Tor in Google Summer of Code 2014

https://blog.torproject.org/blog/tor-google-summer-code-2014

by taylorbuley • 12 years ago

185 42 12 years ago

blog.torproject.org

manish_gill2• 12 years ago

Uhh...I don't think the organisations have been announced yet. This just means that they will be applying for GSoC 2014, not that they are selected. :)

epanastasi• 12 years ago

Announced here: http://google-opensource.blogspot.com/2014/02/mentoring-orga...

Direct Link: http://www.google-melange.com/gsoc/org/list/public/google/gs...

ScottWhigham• 12 years ago

Direct link to the Tor entry: http://www.google-melange.com/gsoc/org2/google/gsoc2014/tor

jlgaddis• 12 years ago

We will announce the list of accepted mentoring organizations on the Google Summer of Code 2014 site on 24 February, 2014 at 19:00 UTC.

-- https://www.google-melange.com/gsoc/document/show/gsoc_progr...

manish_gill2• 12 years ago

Ah, sorry. My bad.

willvarfar2• 12 years ago

I tried to actually use tor for my browsing back when snowden leaked and schneier implored us all to. But I found the browser really too restricted to be useful. I understand that plugins can go around the browser config etc, but there has to be a better way...

The project I want to see is running the tor router in zerovm in docker, and running a full browser and all plugins in a child docker in such a way that it is fully fire walled and can only communicate via the tor container, with vnc screen scraping etc.

And set up so the browser container can be launched in persistent mode to make changes eg browser plugins, but normally runs with aufs on a ram disk so it never touches disk and is completely lost when closed.

13throwaway• 12 years ago

Can't you set up tor as an HTTP proxy then just use whatever browser you want?

willvarfar2• 12 years ago

And that's what the TOR browser bundle does. And that's why it is locked down and disables all plugins etc.

The point of hosting in docker in docker is to firewall the browser so it can't talk to anyone else, and to add extra layers of protection - however flimsy - against any eventual targeted compromise.

apk172• 12 years ago

That wouldn't be good for your anonymity. You get a lot of fingerprinting issues with other browsers which the tor browser tries to avoid.

A_COMPUTER2• 12 years ago

An HTTP proxy won't proxy DNS lookups. If you're using SOCKS4a/5 proxying, Firefox will use it IF you set network.proxy.socks_remote_dns=true, on Chrome it'll work if you use socks5 but the dns prefetch will bypass it and expose you. On Firefox, plugins and extensions can bypass the proxy. I don't know specifically about Chrome, but I experimented with it and when playing around with strict firewall egress filtering and restrictive apparmor profile, using the embedded Flash would just up and crash the browser.

It's not a good idea. If you want to use the web on Tor, use the browser bundle.

safeaim• 12 years ago

You could try setting up TheGrugq's PortalofPi and route your computer through the Pi. https://github.com/grugq/PORTALofPi

"A dedicated hardware device which forces all internet traffic to be sent over the Tor network. This significantly increases the odds of using Tor effectively, and reduces the potential to make fatal mistakes. " https://github.com/grugq/portal

tacoman• 12 years ago

And here are some instructions to do the same thing with any old Debian box. https://rednerd.com/2013/12/07/portal-for-debian/

It works well.

quasque• 12 years ago

I'm not sure if that's such a good idea.

Instead of just having your ISP able to sniff or MITM your web traffic, now you may have some random exit node operator doing the same - likely with more malicious intent than your Internet provider.

zorked• 12 years ago

In many cases your internet provider/government is your #1 concern.

bduerst3• 12 years ago

People who use Tor seriously usually also use a VPN service, and disable cookies, java, or any other client-side means of tracking you. They will also run TOR via a local virtual machine that they created on the fly.

While the exit node will be able to sniff the users, it won't be able to link it back unless the user gives up some information. ISPs can link back every time, regardless of behavior.

The FBI busted a child-porno ring on Tor using only an iframe and some javascript. They were able to take control at the data center the site was hosted, and then trace back to the ISPs for the Tor users who didn't disable java.

dublinben2• 12 years ago

Have you tried Whonix or another kind of Tor virtual machine?

https://www.whonix.org/wiki/Comparison_with_Others

nikcub• 12 years ago

Tor isn't a browser, it is a network, app and protocol, the bundled browser is just one quick way to use it.

I use it with my normal Chrome browser.

    brew install tor

then setup a new user in Chrome and install the proxy switchysharp extension and add 127.0.0.1 9040 socks5 as a proxy.

A_COMPUTER2• 12 years ago

For web browsing, the bundle is the definitive, closest-to-actually-being-secure way to do it. Tor's FAQ explicitly calls what you're doing "a really bad idea." I'm too lazy to write down all the ways it is a bad idea, but I'll just summarize it to say that you can't make Chrome always use the proxy, and it's still possible in various ways for a site to induce Chrome to give up information about you.

benjaminpv• 12 years ago

Serious question for people that are familiar with Tor: given that we've already seen people get arrested for simply running an exit node, have features like hidden services made it any safer for someone that agrees with tor's purpose (providing a less restricted end point to people that are censored by their governments) to keep an exit node running?

It seems to me that arresting an exit node's maintainer for child porn serves to have a real chilling effect on the system. As much as I'd like to provide, say, a dissident with a means to voice their opinion, it's not going to help when the cops cart away the exit note and haul me off to jail.

I guess what I'm thinking is that hidden tor services sort of 'close the gap' when it comes to problems like I describe above, since conceivably a political dissident could post to a hidden service (never appearing on the Internet at large) and have something of an intermediary in a country with greater freedom post it for them?

NegativeK• 12 years ago

I've talked to someone who runs an exit node. They not only have avoided hassle, but they run it via Amazon, which is supposedly against ToS. No issues so far.

Also, if people would like to help Tor but are afraid of running an exit node, Noisebridge (a hackerspace) runs a fucking giant exit node. Donating time or money to them would help.

big_youth• 12 years ago

Many non-profits or universities run exit nodes.

I have a tor relay on amazon[1] and have had no problems.

https://cloud.torproject.org/

dublinben2• 12 years ago

Exit relays can be run on AWS, but it's a waste of money. You'd be better off with an inexpensive VPS from a Tor-friendly provider. Donations of any amount can also be sent to TorServers.net.

https://trac.torproject.org/projects/tor/wiki/doc/GoodBadISP...

linuxguy23• 12 years ago

I'm running an exit for $5/month on DigitalOcean that blows through its 1TB of transfer in ~3 days. I've received one complaint about it (due to someone emailing their abuse address) and their support gave me no trouble when I explained what was happening.

pbhjpbhj• 12 years ago

Someone managing an exit node is effectively running an ISP - presumably in the USA they get protection under safe-harbour provisions like those of the DMCA (17 USC 512).

Aren't there also safe-harbour provisions for transmission of lewd/indecent content and for trademarks, libels and such?

Of course there being legitimacy of your actions in statute [if indeed that's the case] wouldn't mean you don't get hauled off to jail.

linuxguy23• 12 years ago

I don't think those provisions have ever been tested in court by an exit node operator.

linuxguy23• 12 years ago

Exit node operator here, had to login to address your comment.

One of the bigger advantages of a hidden service is that you can't be sure who's hosting it and where. They're great for hosting websites but do nothing for allowing access to other services. If you're worried about trouble from running an exit node you could contribute by running a relay or a hidden bridge which would be way more useful than a hidden service.

I've actually been contacted by the Michigan State Police in a child porn investigation and after explaining that I run a TOR exit node and have no ability to help in their investigation the officer I talked to was quite pleasant. I've heard nothing about it since then.

There are several news outlets that run hidden services for whistle blowers and people in danger or unable to speak openly so your idea isn't without merit but it does require pre-planning to be of any use. If you've got no way to communicate the existence of your service to people before they need it, it'll be of little use.

apk172• 12 years ago

As far as I know arrests or searches only happened for people who ran exit node on their home connection. Running exits on hosting services puts you into a different category for the police, namely good guy to ask for traces instead of bad guy to bust.

Anyway, I'm only running two non-exits. :-)

tokenizerrr• 12 years ago

Exit nodes are not necessary to connect to hidden services, regular relays are used for that who do not know where the data comes from, or where it goes to. The hidden services exist within the tor network, thus no exit is needed.

mo• 12 years ago

I am one of the persons behind https://www.torservers.net/ , a collective of non-profit organizations that run Tor exit relays thanks to your donations. :) I am not aware of any "arrests" anywhere, although some exit relay operators have been raided and their equipment seized in the past. I understand this might scare away some people from running exit relays. You can still contribute to the network by running non-exit relays.

Hidden Services use only the internal network and don't rely on exit relays at all. All communication is end-to-end encrypted, so all relays will only ever see encrypted content.

If you have less than a couple of Mbit/s of upload capacity, you might want to run a bridge. Bridges are especially useful for people in heavily censored regions, and only provide an entry point to the Tor network.

pearjuice• 12 years ago

So is Tox, "a free and open source replacement to the well used proprietary application Skype".

https://www.google-melange.com/gsoc/org2/google/gsoc2014/tox

eqyiel• 12 years ago

This may be the coolest thing to ever come out of /g/!

habosa• 12 years ago

Oh no! Now Google is going to put a backdoor in Tor and use it to make more money on GMail ads and sell my soul to the NSA!

Just kidding, turns out Google is not always evil. Good that HN gets a reminder once in a while.

yeukhon• 12 years ago

In the past Navy sponsored Tor and NSF continues to sponsor Tor. And someone is going to say, "oh no." https://www.torproject.org/about/sponsors.html.en

Truth is, Google doesn't care what open source project you want to make into GSoC, as long as someone likes your proposal, the project will get the $$ it needs :) Note Mercurial didn't make it to GSoC officially this year (probably have to go under PSF's name) - so even popular OSS doesn't automatically becomes a GSoC participant.

yen223• 12 years ago

Tor wasn't just sponsored by the Navy, it was "originally designed, implemented, and deployed as a third-generation onion routing project of the U.S. Naval Research Laboratory." https://www.torproject.org/about/overview.html.en

Zigurd• 12 years ago

That trivializes a difficult issue.

When a company is recruited into a program like Prism, that doesn't necessarily happen through the CEO. Certainly, the company doesn't announce such a deal at an all-hands meeting, and omits it from their financial and regulatory filings.

The vast majority of a company's employees might be legitimately offended at the suggestion they are collaborating in such a program.

And yet, such a company can lose their customers and reputation, and may deserve that fate. It's a form of corruption. It's a hazard for customers. Those companies listed as participating in Prism have to bear the responsibility, whether or not most of the employees and even most of the company leadership can correctly claim to be victims.

Tor in Google Summer of Code 2014

Related Stories