[00:00.000 --> 00:00.900]  ...in here.
[00:01.740 --> 00:07.980]  So today, this talk is the Onion Report from the Tor Project.
[00:07.980 --> 00:12.900]  Tor not being the science fiction publisher, but the Onion Router.
[00:13.040 --> 00:16.480]  So those of you who are here for the science fiction talk, you're at the wrong con.
[00:17.760 --> 00:20.220]  So this is the state of Tor.
[00:20.340 --> 00:28.100]  Tor is wonderful because it is one of the very few technologies that we have for protecting metadata.
[00:28.100 --> 00:33.760]  But it is fragile and complicated and has some great interesting technical issues in it.
[00:34.160 --> 00:37.800]  And this is the Onion Report on the state of Tor.
[00:37.980 --> 00:40.520]  So we have three speakers in this session.
[00:41.240 --> 00:44.500]  ASN, who I am told also will answer to George.
[00:45.360 --> 00:52.980]  David Goulet and Nima Fatemi, who will be giving us the Onion Report.
[00:52.980 --> 01:02.920]  But first, Erinn Clark, also at the Tor Project, has a quick announcement of another event that will be happening after this talk.
[01:06.960 --> 01:08.340]  Thank you, Matt.
[01:08.720 --> 01:09.540]  Hello, everyone.
[01:09.800 --> 01:10.620]  I'm Erinn Clark.
[01:10.880 --> 01:13.460]  I am a long-term Tor person.
[01:13.460 --> 01:15.560]  For five years, I developed the Tor browser.
[01:15.560 --> 01:21.160]  And now I work at First Look as a security engineer, primarily working with the Snowden Archive.
[01:22.700 --> 01:33.760]  But I am here today to announce that a statement that I did not memorize in advance, which is that I care a lot about this community.
[01:34.080 --> 01:39.980]  And as many of you know, it's experienced quite a large upheaval recently, a lot of turmoil.
[01:41.200 --> 01:45.940]  And our executive director, Sherry Steele, made an announcement about it on the blog.
[01:46.140 --> 01:47.640]  And so you can read the details there.
[01:49.560 --> 01:56.780]  But at this panel, they will be discussing basically all of the exciting technical stuff that's happening in Tor.
[01:57.500 --> 02:01.260]  We don't think that this is the appropriate place for Q&A about recent events.
[02:01.260 --> 02:13.160]  However, we are dedicated to trying to, you know, further unearth and surface and, you know, try to find some reconciliation about all of these problems that we've been having.
[02:13.160 --> 02:16.540]  So at 5 p.m.
[02:16.760 --> 02:26.580]  in the Budapest Room on the sixth floor, we are holding an event for people who want to come and talk basically about everything that's been going on.
[02:26.720 --> 02:37.400]  Not in a salacious gossip way, but rather what permitted these events to occur, what permitted them to be surfaced, and how can we fix this going forward.
[02:37.400 --> 02:39.540]  And so it will be a moderated talk.
[02:39.800 --> 02:40.940]  I'm one of the moderators.
[02:41.660 --> 02:44.640]  Matt Blaze is going to be one of the moderators in the second hours.
[02:44.940 --> 02:50.300]  Also Dave Goulet and Biela Coleman, who's a new member of the board of directors.
[02:50.700 --> 02:53.620]  And so that's at 5 p.m., Budapest, sixth floor.
[02:55.120 --> 02:56.300]  We hope to see you there.
[02:56.520 --> 02:57.000]  Thank you.
[02:57.160 --> 02:59.000]  And now, my beloved developers.
[03:04.740 --> 03:05.480]  All right.
[03:05.940 --> 03:06.820]  Hello, everyone.
[03:08.600 --> 03:13.900]  So we had a quite an interesting, wait, seven months since 2015.
[03:16.080 --> 03:18.640]  So we're going to report on everything that's been happened.
[03:19.580 --> 03:22.400]  You know, that is fun and useful to know.
[03:23.000 --> 03:25.300]  So we'll start, of course, the Tor project.
[03:25.520 --> 03:27.340]  So this is a common slide.
[03:27.540 --> 03:31.140]  I'm guessing everyone is comfortable or no Tor.
[03:31.440 --> 03:33.100]  But, you know, this slide is useful.
[03:33.260 --> 03:34.600]  So we're an online privacy anonymity.
[03:34.720 --> 03:35.740]  We are free and open-source.
[03:35.740 --> 03:42.320]  It's an open network, which means anyone can run a relay and join the network and participate and provide bandwidth.
[03:43.360 --> 03:46.220]  We have a huge... we have a slide that's going to show that.
[03:46.320 --> 03:53.840]  But we have a very diverse community of researchers, developers, users, relay operators, bridge operators, grad students, and so on and so forth.
[03:54.000 --> 03:55.000]  It's pretty huge.
[03:55.160 --> 03:56.740]  So we're going to show that to you.
[03:57.380 --> 04:03.040]  Of course, non-profit organization in the U.S., 501C3, whatever that means.
[04:03.040 --> 04:03.820]  All right.
[04:04.300 --> 04:05.820]  The new HQ in Seattle.
[04:06.040 --> 04:08.060]  So one thing that was very exciting happened this year.
[04:08.480 --> 04:12.420]  We were in Boston before and now we are in Seattle.
[04:12.700 --> 04:14.300]  So, yes, we had an office in Boston.
[04:15.200 --> 04:17.480]  I believe it was in Cambridge, something like that.
[04:17.740 --> 04:19.180]  And now it's in some Seattle.
[04:19.330 --> 04:21.580]  We have nice pictures with some hearts and going on.
[04:21.820 --> 04:22.500]  It's pretty neat.
[04:23.360 --> 04:26.440]  We have also an onion space in Berlin.
[04:27.260 --> 04:35.960]  So this is a place where anyone, if you're in Berlin, anyone can go, enjoy, talk to either toy developers, toy operators, people of the community, people like you.
[04:36.150 --> 04:38.120]  And just enjoy this place.
[04:40.360 --> 04:41.640]  Yes, I'm going to go.
[04:42.080 --> 04:42.290]  All right.
[04:42.650 --> 04:42.680]  Go.
[04:42.970 --> 04:43.290]  Sorry.
[04:43.820 --> 04:44.000]  All right.
[04:44.380 --> 04:44.880]  Crowdfunding.
[04:44.880 --> 04:56.060]  So, of course, one of the things that we are working really hard is to get funding that is, you know, diversifying our funding.
[04:56.380 --> 05:02.210]  So one of the things we did in 2015, it was a huge success, is a crowdfunding thing.
[05:02.520 --> 05:09.090]  So we got more than $200,000 from 5,000 different individual donors.
[05:11.730 --> 05:14.230]  And we're going to do a new one soon.
[05:14.650 --> 05:15.880]  And it's working really well.
[05:16.140 --> 05:18.970]  That was like, you know, kind of a tryout, kind of test our things.
[05:19.270 --> 05:20.640]  And it's fine.
[05:21.030 --> 05:22.700]  So we're going to have a new platform.
[05:23.630 --> 05:31.020]  And this is very important because the next bullet point there is government funding, which is a problem for us.
[05:31.140 --> 05:34.980]  Right now we rely heavily on government funding, especially U.S. government funding.
[05:35.500 --> 05:37.160]  It helped us do our work.
[05:37.160 --> 05:40.940]  I think we do great work, as you're going to see today.
[05:41.640 --> 05:43.400]  But it also influences, unfortunately, our priorities.
[05:43.880 --> 05:45.640]  Just to be clear, it influences our priorities.
[05:45.640 --> 05:47.900]  It doesn't mean we are doing bad thing in Tor.
[05:48.180 --> 05:49.680]  We don't do... it's all open-source.
[05:49.790 --> 05:50.820]  We don't do back doors.
[05:51.020 --> 05:52.180]  No, never, never.
[05:53.730 --> 05:55.290]  So other stuff also happened.
[05:55.780 --> 05:56.960]  Mozilla gave us a grant.
[05:57.080 --> 05:57.980]  We're going to talk a bit about this.
[05:58.280 --> 06:01.140]  DuckDuckGo and EFF and so on and so forth.
[06:01.260 --> 06:03.100]  Also Reddit last year gave us some money.
[06:03.440 --> 06:05.320]  So it's going well.
[06:05.320 --> 06:08.730]  But again, this government funding, we need to try to diversify this.
[06:11.260 --> 06:14.080]  So an announcement happened like a week and a half ago.
[06:14.230 --> 06:15.420]  We have a new board of directors.
[06:16.200 --> 06:18.840]  So the entire board resigned.
[06:20.350 --> 06:23.460]  And we now have six new great members right now.
[06:24.320 --> 06:26.620]  Gabriela Coleman, Matt Blaze, Cindy Cohen.
[06:26.920 --> 06:27.340]  Sean?
[06:27.560 --> 06:27.840]  Cohen?
[06:29.000 --> 06:29.780]  Lynnis Nordberg.
[06:30.700 --> 06:31.790]  Of course, Bruce Nair.
[06:32.420 --> 06:33.350]  And Megan Price.
[06:33.980 --> 06:35.680]  So this is currently our new board.
[06:37.120 --> 06:39.790]  They started to think, yeah, a week and a half ago, two weeks.
[06:40.120 --> 06:41.960]  So we expect it's going to be quite epic.
[06:42.290 --> 06:44.780]  And maybe a new board member might come in after a while.
[06:46.680 --> 06:50.120]  So now, a word about the ecosystem of Tor.
[06:52.400 --> 06:54.020]  As you know, this is a pretty big thing.
[06:54.230 --> 06:56.480]  So first of all, we have core members.
[06:56.580 --> 06:59.260]  And by core members, we basically mean people that get money out of it.
[06:59.380 --> 07:00.520]  So board members don't get paid.
[07:00.660 --> 07:02.580]  But employees and contractors, they do get paid.
[07:02.790 --> 07:05.600]  So we have around eight employees, twelve contractors.
[07:05.600 --> 07:09.060]  So it's the thing of 20 people that, you know, get money to make Tor better.
[07:09.480 --> 07:14.320]  So it's pretty nice that we are able to actually pay people to do great stuff.
[07:14.520 --> 07:15.220]  I mean, Tor is great.
[07:15.380 --> 07:16.290]  There's so many challenges.
[07:16.680 --> 07:19.380]  And we're really proud about this.
[07:20.020 --> 07:22.980]  Now this other layer, and yes, it's going to go like an onion.
[07:25.440 --> 07:27.380]  We have so many volunteers.
[07:27.560 --> 07:31.380]  And the 40 volunteers right there, I just want to make a quick point.
[07:31.380 --> 07:36.500]  Those are people that are on RC, that are on their public mailing list, on their internal mailing list.
[07:36.640 --> 07:39.060]  And they just do work for Tor on their own time.
[07:39.220 --> 07:40.900]  And they do an amazing amount of work.
[07:41.160 --> 07:42.080]  And this is great.
[07:42.200 --> 07:46.380]  This is people like you in this room and people around the world that just...
[07:47.700 --> 07:49.020]  We couldn't make it happen.
[07:49.220 --> 07:51.620]  Tor couldn't happen without those people.
[07:51.880 --> 07:54.380]  Because those 20 people that get paid, it's absolutely not enough.
[07:55.280 --> 07:59.500]  One of the fun statistics is 160 unique contributors in Little T Tor.
[07:59.500 --> 08:04.280]  And we call it Little T Tor, which is the Tor demon, the Tor thing that you run on your computer.
[08:04.850 --> 08:06.000]  So, which is pretty huge.
[08:06.180 --> 08:07.160]  It's a big thing.
[08:07.940 --> 08:09.260]  Huge amount of R&D, of course.
[08:09.440 --> 08:10.880]  Grad students, 20 more professors.
[08:11.060 --> 08:13.620]  And this is why Tor actually thrives in the anonymity.
[08:13.680 --> 08:14.620]  And we are really good at it.
[08:14.700 --> 08:15.960]  We think we are really good at it.
[08:16.040 --> 08:19.480]  It's because we have a lot of researchers around the world in different universities.
[08:20.760 --> 08:23.140]  And finally, of course, most important thing.
[08:23.790 --> 08:25.660]  This can happen without relay operators.
[08:25.790 --> 08:27.600]  7,000 relay operators right now.
[08:27.600 --> 08:29.280]  3,000 bridge operators.
[08:29.420 --> 08:31.500]  We have some more details of what a bridge is.
[08:32.620 --> 08:33.760]  50 more projects.
[08:33.900 --> 08:35.980]  Different projects related to Tor.
[08:36.180 --> 08:36.980]  And 2 million users.
[08:37.460 --> 08:38.080]  So, it's pretty great.
[08:38.220 --> 08:38.640]  It's pretty huge.
[08:38.780 --> 08:40.300]  And it's people like you that does make it happen.
[08:42.080 --> 08:44.800]  So, George, let's get about the network.
[08:46.100 --> 08:54.880]  So, apart from the ecosystem of humans that was just presented, Tor is a network of computers through which you bounce to become anonymous.
[08:55.240 --> 09:02.460]  So, those thousands of computers that are run by volunteers around the world is an extremely crucial part of Tor.
[09:03.820 --> 09:07.500]  So, in this graph, you can see the number of relays.
[09:07.640 --> 09:12.040]  Relays are the computers of Tor through which your traffic bounces, basically.
[09:12.500 --> 09:14.020]  You can see it through the years.
[09:14.200 --> 09:18.520]  You can see that, like, 2012, we had 2,000 relays.
[09:18.600 --> 09:22.740]  And now, we have gone up to, like, 7,000 relays.
[09:22.880 --> 09:25.500]  This is definitely a growing community.
[09:25.500 --> 09:42.740]  And it's a pretty intense community building project because to build all these volunteers and for them to be so dedicated, it takes a lot of time and effort to bring Tor out there.
[09:43.160 --> 09:51.620]  And the next slide, which is even more important than the number of computers themselves, is how much traffic the Tor network can actually push.
[09:51.620 --> 09:55.160]  And you can see that here, the increase is even more.
[09:55.360 --> 10:03.340]  So, like, 2012, the Tor network could push, in total, 20 gigabit, which is some traffic, for sure.
[10:03.980 --> 10:12.280]  But now, basically, the Tor network has capacity of 200 gigabit, which is 10 times improved.
[10:12.460 --> 10:16.940]  And it's a much more mature network, let's say.
[10:16.940 --> 10:22.340]  The purple line is an estimate of how much the traffic is used.
[10:22.460 --> 10:28.820]  You can see it's 75 gigabit used, but we're never sure if this statistic is exactly accurate.
[10:30.220 --> 10:40.960]  So, although, even though I told you that it's actually, like, a growing community, it's extremely important for it to become more diverse.
[10:40.960 --> 10:49.920]  That is, currently, these 7,000 computers are mostly situated in Europe and the U.S., the Western world.
[10:50.260 --> 11:01.600]  And, whereas, it is definitely great, but we should try to centralize less and actually get relays running all around the world.
[11:01.600 --> 11:14.080]  For example, even in places with, like, not five eyes countries or in more, in countries that have different, different, I don't know, more diverse.
[11:14.400 --> 11:18.780]  Like, I don't know, Russia, Asia, it's South America.
[11:19.860 --> 11:27.000]  For example, like, OVH, the provider, the VPS provider, has, like, I don't know, a big percentage of the network.
[11:27.000 --> 11:33.340]  And people keep on, like, building relays there, whereas they should try to explore other hosting providers.
[11:33.340 --> 11:43.320]  There are some pages in our Wiki called Good and Bad ISPs where people have tried to, like, they have documented their experience with different ISPs and how they handle Tor.
[11:43.720 --> 11:51.420]  And it's nice that people experiment with this and it would be nice to get more feedback and input on which ISPs are friendly to Tor, basically.
[11:53.780 --> 11:56.120]  And now we move to the next subject.
[11:56.400 --> 11:56.760]  Sure.
[11:57.300 --> 12:01.520]  So, while Tor is awesome and everyone loves it, of course, I'm not biased.
[12:02.500 --> 12:05.400]  Not everyone has the luxury to connect to the Tor network.
[12:05.740 --> 12:10.580]  A lot of people, millions of users, are being blocked from the network.
[12:10.860 --> 12:26.500]  Here is a study that we can do on the metrics website that, if you just look at the metrics, you can see there is a significant drop in the number of direct connections to the Tor network in UIE around April of 2016.
[12:26.500 --> 12:31.680]  I'm not a social scientist, so I leave it to them to realize what was happening there.
[12:31.880 --> 12:39.560]  But what's interesting is that you can see, like, at the very same time, there is a significant increase of the number of bridge users.
[12:41.300 --> 12:49.100]  So, there are two, like, usually there are two ways for, you know, places to block connections to Tor network.
[12:49.100 --> 12:59.380]  Type one is to basically, they just block access to Tor website, and you cannot download Tor browser, so you can't access anything over Tor.
[13:00.420 --> 13:18.360]  Which, for this thing, we have a service called GetTor, and you can send an email to, or an IM over XMPPJabber to gettor at torproject.org, and it basically sends you links to mirrors of whatever you want, like OSX, Linux, Windows, whatever.
[13:18.360 --> 13:26.060]  And, or you can DM, send a DM to this Twitter account, and it basically just sends you all the mirror links.
[13:26.680 --> 13:31.760]  The other type is that when they try to block the connection to the Tor network.
[13:32.660 --> 13:46.780]  This usually happens when, like, they have, like, they do DPI, like, Iran and China, and, or they do, like, block the whole list of relays, because the list of relays is being published, and it's accessible by anyone.
[13:46.780 --> 13:50.640]  They can just basically block all the IPs and ports.
[13:51.640 --> 13:57.620]  And, there are, like, other various ways that they block connection to Tor network.
[13:57.900 --> 14:01.160]  So, for that thing, we have plug-able transports.
[14:01.220 --> 14:12.500]  Which, basically, they obfuscate the traffic and the encrypted traffic, and they make it look like garbage traffic, but it actually is encrypted traffic to Tor network.
[14:12.500 --> 14:18.560]  And, it also takes advantage of various different protocols.
[14:18.960 --> 14:32.460]  And, like, I don't know, WebRTC is one of the things that people are working on, and, or front domaining that, like, it looks like you're connecting to some major CDN, but you're actually connecting to Tor network.
[14:33.760 --> 14:40.660]  And, like, what's, like, the other thing that I like about plug-able transports is that it's basically independent from Tor, the software.
[14:40.860 --> 14:50.660]  So, you can have these plug-able transports and attach them on VPN or any other tools that you have that you can basically obfuscate the traffic to your VPN.
[14:50.660 --> 15:03.340]  So, if, for example, you are in Iran or China and VPN connections are being blocked, you can basically use plug-able transports to connect to your VPN server.
[15:03.980 --> 15:08.040]  You can find a lot more information on this address.
[15:08.260 --> 15:12.020]  We have a wiki page of all the communities that are basically working on this.
[15:12.120 --> 15:13.640]  It's much, much broader than Tor.
[15:14.960 --> 15:22.560]  There are various other organizations and groups working on this, especially those who are active in circumvention technologies.
[15:23.120 --> 15:33.140]  And we would love to, you know, for you to join us, give us more ideas, other transports that we can use and other ways that we can bypass censorship.
[15:36.310 --> 15:36.970]  All right.
[15:37.430 --> 15:42.430]  So, one other thing that happened in last year is that we try to organize a bit more in Tor projects.
[15:42.430 --> 15:46.090]  So, there's so many people, so many volunteers, so we created some different themes.
[15:47.930 --> 15:52.510]  So, we're going to present the five different themes that exist.
[15:52.950 --> 16:02.830]  So, the network development team is basically, yeah, the model casters of the Tor network, which is basically working on everything that touches the network.
[16:03.030 --> 16:09.610]  So, any bytes that goes in, basically the Tor daemon, the core Tor, and some plug-able transport as well.
[16:10.530 --> 16:13.710]  So, one of the great things that's coming up is better crypto.
[16:13.970 --> 16:14.810]  Yes, we won that.
[16:15.050 --> 16:18.010]  So, we have an ED25519 and SHA-3.
[16:18.610 --> 16:20.290]  And this is actually implemented.
[16:20.490 --> 16:21.670]  So, right now you're using Tor.
[16:22.450 --> 16:29.470]  Every link between relays, between clients, is using way better cryptography than RSA124 used to be.
[16:31.070 --> 16:33.390]  This is another big thing.
[16:33.390 --> 16:38.130]  So, this is why we have these nice images, because it's a huge engineering effort for us.
[16:38.690 --> 16:41.270]  So, it's a complex construction of different things.
[16:41.490 --> 16:49.590]  We have a talk tomorrow at noon on the other room there, that is going to be only about this amazing, great, new thing.
[16:50.050 --> 16:51.790]  The next generation onion service.
[16:52.350 --> 16:56.710]  Just to be clear, onion service used to be called hidden services.
[16:56.910 --> 16:58.830]  So, hidden services, onion service, same thing.
[17:00.370 --> 17:01.790]  The plug-able transports.
[17:01.970 --> 17:05.030]  So, Nima told us a bit about plug-able transports.
[17:05.150 --> 17:08.290]  This is a thing that network team is working quite a bit.
[17:08.370 --> 17:10.910]  We have full grants to do new ones.
[17:11.430 --> 17:17.110]  One of the major, main plug-able transports is called OPS4.
[17:18.610 --> 17:21.530]  And it's been used... it's a great one.
[17:21.670 --> 17:23.490]  I'm not sure if it's been blocked in China yet.
[17:23.630 --> 17:24.070]  Maybe not.
[17:24.310 --> 17:25.430]  They're pretty good at blocking.
[17:26.290 --> 17:29.730]  But we're coming up with a new one, which is going to be called Basket2.
[17:29.990 --> 17:32.210]  I don't remember why the 2 is there, but it's called Basket2.
[17:32.390 --> 17:33.710]  And apparently, it's super great.
[17:33.890 --> 17:35.990]  And this guy called Yonning is a toy developer.
[17:36.270 --> 17:39.390]  It's amazing and does crazy, crazy plug-able transport stuff.
[17:41.730 --> 17:43.930]  I think this is the last one for network.
[17:44.170 --> 17:46.010]  So, another thing has been very important.
[17:46.210 --> 17:47.270]  It's DDoS defense.
[17:48.410 --> 17:51.890]  One other thing the Tor relies on is called directory authorities.
[17:52.110 --> 17:53.930]  So, basically, I'm going to go fast on this.
[17:53.930 --> 17:55.990]  This is nine trusted computers around the world.
[17:56.090 --> 17:56.850]  I think it's eight now, sorry.
[17:57.070 --> 17:59.350]  Eight trusted computers around the world.
[17:59.490 --> 18:00.210]  They create a consensus.
[18:00.630 --> 18:02.610]  Every relay, every client, take the consensus.
[18:02.750 --> 18:06.510]  The consensus is a view of the network, where you can connect, where you can go.
[18:07.130 --> 18:08.530]  And DDoS gets attacked sometimes.
[18:09.290 --> 18:13.230]  Not only DDoS, but relays or even hidden services.
[18:13.470 --> 18:16.050]  So, in this case, we implemented this fallback directory authority.
[18:16.050 --> 18:17.910]  So, if you're gonna...
[18:17.910 --> 18:22.930]  In Iran, for instance, and they block all directory authorities IP, because those IPs are hard-coded in the code.
[18:23.670 --> 18:25.010]  Well, you can't get the consensus.
[18:25.290 --> 18:31.110]  So, we have this list now, which is a fallback thing, where every client is going to connect to one of the fallbacks and get the consensus.
[18:31.290 --> 18:35.170]  And when you get a consensus, at least now you can create a Tor circuit and get to the directory.
[18:36.070 --> 18:38.890]  It's a bit technical, but it's something we worked quite a bit on it.
[18:41.150 --> 18:41.670]  Okay.
[18:41.770 --> 18:41.990]  Application team.
[18:43.130 --> 18:43.650]  Okay.
[18:44.010 --> 18:50.330]  So, the network team that you just saw is basically the team which builds the software that powers the network.
[18:50.610 --> 18:53.430]  It's the relays, the clients, all of them run this thing.
[18:53.770 --> 18:59.130]  However, application team is the team that prepares software that our users run.
[18:59.270 --> 19:05.030]  So, you, as the users, when you download Tor, you are faced with the Tor browser.
[19:05.730 --> 19:14.970]  It's basically this thing you see on the right side, which is a fork of Firefox specially modified to provide better security and privacy.
[19:15.730 --> 19:17.730]  It basically uses Tor by default.
[19:17.770 --> 19:20.750]  You can see the onion there on the top left corner.
[19:20.890 --> 19:21.930]  It's the indicator.
[19:22.770 --> 19:27.810]  And basically, anything you visit through this browser, it goes over Tor and you're anonymous.
[19:28.010 --> 19:37.650]  This is the solution we have for our users so that everyone can basically use it and you don't need to make your own Firefox and configure SOX proxies and shit like that.
[19:38.850 --> 19:40.830]  So, this is the Tor browser.
[19:41.950 --> 19:45.150]  It's basically the main effort of the application team.
[19:45.470 --> 19:49.370]  It requires lots of work to fork Firefox, believe me.
[19:49.670 --> 19:57.810]  And I'm gonna tell you a few things about what is currently being researched and done.
[19:57.810 --> 20:09.490]  The application team is quite busy with porting Tor browser to the mobile so that we have a unified experience between the desktop and the mobile.
[20:10.630 --> 20:16.890]  They're also working on advanced security features like Self Rando.
[20:17.070 --> 20:19.190]  They did a blog post recently about this.
[20:19.330 --> 20:24.110]  It's basically a binary protection feature like ASLR but a bit smarter.
[20:24.110 --> 20:29.110]  And it basically tries to randomize memory so that you cannot build exploits so easily.
[20:29.390 --> 20:32.930]  There is a blog post about this in blogtorproject.org.
[20:33.030 --> 20:34.650]  You should go and read it.
[20:36.010 --> 20:46.270]  There is also work being done on the sandboxing and research on the sandbox of Firefox and whether it can be used for Tor browser and all that stuff.
[20:46.270 --> 20:58.390]  And they actually also have a big team of usability researchers that actually look at Tor browser and they do UX studies with people and stuff.
[20:58.630 --> 21:04.050]  And they provide to the application team feedback on how Tor browser can be improved.
[21:04.290 --> 21:10.350]  And through the next months I think you will see lots of this input being incorporated in Tor browser.
[21:11.170 --> 21:14.190]  But that's not the only thing that the application team does.
[21:14.950 --> 21:16.030]  Oh, nice logo.
[21:17.130 --> 21:24.810]  And for example, we have two other software like TorBerdy which is a fork of Thunderbird.
[21:25.010 --> 21:29.890]  And it's basically an email client that uses Tor by default.
[21:30.290 --> 21:32.550]  And you should run it.
[21:32.590 --> 21:33.270]  It's on the website.
[21:33.410 --> 21:36.770]  You can find it, download it, double click and it should work for you.
[21:37.430 --> 21:49.870]  And Tor Messenger which is basically a chat application through which you can do XMPP and other protocols like OTR and stuff like that over Tor by default.
[21:50.790 --> 21:54.270]  You should go to the website and check them out.
[21:56.610 --> 21:57.250]  Okay.
[21:59.730 --> 22:06.690]  So, another initiative that we started at Tor is that we've always been worried about UX but like not very organized.
[22:06.690 --> 22:12.870]  organizational and also doing UX in free and open-source software is really difficult.
[22:13.470 --> 22:17.830]  So, we have a lot of challenges, unique challenges at Tor.
[22:18.130 --> 22:22.350]  And one of them is that we basically make a software that makes it very difficult.
[22:22.670 --> 22:30.110]  And its goal is basically to make it very difficult for anyone to understand what you're doing online and how you're doing it.
[22:30.110 --> 22:39.810]  So, we cannot like collect any measures, measurements and metrics to see how users are using it to see what are the failure points and what not.
[22:39.970 --> 22:43.850]  So, it makes it very difficult and very interesting challenge.
[22:43.850 --> 23:03.310]  But we are still working on it and we are doing this by collaborating with a lot of usable security researchers around the world basically in different universities and open-source designers and what not.
[23:03.310 --> 23:09.590]  And we are... they are running like basically a bunch of user studies as George mentioned.
[23:09.910 --> 23:19.650]  And we are also working on a style guideline for Tor and how you basically use the Tor logo and what not.
[23:19.890 --> 23:27.230]  And this slide that is having like some theme and everything is like one of the outcome of that.
[23:27.230 --> 23:30.190]  So, a lot of things are happening on that front.
[23:30.430 --> 23:44.190]  But we are still looking for more UX people, UX experts from other... you know, like if you have any experience and knowledge in this area, please join us and let us know.
[23:44.470 --> 23:46.510]  Everything we do is open and public.
[23:48.970 --> 23:57.050]  So, one of the... a couple of very nice things that we did with collaboration with Tor Browser team is...
[23:57.230 --> 23:59.310]  the new changes in Tor Browser.
[23:59.590 --> 24:01.150]  One of them is the security slider.
[24:01.390 --> 24:12.690]  If you can... if you go to your Tor Browser, click on the Onion logo and click on privacy and security setting, you can have this slider that basically you set your security level.
[24:12.890 --> 24:15.710]  If you are paranoid, you put it on high and like most of the things don't work.
[24:15.910 --> 24:20.650]  But also, you are far less vulnerable than other people.
[24:20.790 --> 24:24.970]  It basically limits the... the attack surface.
[24:24.970 --> 24:32.810]  And then there is this nice Tor circuit info that basically shows where... what is your... what path you are taking on Tor Network.
[24:35.390 --> 24:39.850]  The other thing that I'm very excited about is the community team.
[24:41.590 --> 24:49.770]  They have been working on various important documents such as social contract and membership guideline, etc.
[24:50.150 --> 25:06.010]  And also like this team is... is part of the team that does the outreach for Tor to teach other people about like what are the... what are the... what are the things that we are working on and what are the values of anonymity and online privacy and whatnot.
[25:06.010 --> 25:10.630]  And a big part of it is Library Freedom Project, which I'm also honored to be part of.
[25:11.370 --> 25:27.590]  We go to different libraries across the country and outside the country and teach them about online privacy, how they can protect themselves using encryption from surveillance or any other threats online.
[25:27.590 --> 25:33.830]  And one of the things we do, we run Tor exit nodes in different libraries.
[25:34.250 --> 25:39.870]  And I don't know if you have... you might have heard that like DHS tried to... like we ran it in one of the libraries.
[25:39.970 --> 25:41.150]  DHS tried to shut it down.
[25:41.730 --> 25:46.290]  We eventually... the library eventually won the fight and then they put it back online.
[25:46.290 --> 25:48.770]  So it like... it created a little bit of a pause.
[25:51.370 --> 25:51.930]  Oh...
[25:51.930 --> 26:00.110]  Yeah, and the other thing is like... they are working on... pursuing different ways to support the Tor users and community.
[26:00.710 --> 26:03.290]  Oh, you might have noticed that thing.
[26:04.330 --> 26:13.510]  So one of the important thing that I think Tor community is trying to do is to reach out to people who run websites and...
[26:14.090 --> 26:19.470]  services to let them know that if they are accidentally blocking Tor users by using some CDNs.
[26:19.530 --> 26:20.550]  I'm not naming names.
[26:23.210 --> 26:29.910]  But yeah, if you run a website and you're using one of those CDNs, please make sure that you...
[26:29.910 --> 26:33.570]  unblock Tor users because they are unfortunately blocking Tor users by default.
[26:34.870 --> 26:35.390]  Measurements.
[26:37.630 --> 26:39.010]  Alright, last team.
[26:39.790 --> 26:40.470]  Measurements team.
[26:40.470 --> 26:43.530]  So they have a very difficult job because...
[26:43.530 --> 26:47.450]  an anonymity network where by design we don't know what's going on.
[26:47.790 --> 26:50.910]  It's kind of difficult to measure or understand anything.
[26:51.870 --> 26:52.330]  So...
[26:52.330 --> 26:59.250]  One of the things that happened this year is that Mozilla granted this great amount of money to the metric team.
[26:59.550 --> 27:03.190]  And this is great because for one of the first time in the history of Tor we have...
[27:03.190 --> 27:07.230]  someone plus another person working full-time on metrics.
[27:08.250 --> 27:11.190]  And if you don't know metrics, all the graphs we saw are...
[27:12.030 --> 27:14.570]  come from this great site metrics.torproject.org.
[27:15.230 --> 27:19.270]  So there is not much fancy stuff we can show you because...
[27:19.270 --> 27:22.730]  this money is being used right now to revamp the whole system.
[27:22.850 --> 27:24.010]  How we collect data.
[27:25.210 --> 27:26.430]  How we store it.
[27:26.530 --> 27:27.510]  How we analyze it.
[27:27.750 --> 27:28.550]  And so on and so forth.
[27:29.230 --> 27:33.930]  This is very important because those statistics allows us to understand...
[27:33.930 --> 27:35.310]  improve the network.
[27:35.910 --> 27:39.010]  One of the graphs they created recently is this new one.
[27:39.470 --> 27:43.170]  Maybe it's not that exciting but for us it's extremely great.
[27:43.850 --> 27:46.210]  Those are plug-in transport per country.
[27:46.750 --> 27:50.730]  So here you can see in Iran which user is using what.
[27:51.550 --> 27:56.070]  Since we don't know because plug-in transport don't say...
[27:56.070 --> 27:58.990]  oh yeah George is connecting to me so I'm going to report it to metrics.
[27:59.190 --> 27:59.710]  We don't do that.
[28:00.050 --> 28:02.070]  It's safe metrics, of course.
[28:02.430 --> 28:06.070]  So this is why there's like a range in those lines.
[28:06.810 --> 28:10.470]  Because we estimate the number of users that are using...
[28:10.470 --> 28:12.930]  OPSP4, OPSP3 or Meek.
[28:13.110 --> 28:16.450]  And this Meek thing is not a great thing but we're not going to do this.
[28:18.030 --> 28:19.050]  And then Uni.
[28:20.970 --> 28:24.210]  Okay, so another project of Tor is Uni.
[28:24.470 --> 28:27.430]  The Open Observatory of Network Interference.
[28:27.850 --> 28:32.110]  It's basically, in common words, it's a censorship detection...
[28:32.110 --> 28:36.070]  which you can basically run from your network and it will conduct some tests.
[28:36.570 --> 28:40.050]  And then it will send back to the Uni headquarters...
[28:40.050 --> 28:44.870]  like a report of the test and whether there was censorship or not.
[28:45.710 --> 28:49.250]  They've been... the Uni project has been doing this for years...
[28:49.250 --> 28:52.290]  and they have currently collected 12 million measurements...
[28:52.290 --> 28:53.910]  and from all around the world basically...
[28:54.410 --> 28:56.890]  in various tests like HTTP, DNS...
[28:57.410 --> 28:59.450]  they have tests on whether Tor is blocked...
[28:59.450 --> 29:01.990]  they have tests on whether the bridges is blocked...
[29:03.370 --> 29:06.270]  and it's still a very actively developed project.
[29:06.390 --> 29:07.930]  You can check the website and everything.
[29:08.190 --> 29:11.510]  Their current approach is that they give raspberry pies to people...
[29:11.510 --> 29:14.690]  and they take them to their exotic countries.
[29:14.710 --> 29:16.710]  They plug them onto the wall in an Ethernet.
[29:16.990 --> 29:20.510]  And then this thing sends reports back to Uni...
[29:20.510 --> 29:25.550]  on whether the network was disturbed in some way.
[29:25.710 --> 29:28.710]  And then this is graphed afterwards and analyzed by the Uni people.
[29:30.950 --> 29:33.510]  So now we're going to...
[29:34.370 --> 29:38.630]  The ecosystem of Tor has many, many side projects...
[29:38.630 --> 29:41.310]  and people that work on 300 things at the same time...
[29:41.310 --> 29:43.750]  and they have like 50 side projects and stuff like that.
[29:43.950 --> 29:46.090]  So there are many, many things going on.
[29:46.190 --> 29:48.990]  We're going to show you just a few projects...
[29:48.990 --> 29:50.510]  that we consider worthwhile and interesting...
[29:51.290 --> 29:52.910]  at the current stage, let's say.
[29:53.710 --> 29:55.310]  First of all, Orbot...
[29:55.970 --> 29:58.730]  is basically our solution...
[29:58.730 --> 30:00.810]  our current solution for Tor on Android.
[30:00.990 --> 30:02.210]  So if you have a mobile phone...
[30:02.210 --> 30:04.250]  you're probably using Orbot to connect to the Internet.
[30:04.770 --> 30:05.950]  Orbot is like Tor...
[30:05.950 --> 30:07.310]  and then you have Orfox...
[30:08.070 --> 30:10.590]  which is like Tor browser but for Android.
[30:10.590 --> 30:13.430]  And they've been doing lots of great work.
[30:13.570 --> 30:16.510]  They've been doing work on how to improve the Tor protocol...
[30:16.510 --> 30:18.790]  in unstable networks like mobile.
[30:19.290 --> 30:21.010]  They've been doing lots of experiments.
[30:21.270 --> 30:23.550]  For example, Nathan from the Guardian project...
[30:23.550 --> 30:29.910]  recently posted like a way to use your mobile phone...
[30:29.910 --> 30:32.730]  and to do Internet of things over hidden services...
[30:32.730 --> 30:35.590]  which is definitely a very interesting use case...
[30:35.590 --> 30:37.090]  of hidden services.
[30:37.450 --> 30:38.530]  And it's a...
[30:38.530 --> 30:40.330]  it's a very worthwhile project in general.
[30:41.990 --> 30:42.630]  Um...
[30:42.630 --> 30:42.850]  Okay.
[30:42.990 --> 30:44.090]  Then we have Amia.
[30:44.470 --> 30:46.890]  Amia is basically a search engine...
[30:46.890 --> 30:47.590]  for hidden...
[30:47.590 --> 30:48.490]  for Onion services.
[30:49.490 --> 30:49.810]  Um...
[30:50.130 --> 30:50.330]  The...
[30:50.330 --> 30:51.390]  the way I look at this...
[30:51.390 --> 30:52.310]  is that basically...
[30:52.310 --> 30:53.810]  you have Onion services...
[30:54.130 --> 30:55.910]  that have been attracting so much...
[30:55.910 --> 30:56.710]  bad press...
[30:57.430 --> 30:58.070]  because...
[30:58.070 --> 30:58.870]  I don't know...
[30:58.870 --> 31:00.770]  people set up their sketchy websites...
[31:00.770 --> 31:01.310]  and then...
[31:01.310 --> 31:02.530]  people are like...
[31:02.530 --> 31:03.050]  oh my god...
[31:03.050 --> 31:04.230]  look at this sketchy website...
[31:04.230 --> 31:05.350]  and it generates...
[31:05.350 --> 31:07.210]  news buzz...
[31:07.210 --> 31:08.110]  and then...
[31:08.110 --> 31:09.210]  journalists just hang on it...
[31:09.210 --> 31:10.070]  and they're like...
[31:10.070 --> 31:10.390]  ah...
[31:10.390 --> 31:10.850]  okay...
[31:10.850 --> 31:11.850]  it's a dark web...
[31:11.850 --> 31:13.410]  and Onion services is like...
[31:13.410 --> 31:14.330]  the worst thing ever...
[31:14.330 --> 31:14.690]  and stuff...
[31:14.690 --> 31:14.970]  but...
[31:14.970 --> 31:16.370]  in my opinion...
[31:16.370 --> 31:16.670]  like...
[31:16.670 --> 31:17.990]  there are so many social...
[31:17.990 --> 31:18.910]  positive...
[31:18.910 --> 31:19.930]  use cases of...
[31:19.930 --> 31:20.710]  Onion services...
[31:20.710 --> 31:22.910]  that never get up to the surface...
[31:22.910 --> 31:23.730]  because you...
[31:23.730 --> 31:25.230]  just don't know where to find it...
[31:25.230 --> 31:25.710]  like...
[31:25.710 --> 31:27.210]  it can enable blogs...
[31:27.210 --> 31:27.710]  forums...
[31:27.710 --> 31:28.950]  all these things that...
[31:28.950 --> 31:30.430]  most people of us...
[31:30.770 --> 31:31.550]  know where to find...
[31:31.550 --> 31:32.230]  Onion services...
[31:32.230 --> 31:33.310]  just because we have not...
[31:33.310 --> 31:34.830]  dug deep enough...
[31:34.830 --> 31:35.750]  into it...
[31:35.750 --> 31:36.250]  and...
[31:36.650 --> 31:36.950]  this...
[31:36.950 --> 31:38.210]  search engine...
[31:38.210 --> 31:39.870]  basically tries to collect...
[31:39.870 --> 31:40.570]  a list of...
[31:40.570 --> 31:41.750]  of hidden services...
[31:41.750 --> 31:43.010]  and index them...
[31:43.010 --> 31:43.390]  and...
[31:43.390 --> 31:44.810]  then you can just type...
[31:44.810 --> 31:45.770]  I don't know...
[31:45.770 --> 31:47.050]  Iranian blog...
[31:47.050 --> 31:47.510]  on...
[31:47.510 --> 31:48.690]  and it will...
[31:48.690 --> 31:49.430]  give you...
[31:49.430 --> 31:50.370]  the...
[31:50.370 --> 31:51.190]  the blogs...
[31:51.190 --> 31:52.550]  it has in its database...
[31:52.550 --> 31:53.930]  it's still very early...
[31:53.930 --> 31:54.090]  in...
[31:54.090 --> 31:55.050]  in development...
[31:55.050 --> 31:55.330]  so...
[31:55.330 --> 31:56.670]  it does not work as nicely...
[31:56.670 --> 31:57.650]  as I just said...
[31:57.650 --> 31:58.190]  but...
[31:58.190 --> 31:59.150]  in general...
[32:00.170 --> 32:00.560]  but...
[32:00.950 --> 32:01.590]  in general...
[32:01.590 --> 32:01.810]  it's a...
[32:01.810 --> 32:03.430]  it's a very worthy cause...
[32:03.430 --> 32:03.870]  and...
[32:03.870 --> 32:04.830]  we should...
[32:04.830 --> 32:06.030]  really work on...
[32:06.030 --> 32:06.610]  on...
[32:07.190 --> 32:07.990]  on...
[32:07.990 --> 32:08.930]  bubbling the good content...
[32:08.930 --> 32:10.430]  of hidden services to the surface...
[32:10.430 --> 32:11.670]  instead of keeping it...
[32:11.670 --> 32:12.590]  hidden...
[32:12.590 --> 32:13.430]  in the...
[32:13.430 --> 32:14.070]  in the...
[32:14.070 --> 32:14.970]  dark web...
[32:14.970 --> 32:16.350]  um...
[32:16.350 --> 32:17.190]  so...
[32:17.710 --> 32:18.450]  so...
[32:18.450 --> 32:18.750]  okay...
[32:18.750 --> 32:19.410]  the last...
[32:20.160 --> 32:20.550]  recent...
[32:20.550 --> 32:21.650]  interesting project...
[32:21.650 --> 32:21.950]  is...
[32:21.950 --> 32:24.030]  the Tor Relay Awards...
[32:24.030 --> 32:25.050]  which is basically...
[32:25.050 --> 32:25.650]  a website...
[32:26.630 --> 32:26.930]  that...
[32:27.170 --> 32:27.830]  that...
[32:27.830 --> 32:28.530]  crawls...
[32:28.530 --> 32:29.550]  the Tor Network...
[32:29.550 --> 32:31.070]  and collects a list of relays...
[32:31.070 --> 32:31.450]  and then...
[32:31.450 --> 32:32.750]  it assigns them...
[32:32.750 --> 32:33.550]  badges...
[32:33.550 --> 32:34.630]  and achievements...
[32:34.630 --> 32:35.010]  and...
[32:35.010 --> 32:35.350]  like...
[32:35.350 --> 32:36.310]  ranks and stuff...
[32:36.310 --> 32:37.010]  based on...
[32:37.010 --> 32:39.090]  what was their uptime...
[32:39.090 --> 32:40.430]  how long they've been...
[32:40.430 --> 32:41.630]  out there...
[32:41.630 --> 32:42.010]  um...
[32:42.010 --> 32:43.430]  if they are situated...
[32:43.430 --> 32:44.730]  in an exotic location...
[32:44.730 --> 32:46.390]  with not many other relays...
[32:46.390 --> 32:48.090]  if they have lots of bandwidth...
[32:48.090 --> 32:48.950]  so you can see that...
[32:48.950 --> 32:49.610]  like...
[32:49.610 --> 32:50.290]  Onyx there...
[32:50.290 --> 32:51.750]  is the champion right now...
[32:51.750 --> 32:52.290]  so it has...
[32:52.290 --> 32:54.050]  all these badges...
[32:54.050 --> 32:55.030]  for example...
[32:55.030 --> 32:55.870]  that red badge...
[32:55.870 --> 32:56.850]  that says 1%...
[32:56.850 --> 32:57.290]  is like...
[32:57.290 --> 32:58.950]  you have more than 1%...
[32:58.950 --> 33:00.050]  exit probability...
[33:00.050 --> 33:01.390]  and it gives you some points...
[33:01.390 --> 33:02.230]  for this...
[33:02.230 --> 33:02.730]  and...
[33:02.730 --> 33:03.890]  in general...
[33:03.890 --> 33:04.190]  it's a...
[33:04.190 --> 33:05.430]  it's a very fun way...
[33:05.430 --> 33:06.230]  to gamify...
[33:06.230 --> 33:07.350]  the whole...
[33:07.350 --> 33:08.750]  set up relays...
[33:08.750 --> 33:09.130]  thing...
[33:09.130 --> 33:09.690]  and...
[33:09.690 --> 33:10.590]  I mean...
[33:10.590 --> 33:12.430]  I can see it being used in...
[33:13.020 --> 33:13.290]  various...
[33:13.290 --> 33:13.630]  like...
[33:13.630 --> 33:14.270]  contests...
[33:14.270 --> 33:14.550]  and...
[33:23.670 --> 33:23.750]  and...
[33:43.190 --> 33:43.310]  other ways...
[33:43.310 --> 33:43.350]  to...
[33:43.350 --> 33:43.390]  to...
[33:43.390 --> 33:43.430]  to...
[33:43.430 --> 33:43.470]  to...
[33:44.450 --> 33:44.530]  to...
[33:52.600 --> 33:55.420]  Thank you so much for all the amazing work you do.
[33:57.140 --> 34:05.260]  My question is something that you mentioned in one of the very first slides about diversity.
[34:05.740 --> 34:08.820]  And I know that it's difficult to get a diverse set of relays.
[34:09.180 --> 34:16.280]  But how do you feel about kind of the diversity in anonymity networks and censorship resistant networks?
[34:16.480 --> 34:24.380]  Do you feel like Tor is a potentially dangerous monoculture, where it's the only good one that everyone uses?
[34:24.800 --> 34:28.260]  Or do you feel like it's important that there be other alternatives?
[34:28.720 --> 34:39.420]  For instance, if the Tor project vanished tomorrow, would there still be robust alternatives that people could turn to, like I2P or Freenet and things like that?
[34:39.520 --> 34:43.000]  Is that also... Do you guys think about that sort of diversity as well?
[34:46.340 --> 34:47.620]  So, yes.
[34:48.460 --> 35:02.720]  One of the very important thing about any project, any research, is diversity in terms of multiple people working on it, finding different solutions, or adjusting solution, and basically shifting paradigms in all this science.
[35:03.740 --> 35:09.840]  So Tor is... Anonymity comes from the fact that there's a lot of users.
[35:09.880 --> 35:11.580]  You can't be anonymous alone.
[35:11.580 --> 35:19.860]  So, in this case, something like I2P or Freenet or GnuNet, and so on and so forth, it is very useful.
[35:19.860 --> 35:25.940]  It's there because it increases and improves the state-of-the-art anonymity.
[35:26.100 --> 35:31.800]  And then we can exchange, we can collaborate, and we can also link the two networks together.
[35:32.040 --> 35:33.200]  So, yes, it is a good idea.
[35:33.400 --> 35:34.360]  It's a really good thing.
[35:34.480 --> 35:35.120]  We think about it.
[35:35.220 --> 35:39.580]  But unfortunately, we don't collaborate much with any other network.
[35:40.900 --> 35:43.740]  Lack of time, lack of motivation sometimes.
[35:43.740 --> 35:44.380]  I don't know.
[35:44.620 --> 35:47.560]  But it's absolutely very important that a lot of people do it.
[35:47.700 --> 35:49.040]  Yeah, can I add something to that?
[35:49.100 --> 35:55.940]  So, the thing that I love about Tor is that a lot of people, a lot of researchers outside Tor are working on it.
[35:56.080 --> 36:02.660]  And I don't think there is any other technology that is getting that much attention in research community.
[36:02.880 --> 36:07.740]  Maybe that would be a good question for them, to put some work on the other stuff.
[36:07.740 --> 36:13.600]  And the other thing that I love about it is that it's not a centralized system, so it cannot vanish tomorrow.
[36:13.840 --> 36:19.360]  Like, if Tor project vanishes, you can, like, we can just get together and run a new Tor network.
[36:20.460 --> 36:22.560]  It's, like, it's not dependent on the organization.
[36:22.560 --> 36:25.060]  It's dependent on the people who are running the network.
[36:25.200 --> 36:29.460]  And there is, like, about 10,000 people who are, you know, participating in this thing.
[36:29.580 --> 36:31.560]  So I don't think that it's going to vanish any rate.
[36:31.560 --> 36:32.400]  Next question.
[36:32.700 --> 36:33.360]  Thank you.
[36:33.540 --> 36:35.720]  I have a slightly technical question.
[36:35.940 --> 36:44.080]  When you resize a Tor browser window, it gives you a... there's a possible fingerprinting attack based on the size of the window.
[36:44.820 --> 36:51.500]  But my question is, with Orbot, because you have so many different types of Android devices, isn't that another avenue for fingerprinting?
[36:51.580 --> 36:55.060]  And why wouldn't you draw similar warnings?
[36:55.180 --> 36:56.640]  Or does that warning even matter?
[36:57.160 --> 37:01.180]  And I'm wondering that for Orbot users, this is not a good thing.
[37:01.500 --> 37:09.340]  So, for example, I don't tell people to run Orbot on Android because I think this is an avenue to de-anonymize people.
[37:09.520 --> 37:11.800]  Or maybe I'm just misunderstanding the point of that warning.
[37:14.060 --> 37:14.760]  I see.
[37:15.120 --> 37:19.640]  You mean as a linkability fingerprint, the size of the screen of the mobile phone?
[37:20.020 --> 37:23.040]  I don't think it's directly de-anonymizing, but I can see what you mean.
[37:23.220 --> 37:23.700]  But fingerprinting, yeah.
[37:23.700 --> 37:24.100]  Yeah.
[37:24.880 --> 37:28.260]  I actually don't know what is Orbot doing in this regard.
[37:28.420 --> 37:30.100]  I don't know if you can spoof it in other ways.
[37:30.220 --> 37:30.580]  I don't know.
[37:30.720 --> 37:31.500]  I really don't know.
[37:31.740 --> 37:33.460]  I think this... do you guys know?
[37:33.720 --> 37:34.040]  I don't know.
[37:34.240 --> 37:36.760]  Unfortunately, none of us are actually Android developers.
[37:36.960 --> 37:39.120]  So, you should probably ask Guardian Project.
[37:39.400 --> 37:55.680]  But what I know is that Guardian Project is very closely working with the Tor Browser team to, like, get all the, like, everything that they've learned during developing Tor Browser to actually put it in a Tor Browser for Android.
[37:56.160 --> 37:58.380]  So, Orbot right now is just a Tor.
[37:58.700 --> 38:00.840]  It's not, like, it's just a Tor Demon.
[38:01.120 --> 38:02.520]  It's not the Tor Browser.
[38:02.740 --> 38:07.740]  So, they are working on a browser that would be the Tor Browser for Android, but it's yet to come.
[38:07.740 --> 38:08.660]  Cool.
[38:08.860 --> 38:09.120]  Thanks.
[38:09.360 --> 38:09.700]  Sure.
[38:11.860 --> 38:12.380]  Hi.
[38:12.500 --> 38:14.180]  I'm John Draper, Captain Crunch.
[38:14.700 --> 38:19.320]  I'll be downstairs in the hardware area, in the mezzanine, selling the nanoboxes.
[38:20.060 --> 38:21.740]  These are Tor routers.
[38:22.040 --> 38:28.780]  And some of the money that the people at the nanobox have been going to the Tor community as well.
[38:29.000 --> 38:33.340]  I was the one that spearheaded that when I was in Berlin at the Tor Developer Conference.
[38:33.840 --> 38:38.200]  So, I'll be downstairs autographing a nanoboxes after 6 p.m.
[38:38.540 --> 38:39.640]  in the hardware area.
[38:40.320 --> 38:41.780]  So, come down there and see me.
[38:42.760 --> 38:43.380]  Great question.
[38:43.440 --> 38:44.020]  Great question.
[38:47.270 --> 38:47.670]  Hi.
[38:47.790 --> 38:49.130]  I have a question on the same topic.
[38:49.590 --> 39:02.730]  Like, especially since Kickstarter and crowdfunding became a thing, there seems to be a lot of, like, every week there's a new box promise, I think, to be, like, a plug-and-play router that you can use to route all your traffic over a Tor.
[39:02.730 --> 39:07.630]  And the majority of them don't even, like, release their source code and are probably highly insecure.
[39:08.310 --> 39:16.770]  What do you think Tor's responsibility as a project is when it comes to, like, educating consumers about those types of products?
[39:16.950 --> 39:21.410]  And my other question is, are there any products like that that you actually do endorse?
[39:21.990 --> 39:25.010]  And then, also, your thoughts on the Freedom Box project.
[39:30.050 --> 39:47.710]  So, to my knowledge, I don't think we have any project that we endorse in terms of hardware at a run store, because there's a lot of issues with those kind of boxes that comes out, because just using Tor, just relaying all the traffic on Tor is actually not enough in many ways.
[39:47.710 --> 39:51.950]  So, all those magic bugs that promise anonymity can be dangerous.
[39:52.090 --> 39:52.950]  It can be good, also.
[39:53.810 --> 40:01.850]  But in most cases, to my knowledge, we get an email from the project saying, like, hey, guys, we did that.
[40:01.950 --> 40:02.910]  Can you read this blog post?
[40:02.990 --> 40:04.030]  And then, can you endorse us?
[40:04.130 --> 40:12.230]  And it takes quite a bit of resources to actually analyze, see what this thing is going on, and so on and so forth.
[40:12.230 --> 40:22.130]  So, if we get money, if we get grants, if we get resources to be able to do this kind of work with hardware, it would be extremely good, I think.
[40:22.310 --> 40:27.990]  And we could get some boxes that are endorsed by Tor, really well-made, research, and so on and so forth.
[40:28.050 --> 40:30.690]  But we, unfortunately, don't have this money right now.
[40:31.130 --> 40:45.090]  Yeah, and I think, like, everybody loves the idea of having this, like, little box, like, on a Raspberry Pi or something, that, like, you just run a Tor on it, and then, you know, like, over Ethernet, and then give Torify Wi-Fi to all your devices and whatever.
[40:45.670 --> 40:50.890]  But, like, just like David mentioned, there is a lot of issues, like linkability and everything.
[40:51.150 --> 40:53.750]  And it's much more than that.
[40:55.430 --> 41:00.830]  It has to be a lot of, like, it needs, like, some dedicated resources to think about those things.
[41:01.030 --> 41:02.590]  Especially the security of the boxes.
[41:02.690 --> 41:06.170]  I'm not, like, very much confident about that.
[41:06.370 --> 41:09.430]  Especially the kernel issues of these boxes, yeah.
[41:09.910 --> 41:10.330]  Thanks.
[41:14.060 --> 41:14.580]  Hi.
[41:15.260 --> 41:16.940]  Thank you again for the Tor project.
[41:17.260 --> 41:18.080]  It's awesome.
[41:18.480 --> 41:25.620]  I want to know how you find new projects to work with, or do they find you, or how do you do that?
[41:26.300 --> 41:27.380]  That's a good question.
[41:28.920 --> 41:29.860]  I can try to answer.
[41:30.680 --> 41:36.720]  So, over the years, the Tor project is 10, 11 years, something like that, 12, maybe.
[41:38.260 --> 41:43.180]  We have a huge amount of tickets on our tracker to our features and enhancements.
[41:43.780 --> 41:50.020]  And when you think about this thing all day, for years, you get some ideas of what should be better.
[41:50.020 --> 42:03.660]  And also, one of the most important thing is that the academy communities are helping us quite a bit on understanding what are the issues and identifying possible solutions and so on and so forth.
[42:03.660 --> 42:22.640]  Now, in terms of projects, like we saw Amya, or whatever, Ricochet, Pawn, Onion Share, and so on and so forth, those are people in this room, like you, not us, not Tor developers, that think about those things, that use Tor as innovative ways to make our world better,
[42:22.780 --> 42:23.160]  safe.
[42:25.020 --> 42:27.360]  So, they usually come to us, I would say.
[42:28.040 --> 42:31.520]  Yeah, it's the beauty of open-source projects, right?
[42:31.760 --> 42:36.520]  So, like, people just, like, do whatever, like, I don't know, like, Michael did the Onion Share thing.
[42:36.880 --> 42:37.600]  It was amazing.
[42:37.880 --> 42:40.860]  And, you know, you can just think about any project.
[42:41.020 --> 42:50.060]  And if, like, I eventually, I was, like, for example, I was a Tor user and then, like, I had, like, I was working on some stuff and then I became a Tor developer.
[42:50.060 --> 42:53.860]  So, it's, like, you can also become a Tor developer after having an idea.
[42:54.060 --> 42:58.740]  So, it's not really, it's, we are trying to be more inclusive rather than exclusive.
[43:00.500 --> 43:03.420]  Are you guys going to be hanging out in a particular area here?
[43:04.840 --> 43:05.300]  Mezzanine?
[43:05.680 --> 43:06.060]  Around.
[43:06.140 --> 43:06.340]  Far.
[43:06.560 --> 43:06.800]  Okay.
[43:07.620 --> 43:10.760]  They're also giving a talk tomorrow about Onion Services.
[43:11.140 --> 43:12.960]  Yeah, you can also find us there.
[43:12.960 --> 43:13.000]  Thank you.
[43:14.380 --> 43:15.920]  Hi, I'm Dick Rocket.
[43:16.740 --> 43:17.980]  And I have a...
[43:19.040 --> 43:19.880]  Why are you laughing?
[43:21.480 --> 43:22.320]  I have a question.
[43:22.580 --> 43:24.060]  First of all, thank you for allowing me to be here.
[43:24.200 --> 43:24.520]  Everybody hope.
[43:24.640 --> 43:25.380]  This is my first time here.
[43:25.460 --> 43:26.100]  I don't know what the hell I'm doing.
[43:26.280 --> 43:26.940]  Thank you, Three Alarm.
[43:27.620 --> 43:28.800]  And Black Lives Matter.
[43:28.920 --> 43:32.160]  How can your project end racism?
[43:35.270 --> 43:36.390]  Well, that's a tall order.
[43:37.610 --> 43:38.530]  Sorry if that's offensive.
[43:39.330 --> 43:39.830]  No, yeah.
[43:39.970 --> 43:46.170]  I think, like, one of the greatest thing, I think Cypherpunks, if you've read Cypherpunks Manifesto...
[43:46.170 --> 43:46.850]  I don't know what that is.
[43:47.450 --> 43:48.790]  Yeah, like, look it up.
[43:49.470 --> 43:50.090]  Google it.
[43:50.170 --> 43:51.010]  They're gonna know who I am then.
[43:52.150 --> 43:53.110]  You can look it up.
[43:53.370 --> 44:00.190]  And, like, basically, we believe that by using encryption we can defend their democracy.
[44:00.850 --> 44:01.230]  Okay.
[44:01.410 --> 44:02.410]  Is that worth defending today?
[44:02.930 --> 44:03.150]  Yes.
[44:03.690 --> 44:04.590]  Let's hear it, everybody.
[44:04.790 --> 44:05.010]  Come on.
[44:05.130 --> 44:06.710]  First Amendment is what I'm using right now.
[44:06.990 --> 44:07.330]  Right?
[44:07.450 --> 44:07.730]  You two?
[44:08.250 --> 44:08.950]  First Amendment.
[44:09.090 --> 44:09.950]  Freedom of speech, correct?
[44:10.310 --> 44:10.550]  Sure.
[44:10.650 --> 44:11.290]  I'm dead serious.
[44:11.290 --> 44:13.630]  But why are the millennials trying to take all my Pokemons?
[44:16.070 --> 44:16.430]  Cool.
[44:16.690 --> 44:16.750]  Cool.
[44:17.810 --> 44:18.810]  Technology is a tool.
[44:19.210 --> 44:19.830]  It's a tool.
[44:22.330 --> 44:23.130]  Sometimes we're tools.
[44:23.430 --> 44:23.670]  Anyway.
[44:24.510 --> 44:26.370]  I just have two quick points.
[44:26.530 --> 44:30.870]  One, in terms of the kind of all-in-one boxes I think that a lot of people are trying to play with for a long time.
[44:31.470 --> 44:34.350]  A lot of them, I mean, you're not gonna encrypt the Internet.
[44:34.610 --> 44:35.870]  You're not gonna solve every problem.
[44:36.450 --> 44:39.090]  It took Tor years to deal with DNS lookups.
[44:39.950 --> 44:46.450]  You know, there's lots of things that have gone on that are problems that Tor people work on that a lot of these all-in-one boxes are never gonna do.
[44:46.670 --> 44:48.310]  And to be honest, a lot of them try to do too much.
[44:48.610 --> 44:51.870]  They try to run a public relay and run a hidden service, which you should never do.
[44:52.150 --> 44:53.330]  There's lots of things that go on.
[44:53.470 --> 44:57.290]  So I'd be really, really careful about a lot of these all-in-one wonder boxes out there.
[44:57.730 --> 45:04.350]  On the issue of diversity, I think, I mean, I think, Georg, whoever brought this up, but it's even worse than just the Five Eyes stuff.
[45:04.490 --> 45:09.350]  Because if you look at the distribution of diversity of network in terms of countries, it's bad.
[45:10.170 --> 45:11.730]  Actually, there's other things that are a lot worse.
[45:12.570 --> 45:16.750]  I'm actually involved in a project you guys probably know about, the Tor BSD diversity stuff.
[45:16.990 --> 45:19.370]  We're porting Tor browser OpenBSD.
[45:20.270 --> 45:29.370]  And actually, if you look at network diversity, 90% of the Tor network and bandwidth, of number of relays and the bandwidth is our Linux-based systems.
[45:29.610 --> 45:33.630]  Which means nine out of ten of them, at least, are sharing the same random number generator.
[45:34.150 --> 45:38.930]  And a common Linux kernel vulnerability affects 90% of the Tor relays.
[45:39.170 --> 45:43.630]  I mean, that in itself, to me, is a horrific, scary, disturbing thing.
[45:43.810 --> 45:50.990]  Because there has been system-wide kernel-based vulnerabilities in the Linux kernel many, many, many, many times.
[45:52.170 --> 45:56.170]  So that, to me, is actually a focus that people need to be looking at more and more.
[45:56.430 --> 46:00.830]  I'm not just saying go and run an operating system that you're not familiar with as a Tor Relay.
[46:00.970 --> 46:01.810]  You shouldn't do that.
[46:02.350 --> 46:07.450]  You know, don't decide tomorrow you're going to start running a Solaris or a Luminos or a FreeBSD or OpenBSD Relay.
[46:07.710 --> 46:08.330]  Bad idea.
[46:08.530 --> 46:13.350]  On the other hand, I think a lot more attention does need to be put at looking at operating system diversity.
[46:14.090 --> 46:15.950]  And whole numbers of other diversity.
[46:16.090 --> 46:19.650]  Because if you're talking about perfect diversity, you're talking about, like, every...
[46:19.650 --> 46:22.930]  You know, billions of devices out there that are all running different...
[46:22.930 --> 46:28.030]  Everyone's running a different operating system, a different IP, a different AS number, and so on and so forth.
[46:28.270 --> 46:29.610]  But we can't hit that.
[46:29.710 --> 46:30.950]  But that's what we should be aiming towards.
[46:31.130 --> 46:33.930]  And that means, actually, breaking up as much as we can the network.
[46:34.070 --> 46:38.990]  It means, you know, more relays in Southern Africa, more relays in Eastern Asia, and so on and so forth.
[46:39.130 --> 46:39.970]  So, anyway.
[46:40.270 --> 46:41.470]  Yeah, I agree with that.
[46:41.670 --> 46:41.770]  Yeah.
[46:43.470 --> 46:46.230]  We are mostly Debian people.
[46:46.470 --> 46:51.050]  So, if you are, like, if you are a Unix person, please join our community.
[46:51.370 --> 46:52.610]  And we need, yeah, yeah.
[46:52.710 --> 46:54.870]  We need more, more Unix people in general.
[46:55.650 --> 46:56.210]  Hi.
[46:56.430 --> 47:02.470]  In advance, I apologize for a potentially very dumb question because I'm not a tech person.
[47:03.050 --> 47:08.530]  But in talking about, to people about Tor and exploring Tor, I've been really scared away.
[47:08.770 --> 47:11.750]  You know, people tell me it's for really great things.
[47:11.750 --> 47:13.250]  For anonymity and so on.
[47:13.470 --> 47:15.210]  But yet, there's that dark web.
[47:15.570 --> 47:18.430]  And, you know, a lot of really bad people on it.
[47:18.610 --> 47:20.090]  And, you know, be careful.
[47:20.370 --> 47:22.570]  So, is there an issue?
[47:23.790 --> 47:27.670]  When I was at, Internet became a thing when I was a teenager.
[47:28.490 --> 47:31.050]  Or, you know, like, I don't know, like, 11, 12 years old.
[47:31.330 --> 47:37.530]  And what my parents knew about Internet was that it's full of porn and full of bad stuff.
[47:37.770 --> 47:41.350]  And I should never use a computer because they know, they don't know what's happening in there.
[47:42.490 --> 47:43.290]  Same thing.
[47:43.290 --> 47:44.170]  Same thing about Tor network.
[47:44.910 --> 47:46.330]  It has all sorts of things.
[47:46.450 --> 47:48.750]  Like, it's, you know, like, it's a network.
[47:49.050 --> 47:54.330]  It enables you to have unrestricted access to the Internet, to the data.
[47:54.510 --> 47:58.010]  Look at it as a, in a form of a public library.
[47:58.330 --> 48:02.290]  You walk in a library, you can just pick and grab any kind of books that you want.
[48:02.630 --> 48:05.770]  And nobody's going to ask you a question, like, what kind of book do you read?
[48:05.870 --> 48:06.710]  Why do you read that?
[48:06.810 --> 48:07.690]  How often do you read that?
[48:07.690 --> 48:10.090]  I don't mean that I'm afraid of information.
[48:10.290 --> 48:10.410]  No, no.
[48:10.530 --> 48:12.830]  I just meant, am I in any way at risk?
[48:13.050 --> 48:13.730]  Do you know what I mean?
[48:14.850 --> 48:21.070]  Am I open to, am I, am I, am I exposing myself to some kind of vulnerability?
[48:21.770 --> 48:25.430]  Frankly speaking, when you use the Internet, you are at risk.
[48:25.770 --> 48:25.950]  Yep.
[48:26.250 --> 48:26.810]  That's true.
[48:27.030 --> 48:27.430]  Yeah.
[48:27.890 --> 48:28.310]  Yeah.
[48:29.410 --> 48:38.870]  And, like, basically, by using a lot of the apps that you probably have on your phone, and most of us have on our phones, we are exposing ourselves to a lot of vulnerabilities.
[48:39.690 --> 48:39.830]  Okay.
[48:39.830 --> 48:48.270]  But what Tor does is that it basically tries to, like, remove, like, at least, like, remove some of the attack surface so we can be more secure.
[48:49.130 --> 48:49.890]  Okay, got it.
[48:50.030 --> 48:56.210]  We, like, our, our, I wish Tor browser was as secure as Chrome, but it's not, unfortunately.
[48:56.670 --> 48:58.350]  But we are working, like, we are moving toward that.
[48:58.710 --> 49:02.990]  But it's the most private browser that you can find.
[49:02.990 --> 49:14.610]  It's, like, you can, you have, you don't have to be worried about, like, all the, all the shadow profiling, all the advertisement companies, tracking your activities and all the, you know, Right.
[49:14.970 --> 49:15.070]  Yeah.
[49:15.250 --> 49:15.850]  Thank you.
[49:15.990 --> 49:16.250]  Sure.
[49:17.110 --> 49:17.810]  Yeah, sure.
[49:19.030 --> 49:30.630]  Speaking of Chrome, since you bring it up, now the Chromebooks are getting the Google Play store support so they can install and use Android apps in a sort of hybrid fashion.
[49:31.570 --> 49:35.370]  So now, I guess, Orbot will be available for Chromebooks.
[49:35.630 --> 49:41.810]  Can you say anything that you, you know about how secure that would be or what the features are that moving forward?
[49:42.050 --> 49:42.330]  Sure.
[49:42.570 --> 49:43.990]  Can I add, say, one thing?
[49:44.750 --> 49:51.410]  So the, the problem with Chrome in general is that I wish that we could have a Tor browser based on, on Chrome.
[49:51.410 --> 49:55.610]  And I think a lot of people, uh, wish, like, share the same wish.
[49:55.770 --> 49:59.530]  But the problem is that you, it's very difficult to remove Google stuff from Chrome.
[50:00.030 --> 50:02.850]  Uh, it's, Google is essentially an advertisement company.
[50:03.070 --> 50:09.270]  And, uh, whatever they built, it has like, I don't like, like, imagine Google Analytics is like 10,000 times worse.
[50:09.610 --> 50:25.690]  And, uh, like, it's like, just having Tor on, I don't think, uh, I don't know what other people think, but I don't think having, um, or, but on, uh, Chromebook would, would, uh, help you from, uh, with, would save you from, from, uh, Google.
[50:25.870 --> 50:27.910]  Like, it depends, like, on, on your thread model, I think.
[50:28.130 --> 50:30.530]  You can bypass censorship still, but, yeah.
[50:30.870 --> 50:31.430]  That's it.
[50:31.950 --> 50:32.110]  Yeah.
[50:32.710 --> 50:33.010]  Thank you.
[50:33.650 --> 50:33.870]  Thank you.
[50:34.010 --> 50:35.590]  Depends on your thread model is the answer.
[50:35.850 --> 50:35.950]  Yeah.
[50:37.650 --> 50:38.010]  Everything.
[50:38.390 --> 50:41.670]  So, thanks very much for the, uh, from the Tor folks.
[50:41.810 --> 50:43.230]  Oh, they left stickers for me.
[50:43.830 --> 50:44.790]  I'm gonna steal their stickers.
[50:44.790 --> 50:45.550]  I'm gonna steal my stickers.
[50:45.550 --> 50:45.710]  Alright.
[50:46.350 --> 50:46.750]  Um.