4

If the NSA is listening and recording at the (very often unecrypted) end where the Tor exit relay meets the Internet, noting all the fingerprinting information (as the webserver interacts with the Tor exit relay) which we strive so much to minimize, then I wonder how much 'plausible deniability' (so to speak) there is - fingerprinting aside - for a given Tor user at a given site, at a given time. (E.g. if two Tor users with the exact same browser fingerprint - say 100% untouched default settings of the same exact TB version - visit the site on the same exit node, perhaps they are 100% indistinguishable to even the NSA for that Internet record.)

Are there multiple Tor users using the same IP (on the same site) at once, and if so, how many does it tend to be?

I am assuming that the more, the more anonymous, and safe (so long as the exit node can handle it and not make it unusable for everyone); users sharing the same IP, especially if all coming from different middle nodes, is a good scenario for Tor user anonymity, and 'crowd anonymity' with fingerprinting becomes especially important when it comes to an adversary like the ever-wiretapping NSA.

Improve this question

1 Answer 1

Reset to default
1

I wonder how much 'plausible deniability' [..] for a given Tor user at a given site, at a given time.

You might be the only one using a relay for your exiting traffic at any given time.

E.g. if two Tor users with the exact same browser fingerprint [..] perhaps they are 100% indistinguishable

If it's the exact same publicly accessible site the two would be identical. Distinguishable perhaps by observations of their session behavior (sub-domain selection for example). Maybe the same person, definitely using Tor.

How many 'peers' will be served by the average exit relay at any given time?

The average exit relay can also be a middle-node and guard for someone at a given time.

Are there multiple Tor users using the same IP (on the same site) at once, and if so, how many does it tend to be?

It would require exits to track the type of traffic they relay and disclose the data. If you know, for all exits, the traffic they relay (from their exit policy), and the amount of traffic is exiting traffic (out of all traffic). If you could say with certainty that all exiting traffic on an instance of a circID came from n-peers. If you could correlate this data into an interval of size 'any given time' you could provide such an average. Alas, such is not the case.

During your use of Tor it depends.

  1. on how many exits you know about
  2. on the subset(s) (n-)length of exits which can handle a particular request-type
  3. on the likelihood that you make a particular request-type
  4. on the predictability of circuit failures for some type of exiting traffic

Exits are chosen randomly from those discovered by your client during bootstrap. When your Tor client has some traffic to relay using Tor it first looks at the existing circuits for an exit which can handle your request. If such an exit doesn't exist it chooses an exit from the descriptors you know and, having checked the exit policy, builds a circuit with this exit as the edge node.

The circuit may fail if.

  1. the exit can't handle the request due to load (maybe ISP throttling)
  2. the exit decides to drop your traffic
  3. the exit is itself being censored
  4. the target site blocks the exit as a source ip

A user of Tor at any given time.

  1. chooses an exit randomly from the ones you know about and suspect can handle a request
  2. cannot predict failure rate for unseen intervals
  3. can reflect on historical data for failures

I am assuming that [..] users sharing the same IP, especially if all coming from different middle nodes, is a good scenario for Tor user anonymity, and 'crowd anonymity'

More sharing of each node is good. It makes your adversary work harder, and position themselves better, to identify individual users of Tor.

-- leeroy

Improve this answer
7
  • So for a Tor exit node with proven history and good bandwidth, it can typically easily be several users on that exit node at once? Like 20, if conditions are right? I'm really looking for some real world examples (I guess from analysis) or at least sufficient knowledge of the protocol to authoritatively give some numbers here, though appreciate explanation of the framework that explains how numbers can be determined! A little knowledge of real-world / realistic example numbers can help a lot in assessing Tor anonymity's effectiveness.
    – user1006
    Commented Jan 9, 2015 at 1:11
  • How do you propose to obtain these real world examples? Run say 100+ different Tor process instances. Exhaustively test each traffic subset on each process. Take into consideration the supposedly uniform distribution of the PRNG in selecting the exit and also take into account the bias which Tor creates in reusing known good exits. There's a good reason for being careful about the streams put over a single circuit. Your choice of exit can uniquely identify you. From what I've mentioned above why do you suppose that is?
    – user5341
    Commented Jan 9, 2015 at 22:55
  • Now, assuming uniform distribution of the PRNG in selecting the exit, and granted Tor creates bias in reusing known good exits, what's the likelihood of 20 people using any given exit with the current size of Tor's network? Perhaps I should reword the question for clarity. What's the (effective) probability of two lines intersecting in R3? It then follows to ask if you generate n-lines in R3 what is the average number that intersect? So the question isn't how many peers use an exit at a given time. It's how uniform is the PRNG.
    – user5341
    Commented Jan 9, 2015 at 23:20
  • Let's try an (over-)simplification. Assume use of Tor is uniform over time and a given moment is defined as right now. How many exits are there right now? Not how many show up in exit lists or in consensus. How many are exits? Let this set be N with cardinality n. All connections are on 443, such that n is the number of relay from which an exit can be chosen. The PRNG is cryptographically secure. What is the likelihood of choosing a particular relay from N. How many clients are active right now? What is the likelihood that any two choose the same relay (simultaneous, and first connect request)
    – user5341
    Commented Jan 10, 2015 at 1:49
  • From the first simplification how many times did you get an overlap in choice over say 1000 repetition? Now reset all parameter and repeat. This time clients make connections to a non-standard (abuse) port. How many exit from N support the non-standard port chosen -- right now. Let this be the set M with cardinality m such that M is a proper subset of N. How many clients are right now using ports such that they would choose an exit from M. Get probabilities as before, but from M. After 1000 repetition do you notice anything unusual? The protocol does not factor except for biasing later choice.
    – user5341
    Commented Jan 10, 2015 at 2:24

You must log in to answer this question.