4 ms·

When using Tor+HTTPS, the first NSA eavesdropper can see location. How serious is that?

by esalman 13y ago

icebraining 13y ago
By location they mean your IP (from which they can get your address, by asking the ISP). As long as they can't links the two captured packets, they just know that you're using Tor.
- vidyesh 13y ago
  Well your IP determines your location. That other evasdropper is from your ISP, since you first connect to your ISP and then Tor. Your ISP potentially knows your location which is what the NSA evasdropper gets. And since its shared with amongst both the evasdropper, potentially NSA knows your location even if you use Tor. They should have indicated that too I guess.
  - icebraining 13y ago
    Sharing the data is not enough, they have to link it to be useful. They probably can, though.
- Achshar 13y ago
  I am wondering how that works with dynamic ip allocation by ISP. My ip changes every time I reset my router.
  - noerps 13y ago
    That doesn't matter, since the changes of your endpoints ip are available from your ISP.
vidyesh 13y ago
Well only if its from your ISP. And the illustration should add that both the NSA eavesdropper(s) would get that information actually. Since data is shared.
- icebraining 13y ago
  The data is shared, but the question is whether or not they can link it.
nwh 13y ago
They only see the location of the user entering Tor, which is only really an issue if using Tor itself is illegal, or they also control the exit node you are using. In the second case, it would be possible (though unlikely) for them to correlate the entry and exit through bandwidth and timing.
belorn 13y ago
We don't know. It slightly depends on how much worse things get in the US. You might get a permanent flag in "your file" as a potential troublemaker, but so might living in the wrong neighborhood, or going to the wrong bar, or being acquainted with someone under NSA suspicion. It's impossible to know what will or will not be put in the file, or which flags will give you grief (without you ever knowing why) when visiting an airport or when applying for a job.
andrewcooke 13y ago
well, it is serious, in that it's the most likely weak point in tor. however, exactly how serious is still an open question. remember - what the nsa wants is both your location and the site. your location alone only means that you were using the internet (and tor, which itself might be regarded a suspicious). the site alone only means someone was using the site. what the NSA have to do is connect those. so everything depends on whether the two NSA people can "join up the dots" (graphically, in that diagram, the dark blue dots joining them). because there's nothing "obvious" that tells them that the message with the location is connected to the message with the site. if they can't make that connection, then they don't know anything useful. but if they can make that connection, then they know that you (well, someone at your location - an open wifi might give you a little deniability, for example) looked at that site. the way they might be able to do it is by comparing traffic patterns. if they can show, for example, that every time you send a request, the site receives a request, and if that happens again and again, so reliably that it cannot be chance, then they can make the connection. so it depends on things like the frequency with which you look at the site, the amount of (tor) traffic when you are around, and the ability of the NSA to assemble and correlate large amounts of data. [disclaimer: not an expert; i don't know the current state of play on how bad a problem this is; i just know it's a known issue. and if i were going up against the nsa, i wouldn't trust tor alone - i'd use an anonymous, disposable, portable connection device, and keep data to an absolute minimum.]
- claudius 13y ago
  Would it be helpful to run a forwarding (at least non-exit, possibly entry) Tor node on one’s own computer to mask the Tor traffic actually originating from this machine?
  - andrewcooke 13y ago
    i think it might, but only at about the level of adding an extra tor hop (the NSA can compare requests in and out, and try to detect which ones out are extra).

When using Tor+HTTPS, the first NSA eavesdropper can see location. How serious is that?

by esalman 13y ago

When using Tor+HTTPS, the first NSA eavesdropper can see location. How serious is that?

By location they mean your IP (from which they can get your address, by asking the ISP). As long as they can't links the two captured packets, they just know that you're using Tor.

vidyesh 13y ago
Well your IP determines your location. That other evasdropper is from your ISP, since you first connect to your ISP and then Tor. Your ISP potentially knows your location which is what the NSA evasdropper gets. And since its shared with amongst both the evasdropper, potentially NSA knows your location even if you use Tor. They should have indicated that too I guess.
- icebraining 13y ago
  Sharing the data is not enough, they have to link it to be useful. They probably can, though.
Achshar 13y ago
I am wondering how that works with dynamic ip allocation by ISP. My ip changes every time I reset my router.
- noerps 13y ago
  That doesn't matter, since the changes of your endpoints ip are available from your ISP.

vidyesh 13y ago

Well only if its from your ISP. And the illustration should add that both the NSA eavesdropper(s) would get that information actually. Since data is shared.

icebraining 13y ago
The data is shared, but the question is whether or not they can link it.

nwh 13y ago

They only see the location of the user entering Tor, which is only really an issue if using Tor itself is illegal, or they also control the exit node you are using. In the second case, it would be possible (though unlikely) for them to correlate the entry and exit through bandwidth and timing.

belorn 13y ago

We don't know. It slightly depends on how much worse things get in the US. You might get a permanent flag in "your file" as a potential troublemaker, but so might living in the wrong neighborhood, or going to the wrong bar, or being acquainted with someone under NSA suspicion. It's impossible to know what will or will not be put in the file, or which flags will give you grief (without you ever knowing why) when visiting an airport or when applying for a job.

andrewcooke 13y ago

well, it is serious, in that it's the most likely weak point in tor. however, exactly how serious is still an open question. remember - what the nsa wants is both your location and the site. your location alone only means that you were using the internet (and tor, which itself might be regarded a suspicious). the site alone only means someone was using the site. what the NSA have to do is connect those. so everything depends on whether the two NSA people can "join up the dots" (graphically, in that diagram, the dark blue dots joining them). because there's nothing "obvious" that tells them that the message with the location is connected to the message with the site. if they can't make that connection, then they don't know anything useful. but if they can make that connection, then they know that you (well, someone at your location - an open wifi might give you a little deniability, for example) looked at that site. the way they might be able to do it is by comparing traffic patterns. if they can show, for example, that every time you send a request, the site receives a request, and if that happens again and again, so reliably that it cannot be chance, then they can make the connection. so it depends on things like the frequency with which you look at the site, the amount of (tor) traffic when you are around, and the ability of the NSA to assemble and correlate large amounts of data. [disclaimer: not an expert; i don't know the current state of play on how bad a problem this is; i just know it's a known issue. and if i were going up against the nsa, i wouldn't trust tor alone - i'd use an anonymous, disposable, portable connection device, and keep data to an absolute minimum.]

claudius 13y ago
Would it be helpful to run a forwarding (at least non-exit, possibly entry) Tor node on one’s own computer to mask the Tor traffic actually originating from this machine?
- andrewcooke 13y ago
  i think it might, but only at about the level of adding an extra tor hop (the NSA can compare requests in and out, and try to detect which ones out are extra).