Tor 0day: Stopping Tor Connections

Post by nix23 » Fri, Jul 24, 2020, 10:26 AM UTC

Ajedi32 wrote: post #67

Moru wrote: post #35

Earlier quoted context omitted.

I'm not realy using it much but i2p[0] has been around for a while. It's Java though as all other projects like this in case you have anything against it. [0] https://geti2p.net/en/

IIRC the main issue with I2P is that it doesn't natively offer access to traditional websites the way Tor does. You can configure your browser to connect to a remote HTTP proxy over I2P and access the web that way, but that requires you to find such a proxy first (preferably several such proxies, each with multiple users, so that your traffic across multiple sessions can't be correlated by using the outproxy IP), and…

Don't forget:

https://i2pd.website/

Post by throwaway89201 » Fri, Jul 24, 2020, 2:47 PM UTC

wcerfgba wrote: post #79

throwaway89201 wrote: post #43

The author of this blog strongly comes across as a person who understands a good deal about finding vulnerabilities, but doesn't really understand the tradeoffs being made in maintaining usable anonymity software such as the Tor browser. The reported scroll bar width vulnerability is his strongest case. He rightly got a bounty for it. But it's relatively hard to fix, and until recently, the Tor browser also just leak…

Could you expand on "his proposed solution in trying to impersonate traditional PKI simply won't work against even mediocre attackers" ? How would you defeat his proposed solution?

As the Tor Project itself already notes in its reply, it's not feasible "to try to imitate normal SSL certs because that's a fight we can't win (they will always look differently or have distinguishers, as has been the case in the pluggable transports arms race)."

Even if the certificate is valid, there are lots of other distinguishing factors. You can go as far as timing attacks. As the answer alludes to, they have an entire project around obfuscated transports primarily for clients and private bridges. [1]

But there's no need for obfuscation here as the ORPort can 'simply' be closed, if it wasn't such a hassle to actually implement.

[1] https://gitweb.torproject.org/torspec.git/tree/pt-spec.txt

Re: Tor 0day: Stopping Tor Connections

Re: Tor 0day: Stopping Tor Connections