10 ms·

This is quite neat, if not semi-obvious. I'm not sure how it would even be possible to hide the fact that you are visiting a certain website, while still having

This is quite neat, if not semi-obvious. I'm not sure how it would even be possible to hide the fact that you are visiting a certain website, while still having two-way comms with that IP. How could the ISP route the traffic if they didn't know the source/destination IP? Clearly the IP address maps to a website, though not always one-to-one. In which case Reverse DNS gets you most of the way there. Presumably, this is better in the case of multiple sites served on the same IP through shared hosting or a CDN. Disambiguating with subqueries makes sense to get that last-mile accuracy. While TFA claims 95% of sites are identifiable with their method, it also states 68% already would have been from IP alone in the first place. Presumably unique IP + unique resource boosts that higher. So the fingerprinting is perhaps not so dramatic, while requiring a lot more work. What would be interesting to measure is how many sites _require_ fingerprinting to be uniquely identified. As well, the average number of sites per shared IP - to see how precise IP is even in the shared case.

franky47 5y ago
This is where Tor shines: you never connect to the destination IP directly, so this kind of tracing is made much harder.
- nighthawk454 5y ago
  Yeah, I suppose proxying your requests through other servers is about the only way to obfuscate the traffic. Maybe bonus points if sub-queries from the same page are routed through a set of proxies instead of one, to further challenge fingerprinting.
- NmAmDa 5y ago
  I think a good commercial VPN would provide this functionality if you get used to change ip connection on a regular basis.
  - bawolff 5y ago
    But then your vpn knows who you are talking to
    - NmAmDa 5y ago
      Yes, that turns down to be the question of how to get a trustworthy VPN provider. Even if you run your own on a cloud then same question with VPS provider. There us no definite answer to that. Even TOR nodes are heavily under surveillance.
      - bawolff 5y ago
        The argument for tor is try and distribute the nodes between countries that hate each other: if russia is doing half the survelience and usa the other half, they'll be unlikely to coorporate just to catch you. Whether that's a reasonable thing to believe in is a good question. I trust that more than most sketchy VPN providers, but that's a low bar.
        pbhjpbhj 5y ago
        Seems like traffic from a VPN hosted in a foreign hostile power to a local VPN is exactly the sort of thing that one would investigate?
        bawolff 5y ago
        You need at least 3 layers before the adversary would have to passively surveil multiple points in order to surveil you, afaik
- pabs3 5y ago
  A global passive adversary can still do correlation attacks on traffic going into and out of the network unfortunately. Would be great if Tor had traffic splitting, chaff traffic and jitter.
  - no_time 5y ago
    That's why real time networking and perfect privacy are inherently incompatible. There was a proof of concept tor like network posted here that did away with the real time aspect and wasted quite a lot of bandwidth to conceal your true target connection but that seemed like a good solution. Unfortunately I can't remember it's name.
inopinatus 5y ago
Reverse DNS is pretty lousy for this, truth be told. Perhaps a couple of decades back there was a reasonable chance of reverse lookup bearing some relation to the host component of the URL that led to the exchange of packets. These days, I'd consider such commonality to be a surprising exception. In particular, don't interpret that 68% figure of bijection to mean the reverse lookup will be meaningful. I'd wager a large number of them are public cloud instances, and a PTR string ending in "compute.amazonaws.com" isn't likely to be a famous bookshop. Hey, consider yourself lucky it wasn't a NXDOMAIN. Note that DNS is not actually normative for HTTP. The standard does not specify how names are resolved to endpoints; it defines no service name or equivalent/alternative record. For years the standards committee has (quite shamefully and negligently in my view) relied on tacitly squatting the address (A/AAAA) record. This architectural wart forces workarounds for consequential misbehaviours both in HTTP (such as aliasing at the domain apex), and in other protocols besides since everyone else has to tiptoe around the entitled gorilla. I suspect the workarounds thus employed further contribute to the fingerprinting options available.
- nighthawk454 5y ago
  Welp, TIL. I tried a reverse lookup for a site I own and indeed got some long string of `a134124randomstuff.awsglobalaccelerator.com`. I suppose I naively assumed that if I put an IP address in the A record, that would be how it resolves. Clearly not! I guess whatever's under the hood of the NS records probably adds a few translation layers. Will have to read further, thanks!
  - mercora 5y ago
    it is just a different record entirely. there is a special zone for reverse lookup on ip addresses for ip4 and ip6 respectively. the address gets transformed into DNS labels to make the lookup. i.e to do a lookup for the ip address "192.0.2.1" the actual name for which the lookup is done is "1.2.0.192.in-addr.arpa." and the delegation for these zones can be and typically is entirely different from the forward zone. if you only have access to the forward zone you wont affect the reverse zone at all...
meowface 5y ago
The page offers CDNs as a potential answer. Cloudflare's reverse proxying, for example, prevents this kind of analysis. (An adversary could compromise Cloudflare's or any other CDN's network and snoop that way, but that takes more effort and is more risky than passive collection of internet traffic, which is otherwise all you need.)
fsflover 5y ago
> I'm not sure how it would even be possible to hide the fact that you are visiting a certain website, while still having two-way comms with that IP. https://geti2p.net https://geti2p.net

franky47 5y ago

This is where Tor shines: you never connect to the destination IP directly, so this kind of tracing is made much harder.

nighthawk454 5y ago
Yeah, I suppose proxying your requests through other servers is about the only way to obfuscate the traffic. Maybe bonus points if sub-queries from the same page are routed through a set of proxies instead of one, to further challenge fingerprinting.
NmAmDa 5y ago
I think a good commercial VPN would provide this functionality if you get used to change ip connection on a regular basis.
- bawolff 5y ago
  But then your vpn knows who you are talking to
  - NmAmDa 5y ago
    Yes, that turns down to be the question of how to get a trustworthy VPN provider. Even if you run your own on a cloud then same question with VPS provider. There us no definite answer to that. Even TOR nodes are heavily under surveillance.
    - bawolff 5y ago
      The argument for tor is try and distribute the nodes between countries that hate each other: if russia is doing half the survelience and usa the other half, they'll be unlikely to coorporate just to catch you. Whether that's a reasonable thing to believe in is a good question. I trust that more than most sketchy VPN providers, but that's a low bar.
      - pbhjpbhj 5y ago
        Seems like traffic from a VPN hosted in a foreign hostile power to a local VPN is exactly the sort of thing that one would investigate?
        bawolff 5y ago
        You need at least 3 layers before the adversary would have to passively surveil multiple points in order to surveil you, afaik
pabs3 5y ago
A global passive adversary can still do correlation attacks on traffic going into and out of the network unfortunately. Would be great if Tor had traffic splitting, chaff traffic and jitter.
- no_time 5y ago
  That's why real time networking and perfect privacy are inherently incompatible. There was a proof of concept tor like network posted here that did away with the real time aspect and wasted quite a lot of bandwidth to conceal your true target connection but that seemed like a good solution. Unfortunately I can't remember it's name.

inopinatus 5y ago

Reverse DNS is pretty lousy for this, truth be told. Perhaps a couple of decades back there was a reasonable chance of reverse lookup bearing some relation to the host component of the URL that led to the exchange of packets. These days, I'd consider such commonality to be a surprising exception. In particular, don't interpret that 68% figure of bijection to mean the reverse lookup will be meaningful. I'd wager a large number of them are public cloud instances, and a PTR string ending in "compute.amazonaws.com" isn't likely to be a famous bookshop. Hey, consider yourself lucky it wasn't a NXDOMAIN. Note that DNS is not actually normative for HTTP. The standard does not specify how names are resolved to endpoints; it defines no service name or equivalent/alternative record. For years the standards committee has (quite shamefully and negligently in my view) relied on tacitly squatting the address (A/AAAA) record. This architectural wart forces workarounds for consequential misbehaviours both in HTTP (such as aliasing at the domain apex), and in other protocols besides since everyone else has to tiptoe around the entitled gorilla. I suspect the workarounds thus employed further contribute to the fingerprinting options available.

nighthawk454 5y ago
Welp, TIL. I tried a reverse lookup for a site I own and indeed got some long string of `a134124randomstuff.awsglobalaccelerator.com`. I suppose I naively assumed that if I put an IP address in the A record, that would be how it resolves. Clearly not! I guess whatever's under the hood of the NS records probably adds a few translation layers. Will have to read further, thanks!
- mercora 5y ago
  it is just a different record entirely. there is a special zone for reverse lookup on ip addresses for ip4 and ip6 respectively. the address gets transformed into DNS labels to make the lookup. i.e to do a lookup for the ip address "192.0.2.1" the actual name for which the lookup is done is "1.2.0.192.in-addr.arpa." and the delegation for these zones can be and typically is entirely different from the forward zone. if you only have access to the forward zone you wont affect the reverse zone at all...

meowface 5y ago

The page offers CDNs as a potential answer. Cloudflare's reverse proxying, for example, prevents this kind of analysis. (An adversary could compromise Cloudflare's or any other CDN's network and snoop that way, but that takes more effort and is more risky than passive collection of internet traffic, which is otherwise all you need.)

fsflover 5y ago

> I'm not sure how it would even be possible to hide the fact that you are visiting a certain website, while still having two-way comms with that IP. https://geti2p.net https://geti2p.net