Re:Use of Tor and e-mail crypto could increase chances that ...
by bigiain on Thursday June 20, 2013 @11:55PM
(#5916429)
The "renew my car registration" example was intended to imply that'd I've chosen to "give them some connected dots" - dots which are operationally useless (or worse - preferably adding noise to make the job harder and evidence that the job is sometimes wasted effort).
I'm assuming "they" have access to government servers and networks, and that they'll easily be able to connect me - as a real and (at least mostly) law abiding citizen - to a clean-slate browser using SSL over TOR - logging in to a government web server with real world credentials and doing some mundane and law abiding everyday task.
Re:Use of Tor and e-mail crypto could increase chances that ...
by dfc on Friday June 21, 2013 @12:04AM
(#5916454)
I don't get what you mean. You think that once you connect to https://site.gov/ they can easily match the traffic entering the tor network with the traffic that exited tor and initiated the web connection?
Re:Use of Tor and e-mail crypto could increase chances that ...
by bigiain on Friday June 21, 2013 @12:15AM
(#5916474)
That's assuming they've got compromised tor nodes that they're able to watch both my entrance and exit node.
Which may well be true.
(But I'm still hoping my new 2048bit GPG key and a significant portion of tor nodes are _not_ NSA bugged...)
Re:Use of Tor and e-mail crypto could increase chances that ...
by dfc on Friday June 21, 2013 @12:42AM
(#5916561)
More confused now. You are worried about a GPA or a lesser adversary?
Re:Use of Tor and e-mail crypto could increase chances that ...
by LoganCale on Thursday June 20, 2013 @11:47PM
(#5916403)
I think the point was that it defeats the common purpose of using anonymity software if you are submitting identifying information (your car registration information) through it. It doesn't necessarily have long term consequences—you can generate a new identity—but it nullifies that session's anonymity.
However, that doesn't mean there isn't a good reason to use it anyway to make a statement and promote legitimate usage of Tor.
"A global passive adversary is the most commonly assumed threat when analyzing theoretical anonymity designs. But like all practical low-latency systems, Tor does not protect against such a strong adversary. Instead, we assume an adversary who can observe some fraction of network traffic; who can generate, modify, delete, or delay traffic; who can operate onion routers of his own; and who can compromise some fraction of the onion routers."[1]
If your attacker is not "a global passive adversary"(GPA) what dots are they going to connect if you renew your car registration? If your attacker is a GPA they are already connecting all the dots.
[1] https://svn.torproject.org/svn/projects/design-paper/tor-des...