3 ms·

I'm doubtful of their 55-60% accuracy claim; how could a statistical analysis of encrypted traffic differentiate between samizdat and benign text? Or, more rele

I'm doubtful of their 55-60% accuracy claim; how could a statistical analysis of encrypted traffic differentiate between samizdat and benign text? Or, more relevantly, whether someone browsing Wikipedia is looking up Tienanmen or just porn?

mike-cardwell 16y ago
It's just simple traffic analysis. A page load generates a certain number of request/responses. Each request and response is a specific size, and will be transferred in a specific order. You create a fingerprint of that and it doesn't matter if the page is opened via a plain http channel, or https, or over Tor, The fingerprint will be the same (almost).
- justsee 16y ago
  But it's not that simple if the client is running as a relaying node as well, is it? The mixture of client traffic and relay traffic would make traffic analysis much more difficult. Of course if you're that interesting that your ISP is doing traffic analysis on your connection you quite possibly have more pressing security issues.
  - gwern 16y ago
    Merely reduces the statistical power, doesn't make the inferences go away completely. And there may be techniques for filtering out relayed material - perhaps relay traffic emerges from the node quickly enough that an observer can then figure out what entering traffic was just being relayed and remove it from consideration (always a concern with a high-performance mix network since you can't randomize retransmission as strongly as you could with email mix networks like Mixmaster where you could wait hours, without rendering it unusable) or relay traffic is constant enough that one can assume any 'spikes' are the user's traffic.
  - mike-cardwell 16y ago
    Relay traffic should be easy enough to identify and filter out. If you think about it, all incoming relay traffic is mirrored on the way out. Obviously it's re-encrypted, but the amount and direction of data remains the same. It adds complexity to the attack, but doesn't negate it completely.

mike-cardwell 16y ago

It's just simple traffic analysis. A page load generates a certain number of request/responses. Each request and response is a specific size, and will be transferred in a specific order. You create a fingerprint of that and it doesn't matter if the page is opened via a plain http channel, or https, or over Tor, The fingerprint will be the same (almost).

justsee 16y ago
But it's not that simple if the client is running as a relaying node as well, is it? The mixture of client traffic and relay traffic would make traffic analysis much more difficult. Of course if you're that interesting that your ISP is doing traffic analysis on your connection you quite possibly have more pressing security issues.
- gwern 16y ago
  Merely reduces the statistical power, doesn't make the inferences go away completely. And there may be techniques for filtering out relayed material - perhaps relay traffic emerges from the node quickly enough that an observer can then figure out what entering traffic was just being relayed and remove it from consideration (always a concern with a high-performance mix network since you can't randomize retransmission as strongly as you could with email mix networks like Mixmaster where you could wait hours, without rendering it unusable) or relay traffic is constant enough that one can assume any 'spikes' are the user's traffic.
- mike-cardwell 16y ago
  Relay traffic should be easy enough to identify and filter out. If you think about it, all incoming relay traffic is mirrored on the way out. Obviously it's re-encrypted, but the amount and direction of data remains the same. It adds complexity to the attack, but doesn't negate it completely.