0

I searched all over the internet for the answer for my simple question, but couldn't find anything useful.

I already know that police have to access PCs used as proxies or Tor relay nodes to read logs (if there are any) in order to track down original IP address. Also Tor prevents my ISP from finding out what website is accessed and data transmitted, but exit node still knows the website accessed.

So, what prevents ISP from seeing IP address of the first relay I'm connected to?

Similarly, what prevents other ISPs of each Tor relay nodes/chain of proxies to see where they route traffic to and from, even when they are located in different countries?

What stops authorities to contact those ISPs for that information and just connect the dots? It won't give them the data transmitted, but they will know which original IP address was connected to what website/server at specific time over Tor network/chain of proxies.

I hope I described my question correctly.

1

So, what prevents ISP from seeing IP address of the first relay I'm connected to?

Nothing. This is the whole point of Tor: this is part of the security model and it doesn't matter that your ISP can see you talking to a Tor node.

Similarly, what prevents other ISPs of each Tor relay nodes/chain of proxies to see where they route traffic to and from, even when they are located in different countries?

There are two questions here, and one is a legal one which I will ignore as it's off topic here. On the technical side, the idea is that Tor nodes are continuously forwarding traffic for a range of other Tor nodes, so the traffic all gets mixed together and you can never be sure which nodes are initiating a new connection to a new endpoint, and which ones are just forwarding someone else's traffic, or at what point in the chain a node is for a particular conversation. Even if you analyse the traffic, you can't read it, as it's all encrypted in a way that prevents even the individual nodes (apart from the exit node) knowing what the destination is. The exit node itself knows the destination of the traffic, but not the source. The intermediate nodes only know who sent them the traffic and where they should send it next. So, at any point no node knowns both the sender and the destination (and message).

What stops authorities to contact those ISPs for that information and just connect the dots? It won't give them the data transmitted, but they will know which original IP address was connected to what website/server at specific time over Tor network/chain of proxies.

Same thing as above, mostly. Nation states, however, do sometimes have the capability to identify Tor traffic flow using packet shape analysis. The idea is that you can look at the size of traffic from one person, and look for another outbound packet from the relay that roughly matches the size, all the way to the target. This requires the traffic of all nodes in the chain to be simultaneously monitored, which is quite difficult even for a dragnet solution like PRISM. It's also made harder by the fact that lots of people are passing data between individual Tor nodes, so there are so many packets being sent/received that the "shapes" of the conversations in terms of packet size are obfuscated by the volume of other traffic.

  • Thanks for the detailed answer! Something made me think, that only one user can be connected to one node, making traffic analysis easy. If there are lots of users, then it would be near impossible. – Marta Gorby Apr 22 '16 at 6:31
  • But isn't it that "you are talking to a Tor node", which your ISP knows, a non-trivial information in his possession? – Mok-Kong Shen Apr 22 '16 at 9:15
  • 2
    @Mok-KongShen Sure, they can tell you're using Tor. There are ways around this (Tor has settings for people in this situation) but they're not perfect. – Polynomial Apr 22 '16 at 9:40
  • 1
    @Mok-KongShen They are informed of this fact. It's in the Tor FAQ. – Polynomial Apr 24 '16 at 22:04
  • 1
    Thanks very muvch for this hint. I only hope that those TOR users whose anonymity is really really critical don't neglect to read its FAQ. – Mok-Kong Shen Apr 25 '16 at 9:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.