00:00:00.042-->00:00:06.125 >>So, the first rule of onion club is you - oh, oh s**t, wrong talk, Okay, so I'm going to tell 00:00:06.125-->00:00:11.083 you a little bit about, uh, Tor Onion services and the sorta things we've been doing lately. 00:00:11.083-->00:00:16.208 I'm gonna try and do a bunch of different topics at once. Um, how many people here know about 00:00:16.208-->00:00:22.542 Tor or how it works? Some, like awesome. Okay. So, I'm going to skip over most the the how it 00:00:22.542-->00:00:28.250 works and so on, um, we finally made the projector work - which is awesome, I can't see what I'm 00:00:28.250-->00:00:33.542 seeing, so I'll be looking at the sides every so often. So Tor is a non-profit, Tor is 00:00:33.542-->00:00:37.458 software, Tor is a privacy tool, Tor is a lot of different things. It's a network of 00:00:37.458-->00:00:42.500 volunteers around the world. Um, it's a group of researchers who try to study how to make privacy 00:00:42.500-->00:00:48.250 better. The Tor network has something like 2 million users, every day using it, so it's a 00:00:48.250-->00:00:53.250 lot of different people all around the world. We've got a lot of people in, uh, the middle 00:00:53.250-->00:00:57.583 east, We've got a lot of people in Europe, we've got a lot of people in North America and each 00:00:57.583-->00:01:02.917 of those are for a lot of different reasons that I can get into. So, what's the - what's 00:01:02.917-->00:01:07.542 the situation here? We've got Alice over here, she's trying to browse the web to some bob and 00:01:07.542-->00:01:12.042 she wants to, um, keep some security properties. She wants to stay safe. She wants to make 00:01:12.042-->00:01:16.542 it so that somebody watching her doesn't know where she is going. She wants to make it so that 00:01:16.542-->00:01:20.500 someone at the destination end can't see where she's coming from. And she wants to make it 00:01:20.500-->00:01:26.875 so no single, like tier one ISP, is like AT&T, which I guess means NSA, um [laughter from 00:01:26.875-->00:01:33.417 audience] get to track, uh, where she's coming from to where she's going. So anonymity is 00:01:33.417-->00:01:38.458 more than just encryption, more than just scripto. I talk to a lot of corporations, to say, 00:01:38.458-->00:01:43.667 yeah, I don't need Tor because, I-I use a VPN. I don't need Tor because I-I've got encryption, I 00:01:43.667-->00:01:49.042 use, I use something else. And encryption is good. You should use encryption, but even when 00:01:49.042-->00:01:52.083 you're using encryption, people watching you get to learn who you're talking to, when you're 00:01:52.083-->00:01:58.375 talking to them, how much you're talking, and that's what the intelligence agencies use these 00:01:58.375-->00:02:03.500 days. It's not about 'let's try to break the crypto' it's about 'let's build a social graph of 00:02:03.500-->00:02:08.167 who's talking to who, find out who's in the middle of that and then go break into their house 00:02:08.167-->00:02:12.417 and change their laptop or steal their hardware ot stuff like that'. So that gal of Tor is to 00:02:12.417-->00:02:16.625 protect the metadata, um i'm sure you've all heard the phrase ' we kill people based on 00:02:16.625-->00:02:23.292 metadata' from our fine government. Okay, so I actually only use the word anonymity when 00:02:23.292-->00:02:27.542 I'm talking to other researchers. When I'm talking to my parents and ordinary people I 00:02:27.542-->00:02:31.458 tell them i'm working on a privacy system. Because anonymity...maybe it's a bit 00:02:31.458-->00:02:36.708 scarey, but privacy is a good, is a good value that the whole world should have. And when I'm 00:02:36.708-->00:02:41.958 talking to companies, Google and Walmart and so on, i tell them I'm working on communication 00:02:41.958-->00:02:48.125 security. Because privacy is dead, and anonymity is scarey, but security - yeah, yeah, I 00:02:48.125-->00:02:53.333 need some security. And then when I'm talking to governments and militaries I tell them I'm 00:02:53.333-->00:02:57.750 working on traffic analysis resistance communication networks. [laughter from 00:02:57.750-->00:03:01.917 audience]. And again, it's the same system, it's the same network, it's the same set of 00:03:01.917-->00:03:05.875 users, it's the same security properties, but but the goal is to blend all of these different 00:03:05.875-->00:03:09.500 groups together. Because when you go to the government and say I got a security tool, they're 00:03:09.500-->00:03:14.625 like 'yeah, I've heard that one before, we fifty security tools, we're, we're all set or we don't 00:03:14.625-->00:03:19.625 like security' or whatever their answer is, um but traffic analysis resistance, 'oh yeah, I 00:03:19.625-->00:03:25.792 do want to send the diplomat in Israel and not have people learn what her affiliation is.' And 00:03:25.792-->00:03:29.292 then there's the fourth category, which is the reachability, um of the 00:03:29.292-->00:03:34.083 censorship side. So all of these is different talks. Er, I'm gonna skip over most of them. 00:03:34.083-->00:03:38.375 Er, I should be around for the rest of the weekend in bright green shirt, so, if you wanna 00:03:38.375-->00:03:42.625 ask me more questions about Tor, um I should be around. Okay, so how how do you build one of 00:03:42.625-->00:03:48.417 these? The easy answer is, uh, you have single hot proxy, um all of the users show up, um and 00:03:48.417-->00:03:52.875 they each request whatever website they're going to. And this is bad news for a couple of 00:03:52.875-->00:03:57.875 reasons. The main reason is that big juicy center target. So I was actually talking to the CTO 00:04:00.125-->00:04:05.000 of one of these companies years ago, i think it was anonymizer dot com, and he said, 'yeah, we 00:04:05.000-->00:04:10.750 never answer subpoenas, if we ever answered a subpoena, nobody would trust us again. So of 00:04:10.750-->00:04:15.042 course we never answer them.' And then I was doing a talk for the US department of Justice, 00:04:15.042-->00:04:19.333 like 6 months later, and one of them interrupted me and said, "why can't you be like 00:04:19.333-->00:04:24.625 anonymizer, it's easy, we send them a subpoena, they send us an answer, it's easy, why can't you 00:04:24.625-->00:04:28.750 be like that...' [laughter from the audience] so, I don't say that to pick on anonymizer in 00:04:28.750-->00:04:33.167 particular, the problem is the architecture. The problem is the centralized system where they 00:04:33.167-->00:04:38.583 have all of your metadata, they know exactly what you're doing and they promise not to screw 00:04:38.583-->00:04:44.708 you. They could screw you, they got everything, they promise not to. I want a system that's based 00:04:44.708-->00:04:51.083 on privacy by design, based on distributed trust, rather than, there's a centralized system and 00:04:51.083-->00:04:54.417 they make some promises and there's no way for you to tell whether they're following 00:04:54.417-->00:04:59.958 through. Okay, and it's actually worse than that, because if it's a centralized system, there's 00:04:59.958-->00:05:04.958 one cable going into the computer, same cable coming out, and if you can tap that cable or 00:05:04.958-->00:05:10.042 the upstream or the upstream's upstream, ah, then you get to do pretty simple traffic analysis - 00:05:10.042-->00:05:15.708 you can say: 'this flow came in and a very similar looking flow went out, so I'm pretty sure 00:05:15.708-->00:05:21.250 this user is talking to that destination.' So, the goal of Tor is to distribute the trust 00:05:21.250-->00:05:26.875 over multiple relay so there's no single point that gets to learn about Alice and Bob in the 00:05:26.875-->00:05:31.875 same circuit. Ok, so far so good? Great. So that's actually only half of what Tor is. The 00:05:34.333-->00:05:40.083 first part i was telling you was the location privacy or um network metadata or something 00:05:40.083-->00:05:46.250 like that. The other half is the, the browser side. The application level privacy. So, 00:05:46.250-->00:05:51.583 in your browser there's so many different ways, um, um awesome, i hope my slides continue to 00:05:51.583-->00:05:56.750 survive as people mess with them. Um, so in your browser there's so many different ways 00:05:56.750-->00:06:02.833 to screw up from the privacy side, um, cookies, HTTP headers, uh, I hear Flash is finally 00:06:02.833-->00:06:09.292 dead, that's awesome, um so, one of the things we do is, fork a FireFox called that tries to 00:06:09.292-->00:06:14.958 keep all of those other things from messing you up. So it tries to, uh, tries to isolate all of 00:06:14.958-->00:06:20.750 your state when you close to a browser it all gets thrown away, um so that's uh, um a second 00:06:20.750-->00:06:24.542 thing that we work on and I'm not going to talk about that one here, except to mention that 00:06:24.542-->00:06:30.250 it's an important piece of things. Okay, so here's a graph of the performance, uh, of the 00:06:30.250-->00:06:35.917 the scalability, the the bandwidth of the Tor network over the past, uh, 7 years or 00:06:35.917-->00:06:40.750 so. So the green line is the capacity of relays in the network, we're up to about 8000 00:06:40.750-->00:06:46.042 relays and the purple line is the load on the network - which is the people who are using it 00:06:46.042-->00:06:50.833 for um going into Facebook or going into CNN or going into WikiLeaks or whatever they're 00:06:50.833-->00:06:55.708 doing with Tor. So, there are a couple of interesting things here. One them is the more the 00:06:55.708-->00:07:01.083 gap is between the green line and the purple line, the faster a Tor can be. So we were 00:07:01.083-->00:07:07.083 discovering this long ago, in fact my last talk at Defcon was 8 years ago and it was entitled 00:07:07.083-->00:07:13.375 'Why Tor is slow and what we're going to do about it' and you can see on this graph where that 00:07:13.375-->00:07:20.292 talk was given. So that was at the zero zero point in this graph and since then, we've 00:07:20.292-->00:07:26.875 moved up to, uh, something like 100 gigabits of actual traffic and maybe 2 or 3 times that 00:07:26.875-->00:07:31.292 capacity. So they're a lot of relays out there around the world, uh, including run by a 00:07:31.292-->00:07:36.250 lot of people here (you should all run relays) um in order to make the Tor network, um, be 00:07:36.250-->00:07:41.500 able to handle more traffic. And it's not just that, it's also the diversity side of things, um 00:07:41.500-->00:07:46.500 it's not just about being able to handle bandwidth, we need to have a lot of different relays 00:07:46.500-->00:07:51.625 in a lot of different places around the world so that a single attacker, maybe French 00:07:51.625-->00:07:56.250 Intelligence or something like that won't, won't be able to see enough places on the internet in 00:07:56.250-->00:08:00.917 order to be able to manage that person in going into the Tor network and this flow is coming 00:08:00.917-->00:08:06.083 out and i can see them both, so I can match them up. So, one piece of the diversity is the, 00:08:06.083-->00:08:11.333 the diversity of relays, where they are, the other piece the diversity of users. So, if we 00:08:11.333-->00:08:17.625 had a an anonymity system for cancer survivors and everybody on it was using it to talk 00:08:17.625-->00:08:22.625 about, uh, how they survived cancer, then the fact that you have Tor installed would give 00:08:22.625-->00:08:27.208 people a really good hint about why you have Tor installed. So one of the really important 00:08:27.208-->00:08:32.417 pieces of the security is having a lot of different types of users, so we need Egyptian 00:08:32.417-->00:08:37.417 activists and cancer survivors and Feds and Russian Feds, or whatever the equivalent is - all 00:08:39.500-->00:08:44.125 in the same system so that you can't guess what's going on just from the fact that they're using 00:08:44.125-->00:08:49.750 Tor. Er, and another piece of that is, uh, imagine there are 50 000 people in a run, like in 00:08:49.750-->00:08:55.083 Tor right now, the average person in a run using Tor is using it because somebody blocks 00:08:55.083-->00:08:58.833 their web comics, somebody blocked Facebook and they want to be able to look at their cute 00:08:58.833-->00:09:03.667 cats or something like that. It's not that's there 50 000 dissidence in a run all trying 00:09:03.667-->00:09:07.125 to take down their government using Tor, they're all trying to be ordinary people on the 00:09:07.125-->00:09:13.167 internet and their country is censoring them. So the fact that most of them are ordinary is is 00:09:13.167-->00:09:18.375 a key piece of the strength of Tor. You can't have an anonymity system that is full of 00:09:18.375-->00:09:24.042 dissidence, uh, you need a lot of other coer traffic and a lot of other people blending. Okay, 00:09:24.042-->00:09:29.042 another, um key point: Transparency for Tor, the Tor project is a key property. So, 00:09:31.250-->00:09:35.750 one piece of that is, it needs to be open source, it needs to be free software and other 00:09:35.750-->00:09:40.542 pieces, we need the actually give you the design documents and specifications and say, um, 00:09:40.542-->00:09:45.250 this is what we meant to build, this is how we thought we built it, here's the source code, 00:09:45.250-->00:09:49.042 here's the design document, please look at whichever of those you're most comfortable 00:09:49.042-->00:09:54.458 with and try to find, uh, bugs and mistakes and so on. Um, another piece is, publically 00:09:54.458-->00:09:59.917 identified developers. So here we are up here saying, "hi, I work on Tor" There are - raise 00:09:59.917-->00:10:04.458 your hand if you're a Tor developer or a Tor researcher, or um something like that in 00:10:04.458-->00:10:09.250 here? We see a couple of hands - awesome. So there are quite a few people here, who are, uh, 00:10:09.250-->00:10:14.167 who are a part of the group of people building Tor. And, another piece of this, I get, I 00:10:14.167-->00:10:18.792 get a lot of people who say, "oh, ha ha the anonymity people are identifying themselves, ha 00:10:18.792-->00:10:24.292 ha they're so stupid," um, privacy is about choice. Privacy is about giving people the 00:10:24.292-->00:10:29.417 ability to choose, "Am I going to publish this information about me or not," and we believe 00:10:29.417-->00:10:35.583 that the best way to build a strong global anonymity system with a community around it is we 00:10:35.583-->00:10:41.250 choose to identify ourselves and we choose to to describe uh, who we are and what we're doing in 00:10:41.250-->00:10:46.250 order for you to be able to trust us. Okay, and yes, there are bad people in the world, um 00:10:48.667-->00:10:54.167 and some of them use Tor, but at this point with millions of people using Tor everyday, the 00:10:54.167-->00:10:59.333 average Tor user is the average internet user. These are people around the world who read about 00:10:59.333-->00:11:04.833 the NSA or their country blocked Facebook and they wanna be able to be internet users just like 00:11:04.833-->00:11:09.708 everyone else. So, yeah, you could look at it as a two-edged sword, you could say, you gotta 00:11:09.708-->00:11:15.208 take the good with the bad, or something like that, um but what really - imagine two scenarios. 00:11:15.208-->00:11:20.250 Scenario 1: I want to build a tool that works for millions of people. I want to tell you all 00:11:20.250-->00:11:25.417 about it, so you can help me analyze it, and i want it to work for the next year or two. 00:11:25.417-->00:11:30.167 So that's the Tor problem. Scenario 2: I want to build a tool that works for the next 2 00:11:30.167-->00:11:35.417 weeks. Only 10 people will use it. And i'm never going to tell you about it. That's the um 00:11:35.417-->00:11:40.333 terrorist, the bad guy problem. So the bad guys have so many more options. It doesn't have to 00:11:40.333-->00:11:45.500 scale, it doesn't have to have peer review, it doesn't have to -to be sustainable, whereas the 00:11:45.500-->00:11:50.583 Tor goal is to build something that works for everybody and can continue to work and can push 00:11:50.583-->00:11:55.208 forward, understanding how to build privacy tools in the world, because there a lot of 00:11:55.208-->00:12:00.042 really big well funded adversaries out there, and we the security community, need to 00:12:00.042-->00:12:05.667 learn how to build things that can defend against them. Okay, so another piece i wanted to 00:12:05.667-->00:12:10.333 talk about, uh, if they're, if you're only learned about Tor from slash dot or some, uh, some 00:12:10.333-->00:12:15.750 crappy newspaper article, um there are a lot of people who've been um, spreading memes over 00:12:15.750-->00:12:20.542 the last while and I want to tackle a couple of them here, um, not to try to like change 00:12:20.542-->00:12:25.708 your mind about something, but many of you are Tor activists, so hopefully this will help you, 00:12:25.708-->00:12:30.500 when you go talk to your parents or your cousins or something and they say, "Well, I heard that 00:12:30.500-->00:12:34.875 Tor..", uh, so hopefully this will give you some ammunition back. So one of the exciting 00:12:34.875-->00:12:39.250 things I hear, um, I heard the navy wrote Tor so how can we trust it? The very short answer 00:12:39.250-->00:12:44.250 to that is: I wrote Tor, not the navy. So, here I am. [applause from the audience]. And the 00:12:52.458-->00:12:56.542 other piece of that, so years ago I was at a hacker conference in the Netherlands called What 00:12:56.542-->00:13:00.667 the Hack, and I did three talks in three days, and I got a lot of people coming up to me 00:13:00.667-->00:13:04.958 saying, "How can we know we can trust this thing?" and I got to try two different answers on 00:13:04.958-->00:13:08.958 them. The first answer was, "it's open source, it's free software, you can look at it, 00:13:08.958-->00:13:13.375 you don't have to trust me, you, you can decide for yourself if it's safe". And they actually 00:13:13.375-->00:13:17.833 didn't like that one, 'cause I think some of them heard, "It's bad news, you should look at it, 00:13:17.833-->00:13:21.917 I can't tell you." The other answer that I tried was, "No dude, don't worry about it, it's 00:13:21.917-->00:13:25.917 fine." And that worked great. Which [laughter from the audience] it shouldn't have 00:13:25.917-->00:13:30.333 worked. It should be that we should teach people about free software and open source, um, so 00:13:30.333-->00:13:36.542 we've got some more work to do in that world. Ok, so myth number 2, um, I heard the NSA 00:13:36.542-->00:13:43.500 runs half the relays. First of all, Ed Snowden's documents showed us the GSQ ran like 5 00:13:43.500-->00:13:49.542 relays for like a week on amazon EC2 some years ago. So, indeed, some intelligence agencies have 00:13:49.542-->00:13:54.000 run relays every so often. But I actually know like, the people who run like two thirds of the 00:13:54.000-->00:13:59.208 relays, by by capacity, so I know that the NSA does not run half the relays, 'cause i know 00:13:59.208-->00:14:03.917 the people who run the relays. But, so so that's one answer. Another answer is: it doesn't 00:14:03.917-->00:14:08.833 make any sense for the NSA to run the relays. Um, this is maybe a sort of a a bad news 00:14:08.833-->00:14:14.750 answer, but they shouldn't run the relays. They should continue to monitor the internet and they 00:14:14.750-->00:14:18.708 should let excited and enthusiastic people run relays and then they're already 00:14:18.708-->00:14:24.167 watching AT&T and Deutsche Telecom and the cables underneath the oceans. Um, so 00:14:24.167-->00:14:27.875 they don't have to run the relays to attack the Tor network. They're already 00:14:27.875-->00:14:33.000 investing in surveilling the internet, so it makes no sense for them to try to go through 00:14:33.000-->00:14:38.417 the red tape and so on, uh, of getting some feds to approve running relays in the network. 00:14:38.417-->00:14:42.333 So, that one's kinda complicated, um, but I don't think there are many actual 00:14:42.333-->00:14:48.625 intelligence agencies running relays because they don't have to. Okay, so, um, myth number 3: 00:14:48.625-->00:14:54.208 I heard Tor is slow. If you used Tor 15 years ago, it actually was kinda slow. Er, but because 00:14:54.208-->00:14:58.750 we got a lot more capacity and network these days, it's become a lot faster than it used to be. 00:14:58.750-->00:15:03.292 So i talked to a lot of people who last used Tor, you know 10 years ago or something, um try 00:15:03.292-->00:15:08.583 it out, if you haven't tried it lately. And, um I heard, Tor gets a lot of it's money from 00:15:08.583-->00:15:13.958 the US government. This one, is alas, true. We get something like 80 percent of our funding 00:15:13.958-->00:15:19.250 from, erm the US state department or the national science foundation, or the open 00:15:19.250-->00:15:23.583 technology fund which is part of Radio Free Asia, um so there are a bunch of different groups. 00:15:23.583-->00:15:28.792 We're diversified inside the US government, um that's not as much as I'd like to be. So we 00:15:28.792-->00:15:33.583 have something like 15 percent of our funding coming from donations and things like that 00:15:33.583-->00:15:38.250 and we'd love to grow that so that we're more sustainable and don't have to keep coming up 00:15:38.250-->00:15:42.375 with, um shiny things to try and convince some funder that that they want to pay for us to 00:15:42.375-->00:15:48.917 build. Okay, um another exciting one, a few years ago there was some researcher who came up with 00:15:48.917-->00:15:53.667 some bad methodology to measure how much Tor is bad people and then some journalist 00:15:53.667-->00:15:58.958 misunderstood it and like like wrote a bad article about it and before we knew it there was a US 00:15:58.958-->00:16:05.208 like, uh, department of justice, uh, high muckety muck who was saying in front of congress 80 00:16:05.208-->00:16:11.458 percent of Tor users are are doing bad things. And every step of that chain was bad news. Um 00:16:11.458-->00:16:16.333 another I guess, it's another way of looking at that, Akamai wrote another report a while ago 00:16:16.333-->00:16:21.917 looking at the people who were going to, uh, Macy's or whatever companies that that Akamai hosts 00:16:21.917-->00:16:27.208 and they found that the number of people buying things over Tor successfully and being ordinary 00:16:27.208-->00:16:33.042 people was the same rate as people buying stuff over not Tor. So, that was the argument 00:16:33.042-->00:16:36.667 they were using to tell all their customers, "yeah you shouldn't be scared of the Tor 00:16:36.667-->00:16:41.458 thing, now that it has millions of people it is a cross section of the internet. It looks like 00:16:41.458-->00:16:47.500 everybody else." And then, myth number 6: I shouldn't use Tor, because if I do that the NSA is 00:16:47.500-->00:16:53.583 going to watch me. Um, so [laughter from audience]. On the one hand, um, a few years ago we 00:16:53.583-->00:16:58.708 actually found some xkeyscore rules that the NSA might be operating where they were spying 00:16:58.708-->00:17:03.500 on my computer and T and tracking all of the connections that came to it. Um , on the 00:17:03.500-->00:17:08.750 other hand, so imagine your friend comes to you and says, "I heard that when I use HTTPS the 00:17:08.750-->00:17:13.750 NSA is watching me, so i'm not going to use encryption anymore and now I'm gonna be safe," 00:17:16.083-->00:17:20.125 [laughter from the audience] that that's crazy talk. The same thing's happening here, NSA is 00:17:20.125-->00:17:24.667 watching everything, they're already building databases of everything going on - and if you 00:17:24.667-->00:17:29.750 say ' well, I'm not gonna use any security tools because then I'll be safe..." somehow we have 00:17:29.750-->00:17:35.542 to get to the world where Tor is normalized enough that people think that it's totally crazy to 00:17:35.542-->00:17:40.625 say 'I'm not gonna protect my metadata because if I protect my metadata then then they'll be 00:17:40.625-->00:17:45.625 watching me. They're watching everybody. Okay, and then myth 7: um, a lot of people look at 00:17:48.583-->00:17:52.708 Tor and say, "Well, I read an article 4 years ago that said there was an attack so I'm I'm 00:17:52.708-->00:17:58.667 scared, I'm going to use the crappy single VPN instead. So part of the challenge here is 00:17:58.667-->00:18:04.667 teaching people about the security system ecosystem. So, you build a tool, somebody else 00:18:04.667-->00:18:09.917 figures out how to attack it, you build a defense for that attack, you go back and forth 00:18:09.917-->00:18:14.958 and then that's how systems become stronger. That's how systems become safe to use, if 00:18:14.958-->00:18:19.792 you design a thing and anytime it's broken you throw it out and start with a new one, you're 00:18:19.792-->00:18:24.375 never going to get anywhere. So part of what we need to do is help the world understand how 00:18:24.375-->00:18:29.375 the security ecosystem works. Okay, so I'm going to talk here about, uh, Onion services, um 00:18:31.625-->00:18:37.000 and what they are so far and um and what we're doing to make them stronger and and change 00:18:37.000-->00:18:43.000 them. So here's a screenshot of using Tor browser to go to blah blah blah dot onion which is one 00:18:43.000-->00:18:47.875 of the Onion services that riseup uses. So that blah blah blah is the hash of the public 00:18:47.875-->00:18:53.917 key for the Onion service. So every Onion service is it's own private key pair and you address 00:18:53.917-->00:18:59.500 them using the public key. So what do you get out of this? One of the really cool things is 00:18:59.500-->00:19:05.875 they're self-authenticated. If I go to that public key address my Tor client makes sure i'm really 00:19:05.875-->00:19:10.333 talking to the Tor on the other side that's running that address. So there's no man in 00:19:10.333-->00:19:15.125 the middle, uh, there's no certificate authority mafia telling us who can have 00:19:15.125-->00:19:20.167 encryption and who can't have encryption. Ah, it's all built into the system. Um, you get end 00:19:20.167-->00:19:24.708 to end encryption out of that, um built in nab punching is awesome. There are a lot of 00:19:24.708-->00:19:29.917 people who run Onion services behind their firewall, no packets are allowed through the 00:19:29.917-->00:19:35.125 firewall at all, it's just you can go in through the Onion service which build a connection 00:19:35.125-->00:19:39.708 out and that way your surface area is really limited. Ah, for example there are a lot of 00:19:39.708-->00:19:45.458 people who run, uh, Onion addresses for their SSH server and that way they can connect 00:19:45.458-->00:19:50.208 back to their computer but nobody else can connect and send, you kow, standard IP 00:19:50.208-->00:19:55.125 packets, you can't send weird IP packets you can only talk to the computer through the Onion 00:19:55.125-->00:20:00.125 channel - and that gives you authentication and encryption and and a lot of other good 00:20:00.125-->00:20:05.250 stuff. So that's, that's one of the neat, that's a bunch of the neat things that Onion services 00:20:05.250-->00:20:11.000 can provide. We we looked a while ago at, uh, there's, at at same time the journalist was 00:20:11.000-->00:20:15.833 saying that bad like 80 percent thing - we were thinking: let's actual try and figure out which 00:20:15.833-->00:20:21.292 fraction of traffic in the Tor network has to do with Onion services, because if you read, 00:20:21.292-->00:20:23.958 you know, the BBC articles about Silk Road, you would think Tor is only Silk Road, ah, so let's 00:20:23.958-->00:20:25.958 actually, you know, measure Tor and try and figure out what's going on, how much traffic there 00:20:25.958-->00:20:32.208 is. So we instrumented the Tor relays in a way that,er, is privacy preserving and safe. 00:20:32.208-->00:20:37.208 Tried to figure out how much total traffic each relay kept, oe uh, handled that was related 00:20:42.083-->00:20:47.500 to Onion services and here's a graph over the past, uh, two and half years or so and it's about 00:20:47.500-->00:20:52.583 a gigabit per second of Onion traffic. So that's something like 1 percent, uh, of the 00:20:52.583-->00:20:56.750 traffic I was showing you before, but actually the math is a bit more complicated because 00:20:56.750-->00:21:02.250 we were just measuring in the middle, in three hops so, um so the very short version is 00:21:02.250-->00:21:09.000 something like 3 percent of Tor traffic has to do with Onion services at all. So the other 97 00:21:09.000-->00:21:15.042 percent of the traffic is people going to ordinary websites like CNN and WikiLeaks and, uh, cute 00:21:15.042-->00:21:19.333 cat pictures and so on - whatever people do on the internet. So that's, that's a 00:21:19.333-->00:21:25.333 really important point because it means...So I wrote Onion services back in like 2004 or 00:21:25.333-->00:21:29.750 something. I wrote them for like a toy to show that once you have Tor you can build blocks on top 00:21:29.750-->00:21:34.958 of it - and they basically still are a toy. They've got a couple of early adopters. A lot of 00:21:34.958-->00:21:40.125 people who are, who are early adopters for any technology tend to be, uh, bad guys in one form 00:21:40.125-->00:21:45.292 or another, but part of what we need to do here is get a lot more users and a lot more people 00:21:45.292-->00:21:51.000 thinking about it because the broader it gets the more ordinary it becomes. So, 00:21:51.000-->00:21:55.708 whenever you see, uh, journalists and so on trying to show you the picture of the deep 00:21:55.708-->00:22:00.708 web, I have to wave my hands whenever I say 'deep web' or um 'dark web' think about what 00:22:00.708-->00:22:05.625 they're trying to sell you because there's there's basically no dark web, it 00:22:05.625-->00:22:10.583 basically doesn't exist. Er, there's a company out there called Terbium labs that found 00:22:10.583-->00:22:15.792 like 7000 websites on the dark we total compared to the billions of pages out there and 00:22:15.792-->00:22:20.000 other places. So whenever someone shows you the picture of the iceberg try to figure out 00:22:20.000-->00:22:25.208 what their incentives are, what are their motivations. Okay, so what are some cool user cases 00:22:25.208-->00:22:30.292 for Onion services? Er, in terms of, um other things people have done with it. One of the really 00:22:30.292-->00:22:36.542 cool ones is SecureDrop. This is basically a way of interacting in a back and forth way with 00:22:36.542-->00:22:40.583 journalists, where say you've got some story about some terrible thing the government 00:22:40.583-->00:22:44.667 did and you want to get it in the hands of the New York Times or the Washington Post or the 00:22:44.667-->00:22:49.208 Intercept,er, and, so that they can write a good article about it, but you want to stay 00:22:49.208-->00:22:53.917 anonymous. So, um there are actually like all those places that i just named are actually 00:22:53.917-->00:22:58.583 running SecureDrop instances. The New York Times has one, the Guardian has one. There are like 00:22:58.583-->00:23:04.625 30 major newspapers that have these whistleblowing platforms as ways that you can reach them 00:23:04.625-->00:23:10.500 safely with built in encryption and built in authentication in a way that, uh, nobody's going to 00:23:10.500-->00:23:16.000 be able to man in the middle it. So, that's an awesome first step. Another,er, out of the box 00:23:16.000-->00:23:22.417 approach is a tool called ricochet.So how many people here use Jabber or XMPP or GoogleTalk 00:23:22.417-->00:23:29.333 or, uh, some words like that? I see, uh, far fewer hands than I expected, you're probably all 00:23:29.333-->00:23:34.417 Skype users. Okay, um [laughter from the audience]. So one of the really cool things about - 00:23:34.417-->00:23:38.875 one of the really sad things about the centralized tools like Jabber, is there's a central 00:23:38.875-->00:23:44.375 server where all of the traffic goes through that server and if you're in the middle you get to 00:23:44.375-->00:23:49.208 learn all the friends lists and whose talking to who and so on. So one of the cool things about 00:23:49.208-->00:23:56.042 ricochet is every user is their own Onion service, so there's no middle. I can talk to someone 00:23:56.042-->00:24:00.375 else's Onion service, I don't have to know who they are who where they are, i just need 00:24:00.375-->00:24:05.292 their Onion address. And now there's nothing to tap if you want to do European styled data 00:24:05.292-->00:24:10.708 retention, there's no place to go to - if you wanna do like American style, I'm just going 00:24:10.708-->00:24:15.500 to break in and take all the data, uh, there's nothing to break into. So there's no middle 00:24:15.500-->00:24:21.750 which is uh, an awesome, um metadata security for chat. There are a lot of the uh, 00:24:21.750-->00:24:26.000 signal, yay signal, but um there's still like a computer in Europe that moxy gets to look 00:24:26.000-->00:24:31.292 at, and it's probably not just moxy. So, we really need to think about metadata security, 00:24:31.292-->00:24:37.500 uh, for our communications apps. Okay, another cool one is Onion Share. This was actually written 00:24:37.500-->00:24:44.333 by journalists for journalists at the Intercept and, so, let's imagine you have um um um um 2 00:24:44.333-->00:24:49.042 gigabyte file, you got it from some guy named Ed at the NSA and you want to give it to the 00:24:49.042-->00:24:55.375 journalist next to you. Do you use DropBox? Do you use a USB key? Do you email it to them? Do 00:24:55.375-->00:25:00.292 you set up an FTP server? All those are crappy answers. So Onion share is a way to use 00:25:00.292-->00:25:06.417 Onion services, where the website spins up for just that one download. You fetch the file 00:25:06.417-->00:25:11.542 over the Onion address - the website goes away. So, it's up for just the transfer and then 00:25:11.542-->00:25:17.000 it's gone and there's nothing left over afterwards. So that's uh, a really important way of 00:25:17.000-->00:25:23.000 more safely, um sharing files when you need to share important files. And there are a bunch of 00:25:23.000-->00:25:27.417 other websites out there that have set up their own Onion addresses, uh, in order to let 00:25:27.417-->00:25:32.208 their user choose what sort of security they get. Er, one of the ones I think is especially 00:25:32.208-->00:25:38.708 awesome is the debbie packaging system, when you do when you get an app upgrade, um, they have 00:25:38.708-->00:25:43.417 Onion addresses for their package servers. So that means that you can get end to end 00:25:43.417-->00:25:47.833 encryption and authentication when you're fetching your updates, and um anonymous 00:25:47.833-->00:25:53.917 updates is an awesome concept. So imagine right now you go to get your next debian update and 00:25:53.917-->00:25:58.750 they're looking at you, like, him yeah I want to give him the exploit. Imagine you're going 00:25:58.750-->00:26:03.542 through Tor - they don't know it's you. It's a bunch of anonymous people doing updates, 00:26:03.542-->00:26:07.583 they can't target particular people because they can't - there's nothing recognizable 00:26:07.583-->00:26:12.292 about them. It's all just a massive anonymous people fetching their updates and if 00:26:12.292-->00:26:16.708 they want to target somebody they have to target a lot of them making it much more likely 00:26:16.708-->00:26:21.833 that somebody is going to notice that they're that they're being sent a bad package or an exploit 00:26:21.833-->00:26:25.792 or something like that. So i think we should, we the security community really need to think 00:26:25.792-->00:26:31.042 more about anonymous updates in general, uh, because the targeting problem seems like a 00:26:31.042-->00:26:36.042 really big one. Okay, so, what do you think the biggest website on the dark web is? If you've 00:26:39.708-->00:26:45.167 been reading like BBC or something it's probably you know Silk Road, um, turns out, the 00:26:45.167-->00:26:50.583 largest website you can reach with an Onion address is Facebook. [laughter from 00:26:50.583-->00:26:56.292 audience] Facebook set up Onion address in order to let their users choose, do I use the 00:26:56.292-->00:27:01.125 normal HTTPS mafia, do I use the Onion address so that I don't have to deal with that. Imagine 00:27:01.125-->00:27:04.792 you're in Turkey and you're trying to go to Facebook, but the Turkish government is 00:27:04.792-->00:27:09.500 actually attacking you, and Turkish telecoms owns a cer-certificate authority so, 00:27:09.500-->00:27:15.458 they actually do target people by signing SSL certificates...so Facebook wanted to give users 00:27:15.458-->00:27:19.167 around the world the choice of what kind of security they're getting - and the Facebook 00:27:19.167-->00:27:24.792 people, this is actually post from Facebook, on their blog, saying last April, uh, I guess, 00:27:24.792-->00:27:29.792 2 Aprils ago now, um a million people logged into Facebook over Tor in that month. So a million 00:27:32.500-->00:27:37.500 people is a lot, but they have, I don't know, a billion users or something? So point one percent 00:27:37.500-->00:27:42.500 of Facebook's user base logged in over Tor last April? That's huge. That's that's that's a lot 00:27:44.750-->00:27:49.500 more people than we were thinking was using Tor. That's a lot more ordinary people than we 00:27:49.500-->00:27:54.875 were thinking. So part of the thing to realise here, uh, is this is a cross section of the 00:27:54.875-->00:27:59.875 world that's using Tor at this point. Okay, so how do these things actually work? Um, so , 00:28:02.250-->00:28:08.583 uh, imagine I'm Bob, I wanna run some service, uh, some website or something and i want people, 00:28:08.583-->00:28:13.417 people to be able to reach it as an Onion address. So the first thing I do is I generate my key 00:28:13.417-->00:28:18.958 pair and I establish circuits out into the Tor network so that, uh, and then I hold them 00:28:18.958-->00:28:24.458 open - those are my introduction points. And at that point, I'm going to publish a descriptor in 00:28:24.458-->00:28:29.417 the, the database in the sky (I'll talk about that in a bit), um and the goal of that is, I 00:28:29.417-->00:28:33.208 want to put my introduction points, all three of them, and i want to put the public key for 00:28:33.208-->00:28:39.750 my for my service , and then Alice is going to learn blah blah blah dot Onion somehow and 00:28:39.750-->00:28:44.125 she's going to pull that down for the the directory, and now she knows the introduction 00:28:44.125-->00:28:48.958 points and she knows the public key so she can verify she's really reaching the right place, 00:28:48.958-->00:28:53.208 um and at that point she's going to establish her own circuit into the Tor network, to what we 00:28:53.208-->00:28:58.042 call the rendezvous point, and then she's going to send it an intr- introduction to the 00:28:58.042-->00:29:03.000 introduction points, saying, 'hey I want to talk to Bob' and it will get passed through to 00:29:03.000-->00:29:07.583 Bob and then Bob will receive a message saying 'somebody wants to talk to you and they're 00:29:07.583-->00:29:12.250 waiting over at this rendezvous point, and here's a cookie for how you can recognize each 00:29:12.250-->00:29:17.375 other. So then Bob is going to connect to the rendezvous point also, and at that point they do 00:29:17.375-->00:29:21.375 the handshake, so they get end to end encryption and authentication and in the last 00:29:21.375-->00:29:25.250 step they just talk to each other through the rendezvous point. So they're a bunch of 00:29:25.250-->00:29:29.708 cool things here. One of the really important ones is that rendezvous point doesn't know 00:29:29.708-->00:29:35.750 who Alice is, doesn't know who Bob is. It's being used once for this transaction and then it 00:29:35.750-->00:29:40.708 gets thrown away. So it doesn't -basically, it it knows nothing about what's going on, ah for 00:29:40.708-->00:29:45.833 that individual transaction. Okay, so I talked about the database in the sky - how does 00:29:45.833-->00:29:52.042 that actually work? Each Onion service publish picks- six of the Tor relays each day and it 00:29:52.042-->00:29:56.958 publishers its descriptors to that six. So it uses this hash function to try to map to which 00:29:56.958-->00:30:01.958 ones. The reason it needs to use the hash function is the Tor hidden service, Tor Onion 00:30:01.958-->00:30:08.042 service needs to be able to predict where to publish it, so that the clients can do the same 00:30:08.042-->00:30:13.542 calculation and fetch it from the same place. So the service publishes to these six places, 00:30:13.542-->00:30:17.875 the client fetches from one of the six and then it can do that dance I was talking about 00:30:17.875-->00:30:22.875 before. So far, so good? Okay. So, what are some problems with the old design? Er, one of the 00:30:25.333-->00:30:30.625 really big problems is, uh, those old addresses are too short and they're built with bad 00:30:30.625-->00:30:35.625 news keys. So the the simple phrase is: it's the first 80 bits of the sha one of the 10 24 00:30:37.792-->00:30:44.208 bit RSA. every single word in that sentence is bad news. So [audience laughter] in fact 00:30:44.208-->00:30:48.958 there's a talk in here in this room next, uh, about finding a collision with sha one. So, uh, 00:30:48.958-->00:30:53.958 we need to fix most of those pieces and the the very short answer is, the new Ed 2 59 keys 00:30:56.167-->00:31:00.542 are stronger, safer, they're based on elliptic curve, but they're not based on the nist 00:31:00.542-->00:31:05.750 curves, so things are a lot better in that shape. One of the down sides though used to be 00:31:05.750-->00:31:10.333 that the Onion addresses are really short and simple and the new ones are 56 characters long. 00:31:10.333-->00:31:15.417 But the plus side is, you actually get the key, the whole key, it's not the hash of 00:31:15.417-->00:31:21.708 anything, that's actually the ED 2 55 19 key in that lower Onion address. So that gives - that 00:31:21.708-->00:31:27.000 let's us do some cool stuff with crypto that I'll talk about in a bit. Okay, so what are some 00:31:27.000-->00:31:32.542 other problems? I talked earlier about how each Onion service picks six relays to publish to, 00:31:32.542-->00:31:38.250 that hash function I was talking about is predictable into the future. So, i can say, 'I want 00:31:38.250-->00:31:43.458 to target this particular Onion address, so I'm gonna spin up 6 relays that have just the right 00:31:43.458-->00:31:49.500 identity keys so that next Tuesday, I'm the 6th it's going to choose," and at that point I 00:31:49.500-->00:31:54.042 can sensor connections to it because somebody tries to fetch a descriptor, I say, ' oh no 00:31:54.042-->00:31:58.708 I've never heard of it, it's down, it's gone' Or I can measure the popularity where 00:31:58.708-->00:32:03.333 people are going to have to go through me in order to to fetch the descriptor, so I can just 00:32:03.333-->00:32:08.167 count how many people do that. I can't denominize it, I can't attack it in that way, but it's 00:32:08.167-->00:32:14.000 still kinda bad news. Um, and in fact, there there was like a researcher at, I think it was, 00:32:14.000-->00:32:19.083 uh, Black Hat Amsterdam, or something, who made 6 relays that were going to be the 6 00:32:19.083-->00:32:24.042 relays for Facebook, like a month or so after that, so people have been doing this in 00:32:24.042-->00:32:29.333 practice, we've been noticing that relays pop up that have really close together identity 00:32:29.333-->00:32:34.500 key hashes for reasons that, I mean, maybe it's the maybe it's something else. So, so far we've 00:32:34.500-->00:32:38.625 been kicking those relays out, but that's a crappy arms race. So, the better way is to, um 00:32:40.792-->00:32:45.167 [pause], I'll take your question at the end I hope. Um, so the better way is to be able to 00:32:45.167-->00:32:51.250 change it and the way to change that is to add another input into that hash function which 00:32:51.250-->00:32:56.917 changes every day. So, it needs to be a global, a globally agreed shared random value. It 00:32:56.917-->00:33:01.250 needs to be, uh, everybody needs to agree on it but nobody should be able to predict it, um 00:33:01.250-->00:33:06.833 beforehand. And basically we're doing that, everyday there's a new shared random value and the 00:33:06.833-->00:33:12.500 um Tor directory authorities work that into their consensus process and - so that's that's a 00:33:12.500-->00:33:18.042 key piece and hopefully we've, uh, we've finally destroyed the, um bad people want to run relays 00:33:18.042-->00:33:23.042 in order to attack Tor like this arms race. Okay, so there's another problem. Those 6 relays, 00:33:26.125-->00:33:31.000 when I publish my Onion descriptor to them, they get to learn my Onion address, so maybe 00:33:31.000-->00:33:36.417 I didn't, I didn't put it on, you know, uh, an index site, I didn't publish it, I didn't send 00:33:36.417-->00:33:41.250 it to all my friends, I didn't tell anybody except the one person I wanted to know my Onion 00:33:41.250-->00:33:46.750 address. But if you run a bunch of relays, and you're one of those 6 and I publish to you, 00:33:46.750-->00:33:51.417 you get to see the Onion descriptor and you get to learn my address. So, in fact there 00:33:51.417-->00:33:55.042 are threat intelligence, I have to wave my hands when I say that phrase too, there are threat 00:33:55.042-->00:33:59.833 intelligence companies that have been running relays in the Tor network with the goal of 00:33:59.833-->00:34:04.375 discovering Onion addresses that aren't published any other way. And then they go to like Fortune 00:34:04.375-->00:34:08.458 500 companies and blackmail them and scare them with phrases like 'dark web' and pictures of 00:34:08.458-->00:34:12.250 icebergs and so on. And apparently, that's an actual business - where you scare 00:34:12.250-->00:34:16.792 people with bullsh percent$ internet stuff. Um , so [audience reacts] we'd like to 00:34:16.792-->00:34:22.542 stop that particular arms race also, um and the way to do that is because of the new crypto 00:34:22.542-->00:34:27.542 system that we're using, um, the new keys allow us to create subkeys and you can sign the 00:34:29.625-->00:34:33.958 descriptor with the subkey that way everybody can check the signature without anybody being 00:34:33.958-->00:34:38.958 able, being able learn the primary key, the main key from that. So, it's cool crypto magic 00:34:38.958-->00:34:44.042 that we get from the the particular crypto system that we picked for the new keys. Er, so 00:34:44.042-->00:34:49.167 hopefully that will destroy the arms race with those f**ked up threat intelligence companies 00:34:49.167-->00:34:52.958 who are trying to [audience laughs] to, because the the problem is I don't want people 00:34:52.958-->00:34:58.000 running relays who aren't trying to protect everybody. If you wanna run relay because, uh, 00:34:58.000-->00:35:02.625 someone in america might be unsafe, or somebody in Egypt might be unsafe that's awesome - 00:35:02.625-->00:35:07.375 please do. If you wanna relay because you're trying to make money off something unrelated, 00:35:07.375-->00:35:11.708 you're not helping Tor, so I wanna make it, I wanna make it so the Tor network is made more 00:35:11.708-->00:35:17.375 of safe relays. Okay, so something else that, um that is exciting that's going on, uh, 00:35:17.375-->00:35:22.958 are called rendezvous single Onion services. So, in the old design Alice makes 3 hops into 00:35:22.958-->00:35:27.583 the Tor network, Bob makes 3 hops into the Tor network and then you got a 6 hop circuit 00:35:27.583-->00:35:33.583 they go over. In the new design, if you want, you the Onion service can just make a one hop 00:35:33.583-->00:35:38.250 circuit into the Tor network. So now it's a 4 hop circuit and you get the end to end encryption 00:35:38.250-->00:35:43.708 and auth-authentication and so on, bit you got a lot better performance. So Facebook did 00:35:43.708-->00:35:50.333 this, uh, debian's mens page did this so if you're not, if you're not trying to hide the location 00:35:50.333-->00:35:54.875 of your Onion service, but you want all the other security properties for your users, then 00:35:54.875-->00:35:58.750 it makes a lot of sense to do this. And there's even a cooler step for that, there's a guy in 00:35:58.750-->00:36:03.792 Europe called Danika who has a tool called Onion balance and this allows you to run a bunch 00:36:03.792-->00:36:09.542 of different versions of your Onion service and it aggregates them all into one place, so for 00:36:09.542-->00:36:14.792 example, debian does this, they've got like 6 backup Onion services for their package 00:36:14.792-->00:36:19.458 service and they they can restart any of them whenever they want to, they can take them 00:36:19.458-->00:36:24.208 down for a while because there's this meta service that aggregates all the introduction 00:36:24.208-->00:36:28.750 points they have, uh, so it makes things scale better, it makes performance better, it 00:36:28.750-->00:36:35.167 makes it easier to manage. Okay, so there's another challenge. Um, so, how many people here 00:36:35.167-->00:36:41.667 know the phrase 'entry guard' or um 'guard relay' or Okay, not very many - awesome. So, there 00:36:41.667-->00:36:46.667 are a bunch of attacks I don't have time to get into, but the fix for many of them is you pick 00:36:46.667-->00:36:52.292 one relay and your first hop and you stick with that for weeks or months. And the fact that you 00:36:52.292-->00:36:57.042 don't change it means that you don't have as much surface area against bad guys who are trying 00:36:57.042-->00:37:01.792 to run a bunch of relays and hope to be that first hop. So, this is great except there are 00:37:01.792-->00:37:06.958 still a bunch of attacks to discover what your first hop is, what your guard relay is and 00:37:06.958-->00:37:12.042 these guard discovery attacks are, are pretty easy and then once you do them it's pretty bad 00:37:12.042-->00:37:18.458 because, uh, you know the guard relay and you've got a while to break in, you got some weeks and 00:37:18.458-->00:37:23.250 maybe it's in Malaysia and you'll never be able to break in, but maybe it's in Ohio, when 00:37:23.250-->00:37:28.750 you just call up the cops in Ohio and there you are. Um, so, there are a bunch of different 00:37:28.750-->00:37:33.292 fixes we are looking at, it's still an open research area, but one of the key things is we need 00:37:33.292-->00:37:39.000 more layers of guards that don't change as often some of them change more often um I'd be 00:37:39.000-->00:37:43.917 happy to chat about that one afterwards, so, um you can learn more about the vanguard design 00:37:43.917-->00:37:48.917 in Tor proposal 2 71. Okay. So the hidden service side of the new, uh, next generation Onion 00:37:51.000-->00:37:56.625 service stuff is in, the relay side is in, the client side and the service side, are not in get 00:37:56.625-->00:38:03.250 master right now but if get - clone that branch you can build it, it works, just used it this 00:38:03.250-->00:38:09.208 morning, so I'm running an Onion service, here's a screenshot of my new style Onion service and 00:38:09.208-->00:38:14.125 you can grab that address and go to it, you can set up your own. Over the next couple of weeks, 00:38:14.125-->00:38:18.500 we're going to clean it up more and merge it into master, do an actual release that includes it, 00:38:18.500-->00:38:24.625 but you can use it right now, uh, if you want to. Okay. uh, so a couple of other things to keep 00:38:24.625-->00:38:30.750 in mind before we finish up. Er one of the important things: Tor is not perfect. There are very 00:38:30.750-->00:38:35.417 few, there's no such thing as um as the perfect privacy tool out there, especially in the face of 00:38:35.417-->00:38:41.125 billion dollar adversaries. So, one of the big things we hear about over and over is - 'oops I 00:38:41.125-->00:38:46.125 wrote my name on my blog post, i was using Tor but S**t', um and it's really hard to be perfect 00:38:48.625-->00:38:53.833 in the OpSec world. But that's a, that's a thing that um if you're trying to remain safe is 00:38:53.833-->00:38:59.375 something to to really pay attention to. Er, another piece, is the browser metadata side. We 00:38:59.375-->00:39:04.625 just started a bug bounty programme for Tor browser and some nice person gave us a proxy 00:39:04.625-->00:39:09.292 bypass bug yesterday and we put out a new version of Tor browser yesterday that patches it. So, 00:39:09.292-->00:39:15.917 yay for bug bounties, um but there's I mean - browsers are terrible things. So somehow we 00:39:15.917-->00:39:21.708 need to find a way to have a secure um Tor browser and um maybe that involves more 00:39:21.708-->00:39:27.750 sandboxing, maybe it involves, uh, trying to find all the other problems we can patch. Um, 00:39:27.750-->00:39:32.083 Chrome is especially bad news here because it basically has some built in proxy bypasses 00:39:32.083-->00:39:37.333 that are part of the designs, so it's really hard to to turn it into a Tor browser. Um, and then 00:39:37.333-->00:39:43.208 another piece - browser exploits. Um, I mean, Java is bad news and Flash is finally 00:39:43.208-->00:39:49.458 dying, but JavaScript is not so great, um image handling is not so great, there are all sorts of 00:39:49.458-->00:39:54.500 pieces of browsers and every so often we hear about some government that bought another 00:39:54.500-->00:39:58.792 FireFox Zero Day and used it against some people in the world. So that's a, currently a 00:39:58.792-->00:40:03.042 thing we need to keep working at. And then there's traffic analysis - imagine you're a 00:40:03.042-->00:40:08.042 large intelligence agency and you want to, um be able to monitor as much of the internet 00:40:08.042-->00:40:13.167 as you can in order to be able to seal a lot of the Tor relays in order to be able to to match 00:40:13.167-->00:40:18.625 up this user is going to that place Okay, so how can you help? There a bunch of different 00:40:18.625-->00:40:23.833 answers there. Um, how many people here run relays or bridges or something like that? 00:40:23.833-->00:40:29.667 I see a very tiny number of hands - more than before - please run relays. Make the Tor 00:40:29.667-->00:40:34.583 network stronger and safer. Each relay has an exit policy that let's you decide whether you 00:40:34.583-->00:40:37.875 want to be the third hop in the circuit, whether you want to be the person who goes to the 00:40:37.875-->00:40:43.333 website.So running non exit relays is also really useful. You can set them up at your 00:40:43.333-->00:40:48.042 university or your work or whatever - you're not gonna be that last hop in the circuit so 00:40:48.042-->00:40:52.708 it will be reasonably safe, nobody's probably ever gonna care except for the bandwidth 00:40:52.708-->00:40:58.125 you use so please help us make the Tor network stronger and safer. Another piece of that is 00:40:58.125-->00:41:02.333 - teach your friends about privacy. Teach your friends about Tor. there are a lot of, I 00:41:02.333-->00:41:07.792 mean, everytime I turn around, some fed, somewhere is lying to us about how the internet works. 00:41:07.792-->00:41:13.750 And we need to try to help the world understand how security works, why privacy is important 00:41:13.750-->00:41:17.750 and we, this community, are the ones who are going to do that, because who else is going to do 00:41:17.750-->00:41:23.542 that. Um, help, help find and fix bugs, i just, I talked about the bug bounty thing, um I was 00:41:23.542-->00:41:27.333 talking to Tom earlier who wanted me to remind everybody - we especially need Windows 00:41:27.333-->00:41:32.750 developers, most of our users are on Windows, most of the Tor developers are on Linux or BSD 00:41:32.750-->00:41:36.708 or MAC or something. So, if you're a windows developer, we'd especially love to hear from you 00:41:36.708-->00:41:42.542 um and and we need a lot of help there. And so pet symposium dot org is a conference that happens 00:41:42.542-->00:41:48.167 every year, the next one's in Spain, the last one was in Minnesota a couple of weeks ago, 00:41:48.167-->00:41:52.542 um and that's basically where the academics and researchers all get together to think about 00:41:52.542-->00:41:58.667 um new attacks and new defences and new designs on being able to keep people safe. And of course 00:41:58.667-->00:42:03.750 there's donate dot tor project dot org, we're a nonprofit that's relatively small compared 00:42:03.750-->00:42:08.500 to the size of the um billion dollar intelligence agencies out there so we'd love to have your 00:42:08.500-->00:42:14.292 help there as well - and I will end with um um an amazing endorsement from, I'm not sure 00:42:14.292-->00:42:19.792 if it's NSA or GCHQ because they didn't actually sign the slides that Ed Snowden walked out with, 00:42:19.792-->00:42:26.250 but it's uh, we're still the king of high secure low latency internet anonymity um so says 00:42:26.250-->00:42:31.250 NSA or GCHQ - and with that [audience applause] so rather than trying to do the Q and A 00:42:43.458-->00:42:47.542 thing in here because I've got like 60 seconds left or something, I'm going to go 00:42:47.542-->00:42:52.500 outside of that waiting area and I'm going to be, and I'm going to be the guy in the bright 00:42:52.500-->00:42:56.625 green shirt, I'm happy to chat with you and answer your questions and um give you um a 00:42:56.625-->00:43:01.667 card with the Tor PGP key on it or a sticker or stuff like that and I'm also going to be around 00:43:01.667-->00:43:06.458 for the rest of the weekend so, love to talk to yo. Thank you. [applause]