-
Is this just research, or some
more development work?
-
Roger: There’s a lot of really hard open
research questions there. So if you’re…
-
so, I get… basically one of the
issues is what we call the
-
end-to-end traffic correlation attack. So
if you can see the flow over here coming
-
into the Tor network, and you can see the
corresponding flow over here, coming out
-
of it, then you do some simple statistics,
and you say: “Hey, wait a minute, these
-
line up!” And there are a bunch of
different directions on how to make that
-
harder. Basically what you want to
do is drive up the false-positive rate.
-
So you see a flow here, and there are
actually 1000 flows that look like they
-
sort of match. And maybe you can do
that by adding a little bit of padding,
-
or delays, or batching or something. The
research, as we understand it right now,
-
means that you have to add hours
of delay, not seconds of delay.
-
That’s kind of crummy. So another way
of phrasing that: Imagine a graph,
-
the X axis is how much overhead
we’re adding. And the Y axis is
-
how much security we get against the
end-to-end correlation attack. We have
-
zero data points on that graph. We have
no idea what the curve looks like.
-
Jacob: There’s also another point which
is: Roger has an assumption. He says
-
if we have a high false-positive rate,
that that’s a good thing. Well, maybe,
-
maybe actually, that’s exactly the
wrong thing. Maybe the result is
-
that 1000 people get rounded up instead
of 1. The reality is that there is
-
no system that – as far as we know –
is actually safer than that. Of course
-
we would say that, we work on Tor. But as
an example: One of the XKeyscore things
-
that I’ve seen in this research which
we published in the NDR story is that
-
they were doing an attack on Hotspot Shield
where they were actually doing
-
traffic correlation where they were able
to de-anonymize VPN users because of
-
it’s a single hop. And then they were
also able to do Quantuminsert to attack
-
specific users using the VPN. We haven’t
seen evidence of them doing that to Tor.
-
That also doesn’t mean that every VPN
is broken. It just means that VPN
-
has a different threat model. There’s
lot of attacks that are like that, and
-
the problem is the internet is a dangerous
place. So, I mean, Banksy said it best:
-
He said, in the future people will be
anonymous for 15 minutes. And
-
I think he may have over-estimated
that. Depending on the attacker.
-
Roger: There’s a conference called the
Privacy Enhancing Technology Symposium,
-
petsymposium.org where all of the
Anonymous Communications researchers
-
get together each year to consider exactly
these sorts of research questions. So,
-
it’s not just an engineering question,
there’s a lot of basic science left
-
in terms of how to make
these things harder.
-
Herald: Alright, the last question
is one from the internet.
-
Signal Angel: Okay, so, does running
a Ooniprobe involve any legal risks?
-
Jacob: Okay, so, great! We can take
different questions, cause we’re gonna say
-
“Talk to Arturo!”
-
Herald: Alright, so, microphone 3!
-
Question: Okay, as a new
Tor relay operator I’ve got…
-
applause
Jacob: Take a bow!
-
Question: So, since about 2 months I run
3 relays, rather high bandwidth, and
-
on 2 of these I had quite strange things
happen. One case: A kernel crash in the
-
Intel e1000 driver, the other one having
the top-of-the-rack switch just reboot,
-
which is by the way a Juniper switch.
So I’m kind of concerned about this
-
operational security. You
know, could you trust that?
-
Jacob: Yeah, absolutely. So the short
version of it is: Agencies like the NSA,
-
depending on where you’re located, might
compromise something like your Juniper
-
switch upstream. They sit on Zerodays
for critical infrastructure, that includes
-
core routers, and switches. But
it may not be such a big thing.
-
It really depends on where you’re located.
It could also be that the hardware sucks.
-
laughter
And that the software is not good. And
-
when you, of course, are pushing,
let’s say gigabits of traffic through it
-
it falls over. It’s really hard to know.
That’s a really good question,
-
which is very specific, and kind of
hard for us to address without data.
-
Question: Sorry, I’m concerned that the
attack, like this, you know, they could,
-
actually, compromise the machine without
knowing, or compromise the exact uplink.
-
And this would actually be a viable
attack, like very low-key,
-
you don’t see it, as [an] operator,
maybe, if you’re not very careful.
-
And you can watch all the traffic
going inside, going outside the box.
-
Jacob: It would be fantastic
if you can prove that theory.
-
Because, of course, if you can, maybe we
can find other information that allows us
-
to stop those types of things to
happen, or e.g. can in some way
-
allow us to fix the problems that are
being exploited. The reality is that
-
general purpose computers
are quite frankly not very secure,
-
and special purpose computers
aren’t doing much better.
-
Roger: I worry not only about active
attacks like that but about passive attacks
-
where they already have some sort of
surveillance device up-stream from you
-
in you co-location facility, or something
like that. So, yes. These are all
-
really big concerns. One of the defenses
that Tor has is diversity around the world.
-
So, hopefully they won’t be able to do
that to all of the relays. But yeah,
-
this is a big issue. We should
keep talking about it.
-
Herald: Alright, I just wanna come back
to the question before, for a second.
-
Because there was a question from the
internet. So the people are not able
-
to talk. Ooniprobe guy, hey, could you
maybe answer the question, like,
-
right now, or maybe on Twitter,
or post a link or something?
-
Because I happen to believe that
it’s a very important question.
-
You remember the question?
If there are legal restric…
-
Arturo: Yeah well, I mean the thing is
that we don’t really know like what are
-
the… who was it that
was asking the question?
-
Jacob: The internet?
Arturo: Ah, the internet. Okay.
-
laughter and applause
Jacob laughs
-
So I guess we can’t know all of the
legal risks involved in every country.
-
It is definitely the case that in some
countries you may get in trouble
-
for visiting some websites that are
considered illegal. So, I can go
-
in more detail into this if you
come later to Noisy Square at 6.
-
Herald: The internet can’t
come, that’s the problem!
-
Arturo: Ah, the internet can’t come, shit!
Okay! laughter
-
So,… laughs
applause
-
Jacob: There’re a lot of jokes in that!
-
Arturo: The short answer is that you
should look at the test specifications,
-
that are written in English, and they have
at the bottom some notes that detail
-
what can be some of the risks involved.
But we are not lawyers. So we don’t know
-
what are the risks for all of the
countries. So you should probably speak
-
to somebody that knows about these things
in your country. And it’s experimental
-
software, and there are not many people
that are doing this. So we generally can’t
-
say. Hope that answers your question.
Question: Thanks a lot, yeah, thanks.
-
Herald: Alright, I guess, just to sum
it up: Be careful whatever you do.
-
laughter and applause
Alright, so, Jake was just asking
-
if maybe we could just gather a couple
of questions, and then ask about them
-
outside. Did I get that right?
Jacob: Yeah, so if everyone who is
-
at a microphone, disperse to the correct
microphone, if you could just ask all your
-
questions, then everyone else who’s here
that wants to hear the answers will know
-
that you should stick around and talk
to us afterwards. We won’t answer
-
all these questions unless there’s
a really burning one. But that way
-
the guys that are standing at the
microphone, or the gals that are
-
standing at the microphone or other, can
actually ask them right now, and if you’re
-
interested come and find us right
afterwards. We’re going to probably
-
go to the tea house upstairs, or
maybe I shouldn’t have said that.
-
laughter
Herald: Alright, so we’re gonna do it
-
like this. We’re gonna rush through this.
And we’re just gonna hear a lot of
-
interesting questions, but no answers. If
you wanna hear the answers stay tuned
-
and don’t switch the channel. So we take
a couple of questions. Microphone 5.
-
And be quick about it.
Question: In regards to robustness and
-
the Mozilla partnership: Are there any
thoughts about incrementally replacing
-
the C++ infrastructure
with Rust? Eventually?
-
Herald: Microphone 4!
Is it open, microphone 4?
-
Question: Can you compare Tor with JAP
from TU Dresden in aspects of anonymity?
-
Herald: Okay, the other
guy at microphone 4!
-
Question: To your knowledge has anyone got
into trouble for running a non-exit relay?
-
And do you have any tips for people that
wanna help by running a non-exit relay?
-
Herald: Okay, microphone 1, 2 guys.
-
Question: I have a question, or
a suggestion for the funding problematic.
-
Have you… you’re teaming up with Mozilla,
have you ever considered like producing
-
own smartphones, because there’s a huge
margin. I also think there’s a problem
-
like… why most people don’t use
cryptography is because there’s no
-
easy-to-use, out-of-the-box, cool product
that’s like… that goes out and has a story
-
or anything, like the marketing on Apple.
-
Herald: Alright, the other
guy at microphone 1.
-
Question: So a couple of minutes before
the talk started someone did a Sibyl (?)
-
attack on Tor. And we should fix that
a.s.a.p. So please don’t disappear
-
for the next few hours.
Jacob rages, laughing, theatrically
-
Thanks!
-
Roger: It never ends.
Jacob: It never ends!
-
Herald: Alright. Two questions
from microphone 3.
-
Question: So when they took
down Silkroad they took
-
a lot of Bitcoins with them. I wonder
what the [U.S.] Government is doing
-
with the large amount of anonymized cash.
-
Roger: They auctioned it off.
Jacob: They sell it. Next question.
-
Question: And I think they
should give it to you.
-
Herald: Alright. Last question!
Jacob: I fully agree!
-
Question: So to combat against the
‘misinformed journalists’ thing
-
why not have a dashboard, very
prominently displayed on the Tor Project
-
listing all of the academic, open
like known problems with Tor,
-
and always have the journalists go there
first to get the source of information,
-
rather than misunderstanding
academic research.
-
Jacob: Fantastic, so if you wanna know…
-
Herald: Alright, if you found any of these
questions interesting, and you’re also
-
interested in the answers stick around, go
to Noisy Square, speak to these two guys,
-
and get all your answers. Other than
that, you heard it a Brillion times, but:
-
go home, start a relay! My friends and I
did two years ago, after Jake’s keynote.
-
It’s really not that hard. You can make
a difference. And thank you so much,
-
for Roger and Jake, as every year!
-
applause
-
silent postroll titles
-
subtitles created by c3subtitles.de
in the year 2017. Join, and help us!