193
Tor says it’s "still safe" amid reports of police deanonymizing users
(www.bleepingcomputer.com)
this post was submitted on 20 Sep 2024
193 points (97.1% liked)
Privacy
32442 readers
619 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
This attack has been known for years now. And tor is simply not able to defend against it without a complete redesign.
The potential for timing attacks has been known since the beginning of Tor. In other words, more than a decade. But that doesn't mean you can't defend against it. One way to defend against it is by having more nodes. Another way is to write clients that take into account the potential for timing attacks. Both of these were specifically mentioned in the article.
Based on what was in the article and what's in the history books, I'm not sure how to interpret your comment in a constructive way. Is there anything more specific you meant, that isn't contradicted by what's in the article?
Yes, sorry i worded it incorrectly you can try to make it harder but timing attacks are still possible.
Nope, just a summary that this is just old news. There is nothing new in the article.
Redesign being I2P
I2p has issues that can more easily lead to deanonymization attacks. It says it on the FAQ
Confirmed the troll.
From the FAQ:
In theory, if you're accessing the clearnet, then it is no better or worse than TOR. It is a little better if you're stay in I2P land.
Don't listen to me or him. If you're reading this, go to the FAQ (https://geti2p.net/en/faq) and make your own decisions.
I2p lacks the ability to mask your traffic. It is obvious that you use i2p and someone could identity you from analyzing the network for long enough
TOR is obvious too to someone snooping on your network, unless you're using bridges (and that's hit or miss). If you don't want someone to know you're using I2P, use OpenVPN and mask your traffic as HTTPS.
You're going to have to explain better about "I2P not masking your traffic" and especially about "someone identifying you" - timing attacks are possible in both cases and the I2P Devs have mitigations against it. Please provide sources which define how I2P is weaker and more susceptible to TOR against network forensics
Not true. I2P actively tries to mask the traffic
Nope, I2P is still vulnerable to timing attacks. https://en.m.wikipedia.org/wiki/Garlic_routing
You linked an article that doesn't say anything to back up your claim. Why do you say i2p is vulnerable to timing attacks?
First sentence. Check up the linked article as source.
Ok, technically still vulnerable in the sense that if you transfer a huge file in excess of other parts of the bundle, it might be identifiable by a bad actor, but that's really misleading, since i2p has a lot of built in logic that makes that scenario pretty unlikely.
Not only huge files. At the end of the article the author goes on about changing the load or manipulating the timing of the traffic.
For both you need to be part of the network and (to some degree) the traffic you want to trace needs to go through a node you are controlling if i understand it correctly. With increasing size it becomes more difficult.
isn't it less vulnerable, though?
it has higher latency, even variable latency if you set up variable hops, and everyone routes the traffic of a lot of other users, so a lot of data they can gather from timing info is noise by default
Yes it has better defenses against timing attacks. Just alone the fact that multiple packets are bundled together makes it harder to identify the route a single package used.
Also, it seems that I2P is more vulnerable against deanonymization when leaving the hidden network, i think the official I2P faq has some info about that, but have not read up upon it myself.
on a quick look I did not find such a mention, but in any case in addition to that, I2P users often don't have such a fortified browser as Tor users do, so that's also something to count with.
and maybe it's not a good idea either to just reconfigure a Tor browser profile for I2P
I would also like to see prove for your claim.
First sentence. Check up the linked article as source.