okay hi i'm roger and i'm going to talk today about russia and censorship and tour i've got
way too much to say and a lot of different topics so i'll i'll try to give everybody something
interesting and fun that they haven't thought about before so we earlier asked how many people
have heard of tour that sounds great how many people here have heard of tour bridges or pluggable
transports or the censorship side awesome okay i see some hands yes and some hands no so i'm
going to go through a little bit of what tour is how tour works i'm going to try to go through
that quickly and from there the same intro to tour and censorship and then we'll talk more about the
russia side of things and what that means for the rest of the world okay so tour is a non-profit
organization we're a 501c3 we provide a tour browser as software a lot of people use to be
safe on the internet we're also a community of activists and developers and users and relay
operators all around the world how many people here
run tour relays or bridges or snowflakes i see a few hands but not as many as there should be so
think about while i'm talking about this think about running relays to help out other people
so we also have some number of users maybe two million daily users maybe eight million daily
users and we're part of a much broader ecosystem of internet freedom anonymity research censorship
resistance free software so there's a a broad history of uh what the tour organization has done
over the years
happy to talk more about that afterwards so how do you actually build one of these what's the
what is tour for so we've got alice over here she wants to browse the web to some website bob
where can the attacker be what sort of threat model are we worried about one answer is maybe
the attacker is watching alice maybe they're watching the starbucks connection or they are
the local tunisian isp or maybe they're watching some pieces of the backbone internet maybe they're
at&t or verizon or deutsch telekom
or the nsa or maybe they're watching bob maybe they're watching wikileaks to learn
what users are connecting to them and who's trying to learn things or maybe the adversary is bob maybe
it's cnn.com and they want to know who their users are so they can advertise to them better
and one of the other important pieces anonymity is not encryption you should use encryption
encryption is good but even when you're using encryption somebody watching your network traffic
learns who you're talking to when you're talking to them how much you're talking to them how much
you're talking and that traffic metadata is what all the agencies and organizations use to try to
attack things these days so we've got creepy nsa dude uh how many people here recognize creepy nsa
dude i'm hoping this is the correct audience okay quite a few hands i did this talk uh like a couple
weeks ago to a different crowd and they're like who is that so we should all remember uh statements
from the nsa like we kill people based on metadata okay so how do you actually build one of these the
nsa is basically a single centralized single hot proxy like vpns and anonymizers so all the users
show up to that single relay and there are some problems the first problem is it's a centralized
point of trust so what happens if that central point that vpn decides to go bad and it's worse
than that because it's a central point even if the vpn itself is trying to be honest you still
there's one wire in and it's the same wire out so if you're able to watch that then you can match up
with your own trust and so the central point is you can match up with your own trust and you can
do that much more with vpn to understand who's talking to who so the goal of tor is to distribute
the trust so that there's no single point that gets to learn about this user goes to that
destination so i'll skip over how the crypto works but basically you build a tunnel through
three relays so no single relay knows what's going on okay and we've got a network of about 7 000
volunteer relays around the world here's a graph of bandwidth load and bandwidth capacity over the
past ten years or so and it's like we're running a network of about seven thousand volunteer relays
So the second half of what Tor is, I talked about Tor, the anonymity, the network layer,
the hiding your IP address layer.
The second half is the application level side where we have Tor browser based on Firefox
that tries to fix all of the application level issues like cookies, used to be flash, fonts,
all sorts of stuff in the browser that could be used to recognize you.
Okay.
Another key point to realize, transparency is critical for Tor as an ecosystem and for
people to be able to trust it.
So yes, that means it's open source, it's free software.
It also means that we give you specifications and design documents to say this is what we
meant to build, this is what we're trying to do, this is what the security goals are.
And also we are publicly identified people.
Hi, I'm Roger.
I built Tor.
I'm happy to explain that to everybody.
And that level of transparency is critical for a privacy tool.
And I always have somebody come up afterwards and they're like, oh, ha, ha, the anonymity
people are talking about transparency.
That's so stupid.
No, actually, the key is privacy is about choice.
And we choose to be transparent in order to build a stronger, safer, bigger ecosystem
and community.
Okay.
So that was the crash course on Tor.
So far, so good.
Now let me talk a little bit about the censorship side of things so you've got some context
for what I'm going to talk about later.
So the first arms race, the 7,000 public relays I was talking about, there's a list of them.
You the censor grab those 7,000 IP addresses and block them and you're done.
Now nobody can bootstrap into the Tor network.
There's nothing to connect to.
So the first step of the arms race is we have unlisted relays called bridges.
And the goal is the users who are in some censored situation can get...
Get some bridges in order to bridge into the Tor network but the adversary hopefully can't
get all of them.
And then the second arms race beyond IP addresses is based on deep packet inspection or DPI.
So the goal is there are some protocols that the censor might try to block by looking at
packet patterns or bytes in the packets.
So the goal originally Tor tried to look like TLS because who would block TLS and then
Syria blocked TLS and a bunch of other places started doing that.
We're not trying to exactly mimic Firefox talking to Apache.
Instead we have a more modular approach where Tor takes care of the privacy, the anonymity
side of things, and then you can plug in various transports.
And the goal of each transport is to transform the Tor traffic into some other protocol appearance
that the censor is not willing to block.
So there are a couple of popular ones of these that work well.
The most popular is called OBS4.
Obfuscating proxy.
Basically the idea is that it adds a layer of encryption on top of whatever the input
is and that means there's no recognizable headers.
There's no structure at the beginning that you can put your Zeek rules on and start recognizing
the protocol.
So the idea is there's a long tail of random stuff on the internet and if you have a protocol
where the automated classifier says I don't know what that is, then the censor has to
choose.
Do I block everything that my classifier can't classify?
Because then there's going to be a long tail of random stuff and a bunch of angry people
who call up the great firewalls help desk to complain.
Or do I allow through everything that I can't classify?
And in that case, protocols like OBS4 can go through also.
There's another transport we've been working on more recently called Snowflake that basically
does a WebRTC connection.
So it looks like you're doing an online video call.
Skype, Zoom, Jitsi, BBB, all of these.
But the reality is that you're tunneling your Tor traffic through that video call.
And one of the cool things about it is that you can install a browser extension to become
one of these Snowflake volunteers.
So you don't have to apt-get install Tor and know how to edit a text file and so on.
You just volunteer your browser as one of the tens of thousands of volunteers that proxy
proxy from their censored situation into your browser extension and from there to
the rest of the Tor network.
So that means we've got a lot more volunteers and it's easy to have more and more dynamic
volunteers.
And that means we can do more, we've got more flexibility about how to use them.
And then the third pluggable transport that is important to learn about is called Meek.
It's based on domain fronting.
So the basic idea for domain fronting is I'm going to make a TLS connection to a popular
cloud provider like Amazon or Fastly or CloudFlare if they still allowed it.
And the idea is from the outside it looks like you're connecting to a popular website
that the censor is not willing to block.
But once you've done the TLS connection and you've labeled in your server name indicator,
you've specified I'm trying to connect to this totally ordinary website.
Inside that connection, then you provide a host header at the HTTP level to say at what
I really wanted to go to was this other server.
So from the outside it looks like a totally ordinary connection to the right IP address
to an acceptable server, but on the inside you end up actually connecting to some other
cloud provider that, for example, tunnels you into the Tor network.
So one big downside of domain fronting is you have to pay the front domain, whether
that's Fastly or CloudFlare or Amazon.
Or Azure or whoever it is.
So you can use it for signaling, but you probably can't use it for actually proxying all of
your flows.
And then the last key background thing to think about is we need smart algorithms for
what we call bridge distribution to match up volunteers who are running bridges with
people who are in censored areas and need to use them.
So we have a couple of...
Basically the idea is to take the bridges you've got and divide them into buckets where
each bucket requires...
Divided by the number of bridges you have.
And then the other bucket requires a different strategy for how you're going to give it out.
So one of them is you email us from your Gmail account, and we give the same answer to the
same Gmail account.
And the goal there is if you have one Gmail account, you can get a set of bridges, but
you need thousands of Gmail accounts to enumerate all of them in that bucket.
There's another one that looks at what subnet on the internet you're coming from.
There's another one that's based on a captcha.
So that's the basic idea.
And we've got something similar in Snowflake.
Snowflake land to match up volunteers with censored users so they can know who to make
what looks like a phone call to.
Okay.
Sounds good.
We're still on time.
Now let me talk more...
So that was the background.
Now let me talk more about what we're talking about today, what Russia did, and then how
we dealt with it.
So in...
Our story starts in December, the beginning of December last year.
And at that point, some ISPs in Russia, it wasn't all of them, but it was a third or
half or something.
They blocked the public IPs in the Tor network by IP address.
They blocked the Meek Azure domain fronting pluggable transport, and we'll talk later
about how they actually did that.
They grabbed the IP addresses of the OBS4 bridges that come with Tor browser, the ones
that are easy, they're built in, and they blocked those by IP addresses.
And they blocked the Snowflake protocol by what turned out to be DPI.
So in the same day or so, they rolled out a bunch of these that I guess they'd been working
on in parallel and decided that that was the day to roll out their Tor block.
Right around then, a little while later, we got an official notice to one of our hosting
providers, Hetzner, in Russian from the Russian censorship ministry saying that our
website is bad and we need to stop having a bad website or they're going to block it.
And we don't really have a way to stop having a bad website.
So a few days later, they blocked it, and that was the official censorship block.
Okay.
So here's a graph of roughly the number of people who were using Tor to connect to direct
public relays.
So you see it starts at maybe 300,000, and we lost maybe a third of them.
And similarly, a bunch of people switched over to using bridges during that month.
So in some sense, this one's sort of a sad graph, this one's sort of a happy graph.
We'll talk more about the balance there.
So this is the detail of how they did the Snowflake DPI.
Basically, we tried to look like WebRTC, but specific implementations behave in certain
ways.
And we had an extra extension on the server side that the Google Chrome WebRTC implementation
doesn't have.
So that was the distinguisher that they used.
And we patched the WebRTC library that we use and put that out a few days later.
So the Snowflake DPI block lasted for maybe 36 hours or something.
Okay.
So we put out a new version of Snowflake that got around the blocking that they did.
And they haven't really rolled out any other DPI-based approaches to block Snowflake since
then.
So that was sort of the good news.
So this is the Meek Azure detail.
And all these slides are online.
I know that the font is small, so you don't have to worry about the details.
But I was looking at trying to figure out, like, how do they block the domain fronting
thing?
Because we're making a connection to the Azure site.
Okay.
Okay.
So the front domain that we're using is ajax.aspcdnnet.
So it's like a main web server that serves JavaScript to every other website on the planet.
So at first I was thinking, oh, my God, they blocked this JavaScript server.
The whole Internet is going to be angry because Russia just blocked the front domain that
they never blocked.
Turns out they blocked it by IP address.
Turns out they blocked Azure by IP address.
Okay.
So no shit, let me tell you that time that we got Russia to block all of Microsoft Azure
story.
And that also lasted for a day or so.
And at some point, I guess somebody at Microsoft noticed that nothing was working and they
rotated to a new IP address.
So at that point, you couldn't do Skype from Russia.
You couldn't do, like, whatever it is that Microsoft hosts on Azure because they do geodns.
So it isn't that they blocked.
Okay.
So there's a different IP address for where in the world you are, and there's one IP address
that everybody in Russia mapped to, and they blocked that IP address.
So I guess the other side of the question is, was Russia willing to do that?
Did they think it through and they said that collateral damage is acceptable, we're going
to do it?
Or was it just somebody who was like, I saw them make a connection to this IP address,
so I'm going to block that.
I don't know what it is.
And then they blocked a whole lot of things, including Skype.
It's hard to say.
Okay.
So the steady state-ish that we're in right now is Russia is crawling various bridge addresses
and trying to block them by IP address, but it's still not instantaneous.
You still have days to weeks between when a new bridge shows up and we give it out to
a lot of people and it gets blocked.
And other OBS4 bridges are working fine, so they're definitely not blocking by protocol,
they're definitely blocking by IP address, and Snowflake and Meek are still working fine,
but they're maybe a little less fun to use than the main ones.
Okay.
So what else happened around the same time?
We put up a forum post explaining to people in Russia what happened and how they can get
around it.
And it turns out we had just set up the Tor forum a couple of months before that, and
we were using discourse because we want a third-party hosted thing.
And because we had a third-party hosted thing, we set it up on forum.torproject.net because
we wanted to isolate the domains.
I don't want to know whether discourse is like faking cookies and making gitlab.torproject.org
cookies.
So we gave them a totally separate domain for that.
Russia never blocked torproject.net.
So that means our forum was reachable the entire time, nobody's ever thought to block
that.
And that means we've got 177,000 views on this Russian language post explaining what
happened and how you can get around it because they never blocked this part of it.
But I guess it's never occurred to them that an organization could use more than one domain
name.
So the longer-term picture here, we start with our 300,000, we lose the first 100,000
in a month, and we lose the next 100,000 over the next couple of months.
So it's sort of a steady state now, but there are an uncomfortably large number of places
in Russia that are working hard to continue to try to block tor.
And there are quite a few people using torproject.net.com.
So we've got a lot of people using torproject.net.com.
So let me take a side note here.
So I've got all these graphs with numbers on them.
But the numbers may or may not be accurate because we've been…
So one of the challenges we have in the tor world is how do we do safe enough metrics.
So the tor relays or bridges, they don't know what you're doing with tor, but they see you
making a connection and they can publish an aggregated 24-hour summary of how many users
they've seen from various countries.
The challenge there is how do we extrapolate from the view of each individual relay how
much total, how many total users we have, how much usage we have.
So the numbers that we have here are assuming each of these users is leaving their tor browser
on all day.
And I'm pretty sure that in some countries where it's an internet cafe and you go in
and you use tor browser for an hour and you go away.
Yeah.
We're off by an order of magnitude.
So one way of visualizing this, I've been working with the metrics team to try to figure
out how to visualize it.
So the green line up there is if every tor user runs their tor browser for only a couple
of hours a day.
In that case, we've got 20 million, 25 million daily users.
The red line down there is if every tor user uses their tor, has their tor running all
day each day.
And the graphs that I've been showing you…
Are that blue line right down there by the red line.
So this is a huge range of lower bound, upper bound on how many tor users there are all
day.
And we'll get back to the metric side of things, but I wanted to let you start thinking
about how do we actually accurately understand the graphs we're talking about.
Okay.
And here's a graph of the number of volunteers we have in snowflake land over the last couple
of months.
You can see a bump in December.
Okay.
Of the standalone proxies, the browser extension people.
But they're folks who actually install the Go client on their Linux machine.
They know how to do Go get and it's a headless browser.
It's a headless snowflake proxy.
And then you see a much bigger jump in March when the actual invasion was happening of
people installing the extension side of things.
And you can see the growth.
And the number of users we have in snowflake.
We've been working on some scalability issues to try to be able to handle more and more
users on the snowflake bridge.
Happy to chat about that one later.
You can also see as we fix some of the scalability issues, the throughput that we're handling
gets a lot better.
So we're handling maybe 10,000 to 50,000 users of snowflake in Russia each day at this
point.
Okay.
Okay.
So we did a couple of bridges that we had.
We did an advocacy campaign in December.
That's the first bump that you can see.
And then we did another advocacy campaign in March to be like, hey, everybody, run a
bridge, help people in Ukraine and Russia get around the censorship that they are seeing
or will be seeing soon.
Okay.
So what are the other things that we did once the initial censorship rolling out?
One of them was we set up a telegram autoresponder and the idea is if you're a telegram user,
you can send us a telegram request and we'll send you a couple of bridges and that way
there's another avenue for getting bridges.
So that you can imagine the censors would block that pretty quickly because they can
get a telegram account.
So they get one and they send us a request and we send them the bridges.
It turns out that telegram accounts are assigned numerically sequentially.
So when you send me a telegram message, I can learn how old your account is.
So our secret sauce there.
It's not all that secret because I'm about to tell a group of thousands of people at
DEF CON.
Our secret sauce there is we look at how old your telegram account is and if you have a
pretty established one, we give you this set of bridges.
And if you have a new one, we give you this other set of bridges.
And so far the censors make new telegram accounts and then they get only the second set of bridges.
So there are a bunch of telegram-based distribution bridges that we've been using.
That end up with hundreds of users for a while until they get rotated out.
So that telegram age-based trick is a fun example of another asymmetry that we need
to explore.
But it's also an example of an unstable one because once we explain it enough, then the
adversary is going to go out and be like, yes, I do have a pile of old telegram accounts
because I made them for this totally unrelated reason.
And I'll use them to try to learn a bunch of the bridges.
Okay.
So that's the kind of measures that those Tor people are giving out.
Okay.
Another fun thing, which I didn't put in the slides and I'm not going to present to the
thousands of people at DEF CON, we have some nice people inside the Russian censorship
ministry who work on censoring Tor who reached out and wanted to explain what they do all
day and how that works and how the censorship works and what they're focusing on.
So I am not going to read any quotes from them translated or otherwise.
Okay.
I don't know what their situation is.
But they were explaining that it's not as automated as you might imagine.
Their job is to actually download Tor browser, go through the same steps that users do, get
an IP address, put it in a spreadsheet, yes, and e-mail it to the censors who then add
that IP address to the censorship infrastructure.
So that is the feedback loop that we're talking about and that explains why a new bridge will
continue to work.
It will work for days to weeks until that feedback loop has succeeded and that particular
IP address gets blocked.
Okay.
So there are a bunch of other lessons I'm going to skip forward to make sure we get
to a lot of things.
At the same time in March, Ooni, the open observatory for network interference, they
do censorship measurement stuff, they had just rolled out a snowflake test from around
the world.
So the first thing I looked at was the China
graph.
And it's pretty cool that snowflake was working, is working in China in March.
And there's a longer time scale version of this that shows mostly green.
So green is successful bootstraps from all around the world of Ooni clients connecting
using snowflake.
But also at the very bottom of the green column, you can see maybe 5% or 10% is yellow.
So that's not censorship.
So much.
So much as being on crappy internet connections or being given a snowflake volunteer that
doesn't have the throughput to let you bootstrap properly.
So we've got more work to do in terms of engineering to try to make every snowflake
connection be fast, fun, and reliable rather than most of them, which is what we've got
going on right now.
And it would be even better if we could have snowflake auto-recognize, I get through this
part of bootstrapping.
But not that part.
I'm trying to do the introduction of the piece of WebRTC.
And this is the one that I got through.
And this is the one that failed.
So that way we could have all of the users or all the Ooni probes auto-diagnosing what's
gone wrong and help us understand how the internet works around the world.
Okay.
So that was what Russia did and responses.
Now let's talk about some other stuff that I either don't understand that happened to
us around the time or that is sort of a bizarre side effect.
So one of them was when that blocking of our website, like the legal request came into
Hetzner, there's an NGO inside Russia that said, that's illegal.
That's unconstitutional.
The Russian censorship ministry broke their own laws by blocking your website.
We want to fight them in court.
And we were like, yeah, okay, so there's a Russian group that wants to go fight the
Russian judges.
And the Russian court, like that's going to work.
But on the other hand, I want to empower them to change their country from the inside.
I don't know what's going on in Russia and they do.
And if we can let them fight the fight they want to fight inside, then yeah, for sure.
Let's do it.
And it turns out that they did go through the fight and they won.
They actually got a judge in the Russian court to be like, yes, you're right.
That was unconstitutional.
That was illegal.
That was illegal.
The process by which they decided to block your website did not involve you and therefore
you must unblock Tor in Russia is what the judge said, which was, did not expect that.
And then of course the follow up question is, okay, what do you mean unblock?
And I don't know whether that judge knows what they meant by unblock either.
We haven't seen much change in terms of the behavior of the censorship ministry trying
to find bridge addresses.
And blocking unblocking them by IP address.
But I think our website has started working in more places in Russia.
So that was a sort of a bizarre side effect that we hadn't been expecting where, uh, and
this, this, this last part just came out a couple of weeks ago and there's a follow
up of course, where I imagine they're just going to go through the process correctly
and then they will have blocked us legally.
And that'll be that they're also taking the opportunity to pull Google in and be like,
Hey Google.
You have to censor your app store.
You got to take that Tor browser thing out of the Android play store.
Uh, so we'll see, we'll see where that goes.
Another fun side effect that we were not expecting, uh, some nice person on the internet broke
into the Russian censorship ministry and took all their files and stuck them on the internet.
So if you are interested in reading through 360,000, uh, PDFs that came from the secret
agency in Russia on censorship.
Uh, the internet has them and it would be great if you could look through them and let
us know what you find.
Uh, we have a couple of people who speak Russian.
We haven't found anything tour specific.
Uh, I would caution you that it's conceivable that the Russian misinformation ministry has
put something in those PDFs that you might not want to load them on your computer directly.
So consider that as an, as the DEF CON audience that you are, and please let me know if you
find anything.
And, uh, if you're interested in, uh, in this data dump, so thanks internet.
Stuff that happened.
So RT.com is censored in a lot of places in Europe.
I'm going to get back to what was going on then, but I, I noticed that first because
I heard somebody talking about censoring RT Russia today in Europe, and because the tour
network has a lot of exit relays in Germany and France and so on, suddenly it became harder
for you to read RT.com over Tor.
That's kind of fucked up.
That's not what I, I want a tool that lets people reach whatever they want to reach on
the internet.
Uh, the, the other side of that is the way that the, uh, blocking happens by IP address
is bidire, bidirectional.
They black hole all traffic in either directions.
And that means that if you're a Tor user trying to go to a Russian website, you connect out
of a Tor exit node and then your connection into Russia fails because they're censoring
the Tor network.
So suddenly they've cut themselves off in a way that we didn't at first expect.
Um, and another side of that, uh, we got a bunch of new relays in the, in the Tor network.
Yay, more relays.
And they've got nicknames like fuck Russia or support Ukraine.
Uh, but we also have some organizations in Russia who've been trying to sneak in some
misbehaving relays and now they've got an excellent opportunity to sneak in a few more.
And if they name them support Ukraine, maybe we'll be happy and leave them there.
So that's a.
An arms race that we can also chat about more afterwards.
Okay.
So another surprise that I'm still working my, my head around, here's a sort of a heat
map of where in the world our Snowflake volunteers are.
So we've got a bunch in the U S we've got a bunch in Germany.
We've got a bunch in Europe.
We have a bunch in Russia and maybe these are people in the free part of Russia who
installed the Snowflake extension to help people out around the world.
Or maybe these are confused people.
Yeah.
Snowflake helps them get around censorship.
So they installed Snowflake.
So that's, that's bad.
That's not what we want.
So there's a lesson here about messaging or UX in terms of, uh, explaining which components
you should install and why and how volunteer ecosystems work.
On the day of the invasion, we had a huge spike in users of Tor in Ukraine.
What the heck?
Yeah.
Yeah.
I have no good explanation here.
Uh, if you have any good ideas of why suddenly a huge spike of people, uh, ended up using
Tor in Ukraine, maybe a, a geo IP mistake, uh, maybe, maybe lots of things we can speculate
all day long.
Uh, this is a, another bizarre mystery in Tor land, but the, I guess the most important
thing to think about here is the user impact on the censorship arms race.
So yeah, we've got pluggable transports, we've got domain fronting, we've got all these tricks
that we can do.
But every time the censorship arms race takes another step forward, the users who don't
care that much fall off.
So yeah, we, we saw a bunch of people switch from connecting to public relays over to
using bridges, but also we lost a bunch of people.
So I guess the, the most important thing to think about here is we need a way to improve
the usability of the arms race or not take so many steps forward because, uh, the sensor
is willing to keep taking the steps.
Yeah.
And some of the users are, and some of the users aren't.
So make sure to think about the, the user impact, uh, in terms of censorship.
That's that's something, I mean, I don't have a good fix, but it's something that we all
have to keep in mind.
Okay.
So what's the, what do we need to do next?
What what's going on?
And I guess the, uh, there are a bunch of building blocks that we have and I'll go through
them and then I'll describe some of the, the improvements and fixes.
So the first building block is a DPI resistant point to point channel.
So that's OBS four, but it's not just OBS four, there's VMS and a bunch of other protocols
out there that try to look like nothing.
So they're unclassifiable.
So that that's building block one building block two, we need some sort of Sybil resistant
signup mechanism.
We need something that, uh, is going to let users get a bridge address and the sensors
can't get all of them.
So the telegram trick is, is a fun example to get you thinking about them, but we need
more situations where we can exploit that asymmetry.
And it needs to be something where we can automate the verification side.
So think like Twitter accounts, friends on Facebook, something like that, where users
have a demonstrated social connections that are hard for the sensor to, to scale up and
imitate that, but that are easy for us to verify.
Like I don't know how to verify in an automated way, how many Facebook friends you have, how
many legit Facebook friends you have.
Maybe there's an API for that.
Love to chat with you afterwards.
Building block three, we need some way to figure out which bridges are actually blocked
in each place around the world.
So the easy answer is you get like a vantage point somewhere and you scan them.
But if they learn what that vantage point is, then they just watch you scanning.
So that's a, an arms race of itself.
There's a new tool called bridge strap.
And the idea is it, you feed it a pile of bridge lines and it connects to each of them
and tells you whether it failed or whether it succeeded.
It's all public data.
You do it.
We publish it by the hash of the fingerprint.
So there's nothing here in this file that you can use to discover where the bridges
are and block them.
But if you already know about the bridge, then you can go to the bridge strap output
and decide, does it work in Turkey?
Does it not work in Turkey?
So we've got vantage points right now in China, Turkey, Russia, Ukraine, and we need to scale
that up and we need to be smarter about how that works.
Maybe we only test the ones that for metrics.
Okay.
For metrics reasons.
It looks like they used to have a lot of users and now they don't because we don't want to
have too much surface area exposing too much building block four.
We need a whole lot of addresses.
So we've got the nice volunteers who are setting up bridges one at a time.
We also have another person who's working on an automated framework for first spinning
up cloud bridges.
And that way on Hetzner or OVH or digital ocean you basically auto spin up a new bridge.
And then there's a mechanism.
For scaling it down and putting up a new one next.
So the more automation we can have there, the better.
And so this is actually happening right now where dynamic bridges are going up and down
and they're easy to use.
The next building block we need is some sort of signaling channel like domain fronting.
So there's a reliable way for Tor browser to get around the firewall.
Not for all of your traffic necessarily, but something that they're unlikely to block.
So domain fronting is one example.
Maybe we tunnel it through email, through DNS over HTTPS.
There are some examples there.
So milestone one in terms of what we're doing to fix this long term is we want Tor browser
to use that signaling.
So if you fail to bootstrap, use domain fronting or something like it to pull down a list
of recommendations for what your Tor browser should automatically do depending on what
country you're in.
So there's a JSON file that describes.
If you're in Belarus, then start with your built in OBS4 bridges because those still
work and then from there try other bridges.
If you're in China, go straight to Snowflake because the other ones are probably going
to be a fail for you.
So building this map of what works in what country in what order and then the goal is
that your Tor browser says, hey, I failed to bootstrap.
I think you're in Brazil.
I think this should have worked.
Are you in a different country?
Help me help you bootstrap in an automatic way.
So the goal of that is that you start off with the automatic approach where while it's
doing the domain fronting connection, it learns what your IP address is and turns that into
a country.
Doing this in a way that makes users comfortable with the automation is another piece of that.
Okay.
So milestone two that we haven't done yet but we need to do in order to have a more
robust system, we need some sort of bridge subscription model.
So right now we have a bunch of volunteers who set up.
a bridge and then they get bored and they take it down.
So it isn't that the bridge got censored but the user found it, they were happily using
it, and then the bridge went away and now the user no longer has a bridge that works.
So we need some once we've got this automation, we can use the domain fronting, the signaling
channel to learn I used to have this bridge.
Can you give me a replacement?
And the trick there is you don't need the same level of proof of work or captcha or
scarce resource proof.
Because you already did that last time.
So you show up saying here is the bridge that I used to use.
Can you automatically in the background give me the replacement?
And that subscription model where your Tor browser seamlessly switches over to the new
bridge is something that we need to have as a building block here.
Okay.
And the fun thing about that is the dynamic cloud bridges work really well with that subscription
model where you spin up a bridge and then it goes away or it gets blocked.
And you spin up another one next door and then you tell all of the users through the
signaling channel you used to use that one, switch over to that one.
So if we can keep on IP address hopping like frequency hopping over the cloud provider
IP space faster than the sensors can keep up, then we've got something going on.
Okay.
And then the third building block, the third milestone that we need to hit is a reputation-based
bridge distribution idea.
So there are a bunch of research papers out there.
There are salmon, locks, hyphae, and so on.
But basically the idea is when users, once you've got the subscription model going on,
so users have some sort of long-term cryptographic identity, keep track of when I give you a
bridge, does it get blocked or not?
And if it does get blocked, then screw you, I'm not going to give you more.
But if it doesn't get blocked, then you're doing great.
We'll keep on giving you more bridges.
We'll maybe put you as the only set of users.
There are users on a bridge that will long-term not get blocked because the ten of you have
demonstrated that you're not the sensor and you're not trying to learn bridges and block
them.
So there's a lot more going on on that.
There are a bunch of parameters we need to get right.
Salmon actually has a design where once you have a high enough reputation, you can invite
your friends in at a similar reputation level.
And that makes the system scale a lot better, but also there's a bunch of analysis in terms
of...
You can get one high reputation person and then invite a bunch of fake people that are
also high reputation.
So getting the parameters right is important here, but this is where the arms race has
to go.
We need this sort of asymmetry where users have social connections or we keep track
of whether the user has behaved correctly or not and reward the ones that are not ending
up blocking their bridges.
Okay.
We've got a little while more.
I'm going to talk about some other things that have been bugging me over the past couple
of years.
So one of the big ones is when Russia invaded Ukraine, a lot of Western companies are like,
ha-ha, I'm going to sanction them.
We heard about ISPs that are like, I'm de-peering from Russia.
That'll show them.
And then we heard about Western companies like Facebook and Google and so on saying,
I'm going to stop allowing Russians to have...
I'm going to have like Gmail accounts and that'll show them.
We'll punish them.
We'll put pressure on them.
And the key to realize, a couple of years ago, Trump was trying to do something similar
in Iran.
It was called the Maximum Pressure Sanctions Program.
And he would call up like Netflix and Google and Facebook and be like, I know the law doesn't
require this, but could you like...
Everybody who speaks Farsi, could you like turn off all their accounts?
Thanks.
And the problem with that is...
Iran...
Iran periodically was trying to like isolate themselves from the internet.
Their goal is they want their own halal internet.
They want their own like safe, religiously okay Facebook, their own Google, their own
Gmail, their own whatever.
And every time Iran tried to cut themselves off from the internet, everybody in the country
is like, fuck you, you blocked Google.
I don't like this.
I need you to stop the censorship.
Whereas when Trump said, hey Google, can you like turn off all the accounts of all the
people from Iran?
Now, when they block Google, nobody cares because Google has already screwed them.
Google has demonstrated that it has no interest in having them as users.
So that means that those sanctions cause the government of Iran to be able to block
more things without any collateral because there's nobody who's left who's angry because
the Western companies let them down anyway.
So we're gonna see the same thing in Russia where if like Facebook decides to stop providing
service to Russia.
Then nobody's gonna get upset when Russia blocks Facebook.
I think actually Russia did block Facebook, but next it's gonna be LinkedIn or whatever
comes next.
So we're gonna see the same isolation results from sanctioning.
Something else that is also kind of bizarre, the European Union decided that they needed
to block misinformation, especially they needed to block RT.
So okay, they unlisted the television channel.
Sounds good.
But they also had an EUY mandate that every member country needs to build and deploy a
censorship infrastructure in order to block the RT.com website.
So that is a fucked up thing that Europe has decided to do.
And I mean, sure, there's the slippery slope of, you know, once you've built your internet
censorship infrastructure, then what else are you gonna use it for?
And I guess the other side of that.
I mean, I was actually.
I ended up arguing with a German guy who's part of the Brussels group that decided to
do this.
And I was like, why are you censoring the internet?
What's going on?
And he kept stopping me.
He's like, no sanctions, not censors, sanctions.
And I'm like, okay, well, that's the word you're using.
But the reality is that you're encouraging every country to buy and deploy a censorship
infrastructure.
And while I was having that argument with him.
And while I was having that argument with him.
I was having that argument with him.
So he got all the right people pointed out that Romania interpreted that EU requirement
as you gotta block all misinformation.
So Romania apparently has a multi megabyte list of URLs that they decided to censor in
their country because of this kind of vague, poorly worded, you better block RT requirement
from the EU.
And they ended up blocking software update sites and so on.
So that's, and you, the same Brussels guy was explaining, no, this is a good idea.
temporary six-month sanction in six months we're gonna you know revisit it
but the problem is these countries are gonna roll out their censorship and
they're not gonna unroll it out in six months they're gonna find something else
to do with their censorship infrastructure so I guess the the big
question is what the fuck Europe why you like censoring so much and if you as the
audience could keep on asking that question to the European Union decision
makers that would be awesome because this is a I mean they start off trying to
argue that they need freedom of information and freedom of speech and
and then they end up using the same tactics to block more things and this is
not where the world should go
another kind of interesting lesson to learn here so our story started in
irm
December of last year, but from the mainstream media's side, the story started in March of this
year. So, tour blocking, censorship blocking, internet censorship is an early warning system
for there's about to be some fucked up stuff going on in that part of the world, and watching
the next political events gives you some early sense of where important things are going to be
and where we, as the world, should put our resources. And the story is not over. There's
more going on. One of the things that's happening recently from the Great Firewall in China is
they've been rolling out an entropy test, where if you're connecting from China to a couple of
cheapo providers like DigitalOcean, Alibaba, Hetzner, OVH, then they look at how many ones
there are in your first couple of packets and how many zeros there are, and if it's about even,
they cut that connection. So, that means that if you're in China trying to do an OBS4 connection
to one of these IP spaces, then it fails. And maybe they're fine with that collateral damage.
I would argue that they can't afford to roll that out to the rest of China, because there's too much
just random protocols on the internet that they'd end up blocking. I was talking to a U.S.
academic researcher who did a study at his university of, if I put this censorship
rule in my system, I'm going to be able to do it. And he said, well, if you're in China,
to my students at my university, he ended up concluding that he would block one or two percent
of all the flows going through his university. So, I don't think China can afford to make this
broader than those destination IP spaces, but I don't know. So, we are going to need better
transports that look like nothing in better ways, or that look like something in better ways.
That's going to be a talk in a bit. We have these awesome,
Tor Onion badges at the Tor booth in the vendor area. So, after this talk ends, I'm going to head
over to the vendor area. I'm wearing my bright green shirt. I'm easy to spot. And I will answer
all of your Tor questions until you have no more Tor questions. So, we are out of time at this
point. Some things for you to think about. Please run Tor bridges. If you can apt-get install Tor,
then run an OBS4.
Please run Tor bridge on your Debian or Ubuntu or whatever system. Please run Snowflakes. We've got a
Firefox extension. We've got a Chrome extension. So, these are easy to add, and you'll be one of
the tens of thousands of people who are helping people in Russia get around their censorship.
Please run Tor relays. Please make the Tor network stronger. And also think about the
anti-censorship research area. We need more academics engaging in workshops like FOCI and
conferences like PETS to think through how to engage with people in Russia. So, I'm going to
analyze these things. And there will be ongoing Tor Q&A at the vendor booth. And I believe I'm at
the end. So, thank you.