Hacker News Reader

Comment by fefe23 | Hacker News Reader

Could these be attempts at data mining for unmasking Tor users?

Back in 2017 the German BND was revealed to have a history with that: https://netzpolitik.org/2017/secret-documents-reveal-german-...

I would be shocked if any intelligence service in the world wouldn't have their hands in that, even in the most respected democracies. Infiltrating "underground" networks and communities, and breaking encryption, is literally their job.

Especially now that there's a war on our borders, the spooks have a plethora of reasons to use to justify their invasiveness.

We just need to make sure to keep them accountable, which is the tricky part, as their work is always classified and our human and privacy rights often clash with their jobs, so unless any whistleblower comes through we might never know the extent of their rule breaking.

Seems most likely, either by academics or government.

Not really the most subtle way about it though and likely to face some response.

I'd assume both have the capability to run a fairly accurate simulated network without anyone noticing so it's a bit strange.

I doubt it's either of those - it would be extremely unethical and illegal for academics to do, and governments don't need to take this approach because they have a bunch of systemic attacks that are less obvious. Perhaps someone with a botnet looking to sell unmasking, which has been popping up as a service recently. Or trying to use it against a specific DWM or vendor.

> it would be extremely unethical and illegal for academics to do

Nothing illegal about it.

Hugely depends on the country. Don't assume the law you know, to apply here

Can you give just one example of a country with a law making it illegal for academics conducting research to attempt to demask tor users?

EU? Basically researchers tries to get PII from people connected to Tor without consent of these people.

That's an interesting argument. Not sure it would hold up. I don't think an IP alone counts as PII, since the ISP would have to be queried to actually get any contact info.

IP addresses are PII under GDPR.

Not by themselves, surely?

Even so, GDPR has research exemptions which would protect the academics doing research in the example being discussed.

Only of they are connected to a short list of more sensitive PII, of which "tor user" is not one.

IP logs are fully legal in the UE under GDPR and Tor deanonymization is just an IP log of connected users.

Also there is already plenty of research of this type out of the EU. It's quite common in infosec.

There is, because it's a botnet

That would likely make researching and demasking the entities involved explicitly legal.

My claim is that researchers are unlikely to be operating the botnet

I don't think anyone claimed or implied otherwise?

The original comment raised the possibility that researchers or the government were responsible for the 2m new tor users

What is unmasking? What does it have to do with a botnet

Revealing the identities of tor users or hidden services. One way to do it is by controlling a large share of the network.

Yes but this clients, not nodes. So this actor does not control a large share of the network, they just use a large share of the network.

Mentioned it because there's been many papers which specifically used the live network to do such a thing already. Some researchers have spun up large numbers of relays in the past to conduct their work.

I personally don't see how it's unethical for either academics or governments to do this? Both have an interest in breaking tor, even when in the governments case where they both utilise it and want to know who else is using it.

The tor people themselves acknowledge the work in their blogs

https://blog.torproject.org/research-problem-measuring-safet...

https://www.researchgate.net/publication/314521450_Character...

Could it be someone using Hetzner?

It's not clear to me how you'd do that with clients, rather than relays.

DDOS a hidden service and track the request spike through your exit nodes. I think this is how the original silk road was investigated.

Silk Road was a hidden service so exit nodes were not involved (they would use rendezvous points). If my recollection from American Kingpin is correct, Silk Road was caught because it leaked its IP address in error messages, and Ulbricht posted questions about bitcoin on Stack Overflow using the same name as the bitcointalk post announcing Silk Road. Its clearnet IP was visible for almost the entire lifespan of the site, I believe.

Would regularly changing circuits/identities mitigate this? E.g., pressing ctrl/cmd + shift + L every few minutes?

It’s quite an interesting spike, though I doubt that such an operation would be so obviously.

Reply on news.ycombinator.com