[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: Proposal: Tor User Agent Carousel (TUAC)

On Apr 4, 2008, at 11:16 AM, lxixnxenoise@xxxxxxxxxxx wrote:
Hi, thank you for the reply!

"Also, when the user agent changes on a website that you logged onto, they
are going to link the two"

This is a good point, if the rotation occurs during the period of login,
but one may choose a longer period between rotations, this still not
solving anything though if the user is logged in somewhere. If the user is logging in somewhere, though, are the maintaining a static identity? If so, why? Would this not be a defeat in and of itself over a long period of
time, regardless of UA?

Aside from this, would they not link more from the browser than UA? So we have two groups if we look at this simply, as a lot of tor users seem to
like using the popular Windows UA:

Group 1: The real Windows users with the UA, most plugins enabled by
default, flash, javascript, etc.

Group 2: The tor users with the common Windows UA, most or all plugins

So group one is Charlie Brown in the standard t-shirt which never changes, and group two is Charlie Brown in the same t-shirt but with a football in
his hands, the disabled plugins standing out.

So in addition to the TUAC idea (which, despite my naming of it, you
mentioned has already been suggested, which doesn't surprise me) I propose

A way to safely spoof (without a negative result to either end) to the
websites that you have plugins enabled, java, javascript, Flash, and all of the rest, but somehow negating the incoming trasmission of said content by passing it into some type of virtual shredder, some type of /dev/ null approach. In this way Charlie Brown would not be holding the football in
being fingerprinted so easily.

Thank you for your other useful comments, I have removed them from my
reply to save space since I have no comments to share on them.

If this is offtopic since it does not directly have to do with tor as you have pointed out, I will take the suggestion to others instead. Thanks for
your kind attention! :)

I don't have much to say to that, except that you stick out as a Tor user because your request came through a tor server. The list of tor servers is publicly accessible (which is necessary by design) and even if you don't spoof anything you're still not the regular Charlie Brown. You need to "blend in" with the other Tor users, as you cannot blend in with anyone on the planet!

Attachment: PGP.sig
Description: This is a digitally signed message part