193
Tor says it’s "still safe" amid reports of police deanonymizing users
(www.bleepingcomputer.com)
this post was submitted on 20 Sep 2024
193 points (97.1% liked)
Privacy
32525 readers
64 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Nope, I2P is still vulnerable to timing attacks. https://en.m.wikipedia.org/wiki/Garlic_routing
You linked an article that doesn't say anything to back up your claim. Why do you say i2p is vulnerable to timing attacks?
First sentence. Check up the linked article as source.
Ok, technically still vulnerable in the sense that if you transfer a huge file in excess of other parts of the bundle, it might be identifiable by a bad actor, but that's really misleading, since i2p has a lot of built in logic that makes that scenario pretty unlikely.
Not only huge files. At the end of the article the author goes on about changing the load or manipulating the timing of the traffic.
For both you need to be part of the network and (to some degree) the traffic you want to trace needs to go through a node you are controlling if i understand it correctly. With increasing size it becomes more difficult.
isn't it less vulnerable, though?
it has higher latency, even variable latency if you set up variable hops, and everyone routes the traffic of a lot of other users, so a lot of data they can gather from timing info is noise by default
Yes it has better defenses against timing attacks. Just alone the fact that multiple packets are bundled together makes it harder to identify the route a single package used.
Also, it seems that I2P is more vulnerable against deanonymization when leaving the hidden network, i think the official I2P faq has some info about that, but have not read up upon it myself.
on a quick look I did not find such a mention, but in any case in addition to that, I2P users often don't have such a fortified browser as Tor users do, so that's also something to count with.
and maybe it's not a good idea either to just reconfigure a Tor browser profile for I2P
I would also like to see prove for your claim.
First sentence. Check up the linked article as source.