21–30 of 122 posts
Obviously it would be a very bandwidth hungry network, though if exit node bandwidth is currently the limiting factor (is it?) then maybe not entirely impractical.
Earlier quoted context omitted.
If I were a national signals intelligence agency with a correspondingly huge multi-billion dollar budget, it would be trivial to run a large percentage of tor exit nodes... You could probably achieve it with 500 individual 1U servers colocated with random hosting companies around the globe at a budget of $250/mo * 500 = $125,000/mo, which is a tiny drop in the bucket compared to the traffic analysis capability it wou…
I formulated the attack myself with your numbers seeming similar. It's one of reasons I didn't trust Tor. The success rate described in Snowden docs indicate NSA might be doing this experimentally. I don't think they're fully committed to point where they're running most nodes or anything. Being careful. The difficulties wouldn't be as much as it seems. They probably wouldn't even be shut down that often. Just a smal…
As far as I'm aware, control of entry & exit is required for these sorts of attacks.
Running the entry node with a consistent entry point and using it as a random walk crawler with a real browser would seem to be enough for personal use as long as you aren't a criminal worth active, serious investigation that is targeted to reveal you.
I wonder why these anti-abuse systems don't use proof-of-work. Instead of a captcha, let the browser chug for 5 seconds, and then POST the solution in order to gain a temporary access cookie. Sure, this could be attacked - but not at scale, and that's the whole point of the capchta anyway, right?
I wonder why these anti-abuse systems don't use proof-of-work. Instead of a captcha, let the browser chug for 5 seconds, and then POST the solution in order to gain a temporary access cookie. Sure, this could be attacked - but not at scale, and that's the whole point of the capchta anyway, right?
Are there any anonymity networks that transmit streams of packets between nodes at a constant rate regardless of whether it's being actively used? Obviously it would be a very bandwidth hungry network, though if exit node bandwidth is currently the limiting factor (is it?) then maybe not entirely impractical.
This short piece doesn't have much detail. But if reCAPTCHA is usable to deanonymize Tor users then I would like to know about it in detail so I can do something about it.
I could make a website that adds random(1, 64) one pixel images to each page. As you browse the site, you'll be broadcasting 6 bits of identifier with every click.
I didn't realize just how fragile TOR is. . . While I understand that remaining anonymous requires adjusting your browser habits somewhat extensively, the fact that a ReCAPTCHA is enough to (theoretically) de-anonymize a user seems to me that it's not able to anonymize at all when browsing. While TOR may be useful for evading firewalls, my general perception of the project has changed from general anonymity tool to a…
This short piece doesn't have much detail. But if reCAPTCHA is usable to deanonymize Tor users then I would like to know about it in detail so I can do something about it.
Traffic analysis is always a problem; this is a specific case, but I'm not sure this is anything new. Many attacks on Tor are facilitated by or require JavaScript. Consider disabling it rather than executing arbitrary, untrusted software on your computer automatically.
Not always. High-latency mix networks with fixed message size and randomized transmission are very robust against traffic analysis.
The elephant in the room is, as usual, PEBKAC. The demand by users for low latency will always be the killer for anonymity networks.
Earlier quoted context omitted.
I formulated the attack myself with your numbers seeming similar. It's one of reasons I didn't trust Tor. The success rate described in Snowden docs indicate NSA might be doing this experimentally. I don't think they're fully committed to point where they're running most nodes or anything. Being careful. The difficulties wouldn't be as much as it seems. They probably wouldn't even be shut down that often. Just a smal…
Wouldn't running your own entry node be enough protection still (assuming you could guarantee it wouldn't be compromised)? As far as I'm aware, control of entry & exit is required for these sorts of attacks. Running the entry node with a consistent entry point and using it as a random walk crawler with a real browser would seem to be enough for personal use as long as you aren't a criminal worth active, serious inves…