8

To me it seems that the only thing Tor is doing for anonymity (not security!) is the fact that it does not record the traffic in and out, because obviously if every router was recording the traffic going through it (let alone publish that information), every pathway would be clearly visible and then anyone could backtrace anyone.

But how does Tor guarantee that nodes do not log their traffic and/or send them to an adversary? I would bet that all NSA-helded routers would keep track of this and I bet that most of private-held routers would also do this since Tor is open-source and since people are naturally driven for evil.

Anonymity would still work if the nodes did not cooperate with each other (sharing traffic logs) or if the data passed through one honest node that does not log any information, but it's still a major flaw if most of the network you don't know if you can trust.

So how does the Tor network know whether to trust a node not to send traffic information to an adversary or to make it publically available?

8
  • 5
    You are assuming that they make that guarantee.
    – schroeder
    Feb 2, 2015 at 21:33
  • related security.stackexchange.com/questions/41542/…
    – AJAr
    Feb 2, 2015 at 21:50
  • 1
    You answered your own question: if one node doesn't cooperate, anonymity is maintained. Let's say data passes through an average of 6-7 nodes; the three-letter organizations would have to have "cooperation" from 90% of the nodes to even have a 50/50 chance of successfully spying on your traffic. Using more nodes, of course, makes it even harder.
    – KnightOfNi
    Feb 3, 2015 at 0:42
  • 3
    Of course @KnightOfNi if the communication consists of more than just a single session or packet then the chances go up. Probably to the extent that anonymity from the NSA et al is impossible. Traffic analysis is the killer here and with enough data it becomes trivial to de-anonomise any user of TOR. There is a paper that looks at this. Feb 3, 2015 at 3:04
  • Your data will likely pass on some relays so when it reach the exit node there is not only your traffic but traffic from other random people aswell what i think it's defeat traffic analysis
    – Freedo
    Feb 3, 2015 at 3:52

2 Answers 2

12

It doesn't guarantee anonymity if enough of the network is controlled by a single adversary. There's no general way you can do so; if your whole connection goes entirely through adversary-run computers, your adversary is going to be able to track it, no matter what system you're using.

What Tor does is make it really, really, really hard for an adversary to control enough of the network to make this happen. It passes each connection through multiple nodes, so you have to control enough nodes that not just one but at least three nodes selected from the list are yours (in specific cases, it may use more than three). The reason Tor works is that with a single Tor network, you have lots and lots of people running Tor servers; an adversary has to compete with tons of legitimate nodes. It's the same basic idea as Bitcoin - make it so an attacker inherently has to compete with legitimate users, and then the bigger the system gets the harder it is to attack.

4
  • Also you can become an relay node to make you even more anonymous by binding random data from others to you
    – Freedo
    Feb 3, 2015 at 3:41
  • And also tor itself is capable of shoting down any compromised node if necessary and they would probably notice a sudden change to their nodes (e.g suddenly there are 1 million nodes opened in China) also many nodes are not exit nodes but relay nodes that mix the data of a great amount of users so when it get to exit node there is not only your connection but the connection of many peoole and also it's is impossible to predict to which nodes the target connection will pass making it even more difficult to do an attack to an individual person
    – Freedo
    Feb 3, 2015 at 3:48
  • Anonymity is not guaranteed, if traffic patterns are the same and repeated consistently. For related articles on this, see: tripwire.com/state-of-security/security-data-protection/… wired.com/2014/11/operation-onymous-dark-web-arrests
    – user67862
    Feb 11, 2015 at 8:57
  • Seems like you could provide full anonymity by having every node establish a Tor connection to every other node, and then send either actual traffic or dummy data to all of them at equal rates. All the attacker could do then is identify which nodes they don't control (which is trivial anyway). Of course, as a side effect it would utterly cripple the network. (Also, they know every node wants to connect to some other node, or it wouldn't be using Tor)
    – user253751
    Jul 31, 2015 at 8:08
1

Like cpast mentioned Tor does not guarantee anonymity if large portion of the network by capacity (not by number of relays) is controlled by colluding advesaries. This is because one relay at 100 MB/sec capacity is effectivly is eqivalant to 100 relays at 1 MB/sec capacity. So it is the colluding adversaries's total employed data capacity to total capacity of the Tor network which determine capability of adversaries to undermine the anonymity of clients. By this account for example adveraries might have only few hundred high capacity relays but control half of all Tor data capacity. In this case they can de-anonymize most Tor users in a relatively short period of time. Tor folks encourage all entities to add as many relays as they wish to the network, and there is little verifiable evidence that these entities do not record or log whatever data they wish to record like what you said. Knowing this fact and all the snooping that is going on according to pulished material in journals especially in last two years, point to the direction that one should be prudent and take the claim of anonymity provided by Tor or any other anonymity network with grain of salt.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .