In this talk I'll take you on a tour of the Tor landscape, starting with a crash course on Tor, how it works, and what security it provides. I'll explain why Tor's open design and radical approach to transparency are critical to its success, and then compare the censorship circumvention arms race to the nation-state surveillance arms race. We'll end with a discussion of onion services, which are essentially an even stronger version of, but which you might instead know from confusing phrases like "the dark web". Tor is a free-software anonymizing network that helps people around the world use the Internet in safety. Tor's 8000 volunteer relays carry traffic for millions of daily users, including ordinary citizens who want protection from identity theft and prying corporations, corporations who want to look at a competitor's website in private, people around the world whose Internet connections are censored, and even governments and law enforcement. This past year has seen many changes to the Tor world: Major browsers are working on Tor integration so their private browsing modes will provide actual privacy. We have a new Tor Browser for Android that brings the same browser-level protections as we have on desktop. Major institutions like the Toronto Public Library are piloting Tor Browser deployments on all of their computers. We have a growing and diverse relay community-which needs your help. Recent Tor Browser updates include major usability improvements, both for initial user experience and for users in censored environments. We've done trainings in many interesting countries to help vulnerable populations use the internet more safely. The anti-censorship arms race has moved forward, with China's further crackdown on VPNs vs the design of new pluggable transports to get around blocking. We've seen new and novel attacks by nation-states to try to block Tor connections or degrade its security. We've deployed the new v3 onion services, which offer improved security, and companies like Facebook and Cloudflare are adopting them. New research on privacy-preserving measurement has let us gather statistics that we had previously been unable to safely observe, including a new estimate that the Tor network has 8 to 10 million daily users. And last but not least, we have a new executive director for the non-profit organization.
 Great. Hi everybody. I'm Roger. I'm going to tell you a bit about how Tor works and what we've been doing lately. How many people here know a lot about how Tor works and decentralized trust and anonymity and okay, I see quite a few hands but also quite a few hands not. Great. I'm going to start with a bit of introduction about what Tor is and how it works and then we'll get on to the more exciting stuff. So Tor is software. The goal is you install it on your computer, Tor browser, things like that. And the goal is that you're routing your traffic through a network of volunteer relays such that somebody watching your local network can't figure out what websites you're going to and people on the website side can't figure out where you're coming from. So those are the two big pieces of anonymity. Another key piece of the Tor world is the community of people everywhere who are working on it. We've got professors and research groups. We've got free software developers. We've got activists and advocates and that huge community of people who care about Tor is critical. We're also a US 501C3 non-profit shtiktoong style organization as well. And there are some number of users. It's an anonymity or privacy system. So it's a bit hard to tell how many users we have really. But one estimate has about 2 million daily users and there's a more recent privacy preserving measurement that shows about 8 million daily users which is both of these numbers are quite huge compared to what they used to be. Okay. So in a lot of situations, let me see. Did I just, yes, I just, I skipped a slide. Perfect. Okay. So the first question to ask from a security perspective, what's our threat model? What are we concerned about? What are we trying to protect? So we've got Alice over here. She's trying to browse the web to some website, Bob. Where could the adversary be? Maybe the adversary is watching Alice's local network. Maybe it's the local coffee shop. Maybe it's the Tunisian telephone company, something like that. Or maybe the adversary is watching Bob. They're watching WikiLeaks and they want to know who connects to WikiLeaks. Or maybe the adversary is Bob. Maybe it's cnn.com and they want to learn all about their users so they can advertise to them better. Or maybe the attackers in the middle of the network. Maybe it's AT&T or Deutsche Telekom and maybe that means it's NSA or other intelligence groups. So there are a bunch of different things we have to worry about. One of the other key things to remember, anonymity is not just encryption. When you're using encryption, nobody can read what you say, but they still learn who you talk to, when you talk to them, how much you say. And this social graph approach is actually what all the intelligence agencies use these days. Nobody tries to break the encryption. It's all about let's build a map of who is talking to who and when they talk and who's in the middle. And whoever that is will break into their house and steal their laptop and change things. So it's not about breaking the encryption. It's about learning who is interesting. And that's what Tor is trying to protect. Everybody here knows the word metadata, I hope. And you've all seen creepy NSA dude with this phrase, we kill people based on metadata. So a lot of this, this is the metadata. This is the communications metadata, the network metadata about who talks to who that is critical to protect. HTTPS is great, encryption is good, but you need the next layer past that in terms of providing metadata security. Okay, I actually only use the word anonymity when I'm talking to researchers and professors and so on. When I'm talking to my parents, I tell them I'm working on privacy systems because privacy is is a good thing that everybody should want. And anonymity is a little bit scary. I'm not sure if I want it. And when I'm talking to companies, I tell them I'm working on communication security or network security because privacy is dead, anonymity is scary. But of course I want to protect my communications. If I'm trying to buy things from the internet or research other companies, of course I want to protect that. And then when I'm talking to governments and military and law enforcement, I work on traffic analysis resistant communication networks. And again, it's the same security properties. It's the same system. It's the same users. The goal is to bring everybody together into the same network so that they can protect each other. You need people who look at it as privacy, the activists in the world, and you need governments and diplomats and so on who are saying, yes, I'm going to Israel and no, I don't want anybody to be able to learn what my affiliation is or what country I'm going to because that's my metadata. And then there's the fourth category, which is the reachability side where I want to go to BBC but I'm in Turkey or Uzbekistan or something and they've blocked the websites I'm trying to get to. So the goal of TORUS is to take all these different groups and bring them into the same network so that they can blend together. You can't have a privacy system only for cancer survivors because then the fact that you're using it tells people too much about why you're using it. So far so good. Am I speaking too quickly or hopefully understandable? Thumbs up. Great. Okay, so how do you actually build one of these? The easy answer is you put some central proxy in the middle and you route all the traffic through that. And the first problem with that is what happens if that central point of failure turns bad? And there's actually a... Okay, I'll get back to that in a bit. So the second problem is even if that central point is perfect and totally honest, you can still look at the traffic going in and match up the traffic going out and it doesn't matter if the person in the middle is trying to be perfect. You can still see the timing and volume flows going in and match them up with the timing and volume flows going out. So this centralized situation is bad news and it's why in the tour case we want to distribute the trust over multiple relays so no single relay gets to learn what's going on. R1 gets to learn that Alice is using tour but he doesn't learn what Alice is doing. R3 learns that somebody is talking to Bob but he doesn't learn who is talking to Bob. And there's encryption. I'm not going to talk about that today but I'll be happy to chat about it later. So this decentralization is really important. Long ago I was talking to the CTO of Anonymizer.com, one of these central proxy systems, and he said, I never answer subpoenas. If I ever answered a subpoena, nobody would ever trust me ever again. So of course I never answer when law enforcement asks. And then I did a talk for the US Department of Justice six months later and one of them interrupted me and said, why can't you be like Anonymizer? It's easy. We send them a subpoena, they send us an answer. It's easy. Why can't you be like that? And I say that not to pick on a particular company. The problem is the architecture. The problem is they have all of your data and they promise not to screw you. That's not a stable situation. There's no way for you to be able to learn whether they're following through on their promise or not. So the key for Tor is to distribute the trust so there's no single point that could screw you and promises not to. We want something stronger than privacy by promise. We want privacy by design. Okay, so that was actually only half of what Tor is. That was the network level privacy or IP address privacy. The second piece is application level privacy. So the first one is when I go to a website, I don't want somebody to learn which website I'm going to. The second one is when I go to a website, I don't want the website to be able to track everything I'm doing and recognize me from time to time. So all the things like cookies and font size and flash cookies and how many pixels by how many pixels your browser window is. It turns out there are hundreds of browser level tracking and tracing mechanisms which we've had to turn off. And this is Tor browser which is based on Firefox and has a lot of privacy bugs fixed in it. And there are other ways of using Tor. One of the safest ways to do that is a live CD based on Debian called tails. You get it, you install it on your USB key, you boot to tails and it has all of the software preconfigured to correctly use Tor and it's missing all the stuff like Microsoft Word that you shouldn't be trying to use Tor with Tor at the same time. So if you're, for example, the journalists who were looking at the Ed Snowden documents were using tails while they were doing that to make sure that they were as safe as they could be. And just this year we are finally finishing Tor browser for Android. It finally got to the point that you could run a real Firefox on Android and we've ported all the issues, all the fixes inside Firefox and we're going to have a real first class Tor browser for Android. Right now it's in alpha, you should go to our website. If you're an Android person download it, try it, tell us about the bugs. Okay, so this is a, so the green line here is capacity of the Tor network since 2010 and the purple line is load on the Tor network since 2010. So there are a couple of neat things to look at. One of them is they're going up, yay. Another one is there's a whole other talk that I don't have time for here about performance where the difference between these two lines has to do with how fun it is to use the Tor network. It used to be way back when that these two lines were really close together and that means there was very little extra capacity on the Tor network, very little, that meant that there was a lot of congestion when you were trying to use Tor, you had to wait for somebody else's page to load before your page could load and as these two lines separate more and more it's more likely that you're going to have a fun experience using Tor. Okay, so there are two pieces to what I mean by Tor safety or Tor diversity. The first one, the first way to measure how safe Tor is has to do with where the relays are. So we have about 7,000 or 8,000 relays all around the world and imagine a Tor network that was all in Boston. We have Tor relays at MIT, Tor relays at Harvard, Tor relays at Boston University. In that case you're bouncing around a small Tor network and there are several internet providers around there who get to see all of it and that means they're very likely to be able to see the connection coming into the Tor network and the connection coming out of the Tor network and then they can do traffic correlation attacks to realize this user was connecting to that website. So as we get more and more relays it's not just the number, it's where they are. As the relays are more and more diversely spread around the world, the set of attackers who are in a position to be able to see traffic going in and corresponding traffic going out gets smaller and smaller. So that's one way of measuring how safe Tor is. Another key thing is diversity in terms of number of users in that area who are using it for different reasons. So for example, imagine you're a Tor user in Iran. I talked to security people who say, okay, here's my algorithm. I'm going to find a Tor user in Iran. I'm going to kill them and then I'm going to repeat until there are no more Tor users in Iran. And if you're a person who doesn't understand society and politics but you're just looking at it from a technical side, okay fine, solid algorithm. But the problem there is the average Tor user in Iran is the average citizen in Iran. They censor their internet so a lot of people install things like Tor in order to get around the censorship. So the average Tor user is the average Facebook user. They're using it to try to read their kitten blog posts just like everybody else in the country. And that diversity of ordinary people is critical for security. You can't have 50,000 political dissidents in Iran and they're the only ones using Tor because then the fact that they are trying to download Tor, the fact that they're trying to use it is itself bad news for them. So far so good? Great. Okay, another key thing to think about is the transparency side. So yes, we're free software, yes we're open source, yes we give you specifications that describe this is what we, here's our source code, here's the specifications that say what we think we built, here's the design documents and proposals that say why we built it this way. And we need all three layers of that. But it's more than that. We also show up to conferences and explain, hi I'm Roger, I want to answer any questions you have about Tor. And this level of transparency is critical for community building and trust in the software. There are a lot of other privacy tools out there who say I'm going to go via pseudonym and I'm never going to show up at a conference and nobody can meet me and I'm just going to write good solid software and it will be fine. Tor is about a community of people around the world who know each other and trust each other and that's how it grows. So I also hear from plenty of people who say oh ha ha the privacy project is talking about transparency that doesn't make any sense. It's not a contradiction, privacy is about choice, privacy is about you being able to choose who learns things about you. And we choose to be public and transparent in order to build a stronger system, in order to build a community that can grow and trust itself. Okay and yes there's always somebody out there who's like but what about bad people? Aren't you helping bad people in the world? So there are a bunch of different answers to this and if you think that Tor is mostly for bad people I'm not going to solve this in one slide, happy to chat more afterwards. But so the first answer is remember that we have something like 8 million people using Tor every day. So through sheer volume we are like the average internet user at this point and yes you see a couple of bad people here and there but all the ones that you don't see are the ones who are using it successfully and happily to get to slash.dot or CNN or Facebook or whatever they do on the internet. Another answer is yes maybe it's a two-edged sword you got to accept the good with the bad. I hear a lot that technology is you know neutral so it's about what the humans do with it. I think that technology is neutral side is bullshit. Technology is inherently political, it benefits some people more than others. When you're building it if you don't think about that you will end up reinforcing the status quo, you'll end up reinforcing the current power structures. So one of our goals with Tor is to think that through, understand the current power structures and think about how to benefit the people who are who don't have as much power right now. The people who aren't governments and companies and so on. If you're a government you can buy your own anonymity system, you can go out and handle Ops-Ec, you can do a lot of trainings and so on. If you're one person in Syria who just saw something terrible happen you don't have any other options besides Tor. You don't have any ways to stay safe on your internet. So yes it's a two-edged sword but I think one edge is a lot sharper than the other or however that metaphor goes. Good people need Tor a lot more than bad people. Another way of looking at that if we took Tor away from the world the CIA would still be doing fine but the people in Syria would suffer a lot more than that. Another way of looking at that, imagine two scenarios. So scenario one, I want to build a tool that works for the next year, it will work for millions of people and I can tell you all about it. That's the Tor problem. Scenario two, I want to build a tool that will work for the next two weeks and it will work for 20 people and I'm not going to tell you about it. That's the bad guy problem. There's so many more ways of solving scenario two. You get in a flame war on Wikipedia, you hide your images in steganography in eBay. There are plenty of things that don't scale, don't last, and don't stand up to transparency and scrutiny whereas we want to build something that can grow to actually provide strong security to lots of people forever and that's a much harder problem and it benefits the good people a lot more in the long run and if you didn't buy any of that I'd be happy to debate more afterwards. Okay, another fun thing to think about. The Toronto Public Library has rolled out a pilot program where they have Tor browser on all of the computers in one of the big rooms in the library and they're working on getting Tor browser in every single computer in the Toronto Public Library system which is awesome because there are so many ordinary people in that world who need more protection from the internet. In America at least we have laws about how libraries have to censor the internet and there's a bunch of problems with law enforcement going to try to surveil what people do in libraries. I don't think Canada is that bad yet but giving people back control of their information, control of who gets to learn what they're doing is a really cool thing to do. Okay, so let me switch gears to the censorship side of things. I'm trying to smash together too many talks at once. So here is the Tor website from various countries around the world. It might not look like the Tor website you're used to seeing. Here's one up there saying surf safely. This website is not accessible in the UAE. Here's another one saying this blocked due to content contrary to the laws of the Sultanate. This one's fun because if you believe that the website you are trying to access does not contain any such content please send us all of your information using this form and then we'll take care of it for you whatever that means. So I'm not sure how that works in practice but I think a lot of people in these countries are smart enough to not fill out these sorts of forms. But here are some other fun examples. Access to this site is currently blocked and then in in Qatar they try to make it fun. Oops we're fascists. Oops we blocked this thing. So there's a recurring theme where it's not you know we're a totalitarian government. It's you know something went wrong. I don't know what went wrong. You tried to do something you shouldn't have. Ha ha this is all fun. So this is the the first introduction that we had to the censorship side of things where people would block our website and that means that when you try to download the source the tour software you can't get it and that means it's harder to connect into the tour network. So this was one of the very early censorship experiences from the tour side. You can see in this so this is a graph of the number of people connecting into the tour network from Egypt. Don't pay too much attention to the y-axis. The numbers there aren't quite right but the the relative graph is pretty accurate. You can see on this graph when they blocked Facebook that's when a whole lot of people decided they needed tour and you can see on this graph when they unplugged the internet. So this is a very early experience from the tour side. Much more recently here's a graph of the set of people who are connecting into the tour network from Russia and you can see here when they blocked Facebook as well because they blocked Facebook and suddenly hundreds of thousands of people switched over to using tour in order to get to Facebook and I say Facebook in this case because I talked to one of the security people at Facebook who says they have a secret data set that's exactly the inverse of my graph. On their side they have a data set of people connecting to Facebook from Russia and it looks like this. It looks like exactly the opposite of this. So so we have the set of users who have switched over to using tour in order to get to the the Facebook site. But eventually and this happened in several countries there people try to use tour to get around censorship great but that means the countries are going to try to censor connections into the tour network with the goal of okay fine we blocked Facebook and we're going to block tour so that you can't use it to get around the censorship. So the fix the first fix for that is what we call bridge relays and the idea is you've got a bunch of volunteer users who are harder to enumerate they're not they're they're not a static list they're not a public list and the censored users route through these bridges into the tour network. We'll get back to that think of that as a building block for later. So another challenge that we have in the censorship world is deep packet inspection DPI. The idea is rather than looking at the IP addresses that you're connecting to and blocking filtering by that you instead look at the the content that's going back and forth and you look for patterns or protocols or something like that and you block certain patterns that you don't want to see certain protocols. So in this case tour tried to look like TLS because who would block HTTPS and we had a slight difference in the Diffie-Hellman prime that we were using in our TLS. We used the one from the DNS sec RFC and Apache uses the one from a different one and somebody tuned the Nokia box in Iran to look for TLS handshakes that used the DNS sec prime and cut them and that meant that over the course of a day or so all the users disappeared from Iran and we heard a lot of people saying oh my god what's going on and they weren't blocking by IP address they hadn't gotten a list of the tour relays and blocked them they were blocking all the bridges and all the relays because they were blocking through the protocol approach and in this case we figured out what it was and rolled out an update and a few weeks later everybody recovered and it was fine but this DPI approach is certainly one of the one of the more pervasively used approaches for censorship these days and the answer that we have for that is what we call pluggable transports the idea is the tour side still takes care of the privacy anonymity security metadata side of things and the pluggable transport transforms the tour traffic in some way that's going to make it look like something the sensor doesn't want to block so there are two main categories here one of them is you transform it into a htdp or htds or skype video or web rtc or stuff like that so it looks like the sort of protocol they're happy to let through and then another answer is you transform it into just a random a random stream of bytes and the goal with that random stream of bytes is they can't figure out what the protocol is now they're forced to either block everything they can't classify in which case there's a lot of false positives in their blocking or allow everything through if they can't classify it and that protocol works pretty well in a lot of places how many people here know the story about blue coat in syria from five years ago or something one hand down here one hand down here yep okay one hand down here great everybody should know the story it's a terrible story everybody should so a few years ago there were folks from anonymous the like the online group and they found a misconfigured ftp server in syria which had gigabytes of web logs publicly available because they screwed up and made them available and they were blue coat web logs and each line of the gigabytes of lines was this ip address tried to access this url and we allowed it this ip address this url we blocked it lines and lines and lines of apache style uh logs explaining who was trying to do what and whether it worked from all around syria and at the top it said you know blue coat so in america we have a law about how certain we're the companies in america are not allowed to sell their stuff to certain countries and syria is on that list so blue coat was was breaking the law in the us so anonymous went to blue coat and said what's up with this you seem to be running the censorship surveillance infrastructure in syria and blue coat said ah no that's not us and so anonymous was like but the top of the log says blue coat on it what do you mean it's not us and then blue coat said oh well gosh we we sold it to dubai or something how are we supposed to know that that they they resold it to syria you can't blame us we don't we don't know uh and then they were like but but it's it's auto updating all the updates are still working why what do you mean you don't know you're serving updates to a blue coat server in syria how do you how do you not know that you're doing that so then blue coat was like oh shit you're right we okay we we disabled the updates now we're definitely not helping this at all so then anonymous went and got the serial number for the blue coat device and logged in and asked for some updates and they got the updates so basically the the end of the story is and then blue coat got an award from the us state department for their cooperation in all of this so it's it's a miserable story every step of the way and it's a recurring theme where european and american and western companies are building and deploying and operating the surveillance and censorship infrastructure all around the world and so i actually went to a meeting at the german foreign office a few years ago where they were trying to figure out what should we do about this should we should we make a law saying european companies can't can't sell stuff to certain countries should we outlaw certain kinds of technologies and i i'm not a fan of that one because every time people try to draw a line my stuff's on the wrong side of the line so i think trying to to delineate what technology should be illegal is probably not not so good this was a fun meeting from my perspective because i was basically the only technology person there so i would be sitting in the room and at one at some point one of the the diplomats or something would lean over and say hey roger what does the technology community think about this and i would try to represent every hacker in the world to explain how how the internet actually works so i don't know how they're actually going to solve this one of the the theories that i heard from privacy international was don't look at the actual software look at the brochures that they use because there are there these huge trade shows where like bluecode and and everybody else show up and they have glossy beautiful documents saying i can arrest 500 bloggers per hour and then somebody else says i can do 800 bloggers per hour and then the the saudi prince goes over and says oh i want the 800 one so actually looking at the the extremely bold advertising that these companies do they're they're shameless they they they're they're making billions of dollars off of this and nobody's stopping them australia censors the internet denmark censors the internet sweden censors the internet belgium censors the internet england censors the internet so when governments go to places like china and say look you're being bad for the world you're harming your country you're you're not playing well you're censoring you need to stop censoring china very reasonably says look i'm just doing what everybody else does i'm keeping my citizens safe from the internet just like you do why are you picking on me so part of what we need to do is not think about just over there a stand where china is doing something bad with their internet the problem is all over where we're starting to try to control and surveil and monitor and prevent connections and and when we're doing it in western countries how are we possibly going to convince other countries to stop doing it so if we're trying to solve this sort of thing maybe we should start at home trying to solve the fact that belgium wants to censor the internet and does it these are the actual official chinese cyber police this is the you remember the you know oops this is fun this is fun to be the chinese cyber police they're all cute and cool and and don't worry so there are a bunch of things i can talk about china i don't have enough time to talk about all of them but one of the critical points one of the things china did recently from the censorship side is what we call active probing the idea so you remember i talked about the pluggable transports where you transform the traffic into something that that they're not willing to block or they're not able to recognize and you drive up the false positives in the active probing world they do a dpi attack to figure out if they think they might want to block it and if they think they might want to they connect to the destination themselves talk the tor protocol to it and if it talks tor back then they're sure then they cut it so they have a nationwide active probing infrastructure where within a few milliseconds of me making a tor connection they make a tor connection spoofing it from an ip address somewhere in china and follow up and try to connect so the fix that we have for that is when you're connecting to a bridge you need to prove knowledge of some secret and that means the active probing infrastructure when they when they connect they can't prove that they know the secret and the challenge there is what should the bridge do when somebody connects and can't show that they know the secret the the the answer is back natural whatever that means do you do you provide a an Apache error file do you so the the answer that we've come up with right now is you wait a random number of seconds and then you hang up because if you ever answer anything that's a fingerprint that they can use to say that is a tor bridge trying to pretend it's not a tor bridge so this is a a terrible arms race going back and forth okay another fun thing we can talk about a while ago a nice guy named ed snowden brought a bunch of documents out he tried to get every single document he could find about tor in order to give it to us so that we would have as good an understanding as possible about what the intelligence agencies are trying to do with an about tor so this is a slide deck from i'm not sure if it's nsa or gchq and i'm really curious which one where they were talking through i tried to attack or like this and it didn't work i tried to attack it like this and it didn't work i tried like this so it's a it's a series of tor stinks i can't break it which is a fun slide deck that they used internally at one of their meetings another challenge we had there you see the fine tor sticker up there on ed's laptop this was the first introduction to tor for a lot of journalists so we had a lot of people calling us and saying so what's this tor thing that ed invented because they had no idea that there was a thing called the tor project and that we'd been working on it for 12 years and so on there's also this great quote in there from one of their slides as endorsed by the nsa still the king of high secure low latency internet anonymity so on the one hand yay they couldn't break tor as of 2012 on the other hand all these intelligence agencies are huge and they have a lot of different groups that don't talk to each other so we need to make sure not to be too confident based on one group not being able to break it that doesn't mean that there wasn't a group down the hall that didn't talk to them that we're working on some other mechanism for being able to do it but it's still a good sign the fact in 2012 they were having meetings between nsa and gchq because they didn't know how to tackle this confusing tor thing which distributes trust all around the world okay so you remember the bridge thing I was talking about earlier all of that I was talking about in the censorship context in the context of somebody's trying to connect to the tor network and we're going to block that connection but what about the surveillance world what about the world where we're trying to learn who is connecting to tor so one of the other pluggable transports that we've been working on that I'm optimistic in the censorship context and I'm intrigued in the surveillance context is something called snowflake so the idea is rather than you run you install tor you edit a text file you do things that that we find normal but most users find confusing instead you let people volunteer to be a tor bridge by going to a website with their browser you give them some javascript it turns them into a javascript browser running into a javascript bridge running in their browser and they do a web socket connection into the tor network and a web socket connect and a web rtc connection to the censored user so as far as china or other sensors are seeing there is a google hangout style video chat thing going on from the user in the country to some random web browser and from there the connections being passed on into the tor network so there are a bunch of cool properties here one of them is web rtc I hope they don't block it another one is you get built-in NAT piercing because web rtc already does all of that you get encryption and you get a whole lot of transient we call them snowflakes a whole lot of transient bridges that come up and go down and if china's goal is to blacklist all the people on are part of the internet running web browsers that's probably not going to work so the other thing to think about is the surveillance style of question where if they're trying to learn who's connecting to tor by building a list of everybody who does web rtc everybody who does google hangouts everybody who does internet video chat that's going to be a much harder approach okay so one of the lessons censorship arms races are crappy because china puts billions of dollars and tens of thousands of people into this sort of thing but at least you you have a handle on whether it's working like you try to connect to the tor network it doesn't work you change something now it works your feedback loop is pretty good there and they've been making it worse by not just not actually cutting the connection but throttling it or slowing it down or something but at least you have a feedback loop in the surveillance case there's no feedback loop you connect to the tor network you don't know if they saw you you don't know what they're looking at you don't know what databases they have you don't know what part of the internet they can see and you don't so you don't know whether you should change something and if you change something you don't know whether you helped it or you heard it so one answer is we need a new ed coming out every week giving us the the new documents that they have i don't have other answers so i'd love to chat more about that okay let me switch over to another topic in the last 12 minutes onion services or hidden services so everything i talked about before was i want to go to a website without the website learning where i'm coming from now let's use that as a building block where i want to connect to another person running the tor software and i want to do it so that i get a bunch of cool security properties and so this is how it looks in practice up there you have a blah blah blah dot onion address and this is the rise up website running as a tour client available and reachable over the tour network and that blah blah blah is the hash of the key of the onion service which gives us a bunch of cool security properties one of them is it's self authenticated if you know the blah blah blah dot onion you can fetch the key hash the key make sure it matches the blah blah blah and that means that you know you're talking to the place that has the private key that corresponds to this address you're trying to go to so you know the whole certificate authority world where Turkish telecom can lie to you about whether it's facebook we bypass all of that you get end to end authentication where you know who you're talking to without needing to rely on digisert or verisign or Turkish telecom or chinese telecom and so on you also get end to end encryption and you get a bunch of other cool things but one of the questions we were wondering in the beginning so a while ago there was some idiot on the internet trying to sell drugs and he set up a website selling drugs and he put it behind an onion address and then some cops found him and busted him and there was some cop who was saying and the tour network traffic went down by 50 percent when we busted this guy so tour is only for bad people and i was thinking well shit that that's not good i thought there were millions of tour users i thought we had all these you know good people doing things i hear good stories yeah there's some some some jerk but you know that's just one guy so then i was thinking wait a minute we don't actually have any data about that we don't have a a way to to argue with this guy other than saying him saying it was half the tour network and me saying i hope that's not true so at that point i'm thinking how do we actually gather data to refute this sort of thing so here's a graph of the amount of onion service traffic that happens over time and it's it's you know a gigabit per second or something but remember at the back back at the beginning of the talk i was showing you 150 gigabits per second of of actual tour load so it's complicated to figure out what fraction of the tour network that is but it's something like three percent so something like three percent of the traffic on the tour network has to do with onion services at all so it is a tiny little toy that i built back in 2005 and it hasn't gotten much use it should get a lot more use there is a lot more potential out there but it's it's basically at the very beginning of its lifetime so that means when you see confusing terrible iceberg pictures scaring you about the other 99 internets out there that you didn't know about try to figure out what their business model is try to figure out why they're why they're trying to scare you with an iceberg slide is it some sort of threat analytics or threat intelligence or something where they want you to give them a million dollars and they'll tell you if they find you on the dark web whatever that means i actually talked to one of these threat intelligence companies and they said yeah we have to say dark web because that that's what sells but actually all the interesting stuff we find is from our paste bin pro account we pay paste bin and they tell us every time a new paste bin thing happens and that's where all the good stuff is we don't find anything on onion services they basically don't exist so another interesting piece of that a while ago bbc did an article saying you can buy drugs on the internet and here's how and the comment section was full of people who are like oh my god that's amazing thanks thanks i don't have to go get shot on the street corner wonderful thank you for telling me about these sort of things and bbc's business model is they sell ads on their article so of course they want to write something that people want to read and then they did a follow-up a week later saying and we bought some and we had them tested and they were really good so what was bbc's motivation in writing these things and getting all these people this was like the most commented on article ever they had to shut down the comments so what's their business model there think about that when when you see an iceberg slide so another another version of that question what do you think the biggest website on the dark web is is it some someplace in malaysia the answer is it's facebook a while ago facebook was looking at how many users are connecting from the tor network into facebook and they saw over the over a one month period in april a few years ago they saw a million people logging into facebook accounts over the tor network and they said uh wow users want safety we should set up an onion address we should embrace tor we should give them the choices that they're that they're clearly asking for so that they can connect to our network the way they want to so one one one reason why they do this they know that there are people in turkey trying to reach facebook and they know that turkish telecom is trying to attack the people in turkey and turkish telecom can lie to them about what s what htps websites they're seeing another key thing to think about here this is still the facebook website it's not like facebook set up a new internet and put themselves on it or something there is no dark web that doesn't even make sense it's the facebook website i was talking to an analyst a while ago who said i found a copy of facebook on the dark web and i'm like no there's a computer it's called facebook they're running a website it's called facebook.com you can get to it over htp you can get to it over htps you can get to it over its onion address it's the same computer it's just a matter of what transport security you get do you get htp where you get very little encryption and authentication do you get htps where you have to rely on one of 300 companies vouching for this thing or do you do the onion address where you don't have to rely on that sort of thing so there are a couple of other cool use cases for onion services that that might expand your idea of what onion services might be one of them is secure drop there's another one that's similar called global leaks out there in the world and the idea is you run a website where people who want to whistle blow or give you anonymous tips for your like new york times runs one of these and you can talk to a journalist safely where you control your own privacy it's not an anonymous tip line where they promise to keep you safe but it's up to them you get to to control these things another fun use case is a tool called ricochet it so you know jabber xmpp google chat all those things uh i chat i message they're all centralized there's all even signal has a central point that knows who you are and who all your friends are and when you talk to them and that metadata is the really interesting stuff so there's there's a juicy middle that you either subpoena them and they give you the answer or you break in and you get the answer the cool thing about ricochet every user is their own onion service there is no middle there's no place to break into you're all rendezvousing with each other through the tour network in a way where each of you keeps control of your privacy and your contact and who you're talking to in a way that there's no place to go to attack in order to learn who's doing what and then a third fun use case is called onion share imagine you're a journalist and you just got the ed's notan documents and you're sitting next to another journalist and you want to share them you're actually in the same room what do you do do you email them through your gmail thing that's probably not a good idea maybe you put them on dropbox but wait dropbox looks at all the files maybe you put them on a usb key but we've all been taught that us keep us b keys are bad news so the answer here is you run a tool called onion share which spins up an onion service and a website you ricochet or signal or whatever the url to your friend your friend goes there downloads the file and then the website disappears so it's a transient way of moving a file around on the internet in a way there's there's nothing there afterwards it's not like a a website like dropbox where they can go subpoena of them afterwards okay so another so some some wrap ups to think about tour is not magic tour is not foolproof user error is one of the most common ways where things can go wrong one piece of that is upset mistakes where the idiot trying to sell drugs apparently wrote his name down in various places and screwed up in all sorts of ways so if you're trying to stay safe on the internet there are a lot of things that you want to think about and a lot of examples of how people screwed up another challenge is metadata browser fingerprints where it's not just cookies it's all sorts of other things at the application level that can let the websites recognize you over time and then another challenge we have is the whole browser exploit world we're based on firefox firefox is not the best software out there no browsers are the best software out there browsers are shit so if you're trying to actually browse the web and be safe this is a terrible world to live in but that's what everybody does so we also are in that game and coming up with a way to keep you safe from people sending you scary javascript and scary images and scary text and scary xml and so on is a challenging world and i've tried to order these in terms of how how prevalent they are how relevant they are to ordinary people because you're much more likely to have an upset problem than than have an intelligence agency try to look at the entire internet and try to match up who's talking to where and so on but these are four areas that we think a lot about in terms of keeping people safe so how can you help one answer is we need a lot more relays you can run an exit relay which means you're the last hop in the connection and websites are going to get confused about whether whether it was you or whether it was tor and sometimes you get the chance to teach law enforcement how tor works or you can run a non-exit relay which means you're never that third hop in the in the circuit in the path and you are just moving in cryptotraffic back and forth inside the tor network so whichever of those you're excited about we need both of them another thing we really need is please tell everybody how tor works explain to them why privacy is important why metadata security is important explain to them why the dark web isn't what they think it is and that guy with the hoodie they saw on the television show is not representing the internet in the way that that actually matches facts another piece use our software find bugs if you're an android person download tor browser android and try to break it try to figure out what happened this summer in july is the pets conference privacy enhancing technology symposium where all of the privacy anonymity researchers get together and it's in stock home which is not so far from here so in five months or six months or something consider going there to meet all the researchers and if you happen to have a real job we're a nonprofit and we'd love to get a donation and also this afternoon at 1500 in room h dot three two four four is a relay operator operator meetup if you run a relay or if you want to run a relay then please come and chat with us and also I will be wandering around in a bright green shirt happy to answer questions for the rest of the day and I am out of time is that I'm out of time so thank you and I'll be around
 Great. Hi everybody. I'm Roger. I'm going to tell you a bit about how Tor works and what  we've been doing lately. How many people here know a lot about how Tor works and decentralized  trust and anonymity and okay, I see quite a few hands but also quite a few hands not.  Great. I'm going to start with a bit of introduction about what Tor is and how it works and then  we'll get on to the more exciting stuff. So Tor is software. The goal is you install it on your  computer, Tor browser, things like that. And the goal is that you're routing your traffic through  a network of volunteer relays such that somebody watching your local network can't figure out  what websites you're going to and people on the website side can't figure out where you're coming  from. So those are the two big pieces of anonymity. Another key piece of the Tor world is the  community of people everywhere who are working on it. We've got professors and research groups.  We've got free software developers. We've got activists and advocates and that huge community  of people who care about Tor is critical. We're also a US 501C3 non-profit shtiktoong style  organization as well. And there are some number of users. It's an anonymity or privacy system.  So it's a bit hard to tell how many users we have really. But one estimate has about 2 million  daily users and there's a more recent privacy preserving measurement that shows about 8 million  daily users which is both of these numbers are quite huge compared to what they used to be.  Okay. So in a lot of situations, let me see. Did I just, yes, I just, I skipped a slide. Perfect.  Okay. So the first question to ask from a security perspective, what's our threat model? What are  we concerned about? What are we trying to protect? So we've got Alice over here. She's trying to  browse the web to some website, Bob. Where could the adversary be? Maybe the adversary is watching  Alice's local network. Maybe it's the local coffee shop. Maybe it's the Tunisian telephone company,  something like that. Or maybe the adversary is watching Bob. They're watching WikiLeaks and  they want to know who connects to WikiLeaks. Or maybe the adversary is Bob. Maybe it's cnn.com and  they want to learn all about their users so they can advertise to them better. Or maybe the attackers  in the middle of the network. Maybe it's AT&T or Deutsche Telekom and maybe that means it's NSA or  other intelligence groups. So there are a bunch of different things we have to worry about.  One of the other key things to remember, anonymity is not just encryption. When you're using encryption,  nobody can read what you say, but they still learn who you talk to, when you talk to them,  how much you say. And this social graph approach is actually what all the intelligence agencies  use these days. Nobody tries to break the encryption. It's all about let's build a map of who is  talking to who and when they talk and who's in the middle. And whoever that is will break into their  house and steal their laptop and change things. So it's not about breaking the encryption. It's  about learning who is interesting. And that's what Tor is trying to protect. Everybody here knows  the word metadata, I hope. And you've all seen creepy NSA dude with this phrase, we kill people  based on metadata. So a lot of this, this is the metadata. This is the communications metadata,  the network metadata about who talks to who that is critical to protect. HTTPS is great,  encryption is good, but you need the next layer past that in terms of providing metadata security.  Okay, I actually only use the word anonymity when I'm talking to researchers and professors and so  on. When I'm talking to my parents, I tell them I'm working on privacy systems because privacy is  is a good thing that everybody should want. And anonymity is a little bit scary. I'm not sure if  I want it. And when I'm talking to companies, I tell them I'm working on communication security  or network security because privacy is dead, anonymity is scary. But of course I want to protect  my communications. If I'm trying to buy things from the internet or research other companies,  of course I want to protect that. And then when I'm talking to governments and military and law  enforcement, I work on traffic analysis resistant communication networks. And again, it's the same  security properties. It's the same system. It's the same users. The goal is to bring everybody  together into the same network so that they can protect each other. You need people who look at  it as privacy, the activists in the world, and you need governments and diplomats and so on who  are saying, yes, I'm going to Israel and no, I don't want anybody to be able to learn what my  affiliation is or what country I'm going to because that's my metadata. And then there's the fourth  category, which is the reachability side where I want to go to BBC but I'm in Turkey or Uzbekistan  or something and they've blocked the websites I'm trying to get to. So the goal of TORUS is to take  all these different groups and bring them into the same network so that they can blend together.  You can't have a privacy system only for cancer survivors because then the fact that you're using  it tells people too much about why you're using it. So far so good. Am I speaking too quickly or  hopefully understandable? Thumbs up. Great. Okay, so how do you actually build one of these?  The easy answer is you put some central proxy in the middle and you route all the traffic through  that. And the first problem with that is what happens if that central point of failure turns bad?  And there's actually a... Okay, I'll get back to that in a bit. So the second problem is even if  that central point is perfect and totally honest, you can still look at the traffic going in and  match up the traffic going out and it doesn't matter if the person in the middle is trying to be  perfect. You can still see the timing and volume flows going in and match them up with the timing  and volume flows going out. So this centralized situation is bad news and it's why in the tour case  we want to distribute the trust over multiple relays so no single relay gets to learn what's  going on. R1 gets to learn that Alice is using tour but he doesn't learn what Alice is doing.  R3 learns that somebody is talking to Bob but he doesn't learn who is talking to Bob.  And there's encryption. I'm not going to talk about that today but I'll be happy to chat about it  later. So this decentralization is really important. Long ago I was talking to the CTO of  Anonymizer.com, one of these central proxy systems, and he said, I never answer subpoenas. If I ever  answered a subpoena, nobody would ever trust me ever again. So of course I never answer  when law enforcement asks. And then I did a talk for the US Department of Justice six months later  and one of them interrupted me and said, why can't you be like Anonymizer? It's easy. We send them  a subpoena, they send us an answer. It's easy. Why can't you be like that? And I say that not to  pick on a particular company. The problem is the architecture. The problem is they have all of your  data and they promise not to screw you. That's not a stable situation. There's no way for you to be  able to learn whether they're following through on their promise or not. So the key for Tor is to  distribute the trust so there's no single point that could screw you and promises not to. We want  something stronger than privacy by promise. We want privacy by design. Okay, so that was actually  only half of what Tor is. That was the network level privacy or IP address privacy. The second  piece is application level privacy. So the first one is when I go to a website, I don't want somebody  to learn which website I'm going to. The second one is when I go to a website, I don't want the  website to be able to track everything I'm doing and recognize me from time to time. So all the  things like cookies and font size and flash cookies and how many pixels by how many pixels your  browser window is. It turns out there are hundreds of browser level tracking and tracing mechanisms  which we've had to turn off. And this is Tor browser which is based on Firefox and has a lot of  privacy bugs fixed in it. And there are other ways of using Tor. One of the safest ways to do that  is a live CD based on Debian called tails. You get it, you install it on your USB key, you boot  to tails and it has all of the software preconfigured to correctly use Tor and it's missing all the  stuff like Microsoft Word that you shouldn't be trying to use Tor with Tor at the same time.  So if you're, for example, the journalists who were looking at the Ed Snowden documents were  using tails while they were doing that to make sure that they were as safe as they could be.  And just this year we are finally finishing Tor browser for Android. It finally got to the point  that you could run a real Firefox on Android and we've ported all the issues, all the fixes inside  Firefox and we're going to have a real first class Tor browser for Android. Right now it's in alpha,  you should go to our website. If you're an Android person download it, try it, tell us about the bugs.  Okay, so this is a, so the green line here is capacity of the Tor network since 2010 and the  purple line is load on the Tor network since 2010. So there are a couple of neat things to look at.  One of them is they're going up, yay. Another one is there's a whole other talk that I don't have  time for here about performance where the difference between these two lines has to do with how fun it  is to use the Tor network. It used to be way back when that these two lines were really close  together and that means there was very little extra capacity on the Tor network, very little,  that meant that there was a lot of congestion when you were trying to use Tor, you had to wait for  somebody else's page to load before your page could load and as these two lines separate more and  more it's more likely that you're going to have a fun experience using Tor. Okay, so there are two  pieces to what I mean by Tor safety or Tor diversity. The first one, the first way to measure how  safe Tor is has to do with where the relays are. So we have about 7,000 or 8,000 relays all around  the world and imagine a Tor network that was all in Boston. We have Tor relays at MIT, Tor relays  at Harvard, Tor relays at Boston University. In that case you're bouncing around a small Tor network  and there are several internet providers around there who get to see all of it and that means  they're very likely to be able to see the connection coming into the Tor network and the  connection coming out of the Tor network and then they can do traffic correlation attacks to realize  this user was connecting to that website. So as we get more and more relays it's not just the  number, it's where they are. As the relays are more and more diversely spread around the world,  the set of attackers who are in a position to be able to see traffic going in and corresponding  traffic going out gets smaller and smaller. So that's one way of measuring how safe Tor is.  Another key thing is diversity in terms of number of users in that area who are using it for different  reasons. So for example, imagine you're a Tor user in Iran. I talked to security people who say,  okay, here's my algorithm. I'm going to find a Tor user in Iran. I'm going to kill them and then  I'm going to repeat until there are no more Tor users in Iran. And if you're a person who doesn't  understand society and politics but you're just looking at it from a technical side, okay fine,  solid algorithm. But the problem there is the average Tor user in Iran is the average citizen in  Iran. They censor their internet so a lot of people install things like Tor in order to get  around the censorship. So the average Tor user is the average Facebook user. They're using it to  try to read their kitten blog posts just like everybody else in the country. And that diversity  of ordinary people is critical for security. You can't have 50,000 political dissidents in Iran  and they're the only ones using Tor because then the fact that they are trying to download Tor,  the fact that they're trying to use it is itself bad news for them. So far so good? Great. Okay,  another key thing to think about is the transparency side. So yes, we're free software,  yes we're open source, yes we give you specifications that describe this is what we,  here's our source code, here's the specifications that say what we think we built,  here's the design documents and proposals that say why we built it this way. And we need all  three layers of that. But it's more than that. We also show up to conferences and explain,  hi I'm Roger, I want to answer any questions you have about Tor. And this level of transparency  is critical for community building and trust in the software. There are a lot of other privacy  tools out there who say I'm going to go via pseudonym and I'm never going to show up at a conference  and nobody can meet me and I'm just going to write good solid software and it will be fine.  Tor is about a community of people around the world who know each other and trust each other  and that's how it grows. So I also hear from plenty of people who say oh ha ha the privacy  project is talking about transparency that doesn't make any sense. It's not a contradiction,  privacy is about choice, privacy is about you being able to choose who learns things about you.  And we choose to be public and transparent in order to build a stronger system, in order to  build a community that can grow and trust itself. Okay and yes there's always somebody out there  who's like but what about bad people? Aren't you helping bad people in the world? So there are a  bunch of different answers to this and if you think that Tor is mostly for bad people I'm not  going to solve this in one slide, happy to chat more afterwards. But so the first answer is remember  that we have something like 8 million people using Tor every day. So through sheer volume we are  like the average internet user at this point and yes you see a couple of bad people here and there  but all the ones that you don't see are the ones who are using it successfully and happily to get to  slash.dot or CNN or Facebook or whatever they do on the internet. Another answer is yes maybe it's  a two-edged sword you got to accept the good with the bad. I hear a lot that technology is you know  neutral so it's about what the humans do with it. I think that technology is neutral side is bullshit.  Technology is inherently political, it benefits some people more than others. When you're building it  if you don't think about that you will end up reinforcing the status quo, you'll end up reinforcing  the current power structures. So one of our goals with Tor is to think that through, understand the  current power structures and think about how to benefit the people who are who don't have as much  power right now. The people who aren't governments and companies and so on. If you're a government you  can buy your own anonymity system, you can go out and handle Ops-Ec, you can do a lot of trainings  and so on. If you're one person in Syria who just saw something terrible happen you don't have any  other options besides Tor. You don't have any ways to stay safe on your internet. So yes it's a  two-edged sword but I think one edge is a lot sharper than the other or however that metaphor goes.  Good people need Tor a lot more than bad people. Another way of looking at that if we took Tor away  from the world the CIA would still be doing fine but the people in Syria would suffer a lot more  than that. Another way of looking at that, imagine two scenarios. So scenario one, I want to build a  tool that works for the next year, it will work for millions of people and I can tell you all about  it. That's the Tor problem. Scenario two, I want to build a tool that will work for the next two weeks  and it will work for 20 people and I'm not going to tell you about it. That's the bad guy problem.  There's so many more ways of solving scenario two. You get in a flame war on Wikipedia,  you hide your images in steganography in eBay. There are plenty of things that don't scale,  don't last, and don't stand up to transparency and scrutiny whereas we want to build something  that can grow to actually provide strong security to lots of people forever and that's a much harder  problem and it benefits the good people a lot more in the long run and if you didn't buy any of that  I'd be happy to debate more afterwards. Okay, another fun thing to think about. The Toronto  Public Library has rolled out a pilot program where they have Tor browser on all of the computers  in one of the big rooms in the library and they're working on getting Tor browser in every  single computer in the Toronto Public Library system which is awesome because there are so many  ordinary people in that world who need more protection from the internet. In America at least  we have laws about how libraries have to censor the internet and there's a bunch of problems  with law enforcement going to try to surveil what people do in libraries. I don't think Canada is  that bad yet but giving people back control of their information, control of who gets to learn  what they're doing is a really cool thing to do. Okay, so let me switch gears to the censorship  side of things. I'm trying to smash together too many talks at once. So here is the Tor website  from various countries around the world. It might not look like the Tor website you're used to seeing.  Here's one up there saying surf safely. This website is not accessible in the UAE. Here's  another one saying this blocked due to content contrary to the laws of the Sultanate. This one's  fun because if you believe that the website you are trying to access does not contain any such  content please send us all of your information using this form and then we'll take care of it  for you whatever that means. So I'm not sure how that works in practice but I think a lot of people  in these countries are smart enough to not fill out these sorts of forms. But here are some other  fun examples. Access to this site is currently blocked and then in in Qatar they try to make it  fun. Oops we're fascists. Oops we blocked this thing. So there's a recurring theme where it's  not you know we're a totalitarian government. It's you know something went wrong. I don't know  what went wrong. You tried to do something you shouldn't have. Ha ha this is all fun. So this is  the the first introduction that we had to the censorship side of things where people would  block our website and that means that when you try to download the source the tour software you  can't get it and that means it's harder to connect into the tour network. So this was one of the  very early censorship experiences from the tour side. You can see in this so this is a graph of  the number of people connecting into the tour network from Egypt. Don't pay too much attention  to the y-axis. The numbers there aren't quite right but the the relative graph is pretty accurate.  You can see on this graph when they blocked Facebook that's when a whole lot of people decided  they needed tour and you can see on this graph when they unplugged the internet. So this is a  very early experience from the tour side. Much more recently here's a graph of the set of people  who are connecting into the tour network from Russia and you can see here when they blocked  Facebook as well because they blocked Facebook and suddenly hundreds of thousands of people  switched over to using tour in order to get to Facebook and I say Facebook in this case because  I talked to one of the security people at Facebook who says they have a secret data set that's  exactly the inverse of my graph. On their side they have a data set of people connecting to  Facebook from Russia and it looks like this. It looks like exactly the opposite of this. So  so we have the set of users who have switched over to using tour in order to get to the the Facebook  site. But eventually and this happened in several countries there people try to use tour to get  around censorship great but that means the countries are going to try to censor connections into the  tour network with the goal of okay fine we blocked Facebook and we're going to block tour so that you  can't use it to get around the censorship. So the fix the first fix for that is what we call bridge  relays and the idea is you've got a bunch of volunteer users who are harder to enumerate  they're not they're they're not a static list they're not a public list and the censored users  route through these bridges into the tour network. We'll get back to that think of that as a building  block for later. So another challenge that we have in the censorship world is deep packet  inspection DPI. The idea is rather than looking at the IP addresses that you're connecting to and  blocking filtering by that you instead look at the the content that's going back and forth  and you look for patterns or protocols or something like that and you block certain patterns that you  don't want to see certain protocols. So in this case tour tried to look like TLS because who would  block HTTPS and we had a slight difference in the Diffie-Hellman prime that we were using in our  TLS. We used the one from the DNS sec RFC and Apache uses the one from a different one and  somebody tuned the Nokia box in Iran to look for TLS handshakes that used the DNS sec prime  and cut them and that meant that over the course of a day or so all the users disappeared from Iran  and we heard a lot of people saying oh my god what's going on and they weren't blocking by IP  address they hadn't gotten a list of the tour relays and blocked them they were blocking all the  bridges and all the relays because they were blocking through the protocol approach and in  this case we figured out what it was and rolled out an update and a few weeks later everybody  recovered and it was fine but this DPI approach is certainly one of the one of the more pervasively  used approaches for censorship these days and the answer that we have for that is what we call  pluggable transports the idea is the tour side still takes care of the privacy anonymity security  metadata side of things and the pluggable transport transforms the tour traffic in some way that's  going to make it look like something the sensor doesn't want to block so there are two main  categories here one of them is you transform it into a htdp or htds or skype video or web rtc  or stuff like that so it looks like the sort of protocol they're happy to let through and then  another answer is you transform it into just a random a random stream of bytes and the goal with  that random stream of bytes is they can't figure out what the protocol is now they're forced to  either block everything they can't classify in which case there's a lot of false positives in  their blocking or allow everything through if they can't classify it and that protocol works pretty  well in a lot of places how many people here know the story about blue coat in syria from  five years ago or something one hand down here one hand down here yep okay one hand down here  great everybody should know the story it's a terrible story everybody should so a few years ago  there were folks from anonymous the like the online group and they found a misconfigured  ftp server in syria which had gigabytes of web logs publicly available because they screwed  up and made them available and they were blue coat web logs and each line of the gigabytes of lines  was this ip address tried to access this url and we allowed it this ip address this url we blocked it  lines and lines and lines of apache style uh logs explaining who was trying to do what and whether  it worked from all around syria and at the top it said you know blue coat so in america we have a  law about how certain we're the companies in america are not allowed to sell their stuff to  certain countries and syria is on that list so blue coat was was breaking the law in the us  so anonymous went to blue coat and said what's up with this you seem to be running the censorship  surveillance infrastructure in syria and blue coat said ah no that's not us and so anonymous was  like but the top of the log says blue coat on it what do you mean it's not us and then blue coat  said oh well gosh we we sold it to dubai or something how are we supposed to know that  that they they resold it to syria you can't blame us we don't we don't know uh and then they were  like but but it's it's auto updating all the updates are still working why what do you mean you  don't know you're serving updates to a blue coat server in syria how do you how do you not know  that you're doing that so then blue coat was like oh shit you're right we okay we we disabled the  updates now we're definitely not helping this at all so then anonymous went and got the serial  number for the blue coat device and logged in and asked for some updates and they got the updates  so basically the the end of the story is and then blue coat got an award from the us state department  for their cooperation in all of this so it's it's a miserable story every step of the way  and it's a recurring theme where european and american and western companies are building and  deploying and operating the surveillance and censorship infrastructure all around the world  and so i actually went to a meeting at the german foreign office a few years ago where they were  trying to figure out what should we do about this should we should we make a law saying european  companies can't can't sell stuff to certain countries should we outlaw certain kinds of  technologies and i i'm not a fan of that one because every time people try to draw a line my  stuff's on the wrong side of the line so i think trying to to delineate what technology should be  illegal is probably not not so good this was a fun meeting from my perspective because i was basically  the only technology person there so i would be sitting in the room and at one at some point one  of the the diplomats or something would lean over and say hey roger what does the technology  community think about this and i would try to represent every hacker in the world to explain  how how the internet actually works so i don't know how they're actually going to solve this one of  the the theories that i heard from privacy international was don't look at the actual software  look at the brochures that they use because there are there these huge trade shows where  like bluecode and and everybody else show up and they have glossy beautiful documents saying  i can arrest 500 bloggers per hour and then somebody else says i can do 800 bloggers per hour and then  the the saudi prince goes over and says oh i want the 800 one so actually looking at the the  extremely bold advertising that these companies do they're they're shameless they  they they're they're making billions of dollars off of this and nobody's stopping them australia  censors the internet denmark censors the internet sweden censors the internet belgium censors the  internet england censors the internet so when governments go to places like china and say  look you're being bad for the world you're harming your country you're you're not playing well  you're censoring you need to stop censoring china very reasonably says look i'm just doing  what everybody else does i'm keeping my citizens safe from the internet just like you do why are  you picking on me so part of what we need to do is not think about just over there a stand where  china is doing something bad with their internet the problem is all over where we're starting to  try to control and surveil and monitor and prevent connections and and when we're doing it in western  countries how are we possibly going to convince other countries to stop doing it so if we're  trying to solve this sort of thing maybe we should start at home trying to solve the fact that  belgium wants to censor the internet and does it these are the actual official chinese cyber police  this is the you remember the you know oops this is fun this is fun to be the chinese cyber police  they're all cute and cool and and don't worry so there are a bunch of things i can talk about china  i don't have enough time to talk about all of them but one of the critical points one of the  things china did recently from the censorship side is what we call active probing the idea so you  remember i talked about the pluggable transports where you transform the traffic into something that  that they're not willing to block or they're not able to recognize and you drive up the false positives  in the active probing world they do a dpi attack to figure out if they think they might want to  block it and if they think they might want to they connect to the destination themselves talk the  tor protocol to it and if it talks tor back then they're sure then they cut it so they have a nationwide  active probing infrastructure where within a few milliseconds of me making a tor connection  they make a tor connection spoofing it from an ip address somewhere in china and follow up and try  to connect so the fix that we have for that is when you're connecting to a bridge you need to prove  knowledge of some secret and that means the active probing infrastructure when they when they connect  they can't prove that they know the secret and the challenge there is what should the bridge do  when somebody connects and can't show that they know the secret the the the answer is back natural  whatever that means do you do you provide a an Apache error file do you so the the answer that  we've come up with right now is you wait a random number of seconds and then you hang up because  if you ever answer anything that's a fingerprint that they can use to say that is a tor bridge  trying to pretend it's not a tor bridge so this is a a terrible arms race going back and forth  okay another fun thing we can talk about a while ago a nice guy named ed snowden brought a bunch  of documents out he tried to get every single document he could find about tor in order to  give it to us so that we would have as good an understanding as possible about what the  intelligence agencies are trying to do with an about tor so this is a slide deck from i'm not  sure if it's nsa or gchq and i'm really curious which one where they were talking through i tried  to attack or like this and it didn't work i tried to attack it like this and it didn't work i tried  like this so it's a it's a series of tor stinks i can't break it which is a fun slide deck that  they used internally at one of their meetings another challenge we had there you see the fine  tor sticker up there on ed's laptop this was the first introduction to tor for a lot of journalists  so we had a lot of people calling us and saying so what's this tor thing that ed invented because  they had no idea that there was a thing called the tor project and that we'd been working on it  for 12 years and so on there's also this great quote in there from one of their slides as endorsed  by the nsa still the king of high secure low latency internet anonymity so on the one hand  yay they couldn't break tor as of 2012 on the other hand all these intelligence agencies are huge  and they have a lot of different groups that don't talk to each other so we need to make sure not to  be too confident based on one group not being able to break it that doesn't mean that there wasn't a  group down the hall that didn't talk to them that we're working on some other mechanism for being  able to do it but it's still a good sign the fact in 2012 they were having meetings between nsa and  gchq because they didn't know how to tackle this confusing tor thing which distributes trust all  around the world okay so you remember the bridge thing I was talking about earlier all of that  I was talking about in the censorship context in the context of somebody's trying to connect  to the tor network and we're going to block that connection but what about the surveillance world  what about the world where we're trying to learn who is connecting to tor so one of the other  pluggable transports that we've been working on that I'm optimistic in the censorship context  and I'm intrigued in the surveillance context is something called snowflake so the idea is rather  than you run you install tor you edit a text file you do things that that we find normal but most  users find confusing instead you let people volunteer to be a tor bridge by going to a website  with their browser you give them some javascript it turns them into a javascript browser running  into a javascript bridge running in their browser and they do a web socket connection into the tor  network and a web socket connect and a web rtc connection to the censored user so as far as  china or other sensors are seeing there is a google hangout style video chat thing going on  from the user in the country to some random web browser and from there the connections being  passed on into the tor network so there are a bunch of cool properties here one of them is web rtc  I hope they don't block it another one is you get built-in NAT piercing because web rtc already does  all of that you get encryption and you get a whole lot of transient we call them snowflakes a  whole lot of transient bridges that come up and go down and if china's goal is to blacklist all the  people on are part of the internet running web browsers that's probably not going to work so  the other thing to think about is the surveillance style of question where if they're trying to  learn who's connecting to tor by building a list of everybody who does web rtc everybody who does  google hangouts everybody who does internet video chat that's going to be a much harder approach  okay so one of the lessons censorship arms races are crappy because china puts billions of dollars  and tens of thousands of people into this sort of thing but at least you you have a handle on  whether it's working like you try to connect to the tor network it doesn't work you change something  now it works your feedback loop is pretty good there and they've been making it worse by not just  not actually cutting the connection but throttling it or slowing it down or something but at least  you have a feedback loop in the surveillance case there's no feedback loop you connect to the tor  network you don't know if they saw you you don't know what they're looking at you don't know what  databases they have you don't know what part of the internet they can see and you don't so you  don't know whether you should change something and if you change something you don't know whether  you helped it or you heard it so one answer is we need a new ed coming out every week giving us the  the new documents that they have i don't have other answers so i'd love to chat more about that  okay let me switch over to another topic in the last 12 minutes onion services or hidden services  so everything i talked about before was i want to go to a website without the website learning  where i'm coming from now let's use that as a building block where i want to connect to another  person running the tor software and i want to do it so that i get a bunch of cool security properties  and so this is how it looks in practice up there you have a blah blah blah dot onion address and  this is the rise up website running as a tour client available and reachable over the tour network  and that blah blah blah is the hash of the key of the onion service which gives us a bunch of cool  security properties one of them is it's self authenticated if you know the blah blah blah  dot onion you can fetch the key hash the key make sure it matches the blah blah blah and that means  that you know you're talking to the place that has the private key that corresponds to this address  you're trying to go to so you know the whole certificate authority world where Turkish telecom  can lie to you about whether it's facebook we bypass all of that you get end to end authentication  where you know who you're talking to without needing to rely on digisert or verisign or  Turkish telecom or chinese telecom and so on you also get end to end encryption and you get a bunch  of other cool things but one of the questions we were wondering in the beginning so a while ago  there was some idiot on the internet trying to sell drugs and he set up a website selling drugs  and he put it behind an onion address and then some cops found him and busted him and there was  some cop who was saying and the tour network traffic went down by 50 percent when we busted this  guy so tour is only for bad people and i was thinking well shit that that's not good i thought  there were millions of tour users i thought we had all these you know good people doing things i hear  good stories yeah there's some some some jerk but you know that's just one guy so then i was  thinking wait a minute we don't actually have any data about that we don't have a a way to to argue  with this guy other than saying him saying it was half the tour network and me saying i hope that's  not true so at that point i'm thinking how do we actually gather data to refute this sort of thing  so here's a graph of the amount of onion service traffic that happens over time and it's it's you  know a gigabit per second or something but remember at the back back at the beginning of the talk i was  showing you 150 gigabits per second of of actual tour load so it's complicated to figure out what  fraction of the tour network that is but it's something like three percent so something like  three percent of the traffic on the tour network has to do with onion services at all so it is a  tiny little toy that i built back in 2005 and it hasn't gotten much use it should get a lot more  use there is a lot more potential out there but it's it's basically at the very beginning of its  lifetime so that means when you see confusing terrible iceberg pictures scaring you about the  other 99 internets out there that you didn't know about try to figure out what their business model  is try to figure out why they're why they're trying to scare you with an iceberg slide is it some  sort of threat analytics or threat intelligence or something where they want you to give them a  million dollars and they'll tell you if they find you on the dark web whatever that means  i actually talked to one of these threat intelligence companies and they said  yeah we have to say dark web because that that's what sells but actually all the interesting  stuff we find is from our paste bin pro account we pay paste bin and they tell us every time a new  paste bin thing happens and that's where all the good stuff is we don't find anything on onion  services they basically don't exist so another interesting piece of that a while ago bbc did  an article saying you can buy drugs on the internet and here's how and the comment section was full  of people who are like oh my god that's amazing thanks thanks i don't have to go get shot on the  street corner wonderful thank you for telling me about these sort of things and bbc's business  model is they sell ads on their article so of course they want to write something that people  want to read and then they did a follow-up a week later saying and we bought some and we had them  tested and they were really good so what was bbc's motivation in writing these things and getting  all these people this was like the most commented on article ever they had to shut down the comments  so what's their business model there think about that when when you see an iceberg slide  so another another version of that question what do you think the biggest website on the dark web  is is it some someplace in malaysia the answer is it's facebook a while ago facebook was looking  at how many users are connecting from the tor network into facebook and they saw over the over  a one month period in april a few years ago they saw a million people logging into facebook accounts  over the tor network and they said uh wow users want safety we should set up an onion address we  should embrace tor we should give them the choices that they're that they're clearly asking for so  that they can connect to our network the way they want to so one one one reason why they do this  they know that there are people in turkey trying to reach facebook and they know that turkish  telecom is trying to attack the people in turkey and turkish telecom can lie to them about what s  what htps websites they're seeing another key thing to think about here this is still the facebook  website it's not like facebook set up a new internet and put themselves on it or something there is no  dark web that doesn't even make sense it's the facebook website i was talking to an analyst a  while ago who said i found a copy of facebook on the dark web and i'm like no there's a computer  it's called facebook they're running a website it's called facebook.com you can get to it over  htp you can get to it over htps you can get to it over its onion address it's the same computer  it's just a matter of what transport security you get do you get htp where you get very little  encryption and authentication do you get htps where you have to rely on one of 300 companies  vouching for this thing or do you do the onion address where you don't have to rely on that sort  of thing so there are a couple of other cool use cases for onion services that that might expand  your idea of what onion services might be one of them is secure drop there's another one that's  similar called global leaks out there in the world and the idea is you run a website where  people who want to whistle blow or give you anonymous tips for your like new york times runs  one of these and you can talk to a journalist safely where you control your own privacy it's  not an anonymous tip line where they promise to keep you safe but it's up to them you get to to  control these things another fun use case is a tool called ricochet it so you know jabber xmpp  google chat all those things uh i chat i message they're all centralized there's all even signal  has a central point that knows who you are and who all your friends are and when you talk to them  and that metadata is the really interesting stuff so there's there's a juicy middle that you either  subpoena them and they give you the answer or you break in and you get the answer the cool thing  about ricochet every user is their own onion service there is no middle there's no place to  break into you're all rendezvousing with each other through the tour network in a way where each of you  keeps control of your privacy and your contact and who you're talking to in a way that there's no  place to go to attack in order to learn who's doing what and then a third fun use case is called  onion share imagine you're a journalist and you just got the ed's notan documents and you're sitting  next to another journalist and you want to share them you're actually in the same room what do you  do do you email them through your gmail thing that's probably not a good idea maybe you put  them on dropbox but wait dropbox looks at all the files maybe you put them on a usb key but we've  all been taught that us keep us b keys are bad news so the answer here is you run a tool called  onion share which spins up an onion service and a website you ricochet or signal or whatever the  url to your friend your friend goes there downloads the file and then the website disappears so it's  a transient way of moving a file around on the internet in a way there's there's nothing there  afterwards it's not like a a website like dropbox where they can go subpoena of them afterwards  okay so another so some some wrap ups to think about tour is not magic tour is not foolproof  user error is one of the most common ways where things can go wrong one piece of that is  upset mistakes where the idiot trying to sell drugs apparently wrote his name down in various  places and screwed up in all sorts of ways so if you're trying to stay safe on the internet  there are a lot of things that you want to think about and a lot of examples of how people screwed  up another challenge is metadata browser fingerprints where it's not just cookies it's all  sorts of other things at the application level that can let the websites recognize you over time  and then another challenge we have is the whole browser exploit world we're based on firefox  firefox is not the best software out there no browsers are the best software out there browsers  are shit so if you're trying to actually browse the web and be safe this is a terrible world to live  in but that's what everybody does so we also are in that game and coming up with a way to  keep you safe from people sending you scary javascript and scary images and scary text and  scary xml and so on is a challenging world and i've tried to order these in terms of how  how prevalent they are how relevant they are to ordinary people because you're much more likely  to have an upset problem than than have an intelligence agency try to look at the entire  internet and try to match up who's talking to where and so on but these are four areas that we  think a lot about in terms of keeping people safe so how can you help one answer is we need a lot  more relays you can run an exit relay which means you're the last hop in the connection and websites  are going to get confused about whether whether it was you or whether it was tor and sometimes  you get the chance to teach law enforcement how tor works or you can run a non-exit relay which  means you're never that third hop in the in the circuit in the path and you are just moving in  cryptotraffic back and forth inside the tor network so whichever of those you're excited about we  need both of them another thing we really need is please tell everybody how tor works explain to  them why privacy is important why metadata security is important explain to them why the dark web  isn't what they think it is and that guy with the hoodie they saw on the television show is not  representing the internet in the way that that actually matches facts another piece use our  software find bugs if you're an android person download tor browser android and try to break it  try to figure out what happened this summer in july is the pets conference privacy enhancing  technology symposium where all of the privacy anonymity researchers get together and it's in  stock home which is not so far from here so in five months or six months or something consider  going there to meet all the researchers and if you happen to have a real job we're a nonprofit and  we'd love to get a donation and also this afternoon at 1500 in room h dot three two four four is a  relay operator operator meetup if you run a relay or if you want to run a relay then please come  and chat with us and also I will be wandering around in a bright green shirt happy to answer  questions for the rest of the day and I am out of time is that I'm out of time so thank you and  I'll be around
The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_0_167.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_168_611.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_612_1919.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_1920_2471.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_2472_2639.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_2640_3947.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_3948_4871.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_4872_5579.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_5580_6599.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_6600_8315.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_8316_8567.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_8568_9383.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_9384_11687.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_11688_12875.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_12876_13763.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_13764_14411.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_14412_15707.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_15708_19223.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_19224_21335.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_21336_25823.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_25824_25883.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_25884_25991.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_25992_26063.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_26064_26111.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_26112_26183.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_26184_26231.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_26232_26375.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_26376_26447.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_26448_26627.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_26628_26747.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_26748_26807.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_26808_26891.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_26892_27011.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_27012_28235.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_28236_29207.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_29208_29759.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_29760_30035.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_30036_30995.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_30996_31127.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_31128_32111.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_32112_33347.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_33348_34151.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_34152_34319.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_34320_34943.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_34944_35807.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_35808_39563.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_39564_41975.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_41976_43571.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_43572_46463.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_46464_47531.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_48096_49283.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_49284_49811.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_49812_52331.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_52332_53735.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_53736_54347.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_54348_54791.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_54792_55823.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_55824_56087.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_56088_56567.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_56568_57599.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_57684_57983.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_57984_58115.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_58116_58199.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_58200_58859.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_58860_60995.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_60996_63431.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_63432_64367.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_64368_65615.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_65616_66959.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_66960_69383.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_69384_71567.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_71568_72671.png The_Current_and_Future_Tor_Project_Updates_from_the_Tor_Project_ZsWe1pI7kas_72672_72786.png