*preroll music*
Herald: I am very happy to introduce this year’s update on the “State of the Onion”!
This is a talk with about 5 speakers, so let’s introduce them one by one.
First, Roger. He did it the last talk. He is the founder of the TOR Project,
*applause* MIT Graduate and Top 100 Global Thinkers.
Then we have Jake, a humble PHD math student
*applause*
that is in my opinion not a National Security threat
but a post National Security promise.
We have Mike Perry, and I think it is enough to say about him,
that the NSA calls him a worthy adversary.
*applause*
He is also the lead dev of the TOR Browser.
And then we have Alison Macrina, a radical, militant librarian.
*applause*
And last but not least: Shari Steele, the new Executive Director of the TOR Project.
*applause*
So without further ado: This year’s State of the Onion!
*applause*
Jacob: Alright, it’s a great honor to be back here again.
And we’re really happy to be able to introduce so many more faces.
It’s no longer the Roger and Jake show. That’s very important to us.
Hopefully next year, we won’t be here, but we’ll still be alive.
So 2015, if I were to express it in a hand gesture
or with a facial expression, it would look something like “Ooouuw”.
It was really a year of big changes. Not all of them were really good changes.
And there were a lot of heavy things that happened throughout the year.
We won’t even be able to cover all of them because we only have an hour.
So we want to focus on the positive things. I would say that
probably the nicest thing is that we are growing. We’re really, really growing.
Not only growing the network, but we’re growing the community.
And in some sense we’re expanding throughout the whole world in terms of
users who are using TOR, what TOR users are using TOR for, which is
of course extremely important that there is more and more people just doing
regular things with TOR, protecting themselves. But then we have of course
lots of specialized things that happen with the TOR network as well.
We have things like OnionBalance and Ricochet. Really exciting developments.
And we’ll talk a bit about all of those things. One of the most unlikely things,
at least when I imagine working on TOR, say 10 years ago vs. now,
is that we’ve worked with some really unlikely partners. Some of you know
that I’m not really a big fan of Silicon Valley, even though I’m from there.
So you know, I sometimes call Facebook not so nice names, like Stasi-Book.
And part of the reason for that is because I think it is a little bit weird,
that you report on all your friends in order to go to parties.
Previously it was to get into the party and now it is to go to parties.
And yet we worked with them on something.
Because it turns out that sometimes you have unlikely temporary alliances.
And it turns out that while I personally may think that they are evil incarnate
in some sense, it is the case that there is at least one good guy there.
Alec worked on this fantastic RFC7686,
that actually allowed us to help all Facebook users mitigate some harm.
Which is that if they want to be able to visit Facebook; and I guess
the reality is that not using Facebook for a lot of people is sort of like
the “Kill your Television” bumper sticker of the 90s. For those of you that ever
visited rural America. You know that that wasn’t like a really successful campaign.
A lot of people have TVs these days as well. So it’s a little bit like that,
only here we actually built an alternative where we can mitigate harm.
And that’s really incredibly important because it mitigates harm in all sorts
of different pieces of software. It makes it possible for us to talk to
Browser vendors, to DNS resolvers. And part of this was motivated
by some investigative journalism that I actually did, where I revealed
XKeyscore rules, where the US Government’s National Security Agency
was sifting through all of the internet traffic to look for .onion addresses.
So when they saw a DNS request for .onion they were actually
learning .onions by harvesting traffic. And that really motivated me
to want to make it, so that the DNS resolvers didn’t do that anymore.
It was very important, because one of my core missions with TOR
is to make that kind of stuff a lot harder for the spies to do.
And protecting everyday users, even users who aren’t TOR users, yet.
And that’s very important. So working with Alec on this has been great,
because the IETF actually supports this. And now
ICANN will not sell .onion to anyone.
It’s a special use reserved name. And that’s incredible!
*applause*
Roger: OK, so. Is this thing on? Yes it is, great!
So there are a couple of interesting graphs, that we’re going to give you,
of usage scenarios, usage instances over the past year.
So pretty recently we were looking at the number of people in Russia
using TOR. Russia has been talking about censoring, talking about all sorts of
oppression steps. And at the beginning of November,
we moved from 180k people in Russia each day using TOR
up to almost 400k people. And this is probably a low estimate.
So many hundreds of thousands of people for that two week period,
which started with a Russian bomber getting shot down, were trying to get
news from the rest of the world, rather than news as Russia wanted to show it
to them. So that’s kind of a cool event.
Another interesting event: Bangladesh ended up censoring Facebook
and some other websites and a whole lot of people switched to using TOR.
I was actually talking to one of the Facebook people and they have their own
internal statistics about the number of people connecting over the TOR network
to Facebook. And it would be super cool to super impose these two graphs.
Our data is public and open and we like sharing it.
They don’t actually share their data. But one day it would be really cool
to be able to see both of these graphs at once, to see users shifting
from reaching Facebook directly to going over TOR.
The other interesting thing from the Bangladesh side: I was looking at the
Alexa top websites around the world and we, torproject.org is
like 8000th in the global rankings, but at least
for the past couple of weeks torproject.org has been
300th in Bangladesh. So there are a whole heck of a lot of people there,
learning about these privacy things that can get around local censorship.
*applause*
OK, and then an exciting other story that we’re
going to touch on briefly, but it’s an entire talk on its own.
So let me give you a couple of facts and we’ll go from there.
January of 2014 a hundred relays showed up
in the TOR network and we weren’t sure who was running them, but they weren’t
exit relays, so they didn’t seem like they were such a threat at the time.
Fast forward a while later: The CERT organization inside CMU
submitted a presentation to Blackhat on how cool they were
for being able to attack TOR users. And they talked about how they were going to
talk about individual users that they de-anonymized
and how cool they were for that. And I spent a while trying to extract
details from them. And eventually I learned what their attack was.
And then Nick Mathewson, one of the other TOR developers decided
to check the TOR network to see if anybody was actually doing that attack.
I mean it’s CERT, they are the folks who publicised the phrase
“responsible disclosure”. Surely, they are not actually undermining
the TOR network and attacking TOR users. But then it turns out that somebody was
doing the attack. And it was these 100 relays that looked kind of ordinary
and innocuous before that. Then I sent mail to the CERT people, saying:
“Hey are those relays yours?” And they went silent. They have never answered any
of my mails since then. So that’s what we know. It doesn’t look good.
One of the key things that we, TOR, have done from here is
we’ve been working on strengthening the TOR network and getting better
at recognizing these things. So the core of the attack was that
they did what’s called a Sybil attack, where you sign up a lot of relays
and you become too large a fraction of the TOR network. So we’ve been working on
a lot of ways to recognize that an attack like that is happening,
and mitigate it, and get rid of it early. For example Philipp Winter
has a bunch of interesting research areas on recognizing similarity
between relays. So you can automatically start detecting:
“Wait a minute, this event happened, where a lot of relays
are more similar than they should be.” Another example there is:
We used to say: “Well I don’t know who’s running them,
but they don’t seem that dangerous. So OK, it’s good to grow the TOR network.”
Now we’re taking the other approach of “Gosh, that’s weird,
let’s get rid of them and then we’ll ask questions after that.”
So we’re trying to be more aggressive, more conservative
at keeping the TOR network safe from large adversaries.
Whether they’re government organizations or corporations or individuals.
Whoever might be attacking it.
Jacob: We’ve had a few really big changes in the TOR community.
One of them is that we had an Interim Executive Director
come on in a sort of quick moment and that’s Roger Dingledine.
Some of you probably always thought he was the Executive Director the whole time.
That’s because for a while he was and then he wasn’t. And then he was back again.
And that change was quite a huge change in that instead of
working on a lot of anonymity stuff, Roger was doing a lot of bureaucratic
paperwork which was actually quite sad for the anonymity world, I think.
He probably reviewed fewer papers and did fewer anonymity things
this year than ever before. Which is really, really sad.
But that really lit a fire under us to make sure that we would actually
change that. To make sure that it was possible to get someone else, who is
really good at being an Executive Director of the TOR Project, to really lead,
so that we could have Roger return to not only being an anonymity researcher,
but also the true Spirit Animal of the TOR Project.
He doesn’t look like an onion, but in spirit.
Roger: Slide! Jacob: *laughing*
Another really big thing that happened is working with Laura Poitras
over the last many years. She has followed the TOR Project
– lots of people like to follow the people on the TOR Project –
but we consented to her following us. And she made a film, “Citizenfour”,
I think some of you… have any of you seen this film?
*applause* Quite amazingly,
she won an Oscar. Actually, she basically won every film prize.
*applause*
One of the key things is that people in this room that work on Free Software
were explicitly thanked. If you work on Tails, if you work on GnuPG,
if you work on SecureDrop, OTR, TOR, …
She specifically said in the credits of the film:
This film wouldn’t have been possible without that Free Software.
Actually making her job and the jobs of her source
and other people involved… making that possible.
And so her winning that Oscar in some sense feels like
closing a really big loop that had been open for a very long time.
And it’s really great and she, I think, would really wish that she
could be here today, again. She sends her regards, and she is really,
really thankful for everybody here that writes Free Software for freedom!
*applause*
Roger: So another exciting event that happened in 2015 is that reddit
gave us 83.000$. They had some extra profit and they decided
that they would give it to 10 non-profits chosen from among the Redditer community.
And there were people who came to me and said: “Hey Roger, you really have to,
you know, start advocating, start teaching everybody, why TOR should be
one of them.” And I said: “Oh, I’m busy. Those things never work.
You know, they’ll choose somebody else.” And so it turns out that we were
the 10th out of 10 without doing any advocacy work whatsoever
to the reddit community, which is super cool that they care about us so much.
Also reddit divided the ten equally. So even though we were the 10th out of 10,
we got 10% of the donations that they were giving out.
*applause*
Jake: One of the really – I would say one of the oddest things
about working at the TOR Project for me is that TOR has supported me through
really crazy times. So when I was being detained by the US Government
or having my property stolen by fascist pigs in the United States Government’s
border checkpoints, TOR didn’t fire me. TOR always backed me and always
kept me safe. And many people often look like they wanted to kill me from stress,
but often they didn’t, which was nice. Or they didn’t get close enough
and I could move fast enough. But they were always very helpful. And
they’ve really helped me to go and do things to speak for
anonymous users who can’t go other places. And one of the places
which I was most honored to go in the last year – I was actually scheduled
to go there with Caspar Bowden, but unfortunately he was ill at the time.
And as you know, Caspar has since passed away.
But we were scheduled to go together and TOR was supporting us both, actually,
to go to this. And it resulted, I believe,
in a very amazing meeting in Geneva at the United Nations,
where the special rapporteur actually endorsed TOR and off-the-record messaging
and encryption programs, and privacy, and free software.
Saying that they are absolutely essential. And in fact their use should be encouraged
from a human rights perspective. And in fact the really amazing part about it is
he didn’t do it only from the perspective of free speech. And this is important,
because actually there are other rights. And we should think about them.
So for example the right to form and to hold an idea is a right
that cannot be abridged. The right to free speech can be abridged
in many free societies, but what is in your head and how you form it
is something where… that is not a right that can be abridged.
And he wrote this in the report. And he, when writing this report with
many other people, made it very clear that this is something we need to keep in mind.
That when we talk about private spaces online, where groups may collaborate
to form ideas, to be able to create a political platform for example,
to be able to make democratic change, they need to be able to use the internet
to freely exchange those ideas in a secure and anonymized, encrypted fashion.
And that helps them to form and to hold ideas. And obviously that helps them later
to express free speech ideas. And that’s a huge thing to have the United Nations
endorse basically what many of us in this room have been saying for, well… decades.
Roger: So the UN thing is really cool. We’ve also been doing some other
policy angles. So Steven Murdoch, who is a professor in England and also
part of the TOR community, has worked really hard at teaching the British folks,
that their new backdoor laws and their new terrible laws are actually
not what any reasonable country wants. So he’s put a huge amount of energy into
basically advocating for freedom for them. And similarly Paul Syverson,
part of the TOR community, basically ended up writing a post note for the UK
about how the dark web is misunderstood. See previous talk.
So we’ve been doing quite a bit of education at the policy level
to try to teach the world, that encryption is good and safe and worthwhile
and should be the default around the world.
Jake: And there is a kind of interesting thing here. Maybe a little contentious
with some people in the TOR community. But I just wanted to make it really clear.
We have the TOR Project, which is a non-profit in the United States.
And we have a much wider TOR community all around the world.
And in Berlin we have a really, really like an incredible TOR community.
We have people like Donncha working on OnionBalance. We have people like
Leif Ryge working on bananaphone. We have all of these different people working
on all sorts of Free Software. And many of those people don’t actually work
for the TOR Project. They’re community members, they’re volunteers,
there is some of privacy students. And so the Renewable Freedom Foundation
actually funded the creation of a sort of separate space
in Berlin where people work on these kinds of things, which is not affiliated
with US Government money. It’s not affiliated with the TOR Project
as some sort of corporate thing. It’s not a multinational thing.
It’s really the peer-to-peer version in some sense of what we’ve already had
in other places. And it’s really great and I wanted to just thank Moritz
who made that happen and to all the people like Aaron Gibson, and Juris
who actually put that space together and made it possible. So in Berlin,
there is a space, not just c-base, not just CCCB, but actually
a place which is about anonymity. It’s called Zwiebelraum.
And this is a place in which people are working on this Free Software. And they
are doing it in an independent manner. And we hope actually that people will
come together and support that, because we need more spaces like that, that
are not directly affiliated with the TOR Project, necessarily, but where we have
an aligned mission about reproduceable builds in Free Software and also
about anonymity and actually about caring about Free Speech. And actually making
it happen. And really building spaces like that all around the world. So if you
have a place in your town where you want to work on those things, we would really
hope that you will work on building that. I called it “general cipher punkery”.
I feel like that’s a good description. There’s lots of stuff to be done.
And now for a Marxist joke: So we discovered the division of labor,
which was a really important discovery. We’re about 180 years too late,
but we started to split up where it didn’t go very well, the Marxist asked why.
Cheers, cheers! So the Vegas Teams are really simple.
Basically we have a bunch of people that previously they did everything.
And this really doesn’t work. It’s very stressful and it’s very frustrating
and it leads to people doing lots and lots of things in a very unfocused way.
And so we split it up! And it actually happened naturally, it was emergent.
So e.g. Mike Perry, who’s gonna talk about the Applications Team’s work
in a second here, he was already leading this,
he was really making this happen. And so we just made it more explicit. And,
in fact we created a way of communicating and reporting back so that
you don’t have to, like, drink from the fire hose about absolutely everything
that’s happening everywhere, but you can sort of tune in to those things, which
means we get higher-level understandings and that is a really, incredibly useful
thing that has made us much more productive. And what was part of the
growing pains of the last year actually was figuring out how to make that work
because we’re a pretty flat group in terms of a community and a pretty flat group
in terms of an organization writing Free Software and advocating.
And so that’s a really incredibly good thing which will come up all the time.
You’ll hear people talking about the Metrics Team or the Network Team or the
Applications Team or the Community Team. And that’s what we’re talking about.
In that sense. So we tried to formalize it and in some ways we may be moving in a
sort of Debian model a little bit. And we’ll see how that actually goes. So we
have a really great person here to explain the work of the Metrics Team.
Roger: OK, so I’m gonna tell you a little bit about what the Metrics Team has been
working on lately to give you a sense of some of the components
of the TOR community. So there are 5 or 10 people who work on the Metrics Team.
We actually only pay one-ish of them; so most of them are volunteers
and that’s… on the one hand that’s great. It’s wonderful that there are researchers
all around the world who are contributing and helping to visualize and helping to do
analysis on the data. On the other hand it’s sort of sad that we don’t have a full
team of full-time people who are working on this all the time. So it’d be great
to have your assistance working on this. So,
actually Metrics has been accumulating all sorts of analysis tools
over the past 5 years. So there are up to 30 different little tools. There’s Atlas
and Globe and Stem and 20-something more which is a challenge to keep coordinated,
a challenge to keep maintained. So they’ve been working on how to integrate
these things and make them more usable and maintainable and extensible.
So one example that they… so they wrote some slides for me to present here.
One example that they were looking at, to give you an example of how
this analysis works, is bad relays in the TOR network. So maybe that’s an exit relay
that runs, but it modifies traffic, or it watches traffic or something.
Maybe it’s a relay that signs up as a Hidden Service directory
and then when you publish your onion address to it, it goes to visit it
or it puts it on a big list or something like that. Or maybe bad relays are Sybils
who – we were talking earlier about the 2014 attack where a 100 relays
showed up at once and we, the directory authorities have a couple of ways of
addressing that relays. One of them is each of the directory authorities can say:
“That relay needs to get out of the network! We just cut it out of the
network.” We can also say: “Bad exit!” We can also say: “That relay is no longer
gonna be used as an exit!” So even though it advertises that it can reach Blockchain
and other websites, clients choose not to do it that way. So that’s the background.
One of the tools that Damian wrote a while ago is called Tor-Consensus-Health and it
looks every hour at the new list of relays in the network and it tries to figure out:
“Is there something suspicious that just happened at this point?” And in this
case it looks for a bunch of new relays showing up all at the same time with
similar characteristics and it sends email to a list. So that’s useful. The second
piece of the analysis is “OK, what do you do when that happens?” So we get an email
saying “Hey, 40 new relays showed up, what’s up with that?” So there’s a real
challenge there to decide: do we allow the TOR network to grow – sounds good –
or do we wonder who these people are and try to contact them or cut them out of
the network or constrain what fraction of the network they can become.
So Philipp Winter also has a visualization, in this case of basically
which relays were around on a given month. So the X axis is all of the different
relays in the month and the Y axis is each hour during that month. And they’ve sorted
the relays here by how much they were present in the given month. And you’ll
notice the red blocks over there are relays that showed up at the same time
and they’d been consistently present at the same time since then. So that’s kind
of suspicious. That’s “Hey, wait a minute, what’s that pattern going on there?”
So this is a cool way of visualizing and being able to drill down and say:
“Wait a minute, that pattern right there, something weird just happened.”
So part of the challenge in general for the Metrics Team is: they have a Terabyte
of interesting data of what the network has looked like over the years –
how do you turn that into “Wait a minute, that right there is something mysterious
that just happened. Let’s look at it more.” So you can look at it from
the visualization side but you can also – there’s a tool called Onionoo where
you can basically query it, all sorts of queries in it, it dumps the data
back on to you. So we’ve got a Terabyte of interesting data out there, what
the relays are on the network, what sort of statistics they been reporting,
when they’re up, when they’re down, whether they change keys a lot,
whether they change IP addresses a lot. So we encourage you to investigate and
look at these tools etc. So there’s a new website we set up this year
called CollecTor, collector.torproject.org that has all of these different data sets
and pointers to all these different libraries and tools etc. that you too
can use to investigate, graph-visualize etc. So here’s another example.
At this point we’re looking at the 9 directory authorities in the network.
Each of them votes its opinion about each relay. So whether the relay’s fast,
or stable, or looks like a good exit or maybe we should vote about “Bad Exit”
for it. So the grey lines are: all of the directory authorities thought that
it didn’t deserve the flag and it’s very clear. The green lines are: enough of the
directory authorities said that the relay should get the flag, also very clear.
And all the brown and light green etc. in the middle are contradictions.
That’s where some of the directory authorities said “Yes it’s fast” and some
of them said “No, it’s not fast”. And this gives us a visualization, a way to see
whether most of the directory authorities are agreeing with each other.
We should look at this over time and if suddenly there’s a huge brown area
then we can say “Wait a minute, something’s going on”, where maybe
a set of relays are trying to look good to these directory authorities and trying
not to look good to these. So basically it helps us to recognize patterns
of weird things going on. So on CollecTor you can find all sorts of data sets
and you can fetch them and do your analysis of them. And Tor Metrics
– metrics.torproject.org – has a bunch of examples of this analysis, where you can
look at graphs of the number of people connecting from different countries, the
number of relays over time, the number of new relays, the number of bridges,
users connecting to bridges etc. There are 3 different libraries that help you
to parse these various data sets. So there’s one in Python, one in Java,
one in Go; so whichever one of those you enjoy most you can grab and start
doing analysis. They do weekly or so IRC meetings, so the TOR Metrics Team
invites you to show up on January 7th and they would love to have your help.
They have a bunch of really interesting data, they have a bunch of really
interesting analysis tools and they’re missing curious people. So show up,
start asking questions about the data, try to learn what’s going on. And you can
learn more about them, on the Metrics Team, there.
And then I’m gonna pass it on to Mike.
*applause*
Mike: OK, so Hello everyone! So, I’ll be telling ’bout the Applications Team part
of the Vegas plan that Jake introduced. Basically,
the Applications Team was created to bring together all the aspects of TOR
and the extended community that are working on anything that’s user facing.
So anything with a user interface that the user will directly interact with,
that’s an application on either Mobile or Desktop.
So to start, obviously we had the TOR Browser, that’s sort of like
a flagship application that most people are familiar with when they think of TOR.
Recently we’ve added OrFox which is a project by the Guardianproject to port
the TOR Browser patches to Android and that’s currently in Alpha Status. But
it’s available on the Guardianproject’s F-Droid Repo. We also have 2 chat clients:
TorMessenger and Ricochet and both with different security properties. I will be
getting to it later. So I guess, first off let’s talk about what happened
in the TOR Browser world in 2015. Basically most of the, or a good deal
of our work is spent keeping up with the Firefox release treadmill.
That includes responding to emergency releases,
auditing changes in the Firefox code base making sure that their features
adhere to our privacy model and making sure that our releases come out
the same day as the official Firefox releases so that there’s
no vulnerability exposure to known vulnerabilities after they’re disclosed.
That has been a little bit rough to over 2015. I believe there is a solid 3..4
months where it felt like we were doing a release every 2 weeks. Due to either
log jam or random unassessed vulnerability or any arbitrary
security issue with Firefox. But we did… despite treading all that water we did
manage to get quite a bit of work done. As always our work on the browser focuses
in 3 main areas: privacy, security and usability. Our privacy work is
primarily focused around making sure that any new browser feature doesn’t enable
new vectors for 3rd party tracking. So no ways for a 3rd party content resource to
store state or cookies or blob URIs or some of the newer features.
There’s a new cash API. These sorts of things need to all be isolated
to the URL bar domain to prevent 3rd parties from being able to track you.
From being able to recognize it’s the same you when you log in to Facebook and
when you visit CNN, and CNN loads the Facebook Like buttons, e.g.
Additionally we have done a lot of work on fingerprinting defences, the Alpha Release
ships a set of fonts for the Linux users so that the
font fingerprinting can be normalized since a lot of Linux users tend to have
different fonts installed on their systems. As well as tries to normalize
the font list that allowed for Windows and Mac users where they often get
additional fonts from 3rd party applications that install them.
On the security front the major exciting piece is the security slider. So with iSEC
Partners’ help we did a review of all the Firefox vulnerabilities and categorized
them based on the component that they were in as well as their prevalence on the web.
And came up with 4 positions that allow you to choose, basically trade off,
functionality for vulnerability surface reduction. And this was actually quite
successful. It turned out that all of the Pwn2own exploits
against Firefox were actually blocked for non-https sites at medium/high.
And if you enable the high security level they were blocked for everything.
We additionally released address sanitizer hardened builds, these are…
basically should… especially the higher security levels of the security slider
should protect against various memory safety issues in the browser and also
help us diagnose issues very rapidly.
And of course we now sign our Windows packages using a hardware security module
from DigiCert. The usability improvements were primarily focused around this UI and
this new Onion Menus you can see if you remember the old menu. There was quite a
lot more options there. We sort of condensed and consolidated options and
eliminated and combined as much as we could. An additionally displayed the
circuit for the current URL bar domain. In 2016 we’ll be focusing mostly on again
the same 3 areas. Our main goal for privacy is to try and convince Mozilla
that they want to adopt our idea of isolating 3rd party identifiers at least
to the point of if the user goes into the Preferences and tries to disable 3rd party
cookies, will let you do the same thing for DOM storage, Cash, blob URIs,
worker threads, and all these other sources of shared state.
We’re very excited about their work on a multi-process sandbox, additionally even
application-level sandboxing, it should be… without Mozilla’s sandbox,
we should still be able to prevent the browser from bypassing TOR using SecComp
or AppArmor or SeatBelt or one of these other sandboxing technologies.
We’re looking forward to trying to get that rolled out. And we’re doing
exploit bounties! We’ll be partnering with HackerOne,
who’ll be announcing this shortly. The program will start out invite-only
and then… just, so we can get used to the flow and scale up
and then we’ll make it public later in the year to basically provide people with
incentive to review our code to look for vulnerabilities that might be
specific to our applications. And of course the usual usability improving,
security, improving installation. And we’d like to improve the censorship and bridges
ability flow as well hoping to automate the discovery of bridges and inform you
if your bridges become unreachable. So TOR messenger
is one of our 2 chat clients, also part of the Applications Team.
Basically, the goal there was to minimize the amount of configuration that
the user had to do if they wanted to use one of their existing chat clients
with TOR and OTR. Now this is based
on another Mozilla platform – Instantbird which is based on Thunderbird.
This allows us to share a lot of the TOR Browser configuration codes
for managing the TOR process and configuring bridges. So the user has a
very similar configuration experience to the browser
when they first start it up. It also has some additional memory safety advantages
– all the protocol parsers are written in Javascript. This basically…
one of the major things when we were looking at candidates for
a messaging client was we wanted to avoid the problems of libpurple in the past
where there’s been a lot of, like, remote code execution vulnerabilities with
protocol parsing. Now there are some trade-offs here, obviously, when you’re
dealing with a browser product. You still have a html window rendering
the messages. But it is XSS filtered and even if an XSS exploit were to get through
to run Javascript in your messaging window that Javascript would still be
unprivileged. So they need an additional browser-style exploit. And that filter has
been reviewed by Mozilla and additionally we’re looking into removing Javascript
from that messaging window at all. It should be completely possible to just
display a reduced, slightly less sexy version of the same window at perhaps
another higher security level without Javascript involved at all in that window.
So we will hand off to Jake now to describe some of the security properties
and differences between TOR messenger and Ricochet.
Jacob: Just to be clear about this: We wanted to sort of echo what Phil Rogaway
has recently said. He wrote a really wonderful paper quite recently about the
moral character of cryptographic work and Phil Rogaway for those of you that don’t
know is one of the sort of like amazing cryptographers, very humble, really
wonderful man who was really a little bit sad that cryptographers and people
working on security software don’t take the adversaries seriously. So they use
Alice and Bob, and Mallory and they have cutie icons and they look very happy.
We wanted to make it clear what we thought the adversary was. Which is definitely not
a cutie adversary. When anonymity fails for Muslims that live in Pakistan, or e.g.
the guys that are giving a talk later today, the CAGE guys, when anonymity fails
for them they get detained or they get murdered or they end up in Guantanamo Bay
or other things like that. So it’s a serious thing. And we wanted to talk about
what that looks like. So e.g. a lot of you use jabber.ccc.de, I guess. Don’t raise
your hands. You should decentralize. Stop using jabber.ccc.de because we should
decentralize. But that said if you do, this is sort of what it looks like, right?
There’s the possibility for targeted attacks when you connect. There’s the
possibility that the Social Graph e.g. of your buddy list, that that would be on the
server. It would be possible that there’s a bug on any Jabber server anywhere.
So of course you know that if you’re using Gmail with Jabber, you know that they are
prison providers. So if you got a pretty big problem there and the attacker, again,
is not a cutie attacker, it’s, you know, I like the Grim Reaper, that fit that
Mike chose, if you like that’s accurate. And now if you see one of the protections
you’ll have for communicating with your peers is off-the-record messaging. That’s
basically the thing. But that’s a very slap together protocol in a sense. Because
it’s hacks on top of hacks. Where you know you compose TOR with Jabber and TLS
and maybe you still have a certificate authority in there somewhere. Or maybe you
have a TOR Hidden Service but then your status updates they don’t have any
encryption at all, for example. Or, again, your roster is an actual thing that
someone can see, including every time you send a message to those people the server
sees that. So, that said, TOR messenger is really great because it meets users where
they already are. Right? So e.g. actually one other point here is if you use a piece
of software like Adium, there is actually a bug filed against Adium where someone
said “Please disable logging-by-default because Chelsea Manning went to prison
because of your logging policy”. And the people working on Adium in this bug report
basically said: “Good!” That’s horrifying! Right? So what if we made it as reasonable
as possible, as configuration-free as possible using TOR, using OTR, trying to
remove libpurple which is a whole like… it’s a flock of Zerodays flying in
formation. Right? So we wanted to kill the bird in a sense but also not we want to
help provide an incentive for improving. And so that’s where TOR messenger fits.
But we also want to experiment with next generation stuff. And one of those things
is written by a really great guy on our community, almost single-handedly, without
any funding at all, and his name is “special”, that’s actually his name. He’s
also special. But it’s really nice, because actually, if you solve the problem
of telling your friend your name, if you’re familiar with the properties of
Hidden Services where you have a self- authenticating name you know that you’re
talking to the person that you think you are because you’ve already done a key
exchange. The important part of the key exchange. And so one of the things that
you’ll see very clearly is that there is no more server. Right? So there’s no more
jabber.ccc.de in this picture. So this is a really good example of how we might
decentralize, actually. It’s an experiment right now but it means no more servers. It
uses the TOR network’s TOR Hidden Service protocol and everybody actually becomes a
TOR Hidden Service for chatting with their buddies. And it’s end-to-end encrypted and
it’s anonymized and of course this means that your Social Graph is a traffic
analysis problem, it’s no longer a list on a server. And it means your metadata is
as protected as we currently know how to do in a low-latency anonymity network.
And in the future one of the really nice things about this is that it will be
possible – or we think it will be possible – to even make it better in a
sense, e.g. multiple chats, sending files, sending pictures, in other words,
everything becomes, instead of a certainty we move it towards probability. And the
probability is in your favour.
Mike: Yes, additionally, I’ll be working on various forms of panning for cases like
this to basically increase this high… the probability that there will be
concurrent traffic at the same time from multiple TOR clients, which will further
frustrate the discovery of the Social Graph based on simple traffic analysis
especially for low-traffic cases such as Ricochet. So just to wrap up that
TOR Applications piece: in 2016 we’re trying to focus heavily on usability and
gin more people to be able to use TOR, omitting the barriers to finding TOR,
downloading TOR, being able especially for censored users, and being able to
install TOR. There’s still some snags, various difficulties that cause people to
stop at various stages of that process and we want to try and work for to eliminate
them. We also, of course, want to increase coordination: share graphics, visual
aesthetics and coordinate the ability to share the TOR process. And we also want to
create a space for more experimentation, for more things like Ricochet. There’s
probably a lot more ideas like Ricochet out there. There could be leverages
of TOR protocol and especially Hidden Services in creative ways. So we’re
looking to create an official sanctioned space as part of TOR to give them a home.
And to look for that in the coming months on the TOR blog.
Jacob: Alright, I just wanted to put in a picture of a guy wearing a Slayer T-Shirt.
So there it is. That’s Trevor Paglen. Some of you may remember him from such things
as helping to film Citizenfour, building Satellites that burn up in space so that
are actually currently on other satellites. And this on the left is
Leif Ryge, he’s sort of the person that taught me how to use computers. And he is
an incredible Free Software developer. Trevor Paglen and myself, and this is
a cube, the Autonomy Cube which we talked about last year. Because we think that
culture is very important and we think that it’s important to actually get people
to understand the struggle that exists right now. So this is installed in a
museum right now in Germany, in the city of Oldenburg, at the Edith-Russ-Haus. And
it actually opened several months ago, it’s filled with classified documents, it
has really interesting things to go and read. I highly encourage you to go and
read. We built a reading room about anonymity papers, about things that are
happening. About how corporations track you, and then the entire museum is an
Open-WiFi network that routs you transparently through TOR. So in Germany
a free open WiFi network that isn’t run by Freifunk – much respect to them – we
wanted to make it possible for you to just go and have the ability to bootstrap
yourself anonymously if you needed to. And also these four boards are Novena boards.
And these Novena boards are Free and Open Hardware devices made by Bunnie and Sean
in Singapore where you could, if you wanted to, download the schematics and
fab it yourself. And it’s running the Debian GNU Linux universal operating
system. And it’s an actual TOR exit node with absolutely every port allowed. So the
museum’s infrastructure itself on the city’s internet connection actually is a
TOR exit node for the whole world to be able to use the internet anonymously.
*applause*
But the museum’s infrastructure is not just helping people in Oldenburg, it’s
helping people all around the world to be able to communicate anonymously and it’s
quite amazing actually because when cultural institutions stand up for this
we recognize it’s not just a problem of over-there stand. We have mass-surveillance
and corporate surveillance in the West and we need to deal with that. Here, by
creating spaces like this. But that said, we also need to make sure that we create
spaces in people’s minds all around the world. And I want to introduce to you
someone who’s incredibly awesome, the most bad-ass radical librarian around,
this is Alison. Alison is going to talk about…
Alison: …Library Freedom Project! Hi! Thank you so much! I’m so excited
to be here, it’s my first CCC and I’m on stage, and it’s very… exciting. So I’m
going to talk to you a little bit about my organization, Library Freedom Project.
I’m the director and what we do: we have a partnership with TOR project to do
community outreach around TOR and other privacy-enhancing technologies. Making
TOR network more strong and making tools like TOR Browser more ubiquitous and
mainstream, all with the help of a coalition of radical militant librarians.
So we introduced you to the Library Freedom Project back in February. We told
you a little bit about the kind of work that we do, mostly in US libraries,
increasingly internationally. Where essentially we teach them about tools like
TOR Browser, how to install it on their local computers, how to teach it into
computer classes that they offer for free in the library or one-on-one technology
sessions for their community. And we’ve had a really amazing year since then.
In addition to working with the TOR project we’re really fortunate to work
with the American Civil Liberties Union (ACLU). If you’re not familiar with them,
they’re basically… they’re the bad asses who’ve been suing the US Intelligence
Agencies and Police for about a 100 years. That is me with 2 people from the ACLU
Massachusetts, Jessy Rossman who is a surveillance law expert and Kay Croqueford
who is an activist for the ACLU. And they’re here, if you see that human buy
them a drink and ask them about the surveillance capabilities of the US Police.
*applause*
So, it’s really cool! It’s a great partnership with the ACLU because
basically they can teach why we need to use tools like TOR Browser. So how to use
them is super-super important but you need to know about the authorizations, the
programs, all the bad laws and the uses of them against ordinary people. So, why do
we teach this stuff to librarians? It’s basically for 2 big reasons. One of them
is that libraries and librarians have an amazing history of activism around
privacy, fighting surveillance and fighting censorship in the US where
I live. Librarians were some of the staunchest opponents of the USA Patriot
Act from the beginning when it was codified back in 2002. They made T-Shirts
that said “Another hysterical librarian for Privacy” because of the…
The Attorney General at the time called them “hysterical” for the fact that they
didn’t want this awful authorization to go through. And of course then after Snowden
we learned many more things about just how bad the Patriot Act was. So librarians
were some of the first people to oppose that. They also have fought back against
National Security Letters which are the US Government informational requests that
sometimes go to software providers and other internet services. They have an
attached gag order that basically says: “You have to give this information about
your users and you can’t tell anyone that you got it.” Well, libraries got one of
these and fought back against that in one. *applause*
They also, all the way back in the 1950s even, at the height of Anti-Communist
Fervor and FUD, around the time of the House on American Activities Committee,
librarians came out with this amazing statement, called the “Freedom to Read”
Statement that I think really is a beautiful text. It’s about 2 pages long
and it is their commitment to privacy and democratic ideals made manifest.
And I have a little excerpt from it here. I’m not gonna read the whole thing to you
’cause I understand I’m all too pressed for time. But the last line is
my favourite. It says: “Freedom itself is a dangerous way of life. But it is ours.”
So everybody go and get that tattooed! You know, on your forehead or whatever.
*applause*
So, the history of activism is one of the big things. There’s a second part that
is more practical. Libraries have an amazing relationship to the local
communities. That doesn’t really exist anywhere else especially in this era of
privatization and the destruction of public commons. Libraries have already
free computer classes in many places, sometimes the only free computer help that
you can get anywhere. They offer free computer terminals to many people who
don’t have any other computer access. They’re trusted community spaces, they
already teach about a whole number of things. So we think they’re really the
ideal location for people to learn about things like TOR Browser. So it’s been
going really well. This year we have visited hundreds of different locations.
We’ve trained about 2300 librarians in the US, in Canada and a few other countries,
Australia, UK and Ireland. We held an amazing conference, you might recognize
this as Noisebridge. Any Noisebridge fans here? I hope so. Come on, there’s got to
be more Noisebridge fans than that! Christ! We had an amazing conference in
Noisebridge and actually my co-organizer is also here, April Glaser, so you can buy
her a drink, she’s right over there. There has been a huge response from the library
community. They wanna learn about TOR Browser, they’re so excited that finally
there’s a practical way for them to help protect their patrons’ privacy. They’ve
cared about this stuff from an ideological and ethical standpoint for a really long
time, and now they know that there are tools that they can actually use and
implement in their libraries and teach to their community to help them take back
their privacy. We’re really lucky that not only do we get to teach librarians but
occasionally we get invited to visit the local communities themselves.
So, here we teach how to teach privacy classes with TOR as a big focus.
But sometimes we get to meet the local community members themselves. So I want to
show you this picture of a recent visit that I made to Yonkers, New York. It was
a class just for teens. They’re all holding TOR stickers if you can see that
and Library Freedom Project stickers. This is a great picture that sort of is
emblematic of the kind of communities that we get to visit. Yonkers is one of
the poorest cities in the US. These kids are… many of them are immigrants, their
parents are immigrants, they face surveillance and state violence as a
matter of their regular everyday lives. For them privacy is not just a human
right but it’s sometimes a matter of life and death. And these kids are just some
of the amazing people that we get to see. Also, just to give you an idea of how the
public perception around privacy is shifting in my anecdotal experience:
we had 65 teenagers come to this class! If you have a teenager or if you’ve been
a teenager you know teenagers don’t show up for stuff, they don’t do that. 65 kids
came to this! And they were so excited! This was just the group that was left over
at the end that had so many questions and wanted more stickers to bring back to
their friends. So it’s pretty cool stuff. Recently we embarked on a new project
bringing TOR relays into libraries. This is Nima Fatemi with me, when we set up
our pilot at a library in New Hampshire which is the state just above where I live
in the United States. And we basically decided to do this project because we
thought it was a really great continuation of the work that we were already doing,
teaching and training librarians around using TOR. We wanted to take a step
further and take the infrastructure that libraries already have; many of them are
moving to really fast internet, they can donate an IP address and some bandwidth.
And they… many of them want to do kind of the next thing to help protect privacy
and not just in their local communities, as well. They want to help protect
internet freedom everywhere. So we thought it was a really great sort of next step to
go. So we set up our pilot project in New Hampshire. It went pretty well, we got a
lot of great press attention, a lot of really great local and global community
support. We also got the attention of the Department of Homeland Security.
*applause*
Basically they contacted the local Police in this town in New Hampshire and they
said: “You know, this is stupid, and bad, and criminal and you should shut this
down!” And the library was understandably shaken by this and temporarily suspended
the operation of the relay. So we responded by writing a letter, an open
letter from Library Freedom Project, from TOR project, from ACLU and a broad
coalition of public interest groups and luminary individuals including the
Electronic Frontier Foundation (EFF), the Freedom of the Press Foundation, the Free
Software Foundation and all of our other friends many of whom are in this audience
today. We wrote this letter to the library basically affirming our commitment to
them, how much we are proud of them for participating in this project and how much
we wanted them to continue. We put a lot of nice, you know, ideological, why this
is important, warm fuzzy stuff. We also got EFF to start a petition for us and
over a weekend we got about 4500 signatures from all over the world, the
library was flooded with emails, calls. Only one negative one. Just one out of
hundreds. And that person was a little confused, so I’m not even counting that
necessarily. It was like a conspiracy type thing. So we got this amazing support and this
was all in anticipation of their board meeting that was gonna happen a few days
later where the board was gonna decide what to do about the relay. So Nima and I
show up to New Hampshire on a Tuesday Night and you might imagine what a library
board meeting in rural New Hampshire is typically like. It was nothing like that.
So we get outside and there’s a protest happening already. Many people holding
Pro-TOR signs. This was just a glimpse of it. And the look on my face is because
someone pointed to a very small child and said: “Alison, look at that child over
there”. This tiny little girl was holding a sign that said “Dammit Big Brother” and
I was like “I’m done, that’s it, I got to go home!” So we went into the board
meeting and we were met with about 4 dozen people and media and a huge amount of
support. Many of the community members expressed how much they loved TOR, that
this whole incident made them download TOR and check it out for themselves. Basically
it galvanized this community into a greater level of support than we even had
when we initially set it up about a month earlier. People who had no idea that the
library was doing this heard about it because it got a huge amount of media
attention thanks to a story by Julia Angwin in ProPublica that broke the news
to everybody and then it just went like wildfire. So as you might imagine the
relay went back online that night. We were super-successful. Everybody in the
community was incredibly excited about it and supportive. And what has happened now
is that this community has sort of… like I said they’ve been galvanized to support
TOR even more. The library has now allowed at some of their staff time and travel
budget to help other libraries in the area set up TOR relays. They’re speaking about
TOR… *applause*
Thank you! They’re speaking about TOR at conferences.
And this has really caught on in the greater library community as well. So I
mentioned already the kind of success that we’ve had at Library Freedom Project in
teaching tools like TOR Browser and getting folks to bring us in for trainings.
This is even bigger than that! Libraries are now organizing their, you know, staff
training days around, you know, “Should we participate in the TOR relay project?” or
“How can we do this best?”, “What’s the best angle for us?” So we’re really
excited to do announce that we’re gonna be continuing the relay project at scale.
Nima Fatemi, who is now also in this picture again, I’m really sad that he
can’t be here, he is wonderful and essential to this project. But he will now
be able to travel across the US and we hope to go a little further opening up
more relays in libraries. We’re gonna continue teaching, of course, about TOR
Browser and other privacy-enhancing Free Software. We’re now gonna incorporate some
other TOR services, so we’re really excited to bring “Let’s Encrypt” into
libraries. And while we’re there, why not run a Hidden Service on the library’s web
server. Among many other things. The other goals for Library Freedom Project: to take
this to a much more international level. So if you want to do this in your country,
you know your librarian, put them in touch with us. You can follow our progress on
LibraryFreedomProject.org or @libraryfreedom on Twidder. And we’re
always sort of posting on Tor Blog about stuff that’s going on with us, so…
Thank you so much for letting me tell you about it. It’s really a pleasure to be
here! *applause*
Jacob: So, that’s a really tough act to follow! But we’re very pressed for time
now. And we want to make sure that we can tell you two big things. And one of them
is that, as you know, we were looking for an Executive Director because our Spirit
Animal, Roger,… Roger: Slide…
Jacob: Right… He couldn’t do it all. And in fact we needed someone to help us. And
we needed someone to help us who has the respect not only of the community here but
the community, basically, all around the world. And we couldn’t think of a better
person, in fact, when we came up with a list of people. The person that we ended
up with was the Dream Candidate for a number of the people in the TOR Project
and around the world. And so, I mean, I have to say that I’m so excited, I’m so
excited that we have her as our Executive Director. I used to think that our ship
was going to sink, that we would all go to prison, and that may still happen, the
second part. But the first part, for sure, is not going to happen. We found someone
who I believe will keep the TOR Project going long after all of us are dead and
buried. Hopefully, not in shallow graves. So, this is Shari Steele!
*applause*
Shari: Hi! *applause*
Thanks! Thanks, it’s actually so fun to be back in this community. And I wasn’t gone
for very long. I had so much for retirement. It didn’t work out for me.
But, that’s OK, I’m really excited. I have had – we’re so tight on time – so I want
to just tell you there are 2 big mandates that I was given when I first was hired.
And one is: Help build a great infrastructure so that TOR Project is
sustainable. Working on that! The other thing is: Money! We need to diversify our
funding sources, as everybody knows here. The Government funding has been really
difficult for us specifically because it’s all restricted. And so it limits the kinds
of things we want to do. When you get the developers in a room blue-skying about the
things that they want to do, it’s incredible! Really, really brilliant
people who want to do great things but they’re really limited when the funding
says they have to do particular things. So we happen to be doing our very first ever
crowd funding campaign right now. I want to give a shout out to Katina Bishop who
is here somewhere and who is running the campaign for us and is just doing an
amazing job. As of last count which is a couple of days ago, we had over 3000
individual donors and over 120.000 Dollars which is incredible for our very first
time when we didn’t even really have a mechanism in place to be collecting this
money, even. So, it’s really great! And I wanna also say we have a limited number
of these T-Shirts that I brought in a suitcase from Seattle. So, and they’re
gonna be available, if you come down to the Wau Holland booth at the Noisy Square.
Come talk with us! Give a donation! We’re doing a special: it’s normally a
100 Dollar donation to get a shirt, but for the conference we’ll do, for 60 Euro
you can get a shirt and it would be great you’d be able to show your support. And
you can also donate online if you don’t wanna do that here. That’s the URL. And
to end, we’d like to have a word from Down Under!
*Video starts*
*Video Intro Violin Music*
Good Day to you! Fellow Members of the Intergalactic Resistance against Dystopian
bastardry! It is I, George Orwell, with an urgent message from Planet Earth, as it
embarks on a new orbit. Transmitting via the Juice Channeling Portal. Our time is
short. So let’s get straight to the point. Shall we? This transmission goes out to
all you internet citizens. Denizens of the one remaining free frequency. In whose
hands rests the fate of humanity. Lord… f_ckin’ help us!
*typewriter typing sounds*
When I last appeared to you, I warned you noobs: You must not lose the Internet! Now
before I proceed, let us clarify one crucial thing. The Internet is not Virtual
Reality, it is actual Reality. *typewriter typing sounds*
Are you still with me? Good. Now ask yourselves: Would you let some fascist
dictate with whom you can and cannot communicate? Because that’s what happens
every time a government blacklists a website domain. Would you let anyone force
you to get all your information from cable TV? That’s effectively the case if you
allow corporations to kill Net Neutrality. *typewriter typing sounds*
Would you let the Thought Police install telescreens in your house, monitor and
record everything you do, every time you move, every word you’ve read, to peer into
the most private nook of all, your head? BECAUSE THAT’S WHAT HAPPENS when
you let your governments monitor the net and enact mandatory data-retention laws!
*smashing sounds*
If you answered “No” to all those questions, then we can safely deduce
that terms like “Online”, “IRL” and “in Cyberspace” are Newspeak. They confuse the
truth: There is no “Cybersphere”. There is only life. Here. It follows that if you
have an oppressive Internet, you have an oppressive society, too. Remember:
online is real life… *typewriter typing sounds*
Your Digital Rights are no different from everyday human rights! And don’t give me
that BS that you don’t care about Privacy because you have nothing to hide.
That’s pure Doublethink. As comrade Snowden clearly explained, that’s like
saying you don’t care about Free Speech because you have nothing to say!
Stick that up your memory holes and smoke it, noobs!
Pigs Arse, the portal is closing, I’m losing you! I’ll leave you with a new tool
to use. I assume you’ve all been fitted with one of these spying devices. Well,
here’s an app you can use in spite of this. It’s called Signal, and, yes, it’s
free and simple. Install it and tell all your contacts to mingle then all your
calls and texts will be encrypted. So even if Big Brother sees them the c_nt won’t be
able to read them. Hahaa! Now that’s a smartphone! Our time is up!
*typewriter typing sounds* Until the next transmission. Heed the
words of George Orwell. Or should I say: George TORwell?
*typewriter typing sounds*
Remember, just as I went to Spain to fight the dirty fascists you can come to Onion
land and fight Big Brother’s filthy tactics. If you’re a Pro run a node and
strengthen the code. Or if you’re in the Outer Party and can afford it, send TOR
some of your dough. Special Salute to all my comrades, the “State of the Onion”.
Happy Hacking! Now go forth and f_ck up Big Brother. That mendacious
motherf_cking, c_ck-sucking bastard son of a corporatist b_tch…
*Video Outro Music*
*applause*
Jacob: So, I think that’s all the time that we have. Thank you very much for
coming. And thank you all for your material support.
*applause*
Herald: Unfortunately we won’t have time for a Q&A. But I heard that some of the
crew will now go to the Wau Holland booth at Noisy Square down in the Foyer and
might be ready to answer questions there. If you have any.
*postroll music*
Subtitles created by c3subtitles.de in 2016. Join and help us!