[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-talk] Tor DNS Deanonymization
On Tue, Oct 18, 2016 at 10:39 AM, Philipp Winter <phw@xxxxxxxxx> wrote:
> On Sun, Oct 16, 2016 at 01:15:32AM -0400, Nick Mathewson wrote:
>> On Fri, Oct 14, 2016 at 11:09 AM, Philipp Winter <phw@xxxxxxxxx> wrote:
>> > There are two ways to mitigate the issue. First, we need better
>> > defences against website fingerprinting, so an attacker learns less by
>> > observing the connection to your guard relay. Second, we need to
>> > improve the DNS setup of exit relays. I would like to see less relays
>> > use Google's resolver, and we need to move towards encrypted DNS.
>> Thanks, Philipp!
>> Could you comment at all about whether our current exit side dns
>> caching approach makes the attack harder, easier, or doesn't matter?
> Generally, the longer exit relays cache domains, the less precise the
> attack. The trade-off is illustrated in Figure 10b in our paper .
> At the moment, exit relays cache domains for only 60 seconds ,
> regardless of the domain's TTL. If that bug is fixed, the attack
> becomes a bit harder to mount. It can become even harder if exit relays
> were to cache each domain for, say, 10 minutes or more.
>  <https://nymity.ch/tor-dns/tor-dns.pdf>
>  <https://bugs.torproject.org/19025>
Thanks! I've just pulled #19025 (and its sibling, #19769) into
consideration for 0.3.0.
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to