67

This question is inspired by this article (in Russian) about a website called I Know What You Download. From what I understand, they scan the DHT networks and display torrents that any given IP participated in, and although it is sometimes inaccurate, it can provide data on Internet usage, and thus presents a threat to anonymity.

Most people suggest using VPN in order to conceal torrent traffic. However, in another article (also in Russian) same author shares his experience with torrenting over VPN set in Azure. Apparently, he received DMCA notice for torrenting a film (author specifically notes that he did not fully download the film, and everything was done for the sake of experiment). They provided the name and the size of the file, along with IP address and port.

But, some (if not all) torrent-sharing programs have an encryption feature. For instance, Tixati can even enforce encryption for both incoming and outgoing connections:

enter image description here

enter image description here

Question is: what does this feature encrypt? Name of the file, its contents, size? Could it prevent DMCA notices? If not, what does it actually do?

Related: the answer there mentions encryption — does this kind of encryption count?

  • Comments are not for extended discussion; this conversation has been moved to chat. – Rory Alsop Jan 27 '17 at 12:08
  • Do not go to "I know what you download", it tried to force me to download an extension – Rohan Jhunjhunwala Jan 28 '17 at 23:31
  • 1
    Short answer: It is useless for privacy. Back years ago when ISPs first started throttling it managed to bypass some of it, but it's been ineffective for years now. Just use it "enabled" - so you can connect to both encrypted ad unencrypted. – Shiki Jan 29 '17 at 9:52
94

Think of it like an underground fight club. Encrypting the traffic means nobody on the outside can see you enter or leave, but once you're inside, everybody there knows who you are and can monitor your participation.

This feature is really only useful if you have an ISP that blocks torrent traffic. Encrypting it means it doesn't appear to be torrent traffic, it's just an encrypted stream, but once you get past the ISP and connect to the swarm everybody else participating knows exactly who you are and what you're doing.

  • So, this makes it safe when the government uses the ISPs to track traffic? – Jorge Leitão Jan 25 '17 at 21:40
  • 44
    Wouldn't it be more accurate to say : "Anybody on the outside can see you enter or leave but doesn't know what you are doing. Once you're inside, everybody there can monitor your participation."? Encryption doesn't hide to who you are connecting. It just protects the content. – Gudradain Jan 25 '17 at 22:45
  • 3
    If that's the only way the government in question is tracking it, maybe @J.C.Leitão. In particular, a government could even host a version of the file with a torrent client supporting encryption, and then they would be able to fully see who all was downloading it no matter what. – daboross Jan 26 '17 at 4:57
  • 2
    @Gudradain Yes, it is, but it breaks my analogy :) – Ivan Jan 26 '17 at 16:09
  • 1
    But... Isn't the first rule of the Torrent : "You do not talk about the Torrent ?". This is the best encryption – Fabich Jan 29 '17 at 1:32
29

The "encryption" hides the content of the torrent data traffic from a casual observer and makes it harder to determine that the traffic is in fact torrent data traffic. It was designed to make it harder for ISPs to snoop on torrent traffic (and either block it, throttle it or send nastygrams). It can also be useful for evading the effects of buggy firmware in network devices*.

The cryptography used is relatively weak. The DH key exchange is only 768 bit with a fixed prime which is almost certainly crackable by a well-funded attacker. The actual encryption is rc4 which is known to have weaknesses though I don't know how relevant they are to this particular application. MITM attacks are possible if the attacker knows the "info hash" of the torrent in question.

Also it only protects data connections. It DOES NOT hide the fact you are present in the swarm from someone scanning the tracker or dht. It DOES NOT stop the copyright enforcers from connecting to your client and downloading a copy of the file from you to demonstrate that you are illegally offering it for distribution.


* I have encountered cases where the same peice of a file was repeatly failling hash checks, turning on encryption fixed it. I suspect a buggy and/or overzealous NAT implementation was responsible.

  • This. Exactly this. It was so if your Internet provider searches all your traffic for "Torrent" (I'm oversimplifying a bit), that it wouldn't appear.. you'd have to write something to find the relevant parts and then use them to unscramble the packets to reveal that it was a torrent. This would be easy for someone determined but too much effort for an Internet provider to bother to do for every customer (and storing the relevant data for every session across your customer network would be a pain). – Matthew1471 Jan 29 '17 at 16:28
  • @PeterGreen, Re "It DOES NOT stop the bad guys from connecting to your client and downloading a copy of the file from you" but what if the file itself was encrypted? – Pacerier Oct 25 '17 at 7:07
  • Then the question becomes whether or not the "bad guys" have the key..... – Peter Green Mar 23 '18 at 18:25
10

what does this feature encrypt?

It encrypts the entire communication stream with other BT peers.

Name of the file, it's contents, size?

All of the above. Note that it is completely and utterly useless to encrypt these things as they are already PUBLIC.

Could it prevent DMCA notices?

It can prevent a residential ISP from casually snooping the traffic. In some countries this doesn't matter, as residential ISPs have no business snooping your traffic. In other countries, rightsholders have programs to cooperate with ISPs to detect piracy and serve out nastygrams.

If not, what does it actually do?

It is mainly security theatre. It will still be obvious to your ISP that you are using BT. It will still be easy for rightsholders to find out which IPs are sharing their content. So, the encryption doesn't solve any real problem. Someone added it to their BT client to draw dumb users who don't understand the security aspects at all. Then everyone else had to add it to their BT client too, even though it is mostly useless.

  • 1
    I don't think torrent protocol/clients ever claimed this to be security feature so labeling it “security theater” just obscures its actual purpose — dodging traffic shaping as per other answers. – Rarst Jan 27 '17 at 21:12
  • @Rarst The traffic shaping thing is just RetCon. It was initially developed to enhance privacy and confidentiality: en.wikipedia.org/wiki/BitTorrent_protocol_encryption. In terms of shaping it is nearly useless as an ISP has lots of options to combat network abuse, including just blanket rate limiting users who transfer a lot of data (which would be mainly BT users). – DepressedDaniel Jan 27 '17 at 23:44
  • 1
    "Purpose" section of the article you linked talks exclusively about traffic shaping. Personally I had encountered cases where it had been useful against it. – Rarst Jan 28 '17 at 0:12
  • @Rarst From about the 3rd line of "Purpose": "These systems were designed initially to provide anonymity or confidentiality, ..." So it is now recognized that anonymity and confidentiality are not much improved and only traffic shaping evasion is potentially has a benefit, depending on the ISP in question. – DepressedDaniel Jan 28 '17 at 0:15
  • "It will still be obvious to your ISP that you are using BT." Could you quantify that? – Luc Feb 1 '17 at 14:17
8

The DMCA notice was sent through Microsoft. Azure is not an anonymous service and makes no effort to conceal the fact that you're the owner of your IP. To protect your identity you need a VPN provicer which specializes in this, e.g., "PIA", "Hide my Ass", etc.

Bittorrent is not designed to anonymize. While it can be used through a proxy, it isn't 100% to protect you there either. See https://hal.inria.fr/inria-00471556 for information about anonymity leaks in bittorrent clients through the Tor network. Even if these holes are addressed, what motivation do the bittorrent client authors have to get security and privacy right?

Even if your client doesn't betray you and you find a VPN who's willing to hide your tracks, you have to question their motive. If they're served with legal papers, will they track you? why would they not operate in the legal framework of the country?

On encryption, Bitcomet has a good comment on this:

Please note that the encryption option is meant to hinder traffic shaping applications on the ISP side by obfuscating BitTorrent traffic between peers. However this doesn't anonymize you on the Internet as far as the other peers in the swarm are concerned, since your IP address will still be visible to each peer of that torrent swarm. If you aim for total anonymity you should look towards a VPN proxy solution which will masquerade your IP behind the VPN IP address, thus offering you a real degree of anonymity.

http://wiki.bitcomet.com/protocol_encryption

  • Please don't ever recommend HMA, considering how infamous they are for giving away server logs. – forest Feb 7 '18 at 2:39
  • @forest it's all in the third paragraph. You're suggesting HMA should violate a court order to protect a customer paying a few dollars a month? – mgjk Feb 10 '18 at 14:23
  • I'm suggesting they do not keep logs in the first place, like any reputable anonymizing service does (or even better, something like Tor, where it's impossible to keep incriminating logs). A VPN that happily gives away logs that directly link to your actual person is not a very good VPN. If you don't have logs, you can't be forced to give out logs (and it is not at all illegal for such a service to refuse to log, at least in the US). Note that they got a subpoena for releasing any logs they had. – forest Feb 10 '18 at 14:26
  • If you don't have logs, you can be forced to install monitoring software and log user activities (see Hushmail). This was suggested as a risk by HMA in their response to the issue over 6 years ago: blog.hidemyass.com/lulzsec-fiasco "these types of services that do not cooperate are more likely to have their entire VPN network monitored and tapped by law enforcement, thus affecting all legitimate customers". Unless you're referring to something more recent. – mgjk Feb 10 '18 at 14:32
  • They suggested it as a risk as a form of damage control. Their statement is already factually inaccurate, as it requires a very high-level judge to give both a gag order and a court order to add monitoring services (in recent history, it's only happened once, compared with log subpoenas which happen daily). Not to mention the obvious, which is that you cannot retroactively demand logs when they do not exist. The fact is, both technically and legally, not keeping logs is a better way to keep both the service and the users legally safe. This should be self-evident. Logs = non-repudation. – forest Feb 10 '18 at 14:34
5

So, VPN is not an option.

This is where you're wrong.

VPN doesn't hide your identity. VPN merely shifts your identity to your VPN provider identity. VPN doesn't do anything for you directly, it merely allows you to hide behind someone's else skirt. Now, depending on what provider you've chosen, when authorities come asking who you are, it can either fight them for you or fight you for them.

Azure is not an identity-hiding service, so using it to conceal yourself cannot work. It doesn't mean that "VPN is not an option" it only means that "Azure VPN is not an option"

Question is: what does this feature encrypt?

It conceals the nature of the traffic from your service providers (your ISP, your VPN provider, and your VPN providers's ISP) to make traffic shaping (read: blocking torrents) more difficult.

  • Good catch! I didn't even register that he set up his own VPN on Azure. snicker – schroeder Jan 26 '17 at 14:25
  • @schroeder >_> – Gallifreyan Jan 26 '17 at 14:35
  • 1
    @Agent_L no need to escalate when a simple comment will suffice. The OP is also free to make his own edits. – schroeder Jan 26 '17 at 18:20
  • @schroeder The need to escalate is to stop you from doing it again. It did changed the meaning and most of my answer addressees the part of the question that wasn't there in the first place. I wouldn't have answered otherwise, as earlier answers are, expectably, more than sufficient. – Agent_L Jan 27 '17 at 11:36
  • @Agent_L again, no need to escalate when a comment will suffice - I added the line to provide relevance to the OP talking about VPNs at all. Else I would have purged that entire 3/4 of the post and not just the pic of the email. The OP agreed with the edit. There is nothing to "stop". – schroeder Jan 27 '17 at 12:59
0

It doesn't encrypt the sources unless they too are using encryption. One sided encrypition is like hiding in a safe from the world outside that knows your inside the safe.

  • 4
    This doesn’t add anything over the other answers. Note that the OP shows encrypted peers only, so I don’t see hiw the remark is even applicable. – JDługosz Jan 28 '17 at 7:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.