Cloudflare ReCAPTCHA De-Anonymizes Tor Users

Post by softawre » Tue, Jul 19, 2016, 7:56 PM UTC

rohit89 wrote: post #63

Johnny555 wrote: post #47

Why is this phrased as if it's Cloudflare's fault? If it's this easy for a side effect of a recapcha image to de-anonymize a Tor user, then this seems like a failing of the Tor protocol that they should fix. Maybe they need to introduce more jitter, repackage requests into a single stream with consistent (or randomized) packet size, or pad the packets with random data.

Introducing jitter would mean increasing latency and generally slowing down your browsing.

Post by niij » Tue, Jul 19, 2016, 7:58 PM UTC

baby wrote: post #68

captainmuon wrote: post #65

Huh, I always thought that Tor breaks up traffic in a random, but deterministic (not data dependent) way - sometimes joining data from two packets into one network packet, sometimes splitting packets and holding data for a while [x]. That's how I explained the jitter to myself. Sometimes a connection would be really fast, and sometimes it would hang on a single packet for hundreds of ms. Seems I was mistaken. In this…

This is called a mix network and only one server currently does that in Tor's network.

Post by nickpsecurity » Tue, Jul 19, 2016, 8:12 PM UTC

tedunangst wrote: post #30

fweespeech wrote: post #22

Earlier quoted context omitted.

Wouldn't running your own entry node be enough protection still (assuming you could guarantee it wouldn't be compromised)? As far as I'm aware, control of entry & exit is required for these sorts of attacks. Running the entry node with a consistent entry point and using it as a random walk crawler with a real browser would seem to be enough for personal use as long as you aren't a criminal worth active, serious inves…

These attacks require observation of entry and exit.

Post by onecooldev24 » Tue, Jul 19, 2016, 8:20 PM UTC

garrettr_ wrote: post #56

onecooldev24 wrote: post #51

Earlier quoted context omitted.

It does obscure the size, maybe not the frequency. Best have JS disabled when you come across this.

> It does obscure the size Encryption does not inherently obscure the size of plaintext. Protocols may choose to pad plaintext for various reasons, and both Tor (since Tor always sends fixed-width cells) and TLS (when it uses a block cipher mode) do so. However, the amount of padding is typically small and can hardly be said to "obscure" the size of a request - it is not a defense against traffic analysis.

Post by Johnny555 » Tue, Jul 19, 2016, 8:25 PM UTC

rohit89 wrote: post #78

softawre wrote: post #71

Earlier quoted context omitted.

as a tradeoff for security? Ok.. I mean, using a VPN is slower than not, but tons of people use them

The effect will be exaggerated since tor traffic goes through three nodes and random jitter would need to be added for each. In general, beating traffic analysis in a low latency network is a hard problem. You could have perfect anonymity if you could add arbitrary delays but that would make the network unusably slow.