1

https://www.whonix.org/wiki/Stream_Isolation

Is it safe to use IsolateDestAddr and IsolateDestPort with my Liferea RSS SOCKSPort?

In general, is it okay to apply these isolations to SOCKSPorts? (eg proxychains, midori, torsocks, apt updates)

It seems like a great feature. But it's not on by default so I'm not sure if it'll cause a major performance hit or make my traffic more identifiable. I would like each feed to have a unique route through the tor network. I have over 100 feeds. It just seems traffic would be easier to track if I fetch the same 100 feeds every few hours (or even every day).

I'm using ubuntu.

1

"it'll cause a major performance hit"

Yes, it'll build far more circuits than are necesary and won't fix isolation problems.

"make my traffic more identifiable"

You'll certainly have non-standard traffic patterns.

An adversary could also try to intentionally cause denial-of-service conditions by, for example making you attempt to build a circuit to every port on a whole range of IPs, making you try to build tens of thousands of circuits and potentially causing denial of service.

An adversary could try to force you, on one circuit, to reuse another circuit. Assuming they suspect you're fetching both X and Y, at distinct IP:Port, and they have the ability to tamper with data on X or Y. They could inject an http redirect to force you to re-use the circuit used for X or Y with some tag that links the two together.

The solution isn't even a very good one, if you don't want all those feeds to be linked to a single identity, you'll need a better approach than sticking them all into a single client and trying to use some kind of contextless isolation.

Your uptime and the fetching of the set of feeds on the same schedule, you'll come back every N seconds and refetch the feed content. The size and offset of N will likely link your refetches together.

Instead you'd be better to try setting up a service that serves the news feeds locally, which you point your RSS reader at, which it itself pulls feeds in using a Parcimonie-like system to preserve privacy, unlinkability and anonymity.

-1

Yes, it will have a performance impact. How big - it depends on your network speed, Tor node hardware and your settings. Generally, if you need to isolate your streams in common case like yours - use IsolateDestAddr, because port isolation will be of no use in your case: RSS feeds are usually on HTTP(80) or HTTPS(443) ports, so IsolateDestPort will make almost no use for you, but will cost resources, but if your feeds are on different hosts - address-based isolation will certanly use it's payload not in vain. Will your traffic be more identifiable? If you're using Tor in client-only mode - I rather say yes than no, but if you're using Tor as a middle node - then the answer is no. So set up your Tor as a middle node(make ORPort and DirPort reachable from outside and declare them in config + ClientOnly 0) and try to use address-based isolation, this will be better.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.