5 ms·

Anonymous, secure, encrypted and instant random web browsing is simply not possible. Technically not possible. If you want anonymity, privacy and security you

by muyuu 13y ago

Anonymous, secure, encrypted and instant random web browsing is simply not possible. Technically not possible. If you want anonymity, privacy and security you will have to make certain compromises to your "current internet" that isn't anonymous nor private, but instant and convenient. Or you can just give up and accept having your every step in the net monitored.

AnthonyMouse 13y ago
>Anonymous, secure, encrypted and instant random web browsing is simply not possible. Technically not possible. Do you have a link to the paper where this was proved? Suppose we take Tor and throw a bunch of fiber at it so that the bandwidth improves, then whenever two Tor nodes make a connection they send data at a fixed rate, sending real data when there is any and padding when there isn't. That clearly isn't "impossible" so what's the attack that works against it?
- muyuu 13y ago
  It's trivial, and indeed you can read about this discussion in many papers. I will give you a run-down. A naked insecure connection through HTTP has response times as low as 100ms coast to coast (US). This makes these connections look instant or almost instant. It's impossible to achieve neither anonymity nor encryption through a naked single connection - you need several, at the very least for AUTH - and this alone multiplies the latency vs a single connection. The problem is that the naked eye can notice the difference between 100ms and 200ms, so the experience cannot be the same. The speed of light is already significant in world-wide distances when you consider a number of hops and a minimum number of messages being necessary to ACK, AUTH and then provide some anonymity layer that hides both sides of the connection. Anonymous, secure, encrypted random web browsing CANNOT be as fast as a naked open connection. The difference can be minimised over long transfers, but latency over many requests is always going to be several times higher. You can make all connections theoretically so fast that even a 5-fold slow down is still "fast enough", but for many small transfers it simply cannot be done so fast that it's humanly not noticeable. Alas, there's ALWAYS going to be a noticeable difference between open connections and hardened connections (to the standard we are talking about in this thread). A simple AUTH cannot be done so fast that a connection across the Atlantic is not humanly noticeable. And what we are talking about implies a whole lot more than that.
  - AnthonyMouse 13y ago
    The latency of the crypto itself is minimal, what you're really having a problem with is traversing the ocean. Solution: Don't do that. So we need more nodes. If there are a thousand nodes within a hundred miles of where you are then you don't need to use the ones that are ten thousand miles away. In addition to that, you can mask latency with caching and prefetch. Browsers could prefetch all the small content on linked pages so that by the time you click on a link the data is already on your computer. This could be helped by general purpose HTTP protocol improvements that allow a browser to know speculatively what such content will be on a page through a POST request etc. without having to actually POST anything. SPDY/HTTP 2.0 also allows asynchronous operation which is extremely good at masking round trip latency when requesting many small objects.
    - muyuu 13y ago
      It's not the nodes. It's the inevitable distance between client and server. The post I was replying to wants casual browsing that's secure, anonymous, private and encrypted AND indistinguishable in speed from what he does without all these features. That's impossible, more requests are needed and every single connection adds noticeable lag past a certain minimum distance.
      - dazmax 13y ago
        That post said nothing about speed or latency.
        muyuu 13y ago
        I just pointed out that the experience cannot possibly be exactly the same without any compromise over his current usage as he described it. Some usage will have to be adapted and/or compromised will have to be made, or else just accept being monitored. Overpromising is not a good policy.

by muyuu 13y ago

AnthonyMouse 13y ago

>Anonymous, secure, encrypted and instant random web browsing is simply not possible. Technically not possible. Do you have a link to the paper where this was proved? Suppose we take Tor and throw a bunch of fiber at it so that the bandwidth improves, then whenever two Tor nodes make a connection they send data at a fixed rate, sending real data when there is any and padding when there isn't. That clearly isn't "impossible" so what's the attack that works against it?

muyuu 13y ago
It's trivial, and indeed you can read about this discussion in many papers. I will give you a run-down. A naked insecure connection through HTTP has response times as low as 100ms coast to coast (US). This makes these connections look instant or almost instant. It's impossible to achieve neither anonymity nor encryption through a naked single connection - you need several, at the very least for AUTH - and this alone multiplies the latency vs a single connection. The problem is that the naked eye can notice the difference between 100ms and 200ms, so the experience cannot be the same. The speed of light is already significant in world-wide distances when you consider a number of hops and a minimum number of messages being necessary to ACK, AUTH and then provide some anonymity layer that hides both sides of the connection. Anonymous, secure, encrypted random web browsing CANNOT be as fast as a naked open connection. The difference can be minimised over long transfers, but latency over many requests is always going to be several times higher. You can make all connections theoretically so fast that even a 5-fold slow down is still "fast enough", but for many small transfers it simply cannot be done so fast that it's humanly not noticeable. Alas, there's ALWAYS going to be a noticeable difference between open connections and hardened connections (to the standard we are talking about in this thread). A simple AUTH cannot be done so fast that a connection across the Atlantic is not humanly noticeable. And what we are talking about implies a whole lot more than that.
- AnthonyMouse 13y ago
  The latency of the crypto itself is minimal, what you're really having a problem with is traversing the ocean. Solution: Don't do that. So we need more nodes. If there are a thousand nodes within a hundred miles of where you are then you don't need to use the ones that are ten thousand miles away. In addition to that, you can mask latency with caching and prefetch. Browsers could prefetch all the small content on linked pages so that by the time you click on a link the data is already on your computer. This could be helped by general purpose HTTP protocol improvements that allow a browser to know speculatively what such content will be on a page through a POST request etc. without having to actually POST anything. SPDY/HTTP 2.0 also allows asynchronous operation which is extremely good at masking round trip latency when requesting many small objects.
  - muyuu 13y ago
    It's not the nodes. It's the inevitable distance between client and server. The post I was replying to wants casual browsing that's secure, anonymous, private and encrypted AND indistinguishable in speed from what he does without all these features. That's impossible, more requests are needed and every single connection adds noticeable lag past a certain minimum distance.
    - dazmax 13y ago
      That post said nothing about speed or latency.
      - muyuu 13y ago
        I just pointed out that the experience cannot possibly be exactly the same without any compromise over his current usage as he described it. Some usage will have to be adapted and/or compromised will have to be made, or else just accept being monitored. Overpromising is not a good policy.