3 ms·

If an attacker learned a Tor Browser user's real IP address yesterday, and the leak gets fixed today, can the attacker still somehow identify that user's traffi

If an attacker learned a Tor Browser user's real IP address yesterday, and the leak gets fixed today, can the attacker still somehow identify that user's traffic tomorrow? Browser fingerprinting comes to mind, but is there another method?

deleted 9y ago
[deleted]
cjbprime 9y ago
Depends on the attacker -- if they're able to surveil the network upstream of the IP address they just learned, they could use timing analysis. i.e. if the attacker is the FBI and they're trying to unmask visitors to an onion service, and they learned your IP address (and hence real life name) through this method, they can also confirm that you're visiting the site they're surveiling through correlating packet times leaving your interface and arriving at the surveiled server's. Maybe there's a less dramatic way to do it too?
- kakarot 9y ago
  It's my understanding that this exploit wouldn't work with a hidden service because there is no way for your machine to know how to connect to it directly and the connection must be established through the Tor network, unlike a regular website. Is this not the case?
yeukhon 9y ago
I think most importantly, most people's IP address given by ISP is "fixed" for a long period of time.
Buge 9y ago
If they saw the person's username, then they can keep tracking that username. Same with any type of cookies. Https obviously makes it harder to do on sites they don't own, but it still works on http sites and https sites they own.
3pt14159 9y ago
If you are paying very close attention you'll see that Tor hasn't been as reliable against well funded state actors for a while now. This is probably one of several vulnerabilities, and IP ownership at a given time is something readily accessible to most states if they really need it. It isn't going to go to catching petty criminals, but it could be used to catch a mole or a leaker.
- forapurpose 9y ago
  > Tor hasn't been as reliable against well funded state actors for a while now. Can anyone provide more detail? I never thought Tor was a panacea, but do we know that it's becoming more vulnerable?

deleted 9y ago

[deleted]

cjbprime 9y ago

Depends on the attacker -- if they're able to surveil the network upstream of the IP address they just learned, they could use timing analysis. i.e. if the attacker is the FBI and they're trying to unmask visitors to an onion service, and they learned your IP address (and hence real life name) through this method, they can also confirm that you're visiting the site they're surveiling through correlating packet times leaving your interface and arriving at the surveiled server's. Maybe there's a less dramatic way to do it too?

kakarot 9y ago
It's my understanding that this exploit wouldn't work with a hidden service because there is no way for your machine to know how to connect to it directly and the connection must be established through the Tor network, unlike a regular website. Is this not the case?

yeukhon 9y ago

I think most importantly, most people's IP address given by ISP is "fixed" for a long period of time.

Buge 9y ago

If they saw the person's username, then they can keep tracking that username. Same with any type of cookies. Https obviously makes it harder to do on sites they don't own, but it still works on http sites and https sites they own.

3pt14159 9y ago

If you are paying very close attention you'll see that Tor hasn't been as reliable against well funded state actors for a while now. This is probably one of several vulnerabilities, and IP ownership at a given time is something readily accessible to most states if they really need it. It isn't going to go to catching petty criminals, but it could be used to catch a mole or a leaker.

forapurpose 9y ago
> Tor hasn't been as reliable against well funded state actors for a while now. Can anyone provide more detail? I never thought Tor was a panacea, but do we know that it's becoming more vulnerable?