4 ms·

To be clear, the only advantage of Tor wrt correlation is that it uses more hops, not anything related to how those hops are selected, right?

fragmede 2y ago
How paranoid are you? If I were the US government and wanted a leg up on Internet meta data of people looking to avoid surveillance, I'd run a shitton of Tor exit nodes and log IP information on the off chance something useful comes of it.
- bangaladore 2y ago
  Afaik, all that gives you is the person running the exit node (and where the request is going) and nothing about the person who initiated the request N-hops ago.
  - radicaldreamer 2y ago
    A large set of exit and relay nodes are being run out of Germany, presumably by some state actor, so it's likely at least a subset of traffic is being unmasked by a state actor. I'm sure some of this info has been passed on and then parallel construction used to obfuscate the initial source of the data.
- devmor 2y ago
  Isn’t that exactly what they do?
chatmasta 2y ago
Tor and Private Relay are both vulnerable to traffic analysis by a global adversary, which is what OP is complaining about here (if Apple and Cloudflare collude or are compelled to share data). Basically, if you can see the traffic going in/out of all the nodes (even just the amount of it), then you can deanonymize individual streams of data. Tor explicitly does not defend against this threat.
- Arnavion 2y ago
  Yes I know. My point was that yupyupyups said: >Contrast this model with Tor where you have 3 hops that are selected in such a way that there is a lower probability that logs from the node operators will be combined "selected in such a way" sounded like there is something in Tor that actively works against a situation where the hops are owned by the same operator, but AFAIK there isn't such a thing. Hence my request for confirmation that the only thing Tor does better than the Apple+Cloudflare situation here is that it has more than two hops so that it increases the number of colluders needed for correlation.
  - chatmasta 2y ago
    Yeah, all true. In fact Tor explicitly forgoes any mitigation against a global passive adversary - it’s designed to accept that risk. Another thing Tor does better is that it creates circuits with nodes spanning multiple jurisdictions, whereas Private Relay circuits are confined to one jurisdiction (and worse, to your current one). > actively works against a situation where the hops are owned by the same operator, but AFAIK there isn't such a thing Right, there is nothing Tor can do to guarantee this, but it does take some best-effort measures like maximizing diversity of AS providers (you won’t get a circuit of three nodes with the same AS number). Of course this is meaningless in a world where anyone can purchase servers from anywhere. There is a lot of research on this attack vector against Tor (and p2p networks in general) - the relevant search term is “Sybil resistance.” Btw - just to add some detail to the discussion, this blog post from Cloudflare is a good introduction to Private Relay: https://blog.cloudflare.com/icloud-private-relay https://blog.cloudflare.com/icloud-private-relay

fragmede 2y ago

How paranoid are you? If I were the US government and wanted a leg up on Internet meta data of people looking to avoid surveillance, I'd run a shitton of Tor exit nodes and log IP information on the off chance something useful comes of it.

bangaladore 2y ago
Afaik, all that gives you is the person running the exit node (and where the request is going) and nothing about the person who initiated the request N-hops ago.
- radicaldreamer 2y ago
  A large set of exit and relay nodes are being run out of Germany, presumably by some state actor, so it's likely at least a subset of traffic is being unmasked by a state actor. I'm sure some of this info has been passed on and then parallel construction used to obfuscate the initial source of the data.
devmor 2y ago
Isn’t that exactly what they do?

chatmasta 2y ago

Tor and Private Relay are both vulnerable to traffic analysis by a global adversary, which is what OP is complaining about here (if Apple and Cloudflare collude or are compelled to share data). Basically, if you can see the traffic going in/out of all the nodes (even just the amount of it), then you can deanonymize individual streams of data. Tor explicitly does not defend against this threat.

Arnavion 2y ago
Yes I know. My point was that yupyupyups said: >Contrast this model with Tor where you have 3 hops that are selected in such a way that there is a lower probability that logs from the node operators will be combined "selected in such a way" sounded like there is something in Tor that actively works against a situation where the hops are owned by the same operator, but AFAIK there isn't such a thing. Hence my request for confirmation that the only thing Tor does better than the Apple+Cloudflare situation here is that it has more than two hops so that it increases the number of colluders needed for correlation.
- chatmasta 2y ago
  Yeah, all true. In fact Tor explicitly forgoes any mitigation against a global passive adversary - it’s designed to accept that risk. Another thing Tor does better is that it creates circuits with nodes spanning multiple jurisdictions, whereas Private Relay circuits are confined to one jurisdiction (and worse, to your current one). > actively works against a situation where the hops are owned by the same operator, but AFAIK there isn't such a thing Right, there is nothing Tor can do to guarantee this, but it does take some best-effort measures like maximizing diversity of AS providers (you won’t get a circuit of three nodes with the same AS number). Of course this is meaningless in a world where anyone can purchase servers from anywhere. There is a lot of research on this attack vector against Tor (and p2p networks in general) - the relevant search term is “Sybil resistance.” Btw - just to add some detail to the discussion, this blog post from Cloudflare is a good introduction to Private Relay: https://blog.cloudflare.com/icloud-private-relay https://blog.cloudflare.com/icloud-private-relay