wkrp
wkrp
An unfortunate side effect of multiple instances of tor sharing the same identity key is that it messes up metrics graphs, namely the [Relay Search](https://metrics.torproject.org/rs.html#details/5481936581E23D2D178105D44DB6915AB06BFB7F) and ["Users by transport"](https://metrics.torproject.org/userstats-bridge-transport.html?start=2021-11-15&end=2022-02-08&transport=snowflake) graphs....
I believe these are the source code commits that aim to mitigate the vulnerabilities found in the paper: * Obfuscated SSH: [Implement "read forever" for OSSH](https://github.com/Psiphon-Labs/psiphon-tunnel-core/commit/3be6d43a89f62f506ee0c3e744b73494002379f1) * obfs4: [Alter tear...
It is interesting to consider the design tradeoffs that permit Slitheen and Protozoa to have the indistinguishability property, despite not having an elaborated traffic model like Balboa. Both of them...
> Is it necessary to have byte-millisecond-perfect traffic profiles to render traffic analysis unusable in practice? In my opinion, no, such a high level of fidelity is not necessary in...
Thanks for making this post. To me it looks like your analysis is correct: a countermeasure to this kind of proxy is to watch for outgoing TLS connections and then...
I like to try to set an encouraging tone. It is, of course, fair play to point out security vulnerabilities, but let's also give credit where it is due. The...
> Don't put secrets in SNI or any other plaintext before the TLS session is established with the proxy. Anything in plaintext can be replayed by an adversary. I think...
> The more I read the more this whole setup resembles port forwarding over SSH, and via connecting TLS over the tunnel. In the sense of tunneling one protocol in...
The Tor anti-censorship team discussed this paper at their reading group on 2021-11-11. http://meetbot.debian.net/tor-meeting/2021/tor-meeting.2021-11-11-15.59.log.html#l-122
> self-signed certificates would be stopped before any network loading is performed. So this is not a realistic attack vector on TLS parrots. I would guess that this is correct....