3

Bridges can be advertised by Email to clients. This procedure hinders anonymity as in new revelations by Das Erste. May this procedure be halted until more anonymous ways are found and/or the procedure continues with the strict warning that it is only for purposes of circumvention and anonymity can not be achieved in this fashion?

Following, please find an excerpt from Das Erste:

Users can request a bridge address via Email or on the web. The following fingerprints show two ways that XKeyscore attempts to track Tor bridge users. First, the fingerprint "anonymizer/tor/bridge/tls" records connections to the bridges.torproject.org server. Second, in order [to] obtain the actual bridge addresses for the purpose of tracking connections to them in the future, the "microplugin" fingerprint called "anonymizer/tor/bridge/email" extracts data from the body of the emails that the Tor Project sends to its users. [And], This code demonstrates the ease with which an XKeyscore rule can analyze the full content of intercepted connections. The fingerprint first checks every message using the "email_address" function to see if the message is to or from "[email protected]". Next, if the address matched, it uses the "email_body" function to search the full content of the Email for a particular piece of text - in this case, "https://bridges.torproject.org/". If the "email_body" function finds what it is looking for, it passes the full email text to a C++ program which extracts the bridge addresses and stores them in a database. The full content of the Email must already be intercepted before this code can analyze it.

Improve this question
12
  • How do you think anonymity can suffer?
    – user66
    Jul 11, 2014 at 6:09
  • @Tichodroma, Dear, read the article.
    – Roya
    Jul 11, 2014 at 7:09
  • I know about that. We can discuss how the mechanisms to get briges can affect privacy. But just asking "shall we discuss this topic" is kind of a meta question. So please start and describe what you think.
    – user66
    Jul 11, 2014 at 8:44
  • @Tichodroma, Dear, I will edit the question.
    – Roya
    Jul 11, 2014 at 8:49
  • @Roya Can you make it more clear what your question is and how this relates to the text you wrote?
    – Jens Kubieziel ♦
    Jul 11, 2014 at 21:04

4 Answers 4

Reset to default
4

This is rather a non issue, I think. People typically use bridges when their Internet uplink (ISP, university, employer, etc.) blocks access to known entry guards. This may be part of national policy, as with China, Iran, etc.

Savvy adversaries monitor public lists of bridge IPs, and so the Tor Project distributes them via email. This is not a perfect solution, because email traffic is not end-to-end encrypted. However, it's adequate as long as (1) the adversary can't compromise any of the intervening mail servers, and (2) users get messages via encrypted connections.

The Das Erste article concerns the NSA's ability to harvest information from email intercepts using XKeyScore. If the NSA has the requisite plaintext intercepts, it could find all of the bridge IPs and associated email addresses. The NSA is undoubtedly intercepting all traffic for nations like China, Iran, etc. And it undoubtedly does its best to get plaintext intercepts, whatever that entails.

So yes, it's possible (or even likely) that the NSA and its friends will know who is getting Tor bridges via email, and what bridges they're using. Even so, the anonymity that Tor provides depends on the path through the relay network being untraceable and transient, with unpredictable changes. It doesn't depend on keeping Tor use secret. That is, knowing the email address of someone using Tor, and even knowing what bridge they're using, doesn't deanonymize them.

However, identifying a user's bridge or entry guard does help resourceful adversaries, but only if they can intercept its local traffic or worst case, compromise it. In that case, given enough fast exit relays, they may correlate entry and exit traffic, and so deanonymize the user.

Bottom line, if your key adversary is the NSA or one of its friends, don't get your bridges through the default email distribution system. Otherwise, it's not that big of a deal. If your goal is simply circumventing the GFW, for example, the risk that the NSA will discover your email address and Tor bridge IPs is a minor issue. If you're a Triad spy, on the other hand, take more care ;)

Ideally, bridges would be available via end-to-end encryption. There is this ticket "BridgeDB e-mails should be encrypted when possible". But after some vaguely incoherent discussion of PGP vulnerabilities, it was closed as being too complicated for most users.

I do think that the Tor Project should have an email address for bridge requests, with a well-known public key. But that would require that the user know how to use GnuPG-encrypted email. Maybe there's middle ground, using ProtonMail or whatever.

Improve this answer
10
  • Dear mirimir, What Das Erste suggest is that adversary through XKeyscore, identify whom use bridges and what that bridge address is. In other word they identify that Alice is using a bridge. Thus, Alice's Guard node is already identified. Now, all they need to do is to force Alice to use one of the exit nodes that they spy on. Anonymity at this point is all over for Alice.
    – Roya
    Jul 17, 2014 at 8:38
  • Dear mirimir, As you are aware Tor does not use PGP for Emails that carry the bridge's address, pluggable or otherwise, The full content of Email including Alice's Email address and bridge's address are available to the adversary on top of any other information in the Email.
    – Roya
    Jul 17, 2014 at 9:00
  • Dear, The adversary that Das Erste is talking about is not the ISP, it is a global adversary the cients like to dodge.
    – Roya
    Jul 18, 2014 at 0:25
  • Dear, by the way this is the second question. First one is much tougher and more tricky to analyze.
    – Roya
    Jul 18, 2014 at 0:30
  • Dear, of course, a global adversary eventually learn. All encryptions also will eventually breaks, but this is not the point. The point is for the time interval of client interest she remain anonymous.
    – Roya
    Jul 18, 2014 at 1:00
2

How about bitmessage? https://bitmessage.org

If Tor gives a bitmessage address to request bridges like how it is done in email. Bitmessage is said to be encrypted P2P messaging protocol but it is still running in beta stage.

Improve this answer
1
  • This is an interesting idea.
    – Roya
    Aug 14, 2014 at 17:59
0

This question is slightly tricky for which I give an answer which is most probably and easily understood by everyone.

According to my knowledge its a NO but depends on the route through which you are accessing your mails. If it is through the default browser then by default your ip address, mac address etc. are stored in the database as soon as a request is made to the server(this involves due to the predefined set of Protocols for the mail transfer to take place like SMTP(Simple message transmission protocol)).When the server replies back with the bridges even the content is stored by default for future course of action which is not known to anyone.

The sending and receiving of mails goes through a different number of firewalls by which the mails may or may not be intercepted based on their requirement.

So in the end your activity log is stored as So and so request was made by the user then and there. In any event if the website reports for an abuse of its site only then your anonymity is at stake. Some sites also store the log and partially display the user activity to the user so that the user can know his logging events for security purposes.

As you can see that it is displaying only IP address and time then you can clearly understand more what it could have logged just through a simple transfer.

There are ways through which one can enter and exit the network without leaving the trace of their activity but those means are termed illegal(for security issues as those means would mostly involve for negative use) and using them (until and unless the use is authorized by the owner of the property for testing purpose only) could cause you legal issues.

Improve this answer
0

One solution to this problem is to emplyee a secure Drop Box similar to what a lot of other organizations do. This question is asking information about Drop Box: Is there a secure drop available for Tor project?

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .