0

Let's say I setup a transparent/isolating Tor proxy (dedicated machine/router), through which all traffic is forced before going out to the Internet.

There are a five machines "behind" that Tor proxy, all used by different people to surf the web.

Now the question is, what data can the various endpoints (hidden services or clearnet) gather and could they link one user's traffic to another one's?

If one user tells his identity, could adversaries derive that the other four people must also be at that same location (or at least come from the same proxy)?

(So far, I've found this answer, basically indicating that, for high anonymity, all users would have to use a different SocksPort/TransPort on the proxy. I hope that's outdated though, since it would mean that the described isolating proxy concept would require high maintenance - setting up one TransPort per user.)

Improve this question

1 Answer 1

Reset to default
0

What you are describing here is quite similar to a transparent proxy (just with users instead of applications) which is not recommended.

This practice isn't recommended because all the connections use the same circuit, which is dangerous and leads to identity correlation.

Improve this answer
6
  • It's rather an isolating proxy (a little down from what you linked to). Also I've tested it and visited check.torproject.org . Result: Loading the page simultanously on two machines, results in two different IP addresses being reported. Thus I continue to doubt the idea about shared circuits in this scenario.
    – user569825
    Sep 6, 2018 at 12:19
  • You mentioned that you hope you wouldn't have to use a separate socks port for each user. However an isolating proxy would require this. How exactly have you set up your proxy? Do all users use the same socks port?
    – bn4t
    Sep 6, 2018 at 12:24
  • Actually none of the clients use the socks port. I redirect their traffic to Tor's TransPort via iptables rules. All the clients have configured is the Tor router as their default gateway to the internet.
    – user569825
    Sep 6, 2018 at 14:44
  • Having just read the articles linked from the "warnings" section, I understand what the concerns are. Also re-reading the Isolating Proxy Concept, which was the basis for my setup, I realize I had overlooked the fact that every single application is supposed to be configured to connect via socks. Now the question remains: If it's true that one socks port equals one distinct circuit: Why do are different outproxy IP addresses reported?
    – user569825
    Sep 6, 2018 at 15:34
  • This is indeed an interesting question. Maybe the wiki is incorrect. However I can't say with guarantee why it was this way. Safest route is probably still to use an isolating proxy.
    – bn4t
    Sep 6, 2018 at 18:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .