3

For the sake of argument, let us assume that all traffic is monitored and recorded at your ISP. Would hosting a Tor relay on the same machine that you are running Tor Browser Bundle protect you from some forms of traffic analysis?

Improve this question

1 Answer 1

Reset to default
1

Yes it does, however you have to distinguish between two kinds of protection

  • If you run a relay-only setup with no exits allowed, you make it harder for an attacker to measure your activity and compare it with the activity on certain websites, especially when you let the relay on all the time

  • If you run an exit node it will give you plausible denyability, because it may not be you visiting a certain website or using a certain service

However please keep in mind that from time to time people abuse exit nodes and it might result in house searches or letters and emails to you or your ISP. Depending on the type of complaint and the attitude of your ISP it may have negative effects for you. You can reduce the chance for this by only allowing certain ports or just stick to running an non-exit-relay.

See also the official FAQ:

Yes, you do get better anonymity against some attacks.

The simplest example is an attacker who owns a small number of Tor relays. He will see a connection from you, but he won't be able to know whether the connection originated at your computer or was relayed from somebody else.

There are some cases where it doesn't seem to help: if an attacker can watch all of your incoming and outgoing traffic, then it's easy for him to learn which connections were relayed and which started at you. (In this case he still doesn't know your destinations unless he is watching them too, but you're no better off than if you were an ordinary client.)

There are also some downsides to running a Tor relay. First, while we only have a few hundred relays, the fact that you're running one might signal to an attacker that you place a high value on your anonymity. Second, there are some more esoteric attacks that are not as well-understood or well-tested that involve making use of the knowledge that you're running a relay -- for example, an attacker may be able to "observe" whether you're sending traffic even if he can't actually watch your network, by relaying traffic through your Tor relay and noticing changes in traffic timing.

It is an open research question whether the benefits outweigh the risks. A lot of that depends on the attacks you are most worried about. For most users, we think it's a smart move.

Improve this answer
4
  • Thanks for the link to the FAQ - I hadn't seen that. But, from what you pasted I think the answer to my question is 'no'. The third paragraph states " if an attacker can watch all of your incoming and outgoing traffic, then it's easy for him to learn which connections were relayed and which started at you" which is what my original question was.
    – Ivar
    Commented Mar 13, 2014 at 17:37
  • @Ivar you are right, but it really depends on what the attacker does and analyzes exactly.
    – meee
    Commented Mar 15, 2014 at 10:50
  • "It is an open research question ..." Is this true now, 2 years after this answer was written? The FAQ itself has no timestamp, so maybe this statement is even older than 2 years. What results did researchers find since then?
    – Hubert Schölnast
    Commented Apr 1, 2016 at 16:48
  • "If you run an exit node it will give you plausible denyability, because it may not be you visiting a certain website or using a certain service" this is likely to be untrue in many situations, and will also harm your actual deniability of other users traffic.
    – cacahuatl
    Commented Dec 21, 2017 at 15:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .