5 ms·

Is strong anonymity even theoretically possible on IP based networks?

deleted 6y ago
[deleted]
pfundstein 6y ago
Of course, and Tor is an excellent example of an accessible turnkey solution to the problem. But you should never rely solely Tor or any single measure. 50% of anonymity is your own opsec.
bawolff 6y ago
Yes (under certain, decently reasonable assumptions), but all solutions have very significant tradeoffs. High latency mixnets (e.g. https://en.m.wikipedia.org/wiki/Anonymous_remailer https://en.m.wikipedia.org/wiki/Anonymous_remailer ) have the drawback that latency means it cannot work with interactive protocols. Dining cryptographer networks have much lower latency but scale very poorly. (https://en.m.wikipedia.org/wiki/Dining_cryptographers_problem https://en.m.wikipedia.org/wiki/Dining_cryptographers_proble... ) Tor (a low latency mixnet) trades a weaker threat model for low latency and scalability. So basically you can pick two of scalability, low-latency and resistence to global passive adversaries.
jandrese 6y ago
If your adversary has a god level view of the network then it's really hard to achieve strong anonymity. The article mentioned large network operators that can monitor a significant fraction of all traffic in the country. If you were the Chinese Government you would have an even better view into the network. Especially if you send a large file somewhere which makes it easy to correlate the TCP session. For real anonymity you need something that scrambles and delays your traffic to make it harder to track. Something that breaks big transfers up into a bunch of small transfers, sends them via different routes, and generally makes your experience miserably slow.
- londons_explore 6y ago
  You need a system which sends constant numbers of bytes/second along every network link. It would actually be pretty easy to implement for tor (either for the whole network, or individual nodes or routes), but as far as I can see nobody wants to work on it.
  - ta8908695 6y ago
    It sounds like your almost describing the Nym mixnet https://nymtech.net/#protocol https://nymtech.net/#protocol https://youtu.be/_2DQ_iYZi5U?t=1580 https://youtu.be/_2DQ_iYZi5U?t=1580 The tradeoff is you necessarily need to smooth traffic bursts out to meet the fixed rate and that introduces high latency. Unfortunately most user traffic is bursty and not continuous.
- GoblinSlayer 6y ago
  Sending data via several routes should increase throughput.
- tenebrisalietum 6y ago
  > Something that breaks big transfers up into a bunch of small transfers, sends them via different routes, and generally makes your experience miserably slow. Bittorrent has the "break into a bunch of small transfers" part solved. Just need to modify Bittorrent to somehow transfer each piece over a different route.
  - jandrese 6y ago
    "Browsing the web over BitTorrent" is an interesting problem statement.
aj3 6y ago
Why wouldn't it? IP only provides best-effort delivery anyway, yet TCP which is built on it makes the connections reliable. Similarly you can use IP which isn't anonymous to build strongly anonymous systems.
cbsmith 6y ago
You can get pretty strong anonymity. That actually got built out pretty well in 2000 by Zero Knowledge Systems, and they open sourced all the components into the Linux kernel back in 2000: https://adam.shostack.org/zeroknowledgewhitepapers/Freedom_System_2_Architecture.pdf https://adam.shostack.org/zeroknowledgewhitepapers/Freedom_S... They actually dealt a lot with the traffic analysis problem, and had both a technical and financial model to encourage defense against it. It wasn't perfect, but it would be more resilient to this stuff than Tor IMHO. It just had the disadvantage that latency was atrocious (for obvious reasons), and ultimately it turns out people don't care about anonymity.
fsflover 6y ago
Yes: http://geti2p.net/en/ http://geti2p.net/en/
- lc5G 6y ago
  Could you explain why i2p works better than tor for the type of attacks from the article?
  - pfundstein 6y ago
    It's not and it's much less anonymous.
    - fsflover 6y ago
      This is plain wrong: https://geti2p.net/en/comparison/tor https://geti2p.net/en/comparison/tor
      - pfundstein 6y ago
        That link doesn't support your statement. Tor is more anonymous than I2P.
        fsflover 6y ago
        Almost everything in the section "Benefits of Tor over I2P" is about the size of the network. Technically I2P is more secure, it just lacks users. I2P allows to increase the number of hops to any value.

deleted 6y ago

[deleted]

Of course, and Tor is an excellent example of an accessible turnkey solution to the problem. But you should never rely solely Tor or any single measure. 50% of anonymity is your own opsec.

bawolff 6y ago

Yes (under certain, decently reasonable assumptions), but all solutions have very significant tradeoffs. High latency mixnets (e.g. https://en.m.wikipedia.org/wiki/Anonymous_remailer https://en.m.wikipedia.org/wiki/Anonymous_remailer ) have the drawback that latency means it cannot work with interactive protocols. Dining cryptographer networks have much lower latency but scale very poorly. (https://en.m.wikipedia.org/wiki/Dining_cryptographers_problem https://en.m.wikipedia.org/wiki/Dining_cryptographers_proble... ) Tor (a low latency mixnet) trades a weaker threat model for low latency and scalability. So basically you can pick two of scalability, low-latency and resistence to global passive adversaries.

jandrese 6y ago

If your adversary has a god level view of the network then it's really hard to achieve strong anonymity. The article mentioned large network operators that can monitor a significant fraction of all traffic in the country. If you were the Chinese Government you would have an even better view into the network. Especially if you send a large file somewhere which makes it easy to correlate the TCP session. For real anonymity you need something that scrambles and delays your traffic to make it harder to track. Something that breaks big transfers up into a bunch of small transfers, sends them via different routes, and generally makes your experience miserably slow.

londons_explore 6y ago
You need a system which sends constant numbers of bytes/second along every network link. It would actually be pretty easy to implement for tor (either for the whole network, or individual nodes or routes), but as far as I can see nobody wants to work on it.
- ta8908695 6y ago
  It sounds like your almost describing the Nym mixnet https://nymtech.net/#protocol https://nymtech.net/#protocol https://youtu.be/_2DQ_iYZi5U?t=1580 https://youtu.be/_2DQ_iYZi5U?t=1580 The tradeoff is you necessarily need to smooth traffic bursts out to meet the fixed rate and that introduces high latency. Unfortunately most user traffic is bursty and not continuous.
GoblinSlayer 6y ago
Sending data via several routes should increase throughput.
tenebrisalietum 6y ago
> Something that breaks big transfers up into a bunch of small transfers, sends them via different routes, and generally makes your experience miserably slow. Bittorrent has the "break into a bunch of small transfers" part solved. Just need to modify Bittorrent to somehow transfer each piece over a different route.
- jandrese 6y ago
  "Browsing the web over BitTorrent" is an interesting problem statement.

aj3 6y ago

Why wouldn't it? IP only provides best-effort delivery anyway, yet TCP which is built on it makes the connections reliable. Similarly you can use IP which isn't anonymous to build strongly anonymous systems.

cbsmith 6y ago

You can get pretty strong anonymity. That actually got built out pretty well in 2000 by Zero Knowledge Systems, and they open sourced all the components into the Linux kernel back in 2000: https://adam.shostack.org/zeroknowledgewhitepapers/Freedom_System_2_Architecture.pdf https://adam.shostack.org/zeroknowledgewhitepapers/Freedom_S... They actually dealt a lot with the traffic analysis problem, and had both a technical and financial model to encourage defense against it. It wasn't perfect, but it would be more resilient to this stuff than Tor IMHO. It just had the disadvantage that latency was atrocious (for obvious reasons), and ultimately it turns out people don't care about anonymity.

fsflover 6y ago

Yes: http://geti2p.net/en/ http://geti2p.net/en/

lc5G 6y ago
Could you explain why i2p works better than tor for the type of attacks from the article?
- pfundstein 6y ago
  It's not and it's much less anonymous.
  - fsflover 6y ago
    This is plain wrong: https://geti2p.net/en/comparison/tor https://geti2p.net/en/comparison/tor
    - pfundstein 6y ago
      That link doesn't support your statement. Tor is more anonymous than I2P.
      - fsflover 6y ago
        Almost everything in the section "Benefits of Tor over I2P" is about the size of the network. Technically I2P is more secure, it just lacks users. I2P allows to increase the number of hops to any value.