News for hackers. Stuff that matters.
Re:Mystery malware destroys 600k routers from a single ISP d... by Thorrez on Friday May 31, 2024 @05:28AM (#40532971)
What do you mean by just run exit nodes? The linked section says that just running exit nodes allows the exit node to steal data sent over plain HTTP. Is that actually a problem? Who's using plain HTTP? The linked section says just running exit nodes doesn't allow deanonymization.
Re:Mystery malware destroys 600k routers from a single ISP d... by kbenson on Friday May 31, 2024 @06:13PM (#40540876)
I didn't mean to imply it was exactly analogous, just a lot simpler, and there is a lot to be gleaned from that data. In fact, I would assume the more data you pass over it (e.g. if you proxy all your traffic across TOR) the easier it is to make assumptions about the source, unless it actively splits it across different exit nodes, which seems like it could be problematic in a lot of cases. If you have a DigitalOcean personal server you run some services on and you access it through TOR... well you might have just made the job of anyone trying to deanonymize you much easier.
Re:Mystery malware destroys 600k routers from a single ISP d... by Thorrez on Saturday June 01, 2024 @12:21AM (#40542844)
> unless it actively splits it across different exit nodes

I believe it does. I believe each destination IP you connect to uses a different exit node. And that'll even switch over time. And even if you connect to 2 destination IPs from the same exit node, I don't think there's a way for the exit node to know those 2 connections were from the same user.