this post was submitted on 26 Apr 2024
284 points (85.7% liked)
Technology
59201 readers
2994 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Hey, if your adversarial model does not include nation states, it’s a great service. Totally fine against basic IP tracking, and I haven’t received a nastygram for sharing movies in years.
Which one is good against nation states? Asking for a friend.
Use the one they’re using: Tor.
There’s a long list of reasons why you might not want to use it though.
By default, Tor doesn't protect you from nation states. It's a start, but you have to be an intelligent user who understands statistics to have some protection from nation states.
Let's assume there's two teams, because in geopolitics, it seems like we divide into "west" and "east." Let's assume team 1 controls 10% [1] of the relays, they have more than enough budget to pay for the entire network 100x over. That means, on entry, there's a 10% probability that you will land on their entry node.
Now, to do traffic analysis, they need you to also land on their exit. The probability of that is also 10% in the example. In other words, 10% of the time that you have their entry, you will also have their exit. (or, for 1 in every 100 circuits, you will have a compromised circuit) If you use Tor everyday for a year, you'll likely have a fucked circuit at least once. If you use something like Whonix that spawns like 10-20 circuits at start, you'll have a compromised circuit weekly.
A compromised circuit isn't the end of the world. Most internet traffic today uses end to end encryption, [2] so as long as the service is outside of team 1's jurisdiction, your communications are safe... but team 1 knows who you are, and that you are talking to someone they don't trust. If it's in their jurisdiction, they can get a warrant, and they can fully de-anonymize the traffic between the service that you were using.
All of this is to say, it's hard to stay in the dark if your adversary is information intelligence. The best way to stay invisible is to use the network as infrequently as possible, and to make the time correlation very far off. (Use custom relays that delay when the traffic travels so that traffic analysis like this example is not possible)
By the way, in the US, the NSA has multiple sites where they copy the traffic on the backbone for analysis. They're performing some deep packet analysis. These systems are going to improve in the future with machine learning. As an example, in China, it's not exactly simple to connect to Tor as some methods of concealing Tor traffic result in detection from machine learning that they're performing on all traffic.
[1] This is a hypothetical. They could control 0%, 5%, 25%, etc. It's publicly unknown how much they control or if they try to control the network at all.
[2] Be careful with your assumptions about https. Where are the root authorities? Why should we trust them? It's better security to never trust them.
Fascinating. Thank goodness my life doesn’t depend on that kind of threat modeling.
They don't actually need to control the entrance nodes if they control the ISP. You can track TCP fingerprints through Tor with just exit nodes