4 ms·

It might seem a smaller task in terms of needed servers but your suspicion fails with the simple fact that anyone can add a relay to the network and thus counte

by hnha 13y ago

It might seem a smaller task in terms of needed servers but your suspicion fails with the simple fact that anyone can add a relay to the network and thus counter the surveillance. I run a non-exit node on every webserver I got because it's cheap and feels good.

gizmo686 13y ago
You don't need to run all of the exit nodes. If a group controls even 10% of the exit node bandwidth, then they have access to 10% of the traffic and can do major analysis. Even if you use end to end encryption (as in https), than with 10% of the endnote bandwidth, they would see the entry and exit of 1% of all packets, and can (probably) correlate them (with timing) to associate the incoming and outgoing. And if you use tor regularly, then every time either your entry or exit node changes, they get another 1% dice roll.
- dfc 13y ago
  Q: What are Entry Guards? A: Tor (like all current practical low-latency anonymity designs) fails when the attacker can see both ends of the communications channel. For example, suppose the attacker controls or watches the Tor relay you choose to enter the network, and also controls or watches the website you visit. In this case, the research community knows no practical low-latency design that can reliably stop the attacker from correlating volume and timing information on the two sides. So, what should we do? Suppose the attacker controls, or can observe, C relays. Suppose there are N relays total. If you select new entry and exit relays each time you use the network, the attacker will be able to correlate all traffic you send with probability (c/n)2. But profiling is, for most users, as bad as being traced all the time: they want to do something often without an attacker noticing, and the attacker noticing once is as bad as the attacker noticing more often. Thus, choosing many random entries and exits gives the user no chance of escaping profiling by this kind of attacker. The solution is "entry guards": each Tor client selects a few relays at random to use as entry points, and uses only those relays for her first hop. If those relays are not controlled or observed, the attacker can't win, ever, and the user is secure. If those relays are observed or controlled by the attacker, the attacker sees a larger fraction of the user's traffic — but still the user is no more profiled than before. Thus, the user has some chance (on the order of (n-c)/n) of avoiding profiling, whereas she had none before. You can read more at An Analysis of the Degradation of Anonymous Protocols, Defending Anonymous Communication Against Passive Logging Attacks, and especially Locating Hidden Servers. https://www.torproject.org/docs/faq.html.en#EntryGuards https://www.torproject.org/docs/faq.html.en#EntryGuards

by hnha 13y ago

gizmo686 13y ago

You don't need to run all of the exit nodes. If a group controls even 10% of the exit node bandwidth, then they have access to 10% of the traffic and can do major analysis. Even if you use end to end encryption (as in https), than with 10% of the endnote bandwidth, they would see the entry and exit of 1% of all packets, and can (probably) correlate them (with timing) to associate the incoming and outgoing. And if you use tor regularly, then every time either your entry or exit node changes, they get another 1% dice roll.

dfc 13y ago
Q: What are Entry Guards? A: Tor (like all current practical low-latency anonymity designs) fails when the attacker can see both ends of the communications channel. For example, suppose the attacker controls or watches the Tor relay you choose to enter the network, and also controls or watches the website you visit. In this case, the research community knows no practical low-latency design that can reliably stop the attacker from correlating volume and timing information on the two sides. So, what should we do? Suppose the attacker controls, or can observe, C relays. Suppose there are N relays total. If you select new entry and exit relays each time you use the network, the attacker will be able to correlate all traffic you send with probability (c/n)2. But profiling is, for most users, as bad as being traced all the time: they want to do something often without an attacker noticing, and the attacker noticing once is as bad as the attacker noticing more often. Thus, choosing many random entries and exits gives the user no chance of escaping profiling by this kind of attacker. The solution is "entry guards": each Tor client selects a few relays at random to use as entry points, and uses only those relays for her first hop. If those relays are not controlled or observed, the attacker can't win, ever, and the user is secure. If those relays are observed or controlled by the attacker, the attacker sees a larger fraction of the user's traffic — but still the user is no more profiled than before. Thus, the user has some chance (on the order of (n-c)/n) of avoiding profiling, whereas she had none before. You can read more at An Analysis of the Degradation of Anonymous Protocols, Defending Anonymous Communication Against Passive Logging Attacks, and especially Locating Hidden Servers. https://www.torproject.org/docs/faq.html.en#EntryGuards https://www.torproject.org/docs/faq.html.en#EntryGuards