Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

To Connect People Securely, Tor Project Seeks New Bridges

timothy posted about a year and a half ago | from the building-not-burning dept.

Encryption 56

An anonymous reader links to an article at Ars explaining the dropping inventory of bridges available to users of the Tor project's encrypted messaging system. They're looking for more bridges, but that doesn't necessarily mean buying new hardware per se. From the article: "After campaigning successfully last year to get more volunteers to run obfuscated Tor bridges to support users in Iran trying to evade state monitoring, the network has lost most of those bridges, according to a message to the Tor relays mailing list by Tor volunteer George Kadiankakis. 'Most of those bridges are down, and fresh ones are needed more than ever,' [Tor volunteer George] Kadiankakis wrote in an e-mail, 'since obfuscated bridges are the only way for people to access Tor in some areas of the world (like China, Iran, and Syria).' For those who want to donate bridges to the Tor network, the easiest route is to use Tor Cloud, an Amazon Web Service Elastic Compute Cloud image created by the Tor Project that allows people to leverage Amazon's free usage tier to deploy a bridge."

cancel ×

56 comments

Sorry! There are no comments related to the filter you selected.

Maybe (2)

fustakrakich (1673220) | about a year and a half ago | (#43487663)

It turns out that a bridge makes a lousy hiding place

Re:Maybe (1)

fustakrakich (1673220) | about a year and a half ago | (#43488115)

Why would this be modded offtopic? A Tor bridge is no different from a physical one, both with easily traceable paths. The simple fact is that under its present configuration the internet cannot be made secure. It's not even very robust. My old POTS line is still more reliable.

Re:Maybe (1)

Nethead (1563) | about a year and a half ago | (#43488195)

Troll hiding under a bridge? Get it?

Re:Maybe (0)

Anonymous Coward | about a year and a half ago | (#43489933)

Because most people don't want to understand that if the information travels over the internet it can eventually be read?

Or simply because they did not understand the post?

Re:Maybe (2, Funny)

Anonymous Coward | about a year and a half ago | (#43489401)

No wonder my torrents over Tor have been a bit slower. Oh well, just have to do all of my torrenting when I am asleep.

Can money be donated? (1)

Anonymous Coward | about a year and a half ago | (#43487669)

I don't have the technical chops or resources to help them out with obfuscated bridges, but I might be willing to donate a few bucks to a worthy cause.

Re:Can money be donated? (3, Informative)

larry bagina (561269) | about a year and a half ago | (#43487711)

Can you afford a raspberry pi? That and a 24-7 internet connection is all you need.

Re:Can money be donated? (4, Informative)

randomErr (172078) | about a year and a half ago | (#43488077)

Re:Can money be donated? (2)

AlphaWolf_HK (692722) | about a year and a half ago | (#43490149)

The main concern for me is security. I don't trust anonymous entry into my private network. Perhaps if I had a proper DMZ I would do so, but that requires more equipment and features than my router and ISP permits.

(For those confused: No, that DMZ feature on your linksys router isn't a true DMZ, it's just a static NAT with PAT, and you really shouldn't be using it if you care anything about security. If it is using the same public IP and same subnet and vlan as everything else inside of your network, it is by definition not a DMZ, and is just needlessly enabling the chance of additional attack vectors.)

Re:Can money be donated? (1)

Vrtigo1 (1303147) | about a year and a half ago | (#43506895)

That's a great and technically accurate description of what the DMZ feature is on most routers and why you shouldn't expect it to work like an actual DMZ does. Kudos to you.

Re:Can money be donated? (1)

Anonymous Coward | about a year and a half ago | (#43490021)

Enjoy your jail time!

Re:Can money be donated? (2)

davester666 (731373) | about a year and a half ago | (#43490049)

I volunteer to be a Tor bridge, but just redirect all the traffic to another bridge so I don't get into trouble.

Re:Can money be donated? (2)

negRo_slim (636783) | about a year and a half ago | (#43487717)

This is what I was just wondering. I saw the article linked that talked of cloud-based bridges and I'm wondering if I just goto the tor project homepage can I count on some of that donation helping with this issue?

Re:Can money be donated? (3, Informative)

Anonymous Coward | about a year and a half ago | (#43487725)

Re:Can money be donated? (2)

PhamNguyen (2695929) | about a year and a half ago | (#43489875)

Sure, you can donate here [cia.gov] . They take paypal.

first! (-1)

Anonymous Coward | about a year and a half ago | (#43487679)

go me! my first modded down post.

I think not! (0)

techno-vampire (666512) | about a year and a half ago | (#43487809)

AC gets modded down all the time.

Re:first! (1)

Cwix (1671282) | about a year and a half ago | (#43488075)

With an attitude like that, I would predict many more!

It's not very hard to block AWS IPs (1)

Anonymous Coward | about a year and a half ago | (#43487683)

seriously guys... how long will this take until they just ban AWS IPs? and what use would be 1000 people signing up all to get similiar amazon IPs anyway

Re:It's not very hard to block AWS IPs (0)

Anonymous Coward | about a year and a half ago | (#43488121)

Yeah, but how hard is it to ban the right ones? It depends on how much a country cares about false positives. You could easily block all tor nodes, just pull the plug, but there may be a few things you want to be able to connect to after all. And that is the difficulty and why using a popular platform to host your bridge may be a good choice.

And the risks ? (1)

b100dian (771163) | about a year and a half ago | (#43487689)

Let's say I'd be 'in' to help Tor. What are the risks for me, in a eastern country - like Romania ?

Re:And the risks ? (0)

Anonymous Coward | about a year and a half ago | (#43487727)

That thugs will come along and bust your kneecaps.

Re:And the risks ? (0)

Anonymous Coward | about a year and a half ago | (#43487773)

While I am not a lawyer nor do I life in Romania and therefore are not familiar with the Romanian laws I am also pretty sure you will not be hunted for filesharing or similar as you, as a bridge, are always the first node in the tor circuit and therefore nobody sees your ip besides the ones who use your bridge.

Re:And the risks ? (0)

Anonymous Coward | about a year and a half ago | (#43487885)

The ISP and the websites know the IP address of the Tor bridge if I am not mistaken.

Re:And the risks ? (0)

Anonymous Coward | about a year and a half ago | (#43488183)

The ISP knows your IP indeed, they likely wont know for certain its a tor node you host. At least, Tor attempts to make sure they don't.
Tor bridges can be configured in certain ways to be known by certain parties, you can simply host one and only give the link to people you trust or you could have it added to the database tor has automatically.

In the end, what the above poster said is true, tor bridges should really only be known by the person using them. With the exception of possibly whoever you used to help distribute the bridge address (automated tor distribution systems and so on).

Re:And the risks ? (2)

slashmydots (2189826) | about a year and a half ago | (#43487791)

Now someone correct me if I'm wrong but there's entry node (which doesn't know if it's an entry or not) and a bridge then an exit node. The exit node, if the target website isn't using SSL, is vulnerable to looking like it's accessing whatever website/server the original viewer is on. So exit nodes are a bad idea. But bridges don't know the end target or whether it's an entry or intermediary bridge so basically it's just routing SSL traffic from one point to another and adding 1 more layer of encryption with zero ability for anyone to snoop at the content.

Re:And the risks ? (1)

slashmydots (2189826) | about a year and a half ago | (#43487869)

Lol okay, I'll correct me. I just researched it and bridges reside outside the "onion" part. They're allegedly still fully encrypted but you'll probably look suspicious to someone somewhere running encrypted connections to Iran constantly.

Re:And the risks ? (4, Informative)

Anonymous Coward | about a year and a half ago | (#43487959)

You are correct, as long as you configure your node as non exit, you are pretty much safe in nearly every european country and plenty of others.

No traffic leaves the tor network through your node and thus nothing should point to you (if the network works, if it doesn't, there are a lot of problems for a lot of people).

Depending on your country this can be very different. In some countries that do not have certain liberties simply having tor may be an issue, while tor does it best to hide everything and itself, it will likely stand out simply by being an encrypted connection, it may lead to you and lead to some questioning or worse.

For the sake of all users in such situation, stop making encrypted connections stand out and make them the norm. There really isn't any reason that everybody should be able to know what you do. Not in a "free" country and not in a non free one. Use SSH wherever you can, just that will be helpful for tor since it can then hide between those connections a bit better. Force encryption on your bittorrent, it may even lead to speedup. And if you believe your country is fine, do host a tor relay, it doesn't have to be an exit node to help the network, although there is a shortage of those as well as non exit nodes. Maybe once upon a time everything everywhere will go through a tor like service, once we get pissed off by all the people being able to see what you do.

Re:And the risks ? (1)

Dekker3D (989692) | about a year and a half ago | (#43490261)

As far as I know, a bridge is a hidden entry node. Unlike regular ones, they're not published on a huge list.. you can only request a few via a certain url at a time.

Look for the Cupcake project (5, Informative)

ptaff (165113) | about a year and a half ago | (#43487749)

Cupcake [github.com] allows you via a browser extension to run a bridge if you won't/can't install the whole Tor suite [torproject.org] .

Currently available for Chrome / Chromium [google.com] , Firefox is in the works.

Please help Tor!

Re:Look for the Cupcake project (1)

PopeRatzo (965947) | about a year and a half ago | (#43487975)

Cupcake allows you via a browser extension to run a bridge if you won't/can't install the whole Tor suite.

That is very helpful, thank you.

I know of a company that might be willing to set up a bunch of these bridges as long as they don't find out about them. If you catch my drift.

wait, what? why? (4, Interesting)

slashmydots (2189826) | about a year and a half ago | (#43487805)

How about someone with a fiber connection that I keep hearing about on slashdot just opens vidalia and configures it to run as an intermediary node. Isn't that functioning as a bridge? I have a 10MB connection but the upload is 1MB and my computer doesn't run anywhere near 24/7 or I'd run an intermediate node that way. Why the hell is anyone bother with amazon web services? Just for the bandwidth? Because I think my i5-2400 could encrypt thousands of people's SSL traffic on the fly easily so that just leaves bandwidth. So is there something else I'm missing or can people with massive bandwidth easily self host a bridge?

Re:wait, what? why? (3, Interesting)

raxx7 (205260) | about a year and a half ago | (#43487859)

You're not missing anything, running a bridge at your home is fine.
But since you're not willing to spare your scarce bandwidth, then AWS instance is an easy and cheap way to contribute.

Re:wait, what? why? (0)

Anonymous Coward | about a year and a half ago | (#43487981)

Bridges and normal nodes are not exactly the same. I don't know how to set up bridges specifically, but I am sure vidalia has an easy way to do it.

Also, I believe they like to use aws because of uptime and bandwidth. Peers will look for stable and fast connections usually (with some limitations for safety of the network). Thus an aws node that is up 24/7 will be of more use than a node that is down every evening.

Re:wait, what? why? (0)

Anonymous Coward | about a year and a half ago | (#43488009)

A node and a bridge aren't the same thing. Nodes are used to mask your IP, while bridges are run to disguise the fact you're using Tor to an observer between you and the first node. You can't run both from the same connection, unless the IP is used for non-Tor purposes as well (e.g. an Amazon IP).

Re:wait, what? why? (0)

Anonymous Coward | about a year and a half ago | (#43490033)

How about someone with a fiber connection that I keep hearing about on slashdot just opens vidalia and configures it to run as an intermediary node. Isn't that functioning as a bridge? I have a 10MB connection but the upload is 1MB and my computer doesn't run anywhere near 24/7 or I'd run an intermediate node that way. Why the hell is anyone bother with amazon web services? Just for the bandwidth? Because I think my i5-2400 could encrypt thousands of people's SSL traffic on the fly easily so that just leaves bandwidth. So is there something else I'm missing or can people with massive bandwidth easily self host a bridge?

you answered yourself ;). Of course there are solutions (using a pi, etc.), but not everyone wants to invest like that, and some people may be afraid of liability through their isp.

silkroad should pay (4, Interesting)

purnima (243606) | about a year and a half ago | (#43487835)

Tor is totally decentrlized. But surely there has to be a decetralized system that incentives people to bridge in the network. Presently, we're asked to do this out of the goodness of our hearts, like a charity. "Think of the poor Iranian freedom lover's," meh, when we know fully well that much of the traffic is silkroad related and what ever other illegal crap has found a home in the Tor space.

Whoever is running the apparently lucrative silkroad can make small bitcoin donations to "bridging" volunteers. It's cheaper than paying their taxes to a real government. You wanna distribute the north east Iranian goodies? pay for the network!

Re:silkroad should pay (0)

Anonymous Coward | about a year and a half ago | (#43487883)

Yeah, that's the answer. Somehow force the criminals into adopting a half-assed currency to send you donations in. And you fucktards have the audacity to blame the big banks for your fucking stupid ideas.

Re:silkroad should pay (1)

purnima (243606) | about a year and a half ago | (#43487919)

Yes sure.

Take bitcoin for example. Why is it valued at all? It has built in incentives but also its value probably comes from its use for money laundering and other illegal activities.

Re:silkroad should pay (0)

Anonymous Coward | about a year and a half ago | (#43488177)

You missed his point. Non-criminals aren't too keen to donating, you shouldn't expect criminals to be better.

Re:silkroad should pay (1)

purnima (243606) | about a year and a half ago | (#43488355)

Isn't the whole idea of Tor-bitcoin is to make an anarchist-nirvana where there is no such thing as criminal and non-criminal.

Re:silkroad should pay (0)

Anonymous Coward | about a year and a half ago | (#43490327)

Isn't the whole idea of Tor-bitcoin is to make an anarchist-nirvana where there is no such thing as criminal and non-criminal.

Even in an anarchy, there is still such as thing as crimnial and non-criminal.
The only difference is, your shotgun toting neighbors get to decide exactly what is illegal at the moment.
But don't worry, if you can build or steal a shotgun of your own, you too can have a voice in the 'legal' system.

Re:silkroad should pay (0)

Anonymous Coward | about a year and a half ago | (#43488207)

You do know that the Silk Road is and has always been 100 percent run in Bitcoin, right? That and Tor are the two key enabling technologies for their whole business model. So I'm not thinking it'll take a lot to force them to use it.

Of course, whether they feel like donating it is another question. And, if they did, they'd be dumb to do so under the Silk Road name, because that would just create heat for the recipients.

Re:silkroad should pay (0)

Anonymous Coward | about a year and a half ago | (#43489677)

The GP is arguing that it is in Silkroad's economic self-interest to pay for bridges, not that they "should be forced".

But you seem to have a serious problem with understanding markets. People will do whatever makes economic sense based on whatever motivates them (usually, greed, but in the case of many politicians, vanity or avarice). That's true for Bitcoin, banks, politicians, and drug dealers.

Re:silkroad should pay (1)

Sigg3.net (886486) | about a year and a half ago | (#43508741)

Mixing money into it is sure to invoke govt attention.

Who writes these headlines?!? (0)

reboot246 (623534) | about a year and a half ago | (#43487845)

This is atrocious:
To Connect People Securely, Tor Project Seeks New Bridges

Better:
Tor Project Seeks New Bridges To Connect People Securely

Did they write this too?
Somebody set up us the bomb.

Re:Who writes these headlines?!? (1)

jblb (2639331) | about a year and a half ago | (#43487909)

To gain respectability, Slashdot copies New York Times?

Re:Who writes these headlines?!? (1)

ArchieBunker (132337) | about a year and a half ago | (#43488143)

Poorly worded headlines are the least of your worries here. We still have to deal with advertisements disguised as stories and summaries that contradict what the article really says.

Slashdot editors. (0)

Anonymous Coward | about a year and a half ago | (#43488247)

Just about anything wrong with this fucking travesty of a site can be explained with those two words.

eg. If you're wondering why the site keeps getting flooded with Bitcoin articles? Slashdot editors. Specifically, Slashdot editors who have made the mistake of investing real money in Bitcoin and are advertising the shit non-stop in the hopes of driving the price up.

Iran elections (2)

Okian Warrior (537106) | about a year and a half ago | (#43488683)

If memory serves, four years ago the Iran elections resulted in much oppression and general chaos. A global call went out for Tor nodes and other resources in order to help the Iranian people at the time.

The next Iranian elections will be in June of this year. Perhaps we should be forward-looking and set up a robust network ahead of time?

Anyone remember these Slashdot posts of note?

http://yro.slashdot.org/story/09/06/29/1230216/the-technology-keeping-information-flowing-in-iran [slashdot.org]

http://yro.slashdot.org/story/09/06/22/1347228/mass-arrests-of-journalists-follow-iran-elections [slashdot.org]

http://science.slashdot.org/story/09/06/16/2137203/statistical-suspicions-in-irans-election [slashdot.org]

Absolute offtopic but... (2)

Thor Ablestar (321949) | about a year and a half ago | (#43488731)

... While I always see 1-2 Chinese nodes in I2P NetDB, I have not seen any Iranian node. Why? Does it mean that anybody trying to connect is persistently looked for, or just the system is not popular? Or, maybe, TOR client is much less visible than I2P node and so is more secure?

Liability (1)

dargaud (518470) | about a year and a half ago | (#43490457)

I feel a lot safer running an open wifi that logs all connection than running a tor node. After all I know who my neighbors are. But who knows what goes through TOR? After reading a few scare stories of TOR volunteers getting their door kicked in and their gear confiscated, that's the reason I'm not running a node, although I support the idea. But if it's to support untraceable spam, kiddie porn and DDOS operations, no thanks. Anyone has a breakdown of the kind of traffic that goes through TOR?

Re:Liability (1)

ickleberry (864871) | about a year and a half ago | (#43490895)

I have run a tor exit node on my home DSL line for years. Never had a door kicked in. Only trouble I had was being blocked from boards.ie and geocaching.com

Tails - new unofficial project to nip the buds (0)

Anonymous Coward | about a year and a half ago | (#43490525)

Tails - new unofficial project to nip the buds

(Please see the .onion link at the bottom of this article for where to respond and help this project with your suggestions. Please do not post at the Tails forums, Tor mailing lists, or in IRC - we are only checking the existing thread at the .onion location below, which requires Tor to access.)

In a few areas of the Tails Forums, (one example below) Tails users have posted about certain âdata collection, logging, debugging, Whisperbackâ(TM), and other issues a distro such as Tails should not include!

I am working on a project which will stop this type of collection and it will be free and released with each new version of Tails (it wonâ(TM)t be included with the Tails distro or worked on by Tails/Tor developers) â" matching any changes the Tails team may make to try and obscure these data logging/collection activities between versions.

Here is one example post from a concerned user (post exists now, could be deleted later!):

Why does Tails log too much? .recently-used.xbel
https://tails.boum.org/forum/Why_does_Tails_log_too_much__63___.recently-used.xbel/ [boum.org]

#

An example of this is this hidden file: .recently-used.xbel located in amnesia folder. To see, open Home/amnesia, press Cntrl+h, look for that file. The contents of that file logs recently used programs and files with names and timestamps.

There are many other logs for different activities and events, a simple look around can locate these.

Caching thumbnails, recent documents, terminal command history and the similar..

Why would Tails need to log all these things during the session?

Some are useful for bug reporting, but many other arent and are widely revealing of system activities.

Yes, a restart will wipe everything, but what about while in the session?

Can an option be made for Tails to be log free or normal where the user can choose between the two? Like run log free and if a problem occurs to re-run tails with logs to identify the problem.â

#

There are debugging scripts, Whisperback, a script to drop all firewall protection, and much more in Tails.

I need more information from Tails users (Tails developers and those pretending not to be Tails developers posting against this will be ignored) before the first release is announced.

Boot into Tails and examine every nook and cranny and post about any file(s) with full path, which contain anything related to logging (excluding /var/log directories â" those will be dealt with) and/or sending of individual personal data.

On their mailing list they even had the balls to discuss whether or not they should add the package âpopconâ(TM)!

This project will be developed by an anonymous user (not included in the annoying âAnonymousâ(TM) group). I will not reveal usernames from posters here, but I may credit this forum with each release with thanks for the help.

So boot into the most recent release of Tails, sniff around as much as possible, and post back juicy information to the thread in âNEWSâ(TM): http://clsvtzwzdgzkjda7.onion/ [clsvtzwzdgzkjda7.onion]

Thank you.

Amazon isn't free forever (0)

Anonymous Coward | about a year and a half ago | (#43494123)

Only the first year is free and you still pay for bandwidth after a certain amount.

Check for New Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>