5 ms·

They need to be able to access netflow data at the entry point. To put it another way, let's say someone is posting bomb threats over Tor on Google Plus. Googl

by tedks 12y ago

They need to be able to access netflow data at the entry point. To put it another way, let's say someone is posting bomb threats over Tor on Google Plus. Google cooperates with the FBI and deterministically perturbs all traffic going into the Tor network. What router does the FBI get netflow data from in order to find the bomber?

rsync 12y ago
Can't the Tor network introduce random perturbations into the traffic flow at every hop, thus defeating this kind of fingerprinting ? I know that it does not do this, but couldn't it ?
- ufo 12y ago
  From what I understood in the OP, Top doesn't add that kind of noise to keep latency down (latency is already high due to the extra hops and would get even worse if you added perturbations)
tptacek 12y ago
You should be aware that every tier 1 ISP already collects, aggregates, and stores NetFlow, which means they have archives of historical data (though probably not raw flow archives, though it would be possible to do that for "anomalous" traffic --- meaning, not port 80) and, more importantly, the capability to very easily enable filtered high-fidelity collection from most points on their network with very few keystrokes. You can thank DDOS trolls for that, I guess, because that's why the ISPs paid to build that out.
- belorn 12y ago
  Tor can today already use port 80 for all it traffic by using the FascistFirewall setting. If tier 1 ISP differentiate traffic on port level, then switching that setting on should bypass the filter.
  - tptacek 12y ago
    I hope you understood what I was saying. I wasn't saying ISPs are limited to monitoring non-port-80 traffic. They can most certainly do sophisticated monitoring of "HTTP" traffic as well. All I was saying is that it was unlikely that most ISPs had high-fidelity raw flow archives for all traffic, but possible they they might already have them for non-port-80 traffic. Hiding in port 80 will protect you not-at-all from traffic analysis, and all the major ISPs already have the infrastructure to deploy traffic analysis.

by tedks 12y ago

rsync 12y ago

Can't the Tor network introduce random perturbations into the traffic flow at every hop, thus defeating this kind of fingerprinting ? I know that it does not do this, but couldn't it ?

ufo 12y ago
From what I understood in the OP, Top doesn't add that kind of noise to keep latency down (latency is already high due to the extra hops and would get even worse if you added perturbations)

tptacek 12y ago

You should be aware that every tier 1 ISP already collects, aggregates, and stores NetFlow, which means they have archives of historical data (though probably not raw flow archives, though it would be possible to do that for "anomalous" traffic --- meaning, not port 80) and, more importantly, the capability to very easily enable filtered high-fidelity collection from most points on their network with very few keystrokes. You can thank DDOS trolls for that, I guess, because that's why the ISPs paid to build that out.

belorn 12y ago
Tor can today already use port 80 for all it traffic by using the FascistFirewall setting. If tier 1 ISP differentiate traffic on port level, then switching that setting on should bypass the filter.
- tptacek 12y ago
  I hope you understood what I was saying. I wasn't saying ISPs are limited to monitoring non-port-80 traffic. They can most certainly do sophisticated monitoring of "HTTP" traffic as well. All I was saying is that it was unlikely that most ISPs had high-fidelity raw flow archives for all traffic, but possible they they might already have them for non-port-80 traffic. Hiding in port 80 will protect you not-at-all from traffic analysis, and all the major ISPs already have the infrastructure to deploy traffic analysis.