4 ms·
> The key idea behind our threat model is that end devices using a VPN connection will, by default, send all their traffic to the same destination (the VPN serv
by majke 2y ago
> The key idea behind our threat model is that end devices using a VPN connection will, by default, send all their traffic to the same destination (the VPN server) identified by its public IP address – Refer to Figure 1. On the other hand, non-VPN traffic is typically sent to a mix of different destinations; e.g. websites, weather widget, OS update server, etc.
It's about looking at the cardinality / entropy of target ip's.
- jmnicolas 2y agoSo run a torrent client that doesn't use the VPN on the same ip and you're good to go?
- benlivengood 2y agoFurther, any traffic that doesn't fit the statistical properties of most other users is going to be an easy outlier to spot, and VPN users will tend to cluster with each other. E.g., if there's no traffic to any search engine or social media then VPN use is statistically more likely (or it's a point of sale device, etc.)