13

This might be a general question about any anonymizing service, but I'm new here and curious about, but not super familiar with, Tor.

Suppose there's a service that engages in some handshake with clients that takes the form of a 'call-and-response'. (The client has to make some decision in response to content at an application level. )

They also have some data stored with the service, so they need to authenticate. So later sessions can be compared against this one.

It seems like the service should get a full round trip time for packets, all the way back to the source, along with a reasonable location for the exit node (they can traceroute to that point).

Latency can be impacted by so many other factors, (including tor routing) so it's definitely noisy data, but the more a person visits, each time from a different tor node, can't the service do a clustering analysis to get a gradually improving picture of the person's physical location?

Is there something that prevents this gradual acquisition of data?

Improve this question

2 Answers 2

Reset to default
9

There's one important fact that makes such an attack extremely difficult. A connection between a Tor client and a Tor hidden service is actually composed of two entirely separate circuits that both connect to a rendezvous point. One circuit is set up by the client, the other by the server.

Therefore, the client doesn't know which relays the data uses on the journey from the RP to the server, and it's not possible to "traceroute" anything beyond the RP. Likewise, the server has no idea how the client gets to the RP. If the server is a normal web service rather than a Tor hidden service, it still doesn't know anything about the client's path to the exit node.

That path can involve relays from all over the world. It's possible for two machines to be right next to each other but transfer data over a Tor connection with 100ms latency thanks to all the bouncing around. (The fastest possible physical speed for data transfer is about 5 milliseconds for a thousand miles, because of the speed of light.)

It is conceivably possible to get an upper bound on the distance if you get extremely lucky and all chosen relays are physically close. Still, there's going to be a lot of noise from Tor's low bandwidth, and it's shockingly unlikely that anybody lives close enough to a sufficiently large clump of Tor relays to allow such deanonymization. Also, this technique would be very vulnerable to deliberate deception.

Improve this answer
5
  • Thanks! it's not possible to gauge the latency of the internal tor network over the course of an extended session? It adds noise, but it should be gaussian no? Also, does Tor attempt to optimize latency internally at all?
    – Shape
    Commented May 30, 2016 at 1:26
  • To be honest, I don't know whether Tor does anything to hide latency. You could measure the latency of a session, but it wouldn't reveal anything about the position of the endpoint - the data travels all over the world. Even if there was effectively only one hop between the server and client, the distance could be estimated, but the direction is still unknown.
    – Ben N
    Commented May 30, 2016 at 1:35
  • I was thinking about overlapping donuts, you get enough of them and certain regions start to look suspicious.
    – Shape
    Commented May 30, 2016 at 1:39
  • 1
    @Shape Indeed, you could estimate a position with fair certainty once you figured out three different distances. Still, getting even one real distance for certain is basically impossible because of the bouncing around.
    – Ben N
    Commented May 30, 2016 at 1:41
  • Well, not necessarily, the donuts could be large and very thick, a lot more than 3 might be needed
    – Shape
    Commented May 30, 2016 at 18:48
2

this kind of analysis is not possible, because even in a clearnet to make ping/latency be actually in a proportional relation with your location, you need also a very accurate data of the network load overall on the full path of the packet. These data a nearly-impossible to accure in clearnet, in any darknet it's technically impossible to get such a data. So don't worry: no locating analysis just by ping/latency is possible

Improve this answer
6
  • Thanks for the reply, What does very accurate mean? if its noisy, that just means I need more data points right? You can add lots of noise, but it ends up just being a gaussian filter. Over time, that filter can be removed.
    – Shape
    Commented May 30, 2016 at 17:00
  • 1
    @Shape very accurate network load data is ideally a load on every port of the network equipment on the packet's path
    – Alexey Vesnin ♦
    Commented May 30, 2016 at 17:17
  • @Shape, "very accurate" means that if you want to know the distance to +/- 400 miles, you need a confidence interval of +/- 1 millisecond. And remember: this is network distance, not straight-line distance.
    – Mark
    Commented May 30, 2016 at 18:14
  • @Mark +1 and a network load data needed in resolution up to Kbps
    – Alexey Vesnin ♦
    Commented May 30, 2016 at 18:24
  • 1
    @Shape and - according to the multi-node nature of darknets it is not so clear, as in clearnet case. So - I still think that it is technically impossible
    – Alexey Vesnin ♦
    Commented May 30, 2016 at 19:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .