4

Tor is in fact just a proxy chain consisting of 3 proxies. A good enough reason to do the paperwork can be enough to deanonymize a user (the link is valid assuming all the relays' ISPs store logs). Thus Tor users' need to worry about their anonymity highly depends on their threat model. (blowing up the WTC is most likely more motivating to do the paperwork than DDoSing your competency's site)

Once, I've read something about making a proxy chain distributed over countries that don't have a good political relationship in some very downvoted (because of the rest of the question) question here.

But the idea itself is interesting. If you've used Tor and for some reason the US government wants to have a friendly talk with you, using a proxy in countries with bad political relationship with the US, such as Russia, would make the paperwork really hard.

A good example of this US-Russia relationship is the Sci-Hub lawsuit:

Elsevier claims that Sci-Hub illegally accesses accounts of students and academic institutions to provide free access to articles through their platform ScienceDirect. The case is complicated by the fact that the site is hosted in St. Petersburg, Russia, making it difficult to target within the US legal system. [Source: https://en.wikipedia.org/wiki/Sci-Hub#Lawsuit]

Question (I admit this might be somewhat discussable/subjective): To what extent do the country choices affect users' anonymity (of course assuming you haven't hacked all the nuclear silos)? Is there any known case of paperwork beating a Tor circuit?

Note: I'm talking about knowing the user's Tor IP address only, nothing more. Not confirming their identity, but finding it.

Improve this question
3
  • 1
    If you're selling nuclear blueprints to North Korea, NSA will have hacked every Cisco router and Linux box within five blocks of your Tor exit node's Moscow data center before you've even finished counting your Bitcoin.
    – Matt Nordhoff
    Commented Oct 12, 2016 at 20:54
  • I've seen instances of people being caught because they were the only person connected to Tor on their own network at the time (IIRC it was a DEFCON talk about Tor users who got caught, and the person was a student who sent in a fake bomb threat). However, I think if there were a case of the 'paperwork' beating the entire circuit, the entities responsible would never divulge those details to the public, as it would potentially reveal links which are effectively compromised, and they would then be removed from the Tor network.
    – childofsoong
    Commented Oct 12, 2016 at 21:47
  • @childofsoong Yeah, for example that Harvard bomb threat. It could've been prevented if he had: Used a bridge, used different network, didn't confess as there were multiple people connected at that time
    – anon
    Commented Oct 13, 2016 at 5:24

2 Answers 2

Reset to default
1

... rather about chaining proxies through countries that don't have a good political relationship to make the paperwork a hard thing.

What paperwork? The nodes only know what other nodes are talking to it. The way to 'reverse' a Tor connection is either by

  1. Infecting the PC through Tor like the FBI did
  2. Running / compromising an exit node and looking for identifiable info in the exit traffic
  3. Running time correllation on the infrastructure used for entry and exit

The only paperwork i could imagine is with #3 but you only need to monitor the entry like this so the intermediate nodes don't matter. The likely opponent, state actors, will probably opt for the first two options. Infecting is easier and more reliable than tracing.

Improve this answer
9
  • "What paperwork?" Oh, I didn't know every adversary has access to all the ISP logs to correlate traffic.
    – anon
    Commented Oct 19, 2016 at 12:47
  • 1
    Sarcasm? o rly. I was legitimately curious what you meant, the only paperwork i could think of was the example in my case #3. So that tone is very, very discouraging for me to continue answering But for case #3 you only need to time the entry and exit nodes, making your question about intermediary nodes quite irrelevant ;)
    – J.A.K.
    Commented Oct 19, 2016 at 13:01
  • Why only the entry and exit node? You need to figure the entry node somehow and unless the person is connected to the Harvard wifi network, you'd need to either do the paperwork to get logs of all the 3 nodes or own all the entry nodes. "Infecting is easier and more reliable than tracing" - infecting what?
    – anon
    Commented Oct 19, 2016 at 13:57
  • Because if someone sends 51.7k data encrypted, and 51.7k data comes out at an exit at that time, you know enough. And figuring out the entry isn't needed if you can recognize the TOR protocol. About infecting, i'm sure you're smart enough to figure that out. Especially if you prefer mocking me over being inquisitive when you don't understand something i say. Don't forget to update your AV! <3.
    – J.A.K.
    Commented Oct 19, 2016 at 15:06
  • You cannot see the entire internet traffic. So without Harvard wifi you cannot really determine the origin to compare that to the exit node. Infecting? Depends on what you mean. You don't really infect the user if they left a forum post. Infecting the server won't help you. Infecting the nodes won't help you.
    – anon
    Commented Oct 19, 2016 at 17:00
-2

Different countries may have different amounts of legit and rogue nodes, while a rogue node (or as you have asked, nodes) can exist in any country. I remember reading about a penetration tester capturing emails via an exit node, but that is about it.

It might not matter if you chain through different countries if the entity you are hiding from runs a rogue node that you pass through.

Improve this answer
0

You must log in to answer this question.