3

Can you describe please, what identity correlation is referring to?

Why should I care?

How can it be prevented?

5

It's arguable that few technologies, and none that are commonly available, provide stronger anonymity than Tor does. The NSA has called it "[t]he king of high-secure, low-latency anonymity". However, as user-friendly and secure as the Tor Browser Bundle (TBB) has become, it cannot reliably prevent tracking and identity correlation.

Online vulnerabilities fall in three general categories: fingerprinting, tagging and exploiting. All TBB users, unless they tweak browser settings, look alike to websites. That certainly mitigates against fingerprinting. However, there are trade-offs. For example, one of the instrumental design choices, having NoScript configured to allow scripts by default, facilitates tagging and exploiting.

Two implementations build on the TBB to provide more-secure anonymity, and better prevent identity correlation: The Amnesic Incognito Live System (Tails) and Whonix. Tails uses TBB to protect against fingerprinting, and it further mitigates against tagging and exploiting by forgetting online activity after shutdown. Using Ducks' example, rebooting Tails would separate Joe and Aron more effectively than TBB alone could.

Whonix also uses TBB to protect against fingerprinting, but its design is heavier on defense than amnesia. The Tor software and userland applications are isolated in separate virtual machines (VMs). Although Whonix arguably doesn't protect against persistent tagging as well as Tails does, it protects far better against application exploits that compromise Tor connectivity, and could reveal ISP-assigned IP address to adversaries.

Also, given that modern computers can run several VMs, it's easy to simultaneously use multiple Whonix instances. Whonix workstation VMs have independent Tor connectivity, each through its own Tor gateway VM. Exploits in one workstation VM can't compromise its gateway VM, or other Whonix instance VMs, unless they break the VM-host barrier.

Using Qubes to run multiple Tor gateway and TBB workstation VMs would provide even stronger security. Qubes is a hypervisor OS, based on Xen and Linux, that runs directly on hardware.

With such strong technology, deanonymization and identity correlation are most vulnerable to human error. By failing to upgrade TBB, many Freedom Hosting users were vulnerable to deanonymization exploits by the FBI, after it compromised the site's servers. Both Silk Road founder Ross Ulbricht and Lulzsec member Anarchaos mindlessly revealed incriminating information on websites and/or chats.

  • Seems like an great answer. But actually to a different question. I had more in mind an explanation what "identity correlation through circuit sharing" is (when you have two tabs open or browser + mail client and the exit relay can correlate them). (And I am not asking, because I don't know myself, but because this isn't explained well anywhere online and I need to refer to it quite often, since we're creating a knowledge database here, I thought it's good to ask.) Let's edit my original question so this one becomes the answer. And I then somehow try to ask my original question better. – adrelanos Oct 16 '13 at 1:13
  • OK, thanks :) I'm somewhat oblivious to the issue of "identity correlation through circuit sharing" because I never mix identities on a machine (or at least, on a VM) let alone on Tor circuits. My answer to that would be "don't risk it". – mirimir Oct 18 '13 at 19:29
  • I've just come across this again, and thought that I might add more of what adrelanos was initially seeking. However, the best I can find on it is his page whonix.org/wiki/Stream_Isolation and the Tor ticket that he references trac.torproject.org/projects/tor/ticket/3455. Maybe I should ask the question, and he can answer ;) Or maybe it's already been asked? – mirimir May 11 '14 at 0:36
  • I was hoping to get a better reference than the one on Whonix's page. – adrelanos May 11 '14 at 11:11
3

Identity correlation is learning that two or more identities -- Like Joe on Facebook and Aron on StackExchange -- are actually the same person. This can be a problem if you don't want others knowing this; for example, Aron is an anonymous gay rights activist, and he made a Facebook profile under a different name to avoid getting persecuted/trolled/flamed. However, someone who doesn't like Aron and wants to bring him down is tracking him across the web, linking his identities, and revealing them to the world. Now his Facebook account is hacked and vandalized, his Gmail is full of spam, and people are stealing his chickens. This is why Tor and the Tor Browser were invented. Using them properly and following the warnings on the download page should be sufficient against most adversaries.

  • I'm more comfortable with Joe and Aron in separate machines, or at least VMs ;) – mirimir Oct 15 '13 at 1:11
  • Also Tor Browser does not yet separate identities. At least now when you don't press the new identity button. Maybe you meant they are separate, when one activity happens over clearnet in one browser and the other in TBB. – adrelanos Oct 15 '13 at 3:29
  • @Ducks: I don't see many "warnings on the download page". Please post a link. – mirimir Oct 15 '13 at 4:14
  • @mirimir Alrighty. – Ducks Oct 15 '13 at 4:20
  • adrelanos, I usually hit the New Identity button. :) Or I used to, anyway. The one in the browser window would restart the browser, losing all my tabs. – Ducks Oct 15 '13 at 4:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.