About Tor

Feb 20
2012

Tor is a worldwide network of proxies run by volunteers. They donate a chunk of their bandwidth to disguise the origin of others.

How it works

Tor establishes random encrypted tunnels between nodes in the network. The connections themselves are mixed to obfuscate the relation between incoming and outgoing ones. This way a passive observer only sees connections going into the network and coming out of the network, but is unable to correlate them. This way a Chinese Tor user may look like coming from Spain.

Look at the following diagrams for a more detailed explanation:
how Tor works 1
how Tor works 2
how Tor works 3

Using it

Downloading and installing the software easy, the configuration needs some attention. If you follow the given guides, you shouldn’t encounter any problems. Any software able to handle SOCKS-proxies now can talk to Tor. Firefox has an Addon called “Torbutton” to provide a one click interface.

You can not only relay your traffic over Tor, you can even run your very own hidden services.That means you can only access them by using Tor, there exist only inside the network. If you want, you can run any service you want: blogs, forums and do on. If you really need to, you can interface them with the non-Tor world, but that’s not needed usually.

The wide variety of users make the Tor network quite resilient (compared
to other proxy solutions). Since a lot of different people form a diverse group, you can’t single them out easily. Besides that you don’t have a single point of failure (or censorship). While Tor obfuscates your traffic, there are things you have to be aware of.

1. Tor is not fast
Tor nodes are run by volunteers and they donate some of their bandwidth. This greatly reduces what’s available to you compared to a non-Tor connection. Remember: your traffic will be relayed through several countries all over the world. Email works, but websites take longer to load (or may even time out) and instant messaging has noticeable delays. Running bittorrent over Tor is plain rude, since it eats a lot of traffic. There are users who’s life depend on Tor, so don’t litter it. You may speed up your browsing by using text-only (or console) browsers like w3m or links2.

2. Tor nodes can be rogue
Since everyone can join the network, bad guys will do so. Tor does not provide so-called end-to-end encryption, so you have to take care of it. Remember: everyone running a node could sniff passwords. If you use protocols, look for a secure counterpart (https instead of http, imaps instead of imap … look into SSL) or try to establish secure channels (look into ssh and VPNs data transmission, GnuPG and OTR for messaging).

3. Tor obfuscates where you’re from, not who you are
There are many things which make you recognizable, not only your IP. These are nicknames, particular browser configurations, even the choice of words to name a few. Be aware of that.

4. You can actively support Tor
Consider running an exit node. Every additional node makes Tor better (more bandwidth, more anonymity). Since you are an active participant it becomes even harder to do traffic analysis on what you do. If you can’t run an open exit node, consider running a bridge or at least relay traffic for the network. All these things improve the network and protect you more than plain hitchhiking. Please check your local law concerning regulations for providing proxy services and internet access. It’s quite different and nuanced under several legislation. If you can not or do not want to become an active supporter, you can always donate money.

If you want a quick portable solution, consider using the Tor Browser bundle, tails or Privatix.

References

documentation

  • EFF: What is a Tor relay?
  • documentation overview
  • Installation guides
  • Configuring a Tor relay
  • Configuring a hidden service
  • Manuals
  • Tor Wiki
  • Tor-Blog: Why Tor is slow
  • Legal FAQ
  • youtube: Setting up a Tor Relay
  • do good
  • donation page
  • NoiseTor
  • Zwiebelfreunde e.V.
  • other

  • an example of traffic analysis of Google Maps over SSL
  • OpenNet Initative: filter profiles per country
  • Reporters without Borders: Internet Enemies 2012(pdf)
  • Video from 28c3

    Jan 01
    2012

    We’ve been recovering from 28c3, Journey to the End of the Year, and Berlin New Year’s Eve all day today at the Unicorn Fortress. Did you know fireworks are legal to shoot off in the city of Berlin? The big, loud ones, too. So it’s kind of terrifying – bright flashes, bangs resounding off the buildings, and cartridges strewn throughout the streets. We sat up late through the night discussing holistic and Cartesian approaches, gender politics, and the slippery slope of Getting Involved.

    But the video that is referenced in the title! That is what you came to this entry for. Here is Tomate and me giving a talk on Security in Response at the 28th Chaos Communications Congress.

    Also totally worth checking out: Meredith’s talk on The Science of Insecurity and Cory’s talk on The Coming War on General Computation.

    <3 to the videographers for getting this online so incredibly quickly, to Telecomix and Tomate for a fantastic co-talk, and Tropo for supporting GWOB.

    The Long and Winding Road to Burning Man

    Aug 23
    2011

    It’s hard to believe that it was a year ago that I first started talking publicly about this GWOB thing.  August 19th in San Francisco at Jeff Pulver‘s 140 Characters Conference and then the very next day August 20th at Chris Pirillo’s Gnomedex were the first two times I expressed (in front of an audience) the idea of building an organization of Geeks coming together to help people communicate in times of crisis.

    And while Geeks without Bounds officially launched on 10.10.10, the 140Conf and Gnomedex conferences will always hold a special place in my heart, pretty much because of my own amazingly dumb luck.

    At 140Conf, it just so happened that there were two people in the audience that had a tremendous influence on the direction that GWOB.org has taken in the past year.  The first of these two people was Ethan Zuckerman.  Ethan founded the GeekCorps back in the late 90′s.  GeekCorps was an international non-profit organization that transfers tech skills from geeks in developed nations to geeks in emerging nations, especially entrepreneurial geeks who are building small businesses. In other words, a Peace Corps for geeks.  By the time I got back to my seat after my talk at 140Conf, I had an email in my inbox from Ethan. Ethan gave me a list of people and companies to talk to…. a list I followed like a blueprint… and he was dead on.

    One of the people that Ethan pointed me towards was Patrick Meier, one of the founders of Ushahidi.  Patrick was in the 140Conf audience at that day too and even tweeted about my talk (like I said…lucky, huh?)

    Ethan also suggested I talk to Heather Blanchard at Crisis Commons, Eduardo Jezierski of Instedd, Inveneo (among MANY others)…all of whom I’ve subsequently met and many of whom I’ve worked virtually side-by-side in times of crisis.  All are incredibly talented, passionate geeks with similar goals.

    The very next day I arrived in Seattle at Gnomedex, where I first met Willow Bl00, and we all know how terribly that went… ;)

    Over the past year Willow and I have traveled around the U.S. and beyond, connecting with hacker & maker communities, software developers, network admins, local, federal and international emergency responders.   We’ve helped organize hackathons, codeathons, tinkerstorms and meetups.

    One of the concepts I’ve held since even before those first two conferences a year ago is to build an open source communications infrastructure that could be used in times when traditional methods of communications have failed.  Originally I called this a “Backpack Network” but in reality it’s more complex than that.  Last summer I spoke on the phone with David Burgess (one of the developers of OpenBTS) on his way to Burning man.  OpenBTS (Open Base Transceiver Station) is a software-based GSM access point, allowing standard GSM-compatible mobile phones to make telephone calls without using existing telecommunication providers’ networks. OpenBTS is notable for being the first free software implementation of the industry-standard GSM protocol stack.  For the past 4 years, David has brought equipment to Black Rock Nevada during Burning Man to test the gear in the harsh desert conditions.

    David and I talked about using OpenBTS in conjunction with Tropo to allow developers to build apps that hook into other things…like crisis mapping platforms like Ushahidi.

    David loved the idea. My friends at Voxeo Labs loved the idea too.  While it was too late for us to do anything about it last year…this year we are actually running some tests during Burning Man integrating OpenBTS with Tropo (and ultimately, Ushahidi).

    Geeks without Bounds at Burning Man

    The camp where we’ll be testing from is called Papa Legba.  If you are heading to the Playa this year and would like like to participate in the test, I strongly urge you to check out the Papa Legba 2011 FAQ. Details about the kind of services and what kind of GSM phone equipment you need to connect to the OpenBTS network can be found there.  Also, check out these posts:

    Tropo Blog Post:  Voice Board and Group SMS for BurningMan

    Tropo Blog Post:  Tropo + OpenBTS + Burning Man = Awesome

    YouTube Video with Chris Pirillo, Diggz, Loopingrage and David Burgess:  How to Communicate at Burning Man

    Willow and Diggz Interviewed at OSCON 2011 Portland

    Aug 05
    2011

    LockerGnome’s Brandon Wirtz talks with Geeks Without Bounds founders Johnny Diggz and Willow Brugh at OSCON 11

    RHoK 3 Seattle Video

    Jun 08
    2011

    A video I put together from this weekend’s event. Thanks to everyone who helped make RHoK 3 Seattle an unforgettable event!


    GameSave Update: Frequently Asked Questions

    Apr 15
    2011

    Q: What’s all this, then?

    A: GameSave is a hack-a-thon style event which takes place over the course of 4 weeks, during which multiple teams of game developers and emergency relief professionals will each create a complete game concept and working demo aimed at disaster relief and mitigation.
    There will be an organization and planning period where team members will be expected to communicate with one another via the wiki and by whatever other methods they so choose. Teams will then meet for a intensive hack-a-thon session in Seattle, Washington where they will pair up with disaster relief personnel for vital information, as well has have sequestered time for the bulk of the build. When the hack-a-thon is up, teams will return to their homes and continue to collaborate and polish their concept for submission.
    Each concept/demo will be judged by a panel of experts, pulled mainly from the fields of game design and emergency management.

    Q: So, how are these teams formed?

    A: Teams can be assembled in several ways. A team can be composed of independent individuals who organize themselves initially through our registration site and wiki. Teams can also be sponsored as a unit by their respective employers. Sponsors can also opt to “adopt” a team, meaning that they help cover expenses for indie teams.

    Q: How do I register?

    A: Follow this link to our general interest signup. You’ll then be among the first to know once registration is open. Once you’re registered, you can create a profile and start interacting with other participants, gain access to resources, and get all kinds of other vital information via our wiki.

    Q: On what platforms can we build?

    A: Any platform you like, so long as it addresses the stated problem.

    Q: Why are you guys doing this right now? Wouldn’t it be a little easier to put it off for a while?

    A: Well, yes. HOWEVER, the Cascadia Subduction Zone is 50+ years overdue for a megaquake, and the cities along the west coast of North America (you know, Vancouver, Victoria, Seattle, Portland, San Francisco, etc) are not even half as prepared as Japan in terms of building code and emergency preparedness. According to our planet’s geological history, the “Ring of Fire” tends to follow a clockwise pattern of movement among the faults
    Of course that’s just a start, because there are all kinds of places that can have all kinds of disasters. Almost anywhere could become a Haiti, a NOLA or a Japan. There are an awful lot of disasters that we can’t control, but for which we’re also not that prepared.

    Q: OK, all that stuff is true, but a game? Seriously? Why?

    A: Because it’s fun! Some of the concepts that are the hardest to learn in a traditional classroom setting are made much easier to understand when experienced in the form of a game.

    Q: But what kind of game could people make out of a disaster scenario?

    A: It is largely up to each team to decide how to address the problem within their game concepts. However, we can offer a few facts about emergency management procedure as a general idea: The information used by first responders to know where they are needed, how to get there, and what resources are available to them on the way is still parsed manually by people. Volunteers dedicate hours to learning the current systems of translating, categorizing, and geolocating information before they can even begin helping. A game which, just as one example, teaches players show to do these things in an intuitive way means faster responses from a larger pool of people.
    With enough development, these games could also train crisis responders. In the meantime, it would certainly make for a more informed and engaged public. As far as who the intended players are, it’s really up to the dev teams!

    Q: Where does the information come from?

    A: There are many different ways in which information is generated during times of crisis. Just as one example, Ushahidi is a crowdsourcing and information maangement tool in which instances are built off of observers tweets. People in emergency situations often tweet with hash tags or texting to short codes about what they see – closed roads, buried people, open gas stations. We can pull from previous events to create simulations. Some retail companies also keep close track of their shipped inventories, and are able to reroute things. This information will also be available to be used in the games.

    Q: Who is organizing this?

    A: Well, if you mean who thought of this whole mess in the first place, that would be Willow, director of Geeks Without Bounds, a non-profit organization dedicated to connecting hacker and maker communities to existing humanitarian organizations and Annie, the features editor at Gameranx, a publication of news, reviews, and critical analysis of games and gamer culture. However, we would not have made it this far if not for some really excellent volunteers. If you are interested in becoming one of these excellent volunteers, please go here!

    Q: How did you come up with this?

    A: Well, it started as a comment thread on an article about PAX East coverage over at Gamer Melodico. A few of us got onto the subject of using games as tools for education and positive change, and how it’s a topic that’s starting to be discussed more in the public eye.
    Lots of people are now familiar with Dr. Jane McGonigal’s ideas regarding games as powerful teaching tools.  We wanted to apply that concept specifically to emergency management and relief.  We believe that in order to have a sustainable model for disaster mitigation, we need more powerful methods of education for workers, volunteers, and the public.

    Q: Who does GameSave want to help out?

    A: Anyone willing and able! Specifically, we are looking for more publishers and dev studios who are willing to sponsor teams to compete. This means donating some man hours and potential travel expenses, though we will also have travel scholarships available for qualified candidates. If this is you, please go here!
    We’re also grateful to publications and companies who can help us put the word out. If you’d like to be put on our press contact list, please sign up here!
    And of course, we can definitely use enthusiastic volunteers, particularly if you’re in the Seattle or San Francisco metropolitan areas. There are other volunteer opportunities available as well, so if you want to help out, sign up here!
    Yes, all of the above links take you to the same place. This is our pre-registration/interest list. Formal registration will be opening soon, but for now, this is the best way to receive updates.

    Q: Where do I need to go in order to participate in the “IRL” events?

    A: The hack-a-thon build session will happen in Seattle, WA in late June of 2011. The awards ceremony and reception will be in San Francisco, CA mid July. Yes, we know. That is really soon. But at least it doesn’t directly conflict with E3 or PAX Prime!

    Q: Is there any kind of assistance available for participants who aren’t local and/or sponsored, but can’t afford to just pack it up and hop on a plane?

    A: Yes, we will be offering various travel scholarships for participants. We are not entirely sure how many or how much we’ll be able to offer yet, because this depends on our sponsorship levels! However, we encourage everyone who needs one to apply. Candidacy is based on income and skill set, but we hope to be able to accommodate as many willing participants as possible! We will have an application for travel scholarship up soon, so if you are interested in applying, add your name to the pre-registration for up-to-the-minute info!

    Q: I’m able to help fund travel scholarships and would like to donate to the cause! Where do I go to make this happen?

    A: Right here. After you submit your info, we’ll contact you posthaste. You can also mail checks to The School Factory, one of our fiscal sponsors, if you prefer the hands-off approach. Make sure you specify that the donation is for GameSave, along with any particular areas in which you’d like the contribution to be applied (ex: travel expenses, LAN setup, developer chow), and it’ll come straight to us. And your donations are tax-deductible, so that’s cool.

    Q: I represent a company or group that could provide some sort of sponsorship. Are there any benefits or incentives to do so?

    A: To see the various ways in which your organization can benefit from sponsorship, head over here.

    Q: What is the difference between the Seattle and San Francisco events?

    A: The build event in Seattle is primarily going to be for participants. It will mostly consist of group work time, as well as some face to face interaction with emergency management personnel who have donated their time to provide information and guidance to this project.
    The reception event in San Francisco will be a formal presentation of each game concept/demo, as well as an awards ceremony and reception. Tickets for this event will be available to to the public!

    Q: Where do I go to get tickets to the reception?

    A: You’ll be able to get tickets via our Kickstarter page!

    Q: I’m not a developer, nor do I have much extra money, but I’d still like to help! What can I do?

    A: Well, if you’re near Seattle or San Francisco, there are plenty of opportunities! If you’re elsewhere, it might not be quite the same kind of involvement, but we will take all the help we can get! Tweet about us, write about us, and tell your friends and family. Disaster preparedness is the name of the game! Just head over to pre-registration to find out more!

    Geeks to converge on Central Florida for BarCamp Orlando 2011

    Mar 28
    2011

    Join Geeks without Bounds at BarCamp Orlando on Saturday, April 2 2011.

    BarCamp Orlando is an annual community building event that brings together makers, creatives and developers from different backgrounds to share and learn from each other. There will be people who know Java, .NET, Ruby, Python, PHP, and other technologies coming together with people who know film, music, photography, graphic design, podcasting, and even other new Media.

    There is only one rule with BarCamp: Share!

    It is strongly recommended that attendees give a demo, a session, or help with one. This is called sharing and we like it. :-) Find something you’re passionate about and come give a talk on it. It could be anything…an operating system you use, a language you program with, a website you like, how to get a thousand twitter followers, how to use photoshop, or whatever you want!

    You won’t need to decide what you want to talk about until you get there. In typical unconference style, talks aren’t decideduntil the day of the event (that’s part of the fun). The schedule of speakers gets built together on a whiteboard starting at 9:30 AM on April 2nd, 2011, the day of the event.

    The Padewan is Right

    Mar 17
    2011

    If you’re like me, you’re watching the events unfolding in Japan with great concern.   I’ve felt it too.  I’ve felt it before.

    On 20010911

    On 20041226

    On 20050829

    I wish I had time to put it more eloquenty, but we need help….now.

    The project we’re currently researching to help Crisis Commons with Japan Earthquake Response is to create a map of Japan’s affected areas where no geocoded social data is coming in. This could *potentially* indicate where communications are down and *perhaps* indicate areas where CRISIS communication infrastructure (Satellite/WiMax/etc) could be most useful.

    The idea would be to use Twitter/Mixi/etc.. (any social network/images/service with Geodata) and lat/lon to see where there is activity in Japan.

    Theoretically we can look at this data on a map to determine where the dark zones are.  We don’t think there is enough data to make accurate maps…but it’s worth a try, and maybe we can help some people in the process of learning.

    There is a voice call at 12pm PST (3pm EST) on 20030317 (St. Patrick’s Day) to discuss this approach.  Also, there’s an active Crisis Commons chat where folks are assisting 24/7.  If anyone would like to be added to either, please let me know. diggz@gwob.org


    This Week in Cloud Computing – Digital Mountaintop (Video)

    Feb 19
    2011

    Diggz recently appeared on This Week in Cloud Computing to talk to Amanda Coolong and David Linthicum speak about how geeks can lend a hand for events like what has recently been occurring in Egypt and in other parts of the world. He talked about his Digital Mountaintop application he built using Tropo, how we got started, and how geeks can help.  Diggz’s part kicks in about 26 minutes into this video.

    Cloud based Crisis Response

    Feb 01
    2011

    All weekend I’ve been in discussions with various people in the Crisis Response community about the events occurring in Egypt and in other parts of the world.  When governments attempt to block information and shut down communications, it is rarely a good thing.  But “helping” can also be a dangerous venture.

    Austin Heap’s Haystack Circumvention Tool, which set up anonymous servers to assist citizens in Iran communicate last summer backfired very publicly, proving to be a valuable lesson:  Even when you *think* you’re doing good…there is always a risk that you can inadvertently cause more harm than good.   As third-party observers, by definition, we don’t know *all* the facts.   We don’t know the situation on the ground.  We are not embroiled in the politics and struggles halfway around the world.

    But yet, we want to help.

    One of the groups doing some amazing work is Meedan.net The Arabic word ‘meedan’ - ميدان – means ‘a town square’ or ‘gathering place.’

    Meedan.net is a digital town square where you can share conversations and links about world events with speakers outside your language community. Everything that gets posted on meedan.net is mirrored in Arabic and English – whether it’s the headlines you read, the comments you write, or the articles you share.

    GWOBorg has been working with folks at Meedan and Tropo to start collecting field reports via SMS and telephone.  With limited information coming from within Egypt, we decided we’ll turn up the volume on the Digital Mountain Top and listen from where we can reach today.

    Unfortunately we can’t get any phone numbers in Egypt, but if anyone in Egypt can make a phone call or Skype, they can now leave a voice message and document eyewitness accounts.  This message will be translated into english and documented.   We’ll be adding additional channels and local numbers as they become available.

    It’s important to note, this is just BETA, and NOT FOR EMERGENCY RESPONSE.  At this stage, this is purely a tool for citizen journalists to record their observations to the cloud.

    Really, big thanks to Tropo for giving us a giant global footprint.  Here are the global GWOBorg access numbers:

    Skype Voice: +990009369991482890
    SIP Voice:  sip:9991482890@sip.tropo.com
    INum Voice: +883510001828102
    Phono App Address: app:9991482890

    Phone/Landlines:
    United States:  407-680-0683 (SMS RECEIVE Enabled)

    Argentina:  +54 1152184089
    Australia: +61 390015552
    Belgium:  +32 28088404
    Brazil:  +55 5132510236
    Chile:  +56 29382286
    Czech Rep: +420 228880178
    Denmark: +45 89880089
    Estonia: +372 6682540
    Finland: +358 931582814
    Greece:  +30 2111982647
    Israel: +972 37631128
    Italy: +39 0699367375
    Japan:  +81 345789457
    Latvia: +371 67652630
    Lithuania: +370 52058928
    Luxembourg:  +352 20880288
    Malta: +356 27780287
    Mexico:  +52 3346240137
    New Zeland: +64 98875687
    Panama:  +507 8365351
    Peru:  +51 17085766
    Poland:  +48 223074192
    Portgual:  +351 308801901
    Slovokia:  +421 233006716
    Slovenia: +386 18888217
    Spain: +34 931786090
    Sweden: +46 840838400
    Switzerland: +41 435081115
    United Kingdom: +44 1259340227