Tor 0.2.1.22 Released

by phobos | January 23, 2010

Tor 0.2.1.22 rotates two of the seven v3 directory authority keys and
locations, due to a security breach of some of the Torproject servers:
http://archives.seul.org/or/talk/Jan-2010/msg00161.html

It also fixes a privacy problem in bridge directory authorities -- it
would tell you its whole history of bridge descriptors if you make the
right directory request.

Everybody should upgrade:
https://www.torproject.org/easy-download

Changes in version 0.2.1.22 - 2010-01-19
o Directory authority changes:
- Rotate keys (both v3 identity and relay identity) for moria1
and gabelmoo.

o Major bugfixes:
- Stop bridge directory authorities from answering dbg-stability.txt
directory queries, which would let people fetch a list of all
bridge identities they track. Bugfix on 0.2.1.6-alpha.

releases

Comments

Please note that the comment area below has been archived.

Downloaded and installed v

Downloaded and installed v 0.2.1.22 (expert package Tor for Windows). Starts and runs slightly faster than version .21. Thanks for the improvement! Running Win XP Pro sp3 with Privoxy 3.0.12 (stable).

Used Scroogle search engine "Scroogle Scraper" and got this notice:

"It appears that you arrived at Scroogle from Tor.

To use Scroogle with Tor, you should use the SSL version of Scroogle.
This will prevent rogue Tor exit nodes from sniffing your search terms.

Thank you."

I never saw this notice until this week. Any ideas why Scroogle would post this notice?

I downloaded Mac

I downloaded Mac vidalia-bundle-0.2.1.22-0.2.6-i386, here is what i get:

janv. 24 13:00:57.786 [Notice] Tor v0.2.1.22. This is experimental software. Do not rely on it for strong anonymity. (Running on Darwin i386)
janv. 24 13:00:57.798 [Notice] Initialized libevent version 1.4.13-stable using method kqueue. Good.
janv. 24 13:00:57.798 [Notice] Opening Socks listener on 127.0.0.1:9050
janv. 24 13:00:57.799 [Notice] Opening Control listener on 127.0.0.1:9051
janv. 24 13:00:57.997 [Notice] No current certificate known for authority moria1; launching request.
janv. 24 13:00:57.998 [Notice] No current certificate known for authority tor26; launching request.
janv. 24 13:00:57.999 [Notice] No current certificate known for authority dizum; launching request.
janv. 24 13:00:57.999 [Notice] No current certificate known for authority ides; launching request.
janv. 24 13:00:58.000 [Notice] No current certificate known for authority gabelmoo; launching request.
janv. 24 13:00:58.000 [Notice] No current certificate known for authority dannenberg; launching request.
janv. 24 13:00:58.001 [Notice] No current certificate known for authority urras; launching request.
janv. 24 13:00:58.002 [Notice] Bootstrapped 5%: Connecting to directory server.
janv. 24 13:00:58.006 [Notice] I learned some more directory information, but not enough to build a circuit: We have no network-status consensus.
janv. 24 13:00:59.948 [Notice] Bootstrapped 10%: Finishing handshake with directory server.
janv. 24 13:01:02.945 [Warning] TLS error: unexpected close while renegotiating
janv. 24 13:01:07.250 [Warning] TLS error: unexpected close while renegotiating
janv. 24 13:01:27.129 [Notice] No current certificate known for authority moria1; launching request.
janv. 24 13:01:27.130 [Notice] No current certificate known for authority tor26; launching request.
janv. 24 13:01:27.131 [Notice] No current certificate known for authority dizum; launching request.
janv. 24 13:01:27.131 [Notice] No current certificate known for authority ides; launching request.
janv. 24 13:01:27.163 [Notice] No current certificate known for authority gabelmoo; launching request.
janv. 24 13:01:27.164 [Notice] No current certificate known for authority dannenberg; launching request.
janv. 24 13:01:27.165 [Notice] No current certificate known for authority urras; launching request.

Should we wait for another update ?

I have Mac OS and I have the

I have Mac OS and I have the same problem as Anonymous upstairs. Anyone can help?

I am running Snow Leopard

I am running Snow Leopard 10.6.2 and am having the same problem. I suspect the problem was created by Apple in security update 2010-001. The following description of one "fix" from Apple's website makes me suspicious because it says they have disabled renegotiation in SSL and TLS. How to fix this, assuming it is the problem, is beyond my expertise.

OpenSSL

CVE-ID: CVE-2009-3555

Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.2, Mac OS X Server v10.6.2

Impact: An attacker with a privileged network position may capture data or change the operations performed in sessions protected by SSL

Description: A man-in-the-middle vulnerability exists in the SSL and TLS protocols. Further information is available at http://www.phonefactor.com/sslgap A change to the renegotiation protocol is underway within the IETF. This update disables renegotiation in OpenSSL as a preventive security measure. The issue does not affect services using Secure Transport as it does not support renegotiation. Credit to Steve Dispensa and Marsh Ray of PhoneFactor, Inc. for reporting this issue.

As mentioned on the or-talk

As mentioned on the or-talk mailing list, the bug can be followed here:
https://bugs.torproject.org/flyspray/index.php?do=details&id=1225

Skipping invalid argument

Skipping invalid argument '%s' to MapAddress
Changed to using entry guards, or changed preferred or excluded node lists. Abandoning previous circuits.
Worker-related options changed. Rotating workers.
Previously validated Bridge line could not be added!
MapAddress '%s' has too few arguments. Ignoring.
Couldn't parse internal dirserver line %s
Ignoring extra arguments to MapAddress.
Previously validated client authorization for hidden services could not be added!
State file "%s" is not a file? Failing.
Loaded state from "%s"
DirPortFrontPage file '%s' not found. Continuing anyway.
Configured to measure directory request statistics, but no GeoIP database found!
Configured to measure entry node statistics, but no GeoIP database found!
Bridge status changed. Forgetting GeoIP stats.
%s\geoip
Unable to parse state in "%s". Moving it aside to "%s". This could be a bug in Tor; please tell the developers.
Uh oh. We couldn't even validate our own default state. This is a bug in Tor.
Initialized state
Unparseable bandwidth history state: %s
Unable to parse state in "%s"; too many saved bad state files to move aside. Discarding the old state file.
Bridges cannot be configured to measure additional GeoIP statistics as entry guards.
Unable to read state file "%s"
Error in accounting options
Error loading rendezvous service keys
Error creating cookie authentication file.
Error parsing already-validated policy options.
Previously validated hidden services line could not be added!
Weirdly, I couldn't even move the state aside. The OS gave an error of %s
Error initializing keys; exiting
set_options
set_options
options_act_reversible
options_act_reversible
Closing old %s on %s:%d
%s\cached-status
Failed to bind one of the listener ports.
DisableAllSwap failure. Do you have proper permissions?
Problem with User value. See logs for details.
Unix domain sockets (ControlSocket) not supported on this OS/with this build.
Closing partially-constructed listener %s on %s:%d
Function not implemented
Couldn't access/create private data directory "%s"
Failed to init Log options. See logs for details.
BAD_LIBEVENT VERSION=%s METHOD=%s BADNESS=%s RECOVERED=NO
Problem with ConnLimit value. See logs for details.
Acting on config options left us in a broken state. Dying.

I'm a bit new to this so I

I'm a bit new to this so I apologize in advance... I upgraded Vidalia to it's newest version for Mac 10.5.8 (PPC), but when I run it, the log says my version of Tor is 0.2.1.19. Where did I go wrong??? Thanks to anyone for your help ^^ !!!

very slow :S why?

because tor depended of the

because tor depended of the number users connecting`s ans the number of Repeaters. for the tor is more fast you can configured your tor how Repeater and if many people make the same think.

I download the last version

I download the last version of tor browser (2.2.35-8),, but I face problem when adding bridges??

H recive the following massege

"Vidalia was not able to applay your network settings to Tor
Unacceptable option value:Bridge line did not parse,see logs for detail"

What is the solution ???

Thank you

Downloaded newest tor

Downloaded newest tor browser bundle 2.2.35-8 on windows vista and vidalia would not connect to tor saying - Vidalia detected that the Tor software exited unexpectedly.
Please check the message log for recent warning or error messages. - i did exactly that and came across the *failed to parse/validate config* & *could not bind to 127.0.0.1:9050: address already in use* heard somewhere that it didnt work correctly with firefox 11.0 so i downloaded 10.0.2 (which is the one i heard worked better) and the exact same thing pops up. I'm not illiterate but pretty close, i'm in way over my head. Any help would be great, Thanks.

side note - i do live in the middle of the woods so the connection out here isnt the greatest. Would that have any bearing on this problem?