2

Why Tor network was not designed in such a way that all traffic that flows from a computer uses the network (like VPNs)? Instead, users have to use Tor browser and take special care with other applications that can leak information.

I guess Tor website tried to explain this issue here, but I couldn't understand.

Thanks.

1

Let's condense the answer from the Tor website:

a. Internet packets have information about your OS. Depending on how your computer is set up, trackers might be able to fingerprint your computer based on the OS features given in the packets. (for more info on fingerprinting, visit https://panopticlick.eff.org)

b. We still need a user control, like the Torbutton in the Tor Browser, that way you can easily change Tor settings.

c. There are other ways programs can leak your information. For example, if DNS requests are sent to your ISP, your ISP can still see what websites you're going to. Tor devs need to figure out a way to rewrite these requests.

d. Once Tor devs decide how to transfer packets, they need to design a new Tor protocol to avoid anonymity and integrity issues that might occur.

e. Exit policies would become a lot more complicated, and so would security for exit nodes. Tor devs also need a way to include the exit policies in the directory servers so the client knows which exit nodes to connect to. (normal web browsing happens on port 80 and 443. adding other traffic means more ports, so you need to find more exit nodes that allow those ports)

f. Onion websites work by intercepting the address in the Tor client. Doing this at the IP level means complications between Tor and the local DNS settings.

To summarize, it's much easier to anonymize web traffic, so that's what Tor did. Anonymizing all traffic means a more complicated Tor program, and more potential data leaks.

1

1. Massively increase complexity (read: attack surface).

Handling arbitrary IP packets, tracking their state and handling their responses is complex. Many operating systems over the years have had serious vulnerabilities in their various network stacks, if Tor implemented their own this would likely result in a series of similar vulnerabilities. See:

Linux: CVE-2016-2070, CVE-2015-5364, CVE-2015-1465, CVE-2014-3673, CVE-2012-6638, CVE-2012-2744, and many, many more.

Windows: ms09-048, ms10-009, CVE-2013-0075, ms13-018, CVE-2014-1811, CVE-2009-1925, MS14-031, and many, many more.

And that's not to mention the difficulty of now implementing some kind of exit policy enforcement which would involve further parsing and classification of the packets in a stateful manner!

How do you discern who should be the recipient of specific types of packet? Could you trick the Exit to return another users traffic to you?

2. New types of abusive traffic for operators to deal with.

If entire IP packets are encapsulated then that necessarily includes the source IP address. Should Tor act like a NAT and rewrite the source, or allow exits to become participants in DNS reflection attacks? What about IP fragmentation as a means of by-passing stateless packetfilters?

Similarly a "bad" exit has new, fine-grained ways to attack the clients various network stacks by sending response packets. This opens up new options to deanonymise or exploit tor users.

3. Metadata.

TCP/IP stacks require state. State identifies you as it changes over time. Full packet encapsulation mean the state that comes out of the other side of the connection is the same as your local state.

TCP and IP and UDP all have various options that can be on or off or specific values. These are implementation and context specific. Tools like lcamtuf's p0f can determine your operating system and even version of operating system by looking at only a few packets. Currently with Tor, this is the exit or onion services operating system, if the full packet was encapsulated, it would be yours. This might allow you to be tracked across sessions, as it currently does with VPNs.

For example if you're the only user with a specific TCP fingerprint in your incoming TCP handshake to the VPN, you'll be the only user coming out of the VPN with that fingerprint in your TCP handshake.

4. Tor isn't magic

You can't just throw all your traffic at Tor and say "make me anonymous", anonymity doesn't work like that. VPNs lack context, they route all traffic over a single path, this means all your traffic is linked together. You may not want your "anonymous" browsing traffic to be taking the same circuit as your ssh connection to your personal webserver, this would link together your "anonymous" browsing and your identity.

For it to be used effectively it would need to provide some means of providing it context to isolate different applications or denying specific applications. If you don't, you will contaminate identities and potentially deanonymise yourself. There is currently no good way to do this outside of specific configuration of distinct applications.


Conclusion.

Ultimately I think it's a dangerous idea that Tor should be very, very careful with if implemented. Not implementing it would be far easier and safer for both clients, and exit and onion service operators.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.