6 ms·
"The Tor design doesn't try to protect against an attacker who can see or measure both traffic going into the Tor network and also traffic coming out of the Tor
by mmaunder 10y ago
"The Tor design doesn't try to protect against an attacker who can see or measure both traffic going into the Tor network and also traffic coming out of the Tor network. That's because if you can see both flows, some simple statistics let you decide whether they match up."
https://blog.torproject.org/blog/one-cell-enough https://blog.torproject.org/blog/one-cell-enough
Work on a client to try and mitigate the risk of timing attacks:
https://news.ycombinator.com/item?id=9585466 https://news.ycombinator.com/item?id=9585466
- djsumdog 10y agoI remember someone at a security conference talking about a kid at a University who sent a bomb threat via Tor. The University simply looked their their logs to see who was connecting to known Tor nodes, narrowed it down by time and found the kid. Source: http://www.theregister.co.uk/2013/12/18/harvard_bomb_hoax_charge/ http://www.theregister.co.uk/2013/12/18/harvard_bomb_hoax_ch...
- jsmthrowaway 10y agoThat situation becomes quite relevant when debating "VPN then Tor" or "Tor then VPN," which I've seen people come down on both ways. Ultimately it depends on who the threat is. Example: https://thetinhat.com/tutorials/darknets/tor-vpn-using-both.html https://thetinhat.com/tutorials/darknets/tor-vpn-using-both....
- drewbug 10y agoWhat about VPN -> Tor -> VPN?
- prdonahue 10y agoYeah, because 5,000ms latency is fun.
- shivsta 10y agoTor is already slow - people use it because they want security. The addition of another VPN increases security greatly and only adds a minimal amount of more latency.
- lucb1e 10y ago> Tor is already slow Relatively, sure. But I've found it very usable in recent times actually. Used it almost full-time (besides a normal Firefox instance for the company's intranet) to get around some silly firewall that wouldn't let me download "hack tools" (I was an intern in the cyber security department, security tools were part of my job). There were times where I didn't notice at all that I was using Tor, and most of the time it was comparable to mediocre wifi.
- rycfan 10y agoYou probably should have spent some time fixing that hole in the firewall that let you bypass your company's download restrictions. ;-)
- lucb1e 10y agoTor can and should circumvent any firewall using obfuscation proxies that use AWS, GCS, Azure, etc. You'd need to block most of the internet to kill Tor. And as for monitoring, I guess it might be possible, but if someone thinks to use bridge nodes that's also defeated.
- halfcat 10y agoYou would usually not try to block Tor at the network level. You would lock down your computers so employees can't make changes, and only allow them to run executables from locations which they have no write access to.
- lucb1e 10y agoFor a bomb threat? Or more benignly, uploading a few documents to a whiteblowers platform (some news organizations have one)? No problem I'd say.
- mmaunder 10y agoGood opsec involves multiple layers of security. There's a fun talk at defcon next month on extending wifi range to avoid detection along with signal 'hiding' via SDR: https://www.defcon.org/html/defcon-23/dc-23-speakers.html#Graham https://www.defcon.org/html/defcon-23/dc-23-speakers.html#Gr...
- ayyn0n0n0 10y agoI will so be there!
- Relys 10y agoSame! =D
- _asummers 10y agoThere's another good talk on more general opsec from Defcon a few years ago called "Don't fuck it up". https://youtube.com/watch?v=J1q4Ir2J8P8 https://youtube.com/watch?v=J1q4Ir2J8P8
- rev_bird 10y agoThis is great, thanks for linking it. I'm really interested in this kind of stuff, but it's so hard to find resources on it. Lots of people on Twitter making fun of mistakes people make, not a lot of folks giving advice.
- j_s 10y agohttps://news.ycombinator.com/item?id=6521145 https://news.ycombinator.com/item?id=6521145 https://news.ycombinator.com/item?id=6521517 https://news.ycombinator.com/item?id=6521517 These discussions are definitely post-mortem analysis but there is also discussion on another OpSec presentation: http://www.youtube.com/watch?v=9XaYdCdwiWU http://www.youtube.com/watch?v=9XaYdCdwiWU
- blastrat 10y agogood opsec also involves logging access to the internet and seeing who sent bomb threats... oh wait, whose side am I on?
- meowface 10y agoIt's funny, because just with a little hostname and MAC spoofing, he probably could've gotten away with it even if he sent it from their wireless network with no anonymization whatsoever. (Depending on how it does authentication, at least.)
- MichaelGG 10y agoNope, not needed. He had gotten away with it! There was no evidence that the target was on campus. Just a lucky lead for the university. All he had to say was he was browsing "personal" sites, or looking up Onion sites out of curiosity, etc. Just a basic cover. Instead, he caved immediately. Maybe they would have found other evidence. But it wouldn't have been just him connecting to Tor.
- 616c 10y agoGod I wish grugq still wrote currently. https://grugq.github.io/blog/2013/12/21/in-search-of-opsec-magic-sauce/ https://grugq.github.io/blog/2013/12/21/in-search-of-opsec-m... I discovered he moved to Github pages after years only to realize he has not published much since I first heard of him.