1

So understand that torrenting over tor isn't generally a good idea, mainly because the speeds aren't high and it strains the network. Also that it doesn't support UDP.

But if we look at the old paper about this on the tor website, there are a couple more issues listed, that don't seem to me like a tor-only issue.

The attack is actually worse than that: apparently in some cases uTorrent, BitSpirit, and libTorrent simply write your IP address directly into the information they send to the tracker and/or to other peers. Tor is doing its job: Tor is anonymously sending your IP address to the tracker or peer. Nobody knows where you're sending your IP address from. But that probably isn't what you wanted your Bittorrent client to send.

Because of the first attack above, the tracker learns both your real IP address and also the random port your client chose. So if your uTorrent client picks 50344 as its port, and then anonymously (via Tor) talks to some other peer, that other peer can go to the tracker, look for everybody who published to the tracker listing port 50344 (with high probability there's only one), and voila, the other peer learns your real IP address.

So what's stopping a torrent client doing that behavior with a VPN too and just sending your original ip address through a VPN if it already is an issue with tor?

Improve this question
1
  • In this regard, Tor is just a pile of VPNs
    – fraxinus
    Commented Jan 26, 2022 at 8:35

1 Answer 1

Reset to default
1

So what's stopping a torrent client doing that behavior with a VPN too ...

Nothing. VPN will not change the content (application layer), what they will do is to make it appear coming from a different IP address (network layer).

The problem is the same with other P2P communication like WebRTC which also include IP addresses directly in the content. To protect against this you would need to disable WebRTC when using a VPN, so not using affected Torrent applications would be advised to.

Improve this answer
3
  • IIRC, Mozilla made substantial improvements to their implementation of WebRTC in Firefox since that (somewhat promotional) article was written. It's possible one no longer needs to disable WebRTC in Firefox if they are using a VPN and don't want their IP disclosed... just don't click the browser's prompt to enable a camera or microphone. I haven't read anything about Chrome making changes, so it might still be needed for that browser (and those based on it). This is all from memory, so please verify and test before believing. ;)
    – End Antisemitic Hate
    Commented Jan 26, 2022 at 7:12
  • @RockPaperLz-MaskitorCasket: "just don't click the browser's prompt to enable a camera or microphone" - yes, if no real time audio/video is needed then no WebRTC is needed. But isn't that similar to "just don't torrent"? The point is that the OP is explicitly using Tor/VPN for privacy when torrenting or using real time audio/video. And that because of how the applications work the expected privacy is not obtained.
    – Steffen Ullrich
    Commented Jan 26, 2022 at 7:19
  • I'm only referring to the need to disable WebRTC. In the past, you actually needed to completely disable it in the browser if you didn't want it leaking an IP addresses. To my knowledge, this is no longer needed in Firefox. I don't know about Chrome and Chrome-based browsers or Safari.
    – End Antisemitic Hate
    Commented Jan 26, 2022 at 7:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .