tor-relays May 2023

tor-relays@lists.torproject.org

15 participants
14 discussions

PSA: Tor 0.4.5 reaches end of life (EOL) on 2023-02-15
by Georg Koppen 17 May '23

17 May '23

Hello! In case it affects you as you are still running your relay or bridge on Tor 0.4.5.x: the 0.4.5 series is going EOL on *2023-02-15* (roughly in 3 weeks from now). That's currently still 760 relays, which means roughly 7% of the advertised bandwidth of the network (and 387 bridges, which means roughly 9% of the advertised bridges bandwidth). Please make sure you have upgraded to the 0.4.7.x series by then. Supported releases in general can be found on the network team wiki.[1] Thanks, Georg [1] https://gitlab.torproject.org/tpo/core/team/-/wikis/NetworkTeam/CoreTorRele…

6 8

Re: [tor-relays] MyFamily
by denny.obreham＠a-n-o-n-y-m-e.net 16 May '23

16 May '23

trinity pointard <trinity.pointard(a)gmail.com> wrote .. > . It's not as easy as having a unique ID, you need to make sure a > relay can't spoof being part of a family, that's why it requires a two > way relationship for now, and will probably use some form of signature > in the future. Why not take advantage of the proof entry of ContactInfo? ( https://nusenu.github.io/ContactInfo-Information-Sharing-Specification/#pro… ) All you need to do is to add a file like https://example.com/.well-known/tor-relay/family-rsa-fingerprint.txt (uri-rsa) or DNS TXT record family-fingerprint.example.com (dns-rsa) which would contain one of the relay fingerprints of the family (the same one for all relays). The name is thus unique and you can easily check if the family name and corresponding relay fingerprint are linked to the same relay operator. The only drawback is if the chosen relay for the family name is removed from the network then a new one will have to be chosen and all the MyFamily values changed on every relay. Most likely a very rare event. Heck, a file https://example.com/.well-known/tor-relay/rsa-fingerprint.txt has already the same content as MyFamily. (Which I am guessing is one way "Alleged Family Members" are identified on Tor metrics.) _________________ > For an easy example, let's imagine that we let any relay put itself > into any family. Now suppose the attacker starts three relays A1, A2, > and A3. Then, since nothing stops them, they put A1 into a family > with every relay on the network, except for A2 and A3. Now, any time > a user (randomly) selects A1, they will find that the only other > relays they can use on that circuit are A2 and A3; this will build a > completely attacker-controlled path, they will get no privacy. How can you find a family with every relay on the network? According to the proposal, the largest family has 270 members and, according to Tor metrics, they are about 2000 exit relays. Even assuming an attacker controls A1 and A2, both falsely belonging to two different families with 250 members each (assuming all exit relays), the attacker would just increase his chances of having his A3 exit relay to be selected from 1/2000 to 1/1500. Not nothing, but not a large advantage either. The problem you are describing is actually one that is possible RIGHT NOW with MyFamily. An attacker CAN list all relay fingerprints he can find in its MyFamily except his relays. If he could only list ONE family name, he could only spoof it with the most popular family name used (assuming family name uniqueness is not enforced and more than one relay operator use the same name). But it is impossible that all [good] relay operators use the same family name, even if they would be allowed to select one as simple as "Smith". MyFamily with a single name seems both a very tiny spoofing problem AND an improvement over the current configuration.

2 1

MyFamily
by denny.obreham＠a-n-o-n-y-m-e.net 15 May '23

15 May '23

This has probably been addressed before but why isn't the MyFamily value just a single, unique ID? If I have the relays with the fingerprints "John", "Jane", and "Alice" and I want to add "Bob", wouldn't it be simpler (and more logical) to add the unique MyFamily "Smith" to each torrc file than listing all fingerprints? What do you do when you have 50 relays and want to add or remove a relay? You must modify 50 torrc files and restart all 50 relays? That seems tedious and unnecessary. I'm trying to find a way to automate this process and I can wrap my head around the complexity of the problem, especially with multiple servers. I could just use the fingerprint of my first relay as MyFamily (to ensure uniqueness) and then add it to every other torrc file I create in the future. Even if I remove the first relay from the network, the MyFamily value is still valid as a unique "family" name. I don't know the particular procedure, but even the process of blacklisting relays based on MyFamily, when selecting a relay, seems tedious. For example, the entry relay has 50 family members and the middle relay has 50 other family members, so I have to compare the potential exit relay "first" name to 100 "first" names instead of comparing its "family" name to two "family" names. Is this too complicated to implement or am I missing something? Denny

5 4

Open call for proposals for improving the health of the Tor relay operator community and the Tor network
by gus 11 May '23

11 May '23

Hello, We accomplished a number of things in our fight against malicious relays over the last 2 years[1]. One area we still need to focus on is strengthening our relay operator community. We're therefore currently collecting proposals from you or anyone else interested that could help to impove the health of the Tor relay operator community and, thus, provide our users a more trusted Tor network. We're accepting both new and old proposals, and we're open to any ideas you may have. Although there are various proposals for improving the network and the Tor relay operator community, not all of them are being enforced at the moment. Nevertheless, some proposals that can help on increasing trust have been adopted by a meaningful fraction of the Tor community (e.g. providing valid contact information). Another great example of such proposals is the "Expectations for Relay Operators"[2] document, where we guide relay operators to keep the Tor community and the network safe, healthy, and sustainable. We'd love to hear your proposal on how to make it more difficult for attackers to run relays while keeping it easy for good contributors to join our network. You can share your proposals on this GitLab ticket[3] and our tor-relays mailing list. It is worth noting that at the moment we are only trying to map these proposals to get an overview over the various options available. We're not in the process of approving any of them. If you have any experience, positive or negative, with Sybil-resistance and online abuse mitigation projects, we welcome your opinion as well. Since in this debate we have seen previous bad actors trying to game this process and thus lowering the effectiveness of our defenses, the Tor team will take all measures to stop people acting in bad faith and enforce the Tor Code of Conduct and policies. During the Tor Relay Operator Meetup on Saturday (March 4, 2023 - 19UTC), we will be discussing some of these proposals we've collected so far. Thank you, Gus [1] https://blog.torproject.org/malicious-relays-health-tor-network/ [2] https://gitlab.torproject.org/tpo/community/team/-/wikis/Expectations-for-R… [3] https://gitlab.torproject.org/tpo/community/relays/-/issues/55 -- The Tor Project Community Team Lead

4 11

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-relays May 2023