3 ms·
The attack surface is far larger than what you specified. Any networking equipment sotting between the client and server(s) can pick up and log IP addresses. K
by overfeed 5mo ago
The attack surface is far larger than what you specified. Any networking equipment sotting between the client and server(s) can pick up and log IP addresses.
Knowing the online services one uses, and the times (to the millisecond) they used them goes a long way to deanonymize individuals. Correlating Internet routing events is very effective when combined with other data sources, like physical surveillance and knowing the exact times the target got home, or interacted with their phone after getting a DM alert.
- illiac786 5mo agoWhat’s the difference if Mullvad did not have the vulnerability described above?
- overfeed 5mo agoThe vulnerability enables clustering outgoing Mullvad traffic into user-sized buckets based on metadata analysis alone. Clustering, in turn, allows time-based deanonymization[1], against the users assumptions of being sufficiently anonymized. Adversaries who do not enjoy a backbone-traffic MitM vantage point cannot exploit this vulnerability, which makes it appear NOBUS-y. 1. Any *aaS, forum, or board, when given a (Mullvad!) IP address and series of request timestamps, and a subpoena, can yield PII on the real identity (email, phone, billing address)
- illiac786 5mo agobut, to cluster this traffic, wouldn’t you need equipment between each and every mullvad exit node and each and every server the user access? Or at least a large proportion of it? Are you talking about a surveillance state?