The Tor Project: Building the Next Generation of Onion Services

Re:The Tor Project: Building the Next Generation of Onion Se... by zmanian on Tuesday May 24, 2016 @12:03PM (#11762663)

The combination of watering hole attacks and internet scale packet timing collection is pretty big problem for the security of Tor users.

Fortunately Internet wide timing attacks are mostly a Five Eyes and domestic Chinese capability. Chaff, padding etc can help here.

Compromising the servers of target services and using that a platform to distribute anonymity stripping malware is also a problem. The Firefox codebase that TBB is based isn't awesome from a security point of view. Hopefully the Firefox code base can catch up from a security perspective and give them something better to work with.

[ Parent | on HN ]

Re:The Tor Project: Building the Next Generation of Onion Se... by alchemical on Tuesday May 24, 2016 @01:13PM (#11763389)

Internet scale packet timing collection only works when the traffic is not messed with when routing through TOR. It's quite a headache when {proxy}.appspot.com is used, or technical documents are exclusively routed through GoogleCache, or even CoralCDN for that matter.

There's even users who configure BitTorrent to use TCP instead of UDP so that it's very difficult to write DPI rules to parse out the TOR traffic. Couple this with meek, VPNs and traffic shaping tools and it's quite bothersome for them.

[ Parent | on HN ]

Re:The Tor Project: Building the Next Generation of Onion Se... by vox_mollis on Tuesday May 24, 2016 @12:09PM (#11762725)

Timing correlation attacks would be much more difficult if Tor users were more willing to tolerate higher latency. But they're not. Everyone wants their cake and eat it too.

[ Parent | on HN ]