7 ms·
Researchers Develop Proxy-Less Anonymity System
- meow 15y agoHow will this stop governments from forcing ISPs to block sites? Its ridiculous to assume that the governments censoring content will let ISPs provide a loophole through which their users can access blocked sites..
- KevinEldon 15y agoAlthough the article says ISP, what they mean is any intermediate hop between the requester and the destination. So any network outside of the control of the censoring government could provide this service.
- mdaniel 15y agoIt is my cursory understanding that 1. the government will not be able to identify "secret" transmissions from normal ones and 2. it only requires the participation of one hop along the route to succeed. Given that my path from Paris to wikipedia.org is 18 hops [excluding my immediate upstream hop], that is a pretty big swatch for hiding "compliant" ISPs.
- mdaniel 15y agoIf anyone else didn't know about Public-Key Stenography, this paper[1] showed up almost everywhere in the search results. It is heavier on the math than I would like for my "wha?" level curiosity, but given the audience here it may be a hit. 1 = http://www.cs.cmu.edu/~biglou/pubkeystego.pdf http://www.cs.cmu.edu/~biglou/pubkeystego.pdf
- haliax 15y agoThis seems to be a related idea: http://people.csail.mit.edu/rivest/Chaffing.txt http://people.csail.mit.edu/rivest/Chaffing.txt
- daten 15y agoMy concerns: * "proxy-less" is a bad term, it sounds like they're still using a proxy, it's just using https encapsulation along the way to hide this from the first few hops. * The participating entry-nodes (proxies?) could be systematically determined with a scanner for future blacklisting or investigation by someone trying to stop this circumvention of censorship. * You have to trust the people running the entry nodes, if they have the key to decrypt your traffic. This sounds like a design that governments can use for monitoring.
- pmjordan 15y agoThe participating entry-nodes (proxies?) could be systematically determined with a scanner How, exactly? Measuring the run-time of packets and comparing to the expected run-time? I suspect this could be masked by the proxy, but I'm not sure. You have to trust the people running the entry nodes You can encrypt the payload independently and then re-encrypt it for the HTTPS tunnel. But as with any proxy, they know the ultimate destination for your traffic, even if they can't get at the data itself.
- daten 15y agoIf your path requires a participating station for the proxy-connection to succeed, just measure successful and unsuccessful proxy-connections against different network paths and logically determine which paths have participating nodes and which don't. Compare the results and expand your search until you narrow down which hops in your path are required for a success.
- swolchok 15y ago(I am one of the authors on the Telex paper.) > * The participating entry-nodes (proxies?) could be systematically determined with a scanner for future blacklisting or investigation by someone trying to stop this circumvention of censorship. The "entry nodes" are positioned at ISPs outside the censoring country. By assumption, they are on-path from the censor's network to popular Internet destinations that the censor has left untouched. > * You have to trust the people running the entry nodes, if they have the key to decrypt your traffic. This sounds like a design that governments can use for monitoring. This came up in our discussions pre-release, and we think it's an interesting feature of Telex. You're effectively able to select which government's Internet policy you'd like to live under.
- KevinEldon 15y agoI understand how this might work technically, but don't see why an ISP or heavily trafficked web-business would be motivated to deploy and maintain one of these Telex stations over the long term. You'd be adding an extra point of failure, cost for maintenance of the Telex stations, most likely some latency, and you'd have to cover the cost of bandwidth for traffic not headed to your website... all while running the risk of being blocked by the censoring country.
- something 15y agoBecause you don't like the censoring country's government and you want to subvert their rule? Maybe you're another government yourself and you're willing to pay for this?
- JoeAltmaier 15y agoTelex stations could be in the cloud, change IP address frequently to avoid a static blacklist. But how to advertise their presence to Telex clients without using a static DNS entry? Some chain of DNS entries that changes predictably? Sounds like more work to be done.
- gcr 15y agoHow is this different than TOR?
- mdaniel 15y agoIt is my understanding that Tor has defined entry points into the network. This mechanism obscures the diversion point even from the requesting user. It claims to have the added advantage that traffic is not provably subversive, unlike connecting to a Tor network which in and of itself raises suspicions.
- trotsky 15y agoIt seems that the system relies on a single private key for secrecy, but deploys it widely - to every participating ISP. It seems difficult to believe that you could distribute a key like that and have it stay private, especially with so much active state sponsored cyber espionage going on. I suppose you could solve this by generating a good number of key pairs and only deploying new secret keys to ISPs when there was evidence of disclosure, but if the government in question eavesdropped instead of blocked I'm not sure you'd find out quickly enough. It's unclear what advantages you'd get by eavesdropping, presumably little if it's really just used as a tunnel to tor.
- aidenn0 15y agoIt seems like inspecting packets at line-rate on a route to a site popular enough to not be suspect would be prohibitively expensive.