24 ms·

Intriguing that this renders Tor essentially transparent in some contexts - that could almost seem by design. I guess (unless Tor is completely broken) that th

Intriguing that this renders Tor essentially transparent in some contexts - that could almost seem by design. I guess (unless Tor is completely broken) that there would still be more legwork involved in associating traffic from the endpoint with its corresponding traffic into Tor, but even "user logs into that service through Tor" is still a pretty fertile datapoint. Obviously Microsoft would be able to see that pretty easily anyway, but why would they make it easy for others to see it too?

devit 11y ago
Why? DNS lookups are routed through Tor just like HTTP/TCP traffic (in implementations that aren't broken).
- eponeponepon 11y ago
  Ah, OK, I see. My understanding of Tor is far from complete, I should point out - it's not my area of expertise at all, and I'm just an interested observer! But surely the point still stands? Even if you only see the DNS lookup as it emerges from the endpoint, you still know that User XYZ uses Tor to access Service ABC, correct?
  - devit 11y ago
    The enemy sees that someone using Tor exit node E is accessing Microsoft using user id XYZ and they can infer that other traffic coming out of exit node E is also more likely than average to be from the owner of Microsoft account XYZ. Obviously, the enemy may know more about the owner of Microsoft account XYZ: for example, they may know the name you typed when registering it or, if you login to the same account from your home internet connection, they may know that it is the same person that had assigned IP I at time T and may thus know that it is the same person that the ISP who was assigned the IP address block containing IP I claimed presented ID stating he was Mr X to the ISP as part of subscribing to the ISP. This means that between accessing the Microsoft account XYZ and doing other things that you don't want to be associated to the owner of Microsoft account XYZ, you should use the "New Identity" button in Tor Browser, or use a separate machine or Tor Browser instance. Of course you cannot know which services reveal your user id to your enemies, so you should always do that regardless of whether the service is known to send it in plain text or not.
pjc50 11y ago
Given that Microsoft recentralized Skype in order to make it suitably wiretappable, we can hazard a guess at the reason.
_nedR 11y ago
>Intriguing that this renders Tor essentially transparent in some contexts - that could almost seem by design. I would have commented on your tinfoil hat, except for what Microsoft did to Skype post-acquisition:- Completely rewriting its protocol architecture from one which was P2P with end-to-end encryption and practically impossible to wiretap or monitor, to a centralized architecture (ostensibly for scalability reasons) which made it much more easier to wiretap or obtain metadata. http://www.zdnet.com/article/skype-ditched-peer-to-peer-supernodes-for-scalability-not-surveillance/ http://www.zdnet.com/article/skype-ditched-peer-to-peer-supe... http://www.theguardian.com/world/2013/jul/11/microsoft-nsa-collaboration-user-data http://www.theguardian.com/world/2013/jul/11/microsoft-nsa-c... Here's a choice quote from the above article. "In July last year, nine months after Microsoft bought Skype, the NSA boasted that a new capability had tripled the amount of Skype video calls being collected through Prism;"
- throwawaykf05 11y ago
  When I heard about the "re-centralization" of Skype, I ran an experiment. I set up calls with a couple of people in various locations and monitored my network connections (on OSX I used nettop). Voice and video traffic is still direct P2P. It was the same when I tried it again last year. Not that I did not investigate messaging connections, nor group video chats, not mobile usage, all scenarios where a centralized service may be more useful. However this gels with their explanation that they have only centralized the call setup servers for reliability and voice/video traffic for mobile devices where P2P is not very feasible. On laptops and PCs, where P2P remains feasible, traffic is still routed directly been peers. Now I haven't run the same experiment in the past year, but I hope somebody will, and that too at larger scale. Given this forum is "hacker" news, there is a distinct lack of technical investigation to verify technical claims, and a disturbing propensity to take tech media for its word, especially when biases are being confirmed.
  - pdkl95 11y ago
    Are you suggesting that the ability to log metadata ("call setup") isn't important? Few people care about the contents of VOIP calls. The relationship maps you can generate from the metadata is far more useful. Also, "reliability" doesn't make sense as a reason to centralize skype. Being very generous, it is a workaround for the problem of NAT removing the average user's ability to self-publish on the internet.

devit 11y ago

Why? DNS lookups are routed through Tor just like HTTP/TCP traffic (in implementations that aren't broken).

eponeponepon 11y ago
Ah, OK, I see. My understanding of Tor is far from complete, I should point out - it's not my area of expertise at all, and I'm just an interested observer! But surely the point still stands? Even if you only see the DNS lookup as it emerges from the endpoint, you still know that User XYZ uses Tor to access Service ABC, correct?
- devit 11y ago
  The enemy sees that someone using Tor exit node E is accessing Microsoft using user id XYZ and they can infer that other traffic coming out of exit node E is also more likely than average to be from the owner of Microsoft account XYZ. Obviously, the enemy may know more about the owner of Microsoft account XYZ: for example, they may know the name you typed when registering it or, if you login to the same account from your home internet connection, they may know that it is the same person that had assigned IP I at time T and may thus know that it is the same person that the ISP who was assigned the IP address block containing IP I claimed presented ID stating he was Mr X to the ISP as part of subscribing to the ISP. This means that between accessing the Microsoft account XYZ and doing other things that you don't want to be associated to the owner of Microsoft account XYZ, you should use the "New Identity" button in Tor Browser, or use a separate machine or Tor Browser instance. Of course you cannot know which services reveal your user id to your enemies, so you should always do that regardless of whether the service is known to send it in plain text or not.

pjc50 11y ago

Given that Microsoft recentralized Skype in order to make it suitably wiretappable, we can hazard a guess at the reason.

_nedR 11y ago

>Intriguing that this renders Tor essentially transparent in some contexts - that could almost seem by design. I would have commented on your tinfoil hat, except for what Microsoft did to Skype post-acquisition:- Completely rewriting its protocol architecture from one which was P2P with end-to-end encryption and practically impossible to wiretap or monitor, to a centralized architecture (ostensibly for scalability reasons) which made it much more easier to wiretap or obtain metadata. http://www.zdnet.com/article/skype-ditched-peer-to-peer-supernodes-for-scalability-not-surveillance/ http://www.zdnet.com/article/skype-ditched-peer-to-peer-supe... http://www.theguardian.com/world/2013/jul/11/microsoft-nsa-collaboration-user-data http://www.theguardian.com/world/2013/jul/11/microsoft-nsa-c... Here's a choice quote from the above article. "In July last year, nine months after Microsoft bought Skype, the NSA boasted that a new capability had tripled the amount of Skype video calls being collected through Prism;"

throwawaykf05 11y ago
When I heard about the "re-centralization" of Skype, I ran an experiment. I set up calls with a couple of people in various locations and monitored my network connections (on OSX I used nettop). Voice and video traffic is still direct P2P. It was the same when I tried it again last year. Not that I did not investigate messaging connections, nor group video chats, not mobile usage, all scenarios where a centralized service may be more useful. However this gels with their explanation that they have only centralized the call setup servers for reliability and voice/video traffic for mobile devices where P2P is not very feasible. On laptops and PCs, where P2P remains feasible, traffic is still routed directly been peers. Now I haven't run the same experiment in the past year, but I hope somebody will, and that too at larger scale. Given this forum is "hacker" news, there is a distinct lack of technical investigation to verify technical claims, and a disturbing propensity to take tech media for its word, especially when biases are being confirmed.
- pdkl95 11y ago
  Are you suggesting that the ability to log metadata ("call setup") isn't important? Few people care about the contents of VOIP calls. The relationship maps you can generate from the metadata is far more useful. Also, "reliability" doesn't make sense as a reason to centralize skype. Being very generous, it is a workaround for the problem of NAT removing the average user's ability to self-publish on the internet.