3

Is my ISP able to see that I run a hidden service from the network traffic I make? My ISP does not allow me to use Tor according to their Terms of Service. The hidden service will do nothing illegal but I am still worried about them shutting us down.

Improve this question
1
  • "My ISP does not allow me to use Tor" - running a hidden service is "using Tor" by any definition. It's not a question about whether you are doing anything illegal. You are violating your ISP's terms of service.
    – Greg Hewgill
    Commented Jan 4, 2015 at 18:43

1 Answer 1

Reset to default
3

Your ISP is able to figure out that you're using Tor from the network traffic you make. In particular they can analyze ordinary Tor traffic for telltale fingerprints. If you live in a (relative to those less fortunate) free, fair, democratic nation, they really shouldn't be able to say you cannot use Tor. This is because ordinary Tor traffic uses TLS for link authentication and encryption. Although Tor makes efforts to appear as TLS web traffic some differences are evident. The reason I mention free, and fair nations is because differentiation requires inspection. Your ISP cannot say you may not use Tor unless they can also put restrictions on TLS traffic in general.

Things to consider

  1. They have to pay attention and analyze the traffic to figure that out but eventually they will figure it out. Sooner if they are attentive and later if they suffer from overloaded staff and cost reducing business structure. However, there are simpler ways that they can figure out that you are using Tor network. The Tor IP addresses are public, so they can figure out you are using Tor just by checking the IP addresses that you use. They can check the available data as easily as you (for example by entering your guard's IP into Atlas). You should seriously consider the consequences that you may encounter and have a plan of action when (but not if) they figure out you are using Tor and running a hidden service.

  2. Your ISP may be enforcing a residential TOU that says you cannot run a server (restricting relay-only and exit-node traffic). They may also be enforcing a TOU that prevents copyright infringement (restricting exit-node traffic). They may not (unless they're bad) restrict your use of Tor in client operation. Hidden services fall, largely, into this last category because your client will maintain some (egress/outgoing) circuits with your HS guards as the destination. This is the same type of behavior a Tor client will exhibit upon connecting. What this means is that if you use a residential connection and you can use Tor in client operation you can also run a hidden service without violating your ISP's TOU.

All this being said I would check again if your ISP TOU prevents Tor use as a client. Don't tell them you would like to run a hidden service, but rather, check for Tor client use. If they don't allow client use I would question how they handle other anonymity services. Do they also prevent web-proxy access? Do they block VPN connections? If they allow VPN connections this presents an interesting solution. You could connect to a VPN first and run Tor over the VPN.

Good luck!

Improve this answer
3
  • Very good and detailed answer. What about pluggable transports? Shouldn't they be able to obfsucate the Tor traffic and make deep packet inspection much harder?
    – Linostar
    Commented Jan 28, 2015 at 21:45
  • 1
    @Linostar Dear Linostar, What you are stating is true to a point. All, ISP need to do, is to connect to your bridge, (pluggable or otherwise) to figure out you are using Tor. Additionally bridges (pluggable or otherwise) are not stable enough to suit hidden services. What will happen is you need to repeatedly change your bridges (pluggable or otherwise) because they are unstable compare to guards, which in itself defeat the concept of persistent guard. This will open you to bunch of other attacks on hidden services which eventually resulted in the concept of persistent guard being implemented.
    – Roya
    Commented Jan 29, 2015 at 1:22
  • @Linostar There are other issues associated with bridges (pluggable or otherwise), which make them unsafe for hidden services. For example read this question and my answer to that: tor.stackexchange.com/questions/6099/… This question talk about email part of the problem. similar type of problem exit with web version of the obtaining bridges (pluggable or otherwise). But that is a whole new Q&A.
    – Roya
    Commented Jan 29, 2015 at 1:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .