3 ms·
Suppose you visit facebook via tor and log in. If you can be traced across the web, then your real name can now be attached to all your activity.
by syrrim 6y ago
Suppose you visit facebook via tor and log in. If you can be traced across the web, then your real name can now be attached to all your activity.
- wolco 6y agoWait.. you are logging into facebook and using your real name? Step 1: Log into tor. Step 2: Create facebook account using a fake name Step 3: Don't add anyone you know in real life as a friend. Best not to search for friends. Facebook will not connect you now.
- jandrese 6y agoWhat is the point of using Facebook then?
- tonyarkles 6y agoOne example would be to join groups that you don't want associated with your IRL identity. Another would be as part of a phish test while doing a pentest against an organization you're working for. Or... a bazillion other illegitimate reasons ;).
- gruez 6y ago>If you can be traced across the web, then your real name can now be attached to all your activity. But that's not how tor works. It's not like a VPN where all your traffic comes out of one node. So if even if you logged into facebook using tor browser, it won't be able to correlate your other tor browsing activities. Even third party cookies won't work because tor browser has third party isolation enabled.
- webmaven 6y ago> >If you can be traced across the web, then your real name can now be attached to all your activity. > But that's not how tor works. It's not like a VPN where all your traffic comes out of one node. So if even if you logged into facebook using tor browser, it won't be able to correlate your other tor browsing activities. Even third party cookies won't work because tor browser has third party isolation enabled. Except that the OP discussed a technique that exposed an attribute of the user's setup that (when combined with other such techniques) allows unique (albeit pseudonymous) identification of the user across requests and sessions (this is called fingerprinting). Add in correlation of the pseud identifier with a real-world identity via use of FB, and the user would be totally hosed.
- staticassertion 6y agoYes, totally. As I said, it's a very significant issue, but it requires a separate ability to tie the tor identity to the user's real identity.