Thus spake Roger Dingledine (arma@xxxxxxx): > On Sat, Aug 28, 2010 at 11:20:41AM -0400, Paul Syverson wrote: > > I keep talking to professors and grad students who have started a paper > showing that website fingerprinting works on Tor, and after a while they > stop working on the paper because they can't get good results either way > (they can't show that it works well, and they also can't show that it > doesn't work well). > > The real question I want to see answered is not "does it work" -- I bet > it can work in some narrow situations even if it doesn't work well in > the general case. Rather, I want to know how to make it work less well. > But we need to have a better handle on how well it works before we can > answer that harder question. Yes. This is the approach we need to solve this problem. However, one of the problems with getting it out of most academics is the bias against easy reproducibility. In order for any of this research to be usable by us, it must be immediately and easily verifiable and reproducible in the face of both changing attacks, and changing network protocols (such as UDP-Tor and SPDY). This means source code and experimental logs and data. Most computer science academia is inherently biased against providing this data for various reasons, and while this works for large industry with the budget and time to reproduce experiments without assistance, it will not work for us. I believe it is the main reason we see adoption lag of 5-10 years for typical research all over computer-related academia. My guess is Tor not have this much time to fix these problems, hence we must demand better science from researchers who claim to be solving Tor-related problems (or proving attacks on Tor networks). I've gone into a little more detail on this subject and the shortcomings of timing attacks in general in my comments on Michal Zalewski's blog about regular, non-Tor HTTPS timing attacks: http://lcamtuf.blogspot.com/2010/06/https-is-not-very-good-privacy-tool.html#comment-form -- Mike Perry Mad Computer Scientist fscked.org evil labs
Attachment:
pgpyOs4rIIfx0.pgp
Description: PGP signature