Why does TOR leak IP through Bittorrent and Flash while VPNs don't?

Question

1) Do VPNs not leak IP while bittorrenting?

Does TOR leak IP while bittorrenting?

If yes why are VPNs safe while TOR is not in respect to Bittorrent?

2) Why don't VPNs warn abvout Flash while TOR seems to leak while using Flash? Does this mean VPNs are also safe from Flash IP leaks while TOR is vulnerable?

Why can't TOR solve these leaks while VPNs seem to?

3) Is this due to TOR using a proxy and not tunneling traffic unlike a VPN?

4) Is there a solution for this like having the TOR proxy on a router or other PC and having it act as VPN and tunnel traffic through the router?

Answer 1

A BitTorrent client learns its actual IP Address through port mapping protocols. It uses NAT - PMP, PCP and uPnP for external IP Address discovery.

To join a torrent, a client sends an announce message to the tracker that maintains the list of all peers in that torrent. This announce message contains an optional parameter, the IP address of the interface from which a client sent the message according to the BitTorrentSpecification#Tracker_Request_Parameters.

According to this research paper, this behaviour was seen in µTorrent, BitSpirit, and libTorrent. I think now this optional parameter is left empty and completely ignored by the tracker servers. They also found that Extension protocol handshakes might also contain the user’s IP address. Tor can't help if you anonymously send deanonymizing information about yourself.

While this kind of deanonymizing information can even deanonymize a client behind a VPN, I think this is no longer happen since the BitTorrent protocol has been gone through various enhancement protocols. It was a problem when this research paper was published but it doesn't happen now.

Today, the only threat which happen on Tor but not on VPN is if a client uses DHT. DHT runs on top of UDP to find peers in a torrent and Tor does not support UDP at all. So a DHT client can communicate directly to the other DHT nodes by completely ignoring the Tor circuit. This was the case by default with µTorrent. This answers your question why is VPN safe for BitTorrent but not Tor. This is still a problem if you use BitTorrent over Tor with DHT enabled.

An application can completely ignore the Tor circuit and communicate directly with its actual IP Address if it is not configured to use Tor. VPN routes entire traffic of your PC by creating virtual adapter. If flash is not configured to use Tor, it may nit see the Tor circuit.

Answer 2

1) Do VPNs not leak IP while bittorrenting?

Part of the BitTorrent protocol is that you tell your IP address to other BitTorrent clients so you can share your content. Tor can't prevent you from sending deanonymizing data over Tor.

2) Why don't VPNs warn abvout Flash while TOR seems to leak while using Flash? Does this mean VPNs are also safe from Flash IP leaks while TOR is vulnerable?

VPNs are applied system wide, Tor provides a proxy. VPNs use the kernel to enforcing routing traffic over the VPN while Tor requires the application to be configured to use the proxy. Flash could still leak IPs even if using a VPN in the same way, by discovering it locally then reporting it over the VPN.

No one should be using Flash anymore, for any reason.

3) Is this due to TOR using a proxy and not tunneling traffic unlike a VPN?

Yes. See above.

4) Is there a solution for this like having the TOR proxy on a router or other PC and having it act as VPN and tunnel traffic through the router?

Yes. Transparent Proxying would solve this issue, or better using a Tor enforcing firewall like that used by Tails. It's still subject to the same problems described with a VPN and Flash like BitTorrent can still leak your IP, etc.

Answer 3

GET Request's will leak your Real location, IP etc. VPN's like tunnels. But Tor is just an bridge to the internet.