Re:PIA open-sources and announces audit plans
by dependenttypes on Wednesday December 18, 2019 @09:32AM
(#21825180)
> They don't even know that they're in the same circuit unless they have a covert channel (like relay early) or manage traffic correlation during the ~10 minute circuit lifetime.
No reason to think that they would not do that.
> And then, using onion services, there are two three-relay circuits that meet at a rendezvous point. One picked by the onion, and the other by the user. So even deanonymizing one of those circuits would be insufficient.
It would be sufficient to de-anonymise one of the parties.
> In practice, there are likely undisclosed vulnerabilities. Perhaps lots of them.
My point is that you do not need an undisclosed vulnerability to break tor if you have enough resources.
No reason to think that they would not do that.
> And then, using onion services, there are two three-relay circuits that meet at a rendezvous point. One picked by the onion, and the other by the user. So even deanonymizing one of those circuits would be insufficient.
It would be sufficient to de-anonymise one of the parties.
> In practice, there are likely undisclosed vulnerabilities. Perhaps lots of them.
My point is that you do not need an undisclosed vulnerability to break tor if you have enough resources.