[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-talk] Better Privacy for Tor Node Operators
----- Original Message ----
> From: tagnaq <tagnaq@xxxxxxxxx>
> To: tor-talk@xxxxxxxxxxxxxxxxxxxx
> Sent: Mon, April 25, 2011 2:24:07 AM
> Subject: Re: [tor-talk] Better Privacy for Tor Node Operators
>
> Alice runs an non-exit Tor node at home. The Tor node at home is always
> running. Her ISP assigns her a new IP address every day.
>
> On 2011-01-29 Alice decides to create a new example.com account
> (alice@xxxxxxxxxxx) using her home IP address - the same as her Tor node
> is using [86.59.30.36] . (Alice is not using Tor for browsing the web
> but she uses Torbutton in Transparent mode - I'm just mentioning this to
> make clear that beside the IP address there is not much identifying
> information)
>
> On 2011-03-13 (and several IP's) later Alice (now browsing with
> [38.229.70.37]) wants another example.com account and again visits their
> website. The Tor node is still running. example.com would like to know
> if Alice did already create an account in the past.
>
> example.com performs the following steps to answer its question:
> 1. IP address to Tor node fingerprint lookup
> 2. fetch all IP addresses that the Tor node (gathered in step 1) ever had
> (one of the obtained records is: 2011-01-29 86.59.30.36)
> 3. look for matching IP addresses (comparing list gathered in step 2
> with their own database)
> MATCH: 2011-01-29 86.59.30.36 => created: alice@xxxxxxxxxxx
>
> Now example.com will kindly ask Alice if she lost her password for
> alice@xxxxxxxxxxx ;)
>
Is it plausible that a group of people could be NATed together with a node
operator? How does limiting node data eliminate the problem of an IP address
match? Isn't this more a problem of historical data being publicly available
ad-hoc? Where is it kept? Is there a need or good use for it? (Yes, of course
would-be attackers could maintain their own lists.)
If one doesn't want to use Tor to visit example.com, maybe a non-blocked one-hop
proxy would work. I don't know how to solve the bigger problem of IP address
linking without using a remote proxy.
_______________________________________________
tor-talk mailing list
tor-talk@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk