1

I know it is generally a bad idea to download torrents using Tor, as Tor is not designed to support such large data transfers and the bandwidth is limited.

However, I wanted to know if, when Tor is set as a proxy in a torrent client, can the peers I'm sharing a torrent with see my IP address? If so, how is it possible?

6

Using Tor for torrenting is the way many people got caught.

So what's the fix? There are two answers here.

The first answer is "don't run Bittorrent over Tor". We've been saying for years not to run Bittorrent over Tor, because the Tor network can't handle the load

The second answer is that if you want your Bittorrent client to actually provide privacy when using a proxy, you need to get the application and protocol developers to fix their applications and protocols. Tor can't keep you safe if your applications leak your identity.

The third attack from their paper is where things get interesting. For efficiency, Tor puts multiple application streams over each circuit.

[...]


What's the fix? The same two fixes as before: don't run Bittorrent over Tor, and/or get your Bittorrent developers to fix their applications. But as Tor developers, this attack opens up an opportunity for a third fix. Is there a way that we as Tor can reduce the damage that users can do to themselves when they use insecure applications over Tor? We can't solve the fact that you'll shoot yourself in the foot if you use Bittorrent over Tor, but maybe we can still save the rest of the leg.

One approach to addressing this problem in Tor's design is to make each user application use a separate circuit.

Another answer is to separate streams by destination port. Then all the streams that go to port 80 are on one circuit, and a stream for a different destination port goes on another circuit.

We've had that idea lurking in the background for a long time now, but it's actually because of Bittorrent that we haven't implemented it: if a BT client asks us to make 50 streams to 50 different destination ports, I don't want the Tor client to try to make 50 different circuits. That puts too much load on the network.

I guess we could special-case it by separating "80" and "not 80", but I'm not sure how effective that would be in practice, first since many other ports (IM, SSH, etc) would want to be special-cased, and second since firewalls are pressuring more and more of the Internet to go over port 80 these days.

https://blog.torproject.org/blog/bittorrent-over-tor-isnt-good-idea

  • Extracted the most important parts from the blog post. Possible solutions for Tor developers are in italic. – Samuel Shifterovich Oct 1 '16 at 11:40
  • This article is old (more than 6 years) and it mainly says that issues in Bittorrent clients are exposing the IP address of the user. Is it reasonnable to think (after checking) that nowadays Bittorrent clients don't have these flaws ? According to torguard.net/checkmytorrentipaddress.php my IP address seems protected when I'm using µtorrent behind Tor, if this is true, it would mean that now Bittorrent can be used anonymously over Tor ? – Fitz Oct 1 '16 at 12:04
  • Haven't heard a single time that BitTorrent works with Tor. Heard the opposite many times. – Samuel Shifterovich Oct 1 '16 at 12:06
  • After verification, some Bittorrent clients have settings to avoid leaks of identifying information (µtorrent for instance), therefore if such settings are present and can be trusted, it is safe, but not recommended, to use Bittorrent over Tor (note: with µtorrent DHT and peer exchange must be deactivated). – Fitz Oct 4 '16 at 14:02
  • If I do not use torrent application over tor and choose to surf torrent over tor browser will there be any vulnerability then? All the other vulnerabilities tor developers have mentioned are when you use torrent client(bit torrent and utorrent) over tor SOCKS proxy. – defalt Oct 16 '16 at 6:45
0

Sending your BitTorrent traffic through the Tor network would overload it even more. It isn't designed to handle such things -- the Tor network has much less capacity than it has users wanting to use it. And since it's zero-sum, every person trying to BitTorrent over Tor means many more people in Syria who can't get to their Facebook pages.

Mechanisms are being explored for throttling "loud" users, to make it even less worthwhile to try to BitTorrent over Tor:

That said, it should be fine to just fetch the torrent files themselves over Tor. That's even what the Pirate Browser folks are trying to do. And it could even be OK to send the tracker traffic over Tor. The trouble there is that it's a slippery slope, and so far everybody who has made a check-box in their torrent software for just tracker traffic also makes a check-box right next to it for the bulk traffic. Since we don't want to get into the business of writing more usable (and more Tor-friendly) BitTorrent software, it's simplest just to tell people not to do it.

If you need alternatives, consider i2p, or gnunet, or just getting a VPN somewhere.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.