4 ms·

Out of curiosity, what prevents Iran from just blocking all Tor end nods ? If del.icio.us is able to do it[1], surely Iran must be able to too. [1] https://ne

Out of curiosity, what prevents Iran from just blocking all Tor end nods ? If del.icio.us is able to do it[1], surely Iran must be able to too. [1] https://news.ycombinator.com/item?id=3567996 https://news.ycombinator.com/item?id=3567996

mukyu 15y ago
They can only do that on sites they control. Iran wants to prevent users from getting into the Tor network and going to sites that they do not have control over. Since it is easy for them to block the public routers Tor uses "bridges" which are nodes that will allow people to connect to the entry nodes through them. The lists of these nodes are then treated as semi-secret (in that they try to limit any one person or organization from learning all of them). This is exactly what they are looking for people to make, more bridges, not more exits. edit: They actually say that Iran does very little active blocking and are just throttling anything that looks like TLS, so the bridge vs. entry node distinction does not really apply in this case, but it is relevant to the attack you are trying to describe.
- pbhjpbhj 15y ago
  But couldn't they simply block on a combination of encrypted traffic and whitelist? That is only allow encrypted traffic to known 'good' sites.
  - andrewcooke 15y ago
    this call is for a workaround that avoids (hopefully) blocking encrypted traffic. why don't you, you know, read the link that this thread is about before commenting?
  - alexholehouse 15y ago
    andrewcooke - sorry, I downvoted before you'd updated your answer. Apologies - should not be a downvote.
    - deleted 15y ago
      [deleted]
  - drostie 15y ago
    Iran is doing an extreme version of precisely that, where the whitelist is a null set. Tor also has a well-established way of fighting blacklists. Normal relays are all listed on a public network, but there is also an opt-in program which exists for Tor relays: a Tor relay can choose to be "hidden" in a certain sense. A "hidden" relay node accepts only entrance connections, and these are advertised more quietly by the Tor Project folks, who don't reveal too many too fast. It is therefore the case that blacklists can be circumvented by asking Tor for a couple of hidden entrance nodes and configuring yourself appropriately. The goal of obfuscation is to buy a little more time during which people can use encryption again, by making the encryption look like normal traffic. (But I have no further knowledge of the particulars, so take what I have said with a grain of salt.)
    - pbhjpbhj 15y ago
      I noticed too, on the Tor project website, about the obfuscating Tor traffic to appear as non-encrypted traffic; that sounds interesting - https://www.torproject.org/projects/obfsproxy-instructions.html.en https://www.torproject.org/projects/obfsproxy-instructions.h....
aw3c2 15y ago
Watch the very informative and entertaining talk by Roger and Jacob from 28c3 http://mirror.fem-net.de/CCC/28C3/webm/28c3-4800-en-how_governments_have_tried_to_block_tor.webm http://mirror.fem-net.de/CCC/28C3/webm/28c3-4800-en-how_gove...
- pferde 15y ago
  Yeah, that talk got me to set up a tor node. Watching it is a time well spent.
- yuvadam 15y ago
  Hands down the best talk of 28C3.
- eneveu 15y ago
  YouTube link: http://www.youtube.com/watch?v=DX46Qv_b7F4 http://www.youtube.com/watch?v=DX46Qv_b7F4 High Quality H264 link (720x576): http://mirror.fem-net.de/CCC/28C3/mp4-h264-HQ/28c3-4800-en-how_governments_have_tried_to_block_tor_h264.mp4 http://mirror.fem-net.de/CCC/28C3/mp4-h264-HQ/28c3-4800-en-h... (found on the YouTube page)
- blario 15y ago
  Where is the obfuscation bridge covered in more detail? (I've already checked the link in Jason's email.) He says it's highly technical, maybe to some it is, but it only coves installation; not how the obfuscation actually works: how a TLS connection can appears to be HTTP? Someone might say read the source, but my literacy in that area is questionable.

mukyu 15y ago

They can only do that on sites they control. Iran wants to prevent users from getting into the Tor network and going to sites that they do not have control over. Since it is easy for them to block the public routers Tor uses "bridges" which are nodes that will allow people to connect to the entry nodes through them. The lists of these nodes are then treated as semi-secret (in that they try to limit any one person or organization from learning all of them). This is exactly what they are looking for people to make, more bridges, not more exits. edit: They actually say that Iran does very little active blocking and are just throttling anything that looks like TLS, so the bridge vs. entry node distinction does not really apply in this case, but it is relevant to the attack you are trying to describe.

pbhjpbhj 15y ago
But couldn't they simply block on a combination of encrypted traffic and whitelist? That is only allow encrypted traffic to known 'good' sites.
- andrewcooke 15y ago
  this call is for a workaround that avoids (hopefully) blocking encrypted traffic. why don't you, you know, read the link that this thread is about before commenting?
- alexholehouse 15y ago
  andrewcooke - sorry, I downvoted before you'd updated your answer. Apologies - should not be a downvote.
  - deleted 15y ago
    [deleted]
- drostie 15y ago
  Iran is doing an extreme version of precisely that, where the whitelist is a null set. Tor also has a well-established way of fighting blacklists. Normal relays are all listed on a public network, but there is also an opt-in program which exists for Tor relays: a Tor relay can choose to be "hidden" in a certain sense. A "hidden" relay node accepts only entrance connections, and these are advertised more quietly by the Tor Project folks, who don't reveal too many too fast. It is therefore the case that blacklists can be circumvented by asking Tor for a couple of hidden entrance nodes and configuring yourself appropriately. The goal of obfuscation is to buy a little more time during which people can use encryption again, by making the encryption look like normal traffic. (But I have no further knowledge of the particulars, so take what I have said with a grain of salt.)
  - pbhjpbhj 15y ago
    I noticed too, on the Tor project website, about the obfuscating Tor traffic to appear as non-encrypted traffic; that sounds interesting - https://www.torproject.org/projects/obfsproxy-instructions.html.en https://www.torproject.org/projects/obfsproxy-instructions.h....

aw3c2 15y ago

Watch the very informative and entertaining talk by Roger and Jacob from 28c3 http://mirror.fem-net.de/CCC/28C3/webm/28c3-4800-en-how_governments_have_tried_to_block_tor.webm http://mirror.fem-net.de/CCC/28C3/webm/28c3-4800-en-how_gove...

pferde 15y ago
Yeah, that talk got me to set up a tor node. Watching it is a time well spent.
yuvadam 15y ago
Hands down the best talk of 28C3.
eneveu 15y ago
YouTube link: http://www.youtube.com/watch?v=DX46Qv_b7F4 http://www.youtube.com/watch?v=DX46Qv_b7F4 High Quality H264 link (720x576): http://mirror.fem-net.de/CCC/28C3/mp4-h264-HQ/28c3-4800-en-how_governments_have_tried_to_block_tor_h264.mp4 http://mirror.fem-net.de/CCC/28C3/mp4-h264-HQ/28c3-4800-en-h... (found on the YouTube page)
blario 15y ago
Where is the obfuscation bridge covered in more detail? (I've already checked the link in Jason's email.) He says it's highly technical, maybe to some it is, but it only coves installation; not how the obfuscation actually works: how a TLS connection can appears to be HTTP? Someone might say read the source, but my literacy in that area is questionable.