Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare ReCAPTCHA De-Anonymizes Tor Users

cryptome.org

Post reply on HN
Print view View original

61–70 of 122 posts

Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users

#61

Post by rohit89 »

mikeash wrote: post #12
pyromine wrote: post #3

I didn't realize just how fragile TOR is. . . While I understand that remaining anonymous requires adjusting your browser habits somewhat extensively, the fact that a ReCAPTCHA is enough to (theoretically) de-anonymize a user seems to me that it's not able to anonymize at all when browsing. While TOR may be useful for evading firewalls, my general perception of the project has changed from general anonymity tool to a…

That was exactly my reaction upon seeing the description of the problem. Seems like the title of the article should really be, "Tor kind of sucks at anonymizing users." If all it takes is 25 requests sent in quick succession, then surely half the web pages out there share this same problem just from loading various resources.

As I understand it, this is a fundamental problem for any low latency network. You could fix the problem by introducing delays but that would break the low latency requirement.

Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users

#63

Post by rohit89 »

Johnny555 wrote: post #47

Why is this phrased as if it's Cloudflare's fault? If it's this easy for a side effect of a recapcha image to de-anonymize a Tor user, then this seems like a failing of the Tor protocol that they should fix. Maybe they need to introduce more jitter, repackage requests into a single stream with consistent (or randomized) packet size, or pad the packets with random data.

Introducing jitter would mean increasing latency and generally slowing down your browsing.

Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users

#64

Post by djsumdog »

mmaunder wrote: post #55

"The Tor design doesn't try to protect against an attacker who can see or measure both traffic going into the Tor network and also traffic coming out of the Tor network. That's because if you can see both flows, some simple statistics let you decide whether they match up." https://blog.torproject.org/blog/one-cell-enough Work on a client to try and mitigate the risk of timing attacks: https://news.ycombinator.com/ite…

I remember someone at a security conference talking about a kid at a University who sent a bomb threat via Tor.

The University simply looked their their logs to see who was connecting to known Tor nodes, narrowed it down by time and found the kid.

Source: http://www.theregister.co.uk/2013/12/18/harvard_bomb_hoax_ch...

Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users

#65

Post by captainmuon »

Huh, I always thought that Tor breaks up traffic in a random, but deterministic (not data dependent) way - sometimes joining data from two packets into one network packet, sometimes splitting packets and holding data for a while [x]. That's how I explained the jitter to myself. Sometimes a connection would be really fast, and sometimes it would hang on a single packet for hundreds of ms. Seems I was mistaken.

In this case, it would have helped a bit, since an attacker would not have seen the characteristic staccato of the reCAPTCHA exchange. They would have seen a few kB in either direction, in 40-100 packets, over a period of a few seconds. If the implementation is clever, on end would even have a different signature than the other.

At least this is something I would have included in Tor. Now that I think about it, randomly introduced delays (from the outside) might actually be a technique to deanonymize users....

([x] You'd generate packet sizes and minimum transmission times from a known seed. First packet is 501 B, 24 ms later a packet of 2048 B, then 15 ms later one of 1718 B, and so on. If there is not enough data after a grace period, pad with junk. If you constantly need more time to send packets than allowed, or need to pad, then adjust the model. Also choose the model to match regular traffic if possible. Disclaimer: I'm just making this up on the spot and am no expert, but it seems plausible and obvious to me.)

Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users

#66

Post by jsmthrowaway »

djsumdog wrote: post #64
mmaunder wrote: post #55

"The Tor design doesn't try to protect against an attacker who can see or measure both traffic going into the Tor network and also traffic coming out of the Tor network. That's because if you can see both flows, some simple statistics let you decide whether they match up." https://blog.torproject.org/blog/one-cell-enough Work on a client to try and mitigate the risk of timing attacks: https://news.ycombinator.com/ite…

I remember someone at a security conference talking about a kid at a University who sent a bomb threat via Tor. The University simply looked their their logs to see who was connecting to known Tor nodes, narrowed it down by time and found the kid. Source: http://www.theregister.co.uk/2013/12/18/harvard_bomb_hoax_ch...

That situation becomes quite relevant when debating "VPN then Tor" or "Tor then VPN," which I've seen people come down on both ways. Ultimately it depends on who the threat is.

Example: https://thetinhat.com/tutorials/darknets/tor-vpn-using-both....

Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users

#67

Post by Illniyar »

A lot of comments here talk about recaptcha having a distinctive traffic signature, but I don't understand this.

Why does recaptcha have a distinct signature and if it does couldn't an attacker just make a distinct signature without recaptcha?

And why does recaptcha have a traffic signature that can distinguish between users? I mean how does a simple request response create a distinct traffic?

Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users

#68

Post by baby »

captainmuon wrote: post #65

Huh, I always thought that Tor breaks up traffic in a random, but deterministic (not data dependent) way - sometimes joining data from two packets into one network packet, sometimes splitting packets and holding data for a while [x]. That's how I explained the jitter to myself. Sometimes a connection would be really fast, and sometimes it would hang on a single packet for hundreds of ms. Seems I was mistaken. In this…

This is called a mix network and only one server currently does that in Tor's network.

Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users

#69

Post by captainmuon »

Illniyar wrote: post #67

A lot of comments here talk about recaptcha having a distinctive traffic signature, but I don't understand this. Why does recaptcha have a distinct signature and if it does couldn't an attacker just make a distinct signature without recaptcha? And why does recaptcha have a traffic signature that can distinguish between users? I mean how does a simple request response create a distinct traffic?

Right, include Javascript (or heck, just a bunch of images of different sizes) that open requests in Morse code. Long request, long request, short request, long request...

Or, my favorite, the binary search (assuming you control the server / the network in front of the server / some exit nodes, and can monitor the traffic of your targeted user): have sites that cause transmissions for some time (long running JS / requests, or just a lot of content the user interacts with). Freeze 50% of the servers connections. Is the user still connecting? Then s/he is in the 50%. If not, in the other. Repeat until the is user matched to activity on the server.

Post reply on HN