131-verify-tor-usage.txt 5.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148
  1. Filename: 131-verify-tor-usage.txt
  2. Title: Help users to verify they are using Tor
  3. Author: Steven J. Murdoch
  4. Created: 2008-01-25
  5. Status: Needs-Revision
  6. Overview:
  7. Websites for checking whether a user is accessing them via Tor are a
  8. very helpful aid to configuring web browsers correctly. Existing
  9. solutions have both false positives and false negatives when
  10. checking if Tor is being used. This proposal will discuss how to
  11. modify Tor so as to make testing more reliable.
  12. Motivation:
  13. Currently deployed websites for detecting Tor use work by comparing
  14. the client IP address for a request with a list of known Tor nodes.
  15. This approach is generally effective, but suffers from both false
  16. positives and false negatives.
  17. If a user has a Tor exit node installed, or just happens to have
  18. been allocated an IP address previously used by a Tor exit node, any
  19. web requests will be incorrectly flagged as coming from Tor. If any
  20. customer of an ISP which implements a transparent proxy runs an exit
  21. node, all other users of the ISP will be flagged as Tor users.
  22. Conversely, if the exit node chosen by a Tor user has not yet been
  23. recorded by the Tor checking website, requests will be incorrectly
  24. flagged as not coming via Tor.
  25. The only reliable way to tell whether Tor is being used or not is for
  26. the Tor client to flag this to the browser.
  27. Proposal:
  28. A DNS name should be registered and point to an IP address
  29. controlled by the Tor project and likely to remain so for the
  30. useful lifetime of a Tor client. A web server should be placed
  31. at this IP address.
  32. Tor should be modified to treat requests to port 80, at the
  33. specified DNS name or IP address specially. Instead of opening a
  34. circuit, it should respond to a HTTP request with a helpful web
  35. page:
  36. - If the request to open a connection was to the domain name, the web
  37. page should state that Tor is working properly.
  38. - If the request was to the IP address, the web page should state
  39. that there is a DNS-leakage vulnerability.
  40. If the request goes through to the real web server, the page
  41. should state that Tor has not been set up properly.
  42. Extensions:
  43. Identifying proxy server:
  44. If needed, other applications between the web browser and Tor (e.g.
  45. Polipo and Privoxy) could piggyback on the same mechanism to flag
  46. whether they are in use. All three possible web pages should include
  47. a machine-readable placeholder, into which another program could
  48. insert their own message.
  49. For example, the webpage returned by Tor to indicate a successful
  50. configuration could include the following HTML:
  51. <h2>Connection chain</h2>
  52. <ul>
  53. <li>Tor 0.1.2.14-alpha</li>
  54. <!-- Tor Connectivity Check: success -->
  55. </ul>
  56. When the proxy server observes this string, in response to a request
  57. for the Tor connectivity check web page, it would prepend it's own
  58. message, resulting in the following being returned to the web
  59. browser:
  60. <h2>Connection chain
  61. <ul>
  62. <li>Tor 0.1.2.14-alpha</li>
  63. <li>Polipo version 1.0.4</li>
  64. <!-- Tor Connectivity Check: success -->
  65. </ul>
  66. Checking external connectivity:
  67. If Tor intercepts a request, and returns a response itself, the user
  68. will not actually confirm whether Tor is able to build a successful
  69. circuit. It may then be advantageous to include an image in the web
  70. page which is loaded from a different domain. If this is able to be
  71. loaded then the user will know that external connectivity through
  72. Tor works.
  73. Automatic Firefox Notification:
  74. All forms of the website should return valid XHTML and have a
  75. hidden link with an id attribute "TorCheckResult" and a target
  76. property that can be queried to determine the result. For example,
  77. a hidden link would convey success like this:
  78. <a id="TorCheckResult" target="success" href="/"></a>
  79. failure like this:
  80. <a id="TorCheckResult" target="failure" href="/"></a>
  81. and DNS leaks like this:
  82. <a id="TorCheckResult" target="dnsleak" href="/"></a>
  83. Firefox extensions such as Torbutton would then be able to
  84. issue an XMLHttpRequest for the page and query the result
  85. with resultXML.getElementById("TorCheckResult").target
  86. to automatically report the Tor status to the user when
  87. they first attempt to enable Tor activity, or whenever
  88. they request a check from the extension preferences window.
  89. If the check website is to be themed with heavy graphics and/or
  90. extensive documentation, the check result itself should be
  91. contained in a seperate lightweight iframe that extensions can
  92. request via an alternate url.
  93. Security and resiliency implications:
  94. What attacks are possible?
  95. If the IP address used for this feature moves there will be two
  96. consequences:
  97. - A new website at this IP address will remain inaccessible over
  98. Tor
  99. - Tor users who are leaking DNS will be informed that Tor is not
  100. working, rather than that it is active but leaking DNS
  101. We should thus attempt to find an IP address which we reasonably
  102. believe can remain static.
  103. Open issues:
  104. If a Tor version which does not support this extra feature is used,
  105. the webpage returned will indicate that Tor is not being used. Can
  106. this be safely fixed?
  107. Related work:
  108. The proposed mechanism is very similar to config.privoxy.org. The
  109. most significant difference is that if the web browser is
  110. misconfigured, Tor will only get an IP address. Even in this case,
  111. Tor should be able to respond with a webpage to notify the user of how
  112. to fix the problem. This also implies that Tor must be told of the
  113. special IP address, and so must be effectively permanent.