ISP & LEO tracking on Tor

Question

I realize this will sound like I am beating a dead horse; however, I've read many, many threads and comments on this topic and am not quiet satisfied. Maybe I'm being too specific and need a more specific answer.

This is a two part question.

Scenario ONE: Time and again I see the question of whether or not ISPs can see detailed information on users activity and repeatedly see the answer "No, they can see the URL but nothing more on httpS, etc."

Question: Why can the ISP NOT see what is coming through their servers? In my mind I see it like this: Hi, I'm Skynet ISP. I see that right now IP#THIS is on http Google and he's looking up homemade taco soup recipes. That IP # is assigned to Hugh Jass.

And here is IP#THAT on httpS Yahoo. That IP is assigned to Pat McCrotch. Even though it is a httpS, I still must be able to decipher what is on the page to make sure I transmit the data properly. Yahoo is delivering an ad about Clash of Clans, Headlines of a presidential assassination and Microsoft going bankrupt.

Oh, Yahoo just delivered video results about college orgies.

And... this is odd, IP#THIS&THAT...assigned to Mike Hunt is on a strange looking URL... .onion. Oh, he's using Tor. I'm going to open Tor Browser and see what is on that page. Looks like Mike is shopping for unauthorized medicine. I'll log this and save it for law enforcement.

.................

Scenario TWO: On the other end is the FBI running DeepWeb markets. One site sells unauthorized medicines. The funds go to support the Bureau in efforts to rout out cyber-criminals. Maybe even bust a few customers here and there since they have their address. Looks good in the papers to see the Bureau busting people for online drug deals.

On another page the FBI runs a photo & video page of underground porn, jihad execution videos, hacker Anonymous video messages, etc.

Question: Would it not be possible that embedded in the photo or video metadata could be a homing beacon? Every time the beacon hits an ISP, relay and final destination the beacon would "phone home" to announce it's current location thereby exposing the users and relays and final recipients of the requested information?

............................

It seems to me that the only way to be completely secure is for you to produce your own encryption software, hand it to me on disc and I install it on my PC. Then when I go to your encrypted site and the data begins to transfer thru my ISP they have no way of decrypting the data because the decrypt software was never online.

Fin. Please tell me how I am mistaken in my suppositions. Thank you all for your time.

Answer 1

Let me first make a remark: you should avoid to roll you own crypto. :-)

Instead of giving the encryption software, two people could physically exchange the keys used for the encryption. However, that would be very cumbersome, and we found a way to properly exchange these keys on an untrusted network. You can take a look at this question about how could encryption work when you have to exchange the keys.

Note: I tried to resume your problematic when I wrote the two titles, tell me if I missed something.

---

Scenario 1. Why couldn't the ISP see what I'm doing with HTTPS?

When Hugh Jass is looking for his favorite taco soup recipes using HTTP, the data exchanged between him and the server are not encrypted. As a consequence, the ISP can read everything that is transmitted between Hugh Jass and the website.

When Pat McCrotch is browsing Yahoo using HTTPS, most of the data exchanged between him and the server is encrypted. The ISP has no way to recover it¹. The only part that are not encrypted are the ones necessary for the packet to be transmitted to Yahoo. (e.g. IP addresses.) The ISP will only know that Pat McCrotch is browsing Yahoo, thanks to the IP addresses. (And probably the DNS request beforehand.) The ISP will not know what is Pat doing on the Yahoo website, because this part is encrypted.

It is not very different of the Post Office that can't read your mails as long as it doesn't open the envelopes. The only thing the Post Office can know is who are talking together. (If the sender's address is present.)

To prevent this issue, some people use a VPN. Using a VPN, the whole packet will be encrypted, and put in another packet (encapsulated) that will be sent to the VPN. The VPN will decrypt your original packet, and forward it to its destination.

Regular HTTPS packet:
┌───────────────────────────┐
│           DATA            │
│        (encrypted)        │
├────────────────┬──────────┤
│ IP_PatMcCrotch │ IP_Yahoo │ <- The ISP might still recognize Yahoo's IP
└────────────────┴──────────┘

Using a VPN:
┌─────────────────────────────┐
│┌───────────────────────────┐│
││           DATA            ││
││        (encrypted)        ││
│├────────────────┬──────────┤│
││ IP_PatMcCrotch │ IP_Yahoo ││        ┌─────────────────────────┐
│└────────────────┴──────────┘│   ==   │          DATA           │
│         (encrypted)         │        │       (encrypted)       │
├────────────────┬────────────┤        ├────────────────┬────────┤
│ IP_PatMcCrotch │ IP_VPN     │        │ IP_PatMcCrotch │ IP_VPN │
└────────────────┴────────────┘        └────────────────┴────────┘
  ⬑ What you send                        ⬑ What your ISP see

Note that in the 2 cases aforementioned, the users weren't using Tor! If they were using Tor, then the ISP won't know anything, like with a VPN. However, they will know that you are using Tor, because Tor addresses are known.

Therefore, in you last case where Mike Hunt is browsing a .onion address, the ISP won't know anything, except that he is using Tor.

In other words, the request to the .onion address has been encrypted and encapsulated and sent to the Tor network, out of the ISP reach.

EFF.org made an interactive visualization of Tor and HTTPS; you might want to take a look.

---

Scenario 2. If the LEO are running the server, can they deanonymize me?

Yes!

It has already been done when the FBI seized the Freedom Hosting website. They don't even need to go as far as making malicious metadatas, there are easier ways. For example, with the Freedom Hosting website, the FBI embedded a malicious Javascript file. This file, executed by the Tor Browser², forced the user to send a packet with his public IP to a server controlled by the FBI.

---

^{1 HTTPS uses Asymetric cryptography. Basically, you use one key to encrypt (public key) and another to decrypt (private key). The server gives you the public key that you will use to encrypt the data. Even if the ISP can watch the data exchanged and get the public key, it will not be able to decrypt the data. You neither. Only the server can decrypt it using its private key, that is never sent to anyone.}

^{2 If Javascript is turned on, which is the default setting for the Tor Browser.}