Re: [tor-talk] Is tor network 100 percent anonymous ?

[grarpamp <grarpamp@xxxxxxxxx>]

On Sun, Jan 8, 2017 at 6:09 AM, Petrusko <petrusko@xxxxxxxxxx> wrote:
> with more and more relays driven by volunteers, we can reduce this risk.

It's statistical. There are no available trust metrics, or even afaik any
studies of the network metas to discover any potential for trust metrics.
Consensus weighting could be seen as a kind of analog for trust,
but its one based on only a few potential parameters that might
make up a full list of trust parameters one could assign various
importance to. Others have proposed additional parameters
that could make up such a list that users might choose to use.

> And this is an reason why server operators are using "myfamily" field in
> the relay configuration, to not use other relays driven by them...

MyFamily is tricky to understand.
It removes use of a quantity relays that you might otherwise normally
consider and use as 'good' relays, thus raising statistical risk of pathing
through 'bad' relays that are of course purposefully not familied together.
Adversary who compromises a family, particularly in a manner that
chills speech of operator (law) or mirages their vision (rootkit), will perhaps
deconfigure the family association in order to increase their
statistical numbers.
And afaik no one is watching for orphans moving out of family statements.

Though some people watch for nodes to aggregate into family.
And family is encouraged for and used by operators since it does
cover a lot of attack surface.

> Be careful about exists relays, the server operator can sniff the
> traffic, and if I'm not wrong, can retrieve for example a password in
> clear text sent on a http (not http*s*!) form.

Be aware of your general use of unencrypted data and context over clearnet.
And extremely aware of any authentication info or sensitive datas

> But for me, Tor is a good network to annoy people who are trying to spy
> you ;) Absolutely better than using the usual home network...

Depends on capabilities of adversary, and any level of interest
they might have in your activities.

For the typical innocent home user, and with proper usage, tor provides
a very high level of location anonymity, and content protection within the
tor network, up against say, your local ISP, or the website you're visiting.
That's what tor was designed for, and why lots of people use it.

Tor is not "100% anonymous".
You must study your usage and use case up against your threat
model in order to determine suitability of any given tool.
These analyses and risks and benefits apply to other networks
as well, not just tor.

> Le 08/01/2017 à 10:36, Arthur Wang a écrit :
>> What if there are quite many enough compromised tor nodes ,that are made up
>> by attackers ?
>>
>> One node can record the source and destination of an access , tow nodes can
>> combine tow points into a line , and when there are quite many nodes that
>> are made up by on attacker , he can then draw a full map of an access , and
>> finally find out the real ip address where does the request originally
>> issued out .
>>
>> Can this scenario possibly occur for the current tor network ?

Yes. Though at the point of owning the full path, they'll probably
go for the full decrypt as well.
-- 
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk