3 ms·
TCP fingerprinting TOR would fingerprint the exit node
by benmmurphy 5y ago
TCP fingerprinting TOR would fingerprint the exit node
- southerntofu 5y agoThat's a fair interpretation! I'm not familiar with tor internals, but i assumed after removing the last encryption layer, the exit node would "expose" raw TCP trafic from the original requester. Otherwise, how does it work?
- benmmurphy 5y agoTCP is a bidirectional stream so ignoring some of the edge cases you can just proxy it across any stream transport. in the case of TOR it sets up a bidirectional stream across its network and then bytes come into the exit node over the TOR stream and then the exit node just writes them out using the normal operating system write() method. bytes then come from the normal operating system read() method on the exit node and the TOR exit node just sends them back over the TOR stream. on the client node setting up the stream over the TOR network and receiving/sending is exposed as a SOCKS proxy but i guess you could also have something fancy which intercepted traffic transparently (https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TransparentProxy https://gitlab.torproject.org/legacy/trac/-/wikis/doc/Transp...). i haven't looked at the TOR project for a while but it looks like they are heavily pushing the TOR browser which I guess means the user is not exposed to any proxy setup and can't accidentally misconfigure things in a way that would break their anonymity.