Delivery-Date: Thu, 31 Dec 2015 07:06:44 -0500
Return-Path: <tor-talk-bounces@lists.torproject.org>
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on moria.seul.org
X-Spam-Level: 
X-Spam-Status: No, score=-4.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
	RCVD_IN_DNSWL_MED,T_DKIM_INVALID,T_RP_MATCHES_RCVD autolearn=ham version=3.3.1
X-Original-To: archiver@seul.org
Delivered-To: archiver@seul.org
Received: from eugeni.torproject.org (eugeni.torproject.org [38.229.72.13])
	(using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by khazad-dum.seul.org (Postfix) with ESMTPS id 896E81E039F;
	Thu, 31 Dec 2015 07:06:42 -0500 (EST)
Received: from eugeni.torproject.org (localhost [127.0.0.1])
	by eugeni.torproject.org (Postfix) with ESMTP id A57E53503E;
	Thu, 31 Dec 2015 12:06:38 +0000 (UTC)
Received: from localhost (localhost [127.0.0.1])
 by eugeni.torproject.org (Postfix) with ESMTP id 1FA9234C8A
 for <tor-talk@lists.torproject.org>; Thu, 31 Dec 2015 12:06:35 +0000 (UTC)
X-Virus-Scanned: Debian amavisd-new at 
Received: from eugeni.torproject.org ([127.0.0.1])
 by localhost (eugeni.torproject.org [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id AWSMqBEuFZfz for <tor-talk@lists.torproject.org>;
 Thu, 31 Dec 2015 12:06:35 +0000 (UTC)
Received: from mail2.eff.org (mail2.eff.org [173.239.79.204])
 (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits))
 (Client did not present a certificate)
 by eugeni.torproject.org (Postfix) with ESMTPS id 002F234AA3
 for <tor-talk@lists.torproject.org>; Thu, 31 Dec 2015 12:06:34 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=eff.org;
 s=mail2; 
 h=In-Reply-To:Content-Type:MIME-Version:References:Message-ID:Subject:To:From:Date;
 bh=PVNxmf/giFOJX44o2apxDz1WjOVNjk+zbAeCXEDDBSY=; 
 b=rYPUYo88ekfKebO3k9OLy02be9iN3VZ1ai7sPfgLAGApoUqYJj6Js811KBb3gij3qe6PYSCIsbiu70Z+zjiczmke16Dscg5an6zRZhLV4KXpvSkEWIm8URv4g4fPWHX8JWZuKh2mWUI1osEAdYXcU9M0ELhK8ZxoPcHAN9QqcpI=;
Received: ; Thu, 31 Dec 2015 04:06:32 -0800
Date: Thu, 31 Dec 2015 04:06:31 -0800
From: Seth David Schoen <schoen@eff.org>
To: tor-talk@lists.torproject.org
Message-ID: <20151231120631.GF27095@mail2.eff.org>
References: <34e1536b62d7b9ce1ba867f0fa59c8@cweb20.nm.nhnsystem.com>
 <6a91ca60ee4d22ed9d6e90d9ab389ed4@cweb23.nm.nhnsystem.com>
 <1705812.7vP645ThCe@home> <n62t6i$c5o$1@ger.gmane.org>
MIME-Version: 1.0
Content-Disposition: inline
In-Reply-To: <n62t6i$c5o$1@ger.gmane.org>
User-Agent: Mutt/1.5.21 (2010-09-15)
Subject: Re: [tor-talk] Hello I have a few question about tor network
X-BeenThere: tor-talk@lists.torproject.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: tor-talk@lists.torproject.org
List-Id: "all discussion about theory, design,
 and development of Onion Routing" <tor-talk.lists.torproject.org>
List-Unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-talk>, 
 <mailto:tor-talk-request@lists.torproject.org?subject=unsubscribe>
List-Archive: <http://lists.torproject.org/pipermail/tor-talk/>
List-Post: <mailto:tor-talk@lists.torproject.org>
List-Help: <mailto:tor-talk-request@lists.torproject.org?subject=help>
List-Subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk>, 
 <mailto:tor-talk-request@lists.torproject.org?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: tor-talk-bounces@lists.torproject.org
Sender: "tor-talk" <tor-talk-bounces@lists.torproject.org>

Oskar Wendel writes:

> Does it apply also to traffic going from/to hidden services? How safe are 
> users of hidden services when compared to users that browse clearnet with 
> Tor?

The hidden service users can be identified as users of the individual
services using the same sybil approach: if a user uses a particular
guard node and the hidden service uses a guard node controlled (or
observed) by the same entity, that entity can correlate the traffic
between the two.  I don't know how easy it is to infer right at that
moment that the communication is between a user and a hidden service
rather than between two users intermediated by something else.  However,
the attacker can potentially realize that it's a guard node for some
hidden service because a particular user connects to the guard node
all the time, has a high traffic volume, and for some hidden services,
uploads more than it downloads on average (which is the reverse of the
usual pattern for a Tor Browser user).  (That inference might be even
easier if the hidden service's guard node just notices whether that user
tends to upload a little data followed by downloading a lot of data,
or download a little data followed by uploading a lot of data, since
web browsers usually do the former and web servers usually do the latter.)

The guard node has a conceptually harder task in figuring out _which_
hidden service it's a guard node for.  There has been a lot of research
that touches on this issue and it's clearly not as easy for hidden
services to conceal their identities from their guard nodes as it
should be, especially if the guard nodes actively experiment on the
hidden service.  One example that shows why this is a difficult problem
is that if you control a guard node and you know about the existence of a
particular hidden service, you can connect to the hidden service yourself
and see if that results in any traffic coming out of your guard node.
You can also deliberately shut down clearnet traffic to and from your
guard node for a few seconds at a time at randomly-chosen moments and
see if that results in outages of availability for the hidden services
at the same moments.

I think some of these ideas are developed in published papers and I'm
sorry for not thinking of which papers at the moment.  You can see that
this can make the situation of the hidden service somewhat precarious.

See also

https://blog.torproject.org/blog/hidden-services-need-some-love

There might be some more hope in the future from high-latency services
(based on examples like Pond), or, based on what some crypto folks have
been telling me, from software obfuscation (!!).

-- 
Seth Schoen  <schoen@eff.org>
Senior Staff Technologist                       https://www.eff.org/
Electronic Frontier Foundation                  https://www.eff.org/join
815 Eddy Street, San Francisco, CA  94109       +1 415 436 9333 x107
-- 
tor-talk mailing list - tor-talk@lists.torproject.org
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

