3 ms·
> Tor is apparently wide open to the NSA through traffic analysis. Would you be willing to clarify what you mean by that? To start with, are you saying that T
by kfreds 2y ago
> Tor is apparently wide open to the NSA through traffic analysis.
Would you be willing to clarify what you mean by that?
To start with, are you saying that Tor is wide open to traffic analysis
(1) by anyone,
(2) by powerful attackers such as the NSA, or
(3) by the NSA specifically?
- roywiggins 2y agoThe allegation is usually that the NSA owns enough of the Tor network to deanonymize people using it.
- dumbo-octopus 2y ago“owns” not necessarily in a financial sense, more that they have very comprehensive access to ip metadata the world over.
- thisconnect 2y agoNot just that, nsa can observe enough of the whole intrnet traffic and do deep packet inspection. Afaik tor does explicitly not protect against such an observer in their threat model.
- ddtaylor 2y ago> do deep packet inspection There is no DPI on Tor networks. Traffic analysis for de-anonymization for Tor works by knowing all the variables in the system and solving it, not by looking at any content of the packets themselves. The last time something like that was possible at all in Tor it broke it entirely and destroyed the anonymization. The bug involved a vulnerability in the way Tor handled the traffic confirmation attack on Onion Services. This attack allowed malicious relays to embed uniquely identifiable information into Tor cells (the packets used in the Tor network).
- g-b-r 2y agoNo, you just need to observe the timings, and only of the first and last segments of the communication Western nations will probably have access to them in most cases, at least for traffic originating and ending in one of them
- ddtaylor 2y agoThat's not deep packet inspection, just FYI. Timing and traffic correlation attacks never get any access to the packet information and piggy back on existing network weaknesses (correlating IP addresses based on timing metadata)
- g-b-r 2y agoYeah, but there's no need of "knowing all the variables in the system" and there's no "last time something like that was possible", it's always been possible. And you get the "packet information" out of the exit nodes...
- roywiggins 2y agoDPI usually refers to actually poking around the contents of the packets, which in TOR are (hopefully) minimally informative. With timing attacks you just keep track of the volume.
- g-b-r 2y agoWhy is DPI still being brought up? And what was wrong in my message? With timing you keep track of the volume and... timing, which (often) allows you to correlate the entering and exiting traffic...
- deleted 2y ago[deleted]
- dooglius 2y ago(2), the Tor design is explicitly stated as being vulnerable to a "global passive adversary" (you can search that phrase online for details)