Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare ReCAPTCHA De-Anonymizes Tor Users

cryptome.org

Post reply on HN
Print view View original

101–110 of 122 posts

Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users

#101

Post by meowface »

djsumdog wrote: post #64
mmaunder wrote: post #55

"The Tor design doesn't try to protect against an attacker who can see or measure both traffic going into the Tor network and also traffic coming out of the Tor network. That's because if you can see both flows, some simple statistics let you decide whether they match up." https://blog.torproject.org/blog/one-cell-enough Work on a client to try and mitigate the risk of timing attacks: https://news.ycombinator.com/ite…

I remember someone at a security conference talking about a kid at a University who sent a bomb threat via Tor. The University simply looked their their logs to see who was connecting to known Tor nodes, narrowed it down by time and found the kid. Source: http://www.theregister.co.uk/2013/12/18/harvard_bomb_hoax_ch...

It's funny, because just with a little hostname and MAC spoofing, he probably could've gotten away with it even if he sent it from their wireless network with no anonymization whatsoever. (Depending on how it does authentication, at least.)

Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users

#102

Post by [deleted] »

rvern wrote: post #59
matt_wulfeck wrote: post #54

It's bizarre that this article is critical of Cloudflare. If TOR can't stand up to a recaptcha without leaking PII, then it sounds like TOR ultimately needs to be fixed. I stand by Cloudflare. So much malicious traffic comes through Tor that administrators need to do a lot to protect themselves from it.

Almost all the pages I see CAPTCHAs on with Tor have absolutely nothing to protect. Arguably the website owners who use CloudFlare are far more to blame than CloudFlare itself. Nevertheless, I believe CloudFlare should stop using reCAPTCHA and create a challenge system that does not require JavaScript, and does not require sending requests to any website other than the website being visited. I like their proposed sol…

[deleted]

Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users

#103

Post by MichaelGG »

meowface wrote: post #101
djsumdog wrote: post #64

Earlier quoted context omitted.

I remember someone at a security conference talking about a kid at a University who sent a bomb threat via Tor. The University simply looked their their logs to see who was connecting to known Tor nodes, narrowed it down by time and found the kid. Source: http://www.theregister.co.uk/2013/12/18/harvard_bomb_hoax_ch...

It's funny, because just with a little hostname and MAC spoofing, he probably could've gotten away with it even if he sent it from their wireless network with no anonymization whatsoever. (Depending on how it does authentication, at least.)

Nope, not needed. He had gotten away with it! There was no evidence that the target was on campus. Just a lucky lead for the university. All he had to say was he was browsing "personal" sites, or looking up Onion sites out of curiosity, etc. Just a basic cover. Instead, he caved immediately.

Maybe they would have found other evidence. But it wouldn't have been just him connecting to Tor.

Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users

#104

Post by SwellJoe »

jerf wrote: post #43
SwellJoe wrote: post #40

Earlier quoted context omitted.

I believe the "unique to CloudFlare" element is that CloudFlare effectively sees traffic for significant portions of the web...but is one entity. So, a powerful enough hostile actor (say, a state) would only need to compromise one entity (CloudFlare) to exploit users of thousands of websites, including many major ones. Er, well, two entities, because they also need entrance data. So, if a state were to compromise an…

But if we're talking about The Adversary, then they're already deeper in than CloudFlare will ever be, so... what's different?

CloudFlare is an endpoint for predictable actions; and serves overseas websites. So, even a state that doesn't necessarily have power to infiltrate a foreign host might still be able to identify users of those foreign hosts.

So, say I use Tor to make political comments on a foreign website; one that I have reasonable trust is outside the reach of my government. But, say that website uses CloudFlare and CloudFlare has servers that are within reach of my government. That's the difference. It is a difference of degree, rather than kind, but a difference nonetheless.

Powerful actors have always had some ability to compromise Tor by compromising the requesting side (the ISP of the target of an investigation, for example), and then the receiving side (the website where your suspect does the thing you're investigating them for...possibly a honey pot setup specifically to catch people who do this thing, or possibly a website whose owner has already been arrested, prosecuted and made a deal that allowed access to the systems). CloudFlare just adds an additional element of uncertainty for Tor users: Will this CAPTCHA take place in a way and place that allows someone to narrow down my identity?

As with a lot of the security concerns about Tor, one has to take it as weights on a scale. Who are my attackers, and what level of attack can they bring against my traffic? If your privacy concerns don't include state level actors, then this is probably a theoretical attack. If your attackers do include state level actors, then it is a concern to be aware of. State level actors have other means of compromising your identity and traffic, of course, but this is one of them, and if I understand it correctly, it is a valid concern.

Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users

#105

Post by blastrat »

mmaunder wrote: post #91
djsumdog wrote: post #64

Earlier quoted context omitted.

I remember someone at a security conference talking about a kid at a University who sent a bomb threat via Tor. The University simply looked their their logs to see who was connecting to known Tor nodes, narrowed it down by time and found the kid. Source: http://www.theregister.co.uk/2013/12/18/harvard_bomb_hoax_ch...

Good opsec involves multiple layers of security. There's a fun talk at defcon next month on extending wifi range to avoid detection along with signal 'hiding' via SDR: https://www.defcon.org/html/defcon-23/dc-23-speakers.html#Gr...

good opsec also involves logging access to the internet and seeing who sent bomb threats... oh wait, whose side am I on?

Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users

#106

Post by rohit89 »

Johnny555 wrote: post #79
rohit89 wrote: post #78

Earlier quoted context omitted.

The effect will be exaggerated since tor traffic goes through three nodes and random jitter would need to be added for each. In general, beating traffic analysis in a low latency network is a hard problem. You could have perfect anonymity if you could add arbitrary delays but that would make the network unusably slow.

So make it a configurable option that you can turn on and off when you need it. Having to wait a few seconds for a web page to load seems like a small price to pay to avoid government agents banging on your door because you're looking at "subversive content".

The delays would have to be longer than that, not just a few seconds. You're looking at minutes to hours for strong guarantees. Also having a configurable option could make you more fingerprintable.

Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users

#107

Post by rev_bird »

_asummers wrote: post #100
mmaunder wrote: post #91

Earlier quoted context omitted.

Good opsec involves multiple layers of security. There's a fun talk at defcon next month on extending wifi range to avoid detection along with signal 'hiding' via SDR: https://www.defcon.org/html/defcon-23/dc-23-speakers.html#Gr...

There's another good talk on more general opsec from Defcon a few years ago called "Don't fuck it up". https://youtube.com/watch?v=J1q4Ir2J8P8

This is great, thanks for linking it. I'm really interested in this kind of stuff, but it's so hard to find resources on it. Lots of people on Twitter making fun of mistakes people make, not a lot of folks giving advice.

Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users

#108

Post by 616c »

djsumdog wrote: post #64
mmaunder wrote: post #55

"The Tor design doesn't try to protect against an attacker who can see or measure both traffic going into the Tor network and also traffic coming out of the Tor network. That's because if you can see both flows, some simple statistics let you decide whether they match up." https://blog.torproject.org/blog/one-cell-enough Work on a client to try and mitigate the risk of timing attacks: https://news.ycombinator.com/ite…

I remember someone at a security conference talking about a kid at a University who sent a bomb threat via Tor. The University simply looked their their logs to see who was connecting to known Tor nodes, narrowed it down by time and found the kid. Source: http://www.theregister.co.uk/2013/12/18/harvard_bomb_hoax_ch...

God I wish grugq still wrote currently.

https://grugq.github.io/blog/2013/12/21/in-search-of-opsec-m...

I discovered he moved to Github pages after years only to realize he has not published much since I first heard of him.

Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users

#109

Post by mikeash »

rohit89 wrote: post #61
mikeash wrote: post #12

Earlier quoted context omitted.

That was exactly my reaction upon seeing the description of the problem. Seems like the title of the article should really be, "Tor kind of sucks at anonymizing users." If all it takes is 25 requests sent in quick succession, then surely half the web pages out there share this same problem just from loading various resources.

As I understand it, this is a fundamental problem for any low latency network. You could fix the problem by introducing delays but that would break the low latency requirement.

Makes sense. I wonder if that could be made a tuneable parameter, so users could choose what sort of tradeoff they preferred. That might impose unacceptable storage costs on the router nodes, at the least.

Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users

#110

Post by j_s »

rev_bird wrote: post #107
_asummers wrote: post #100

Earlier quoted context omitted.

There's another good talk on more general opsec from Defcon a few years ago called "Don't fuck it up". https://youtube.com/watch?v=J1q4Ir2J8P8

This is great, thanks for linking it. I'm really interested in this kind of stuff, but it's so hard to find resources on it. Lots of people on Twitter making fun of mistakes people make, not a lot of folks giving advice.

https://news.ycombinator.com/item?id=6521145

https://news.ycombinator.com/item?id=6521517

These discussions are definitely post-mortem analysis but there is also discussion on another OpSec presentation:

http://www.youtube.com/watch?v=9XaYdCdwiWU

Post reply on HN