On 5/9/13 12:38 PM, Lunar wrote:

Tom Ritter:

...

Some small suggestions:

• I'd flip the bottom and the top, with connect being on top.

I actually think that placing the safer (but more complicated) option first makes it more likely that people will at least read it. But we can change our minds later without affecting the localizations.

...

• Wording suggestion:

"This computer's internet connection is free of obstacles: [greenboldtext]My network operator does not threaten my person safety[/greenboldtext] "This computer's Internet connection is [redboldtext]censored, filtered, or proxied[/redboldtext]

Nitpick: you might be configuring someone else's computer, so “my” might not be appropriate.

In some future, having stylized images on that screen could be great.

In any cases, it's already quite an improvement. :)

Thanks! Regarding Tom's suggestion to use colored text, we are not going to tackle that at this time because doing so will complicate localization. Also, Mike pointed out that in situations where physical harm is a real possibility, the person will be so censored that they will know to chose the Configure option.

On Fri, May 10, 2013 at 10:04:46PM -0700, Mike Perry wrote: | Thus spake Mark Smith (mcs@pearlcrescent.com): | | > >> - Wording suggestion: | > >>"This computer's internet connection is free of obstacles: | > >>[greenboldtext]My network operator does not threaten my person | > >>safety[/greenboldtext] | > | > >>"This computer's Internet connection is [redboldtext]censored, | > >>filtered, or proxied[/redboldtext] | > | > Thanks! Regarding Tom's suggestion to use colored text, we are not | > going to tackle that at this time because doing so will complicate | > localization. Also, Mike pointed out that in situations where | > physical harm is a real possibility, the person will be so censored | > that they will know to chose the Configure option. | | I guess, to be fair, someone should double-check that my point above | is enough to decide against adding a *full* sentence here (instead of a | colorized fragment). | | I think the main problem is that sentence fragment coloring is a big | localization problem, like Mark said. If we want to add color/style | changes to anything more than a single word, it needs to be at the full | sentence level. I think that's Mark's main concern, and on reflection, | it might actually be the biggest issue with this text, perhaps more so | than my issue if we can find a middle ground for it. | | So, if we can think of a way to add a full sentence to the "Configure" | option that would help instruct a potential non-censored but still | heavilly persecuted and surveilled userbase (One example: Citizen | journalists reporting on the Mexican Drug war) to click Configure | instead of "Connect to the public Tor network", *without* also freaking | out everybody else who safely uses the public Tor network, then we have | a solution. | | Otherwise, I think it should be left as-is?

I have opinions, but no data. Given that this has been contentious and discussed repeatedly, is there a way it can be tested?

For example, would it make sense to present it to a set of people and then survey how they'd respond in various circumstances, or describe circumstances and ask them what they'd choose?

Obviously, surveys are inferior to live testing, but they're far easier, and in this case, less dangerous to run.

Adam

Roger Dingledine:

On Thu, May 09, 2013 at 09:47:19AM -0400, Tom Ritter wrote:

...

My network operator does not threaten my person safety

1. This is also the first point I thought of here -- in the past we've

said that some people should be using a bridge for an extra layer of "it's not so obvious that I'm using Tor", rather than just because they need one to get around filtering.

That said, these days most places that filter can also figure out that you're using a Tor bridge, or obfs2 or obfs3, even if only retroactively. We don't have the "I look just like web browsing, no matter how closely you look" holy grail in place, and it will be a long time until we do. So I don't think we should spend too much energy here distinguishing between the people who need bridges for reachability, and the people who need bridges for safety.

So what's the ethical thing to do?

Totally deprecate the "hide the fact, you're using Tor" use case?

Have a button "My network operator threatens my person safety", which is honest and explains, Tor can't help, that the use case "hide the fact, you're using Tor" is unsupported, but private obfs3 bridges are still their best bet?

Risk users in that situation, moving on to less secure, less honest anonymity services?

Thus spake Roger Dingledine (arma@mit.edu):

On Mon, May 13, 2013 at 08:38:53AM +0000, adrelanos wrote:

...

So what's the ethical thing to do?

Totally deprecate the "hide the fact, you're using Tor" use case?

Have a button "My network operator threatens my person safety", which is honest and explains, Tor can't help

Actually, Tor can help. The diversity of Tor users in a given locale gives safety in numbers. If many Tor users are using Tor to read their friends posts on Facebook, then this threatening network operator cannot easily tell whether you're doing that or something else. The issue here is that whether you use a bridge doesn't really change anything.

I think bridge use actually still does change things for many users.

First, not everywhere in the world has expensive and sophisticated DPI-based censorship systems already installed, but just about everywhere in the world *does* have the ability to inspect the endpoint IP addresses of network flows and compare them against a provided list.

Second, unfortunately right now there are laughably few Tor users in many areas of the world. Consider again the Mexican blogger reporting on the drug war. If you know the area that person lives in based on what events they report, there probably aren't many Tor users in that area: https://metrics.torproject.org/users.html?graph=direct-users&country=mx

As a drug lord, you're also way more capable of bribing or exploiting your way into the existing network infrastructure of that city than you are of covertly installing a new and sophisticated DPI device into that infrastructure to find Tor Bridge users, let alone obfsproxy3 and flashproxy users.

As a drug lord, you probably also don't have a whole lot of problems with killing a small handful of people to make extra sure you got the right one. :/

I guess that logic leads me towards leaving out mentions of personal safety in the "do you need a bridge" dialog, since it's increasingly looking like it's an orthogonal topic.

I still agree here for now, but more so because it is hard to phrase this in a way that will apply to cases where it does help, using wording that reflects the level of protection you get (which certainly will be subject to change as new transports enter the picture).