3

We're doing an assignment on net anonymity, especially about Tor. We're trying to find out where Tor users are coming from. In order to achieve this, we set up a Tor node and disabled scrambled logging. However, filtering IP addresses from a log file isn't the most efficient way, plus a lot of IP addresses belong to exit nodes that aren't actually used by clients. With clients I mean humans using Tor.

Is there a way, for an entry guard, to see whether it's being used as first node in a circuit by a client?

Improve this question
1
  • If you just assume that any connection from a known relay is not a client, you will mostly be correct, since there are overwhelmingly more clients than relays.
    – Jobiwan
    Commented Sep 22, 2014 at 20:56

2 Answers 2

Reset to default
1

Metrics is a good source for your cause. And it is official. You can and should get blacklisted for hosting a relay that grabs such sensitive user data. As you said Tor is a tool that is granting anonymity to his users and I think none of them wants you to collect data from a guard relay for your assignment. Metrics is the only source that is allowed to do so.

Improve this answer
1
  • The thing is that we do not want to use the available metrics. Besides, this does not answer my question.
    – Tobias Sytsma
    Commented Sep 18, 2014 at 13:12
0

Sure there's ways. That said:

  • Why not use the metrics provided by the Tor Project that include sanitized information on where users are coming from? (https://metrics.torproject.org).

  • What did your institution's ethical review board think about your plan to collect personal identifying information from subjects without consent (that they are unlikely to give) as part of your research project?

  • What is the fingerprint of your malicious relay, that should be blacklisted by the Directory Authorities?

Improve this answer
3
  • I disagree that this is malicious. There is even a torrc option for it. Tor clients should assume they're known as such. Your reply suggests that you have the answer but don't want to give it. (Restricting information and counting on strangers to scrub their logs both make for a bad security model.)
    – Jobiwan
    Commented Sep 18, 2014 at 11:54
  • Becoming a user's entry point into an anonymity system for the express purpose of collecting Personal Identifying Information about said user if not malicious is at the very least "not very nice", especially when there is bulk metrics collected in a user-privacy aware manner.
    – user78
    Commented Sep 18, 2014 at 13:05
  • I agree that security through obscurity is not the way to go. Why we aren't using metrics? Because that would make the experiment way too easy. And in what way am I infringing privacy? Gathering IP addresses doesn't expose any services used by the client.
    – Tobias Sytsma
    Commented Sep 18, 2014 at 13:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .