1

Let's say we have two users connected via a socket over Tor. Is there anyway for one user to DoS the other user, maybe by learning their real IP address?

My end goal is to design a system that let two users play a game with each other over a socket, but not be able to learn each other's IPs or DDoS each other.

Improve this question
1

There really isn't an easy way to discover a persons IP address through Tor. The problem for you is really deployment. In my (not so professional) opinion, your best bet would be to have each user set up their own hidden service, and the two hidden services exchange the .onion address through a man in middle. Kinda like this:

User #1's .onion => man in the middle => User #2 User #1 <= man in the middle <= User #2's .onion

If you are concerned about DDoS attacks, then you can add some basic anti's in. There are only a few basic attacks that the Tor network can used, as Tor can only use the TCP protocol. In my opinion, many skidds wouldn't bother attacking, because there are not many easy ways to hit a .onion service. No stresser/booter/botnet really supports that kind of thing (or at least I have never seen one in my years as a security analyst).

The real question is, why through Tor? Tor only supports TCP, and your latency will be horrendous. If the amount of data is to big, you might accidentally stress out the nodes as well. These are something to remember when using Tor.

Improve this answer
1
  • We created an app that lets you play poker and other games peer-to-peer (using a cryptocurrency for betting). If an opponent is taking too long, you can claim a win by disconnect. We envisioned that an attacker could DoS an opponent long enough to get their win claim verified, and thus cheat other players. We thought Tor (or a routing algorithm) that anonymizes IP addresses would address our security issue. I'd be open to other suggestions :). Since we have our own network, we could also not go through the actual Tor network, but just onion-route our network. – Andrew Johnson Sep 1 '14 at 14:37
0

Tor connects users to destinations. It hides users' IP addresses, but does not hide the IP addresses of destinations. And so users could DoS destinations.

For what you want, each user should run a hidden service, and they should use OnionCat to connect via Tor. However, it's also possible to DoS hidden services.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.