1

I am preparing a survey on Tor and its security. While searching for resources, I have come across with the paper Users Get Routed:Traffic Correlation on Tor by Realistic Adversaries. I comprehend the idea and the conclusion of the paper, but I am a bit confused with the phrase "common locations". Quoting the paper:

Our analysis shows that 80% of all types of users may be deanonymized by a relatively moderate Tor-relay adversary within six months. Our results also show that against a single AS adversary roughly 100% of users in some common locations are deanonymized within three months (95% in three months for a single IXP).

What do they mean by "common locations"?

Improve this question

1 Answer 1

Reset to default
2

The ability to deanonymize using this method involves correlation among other traffic by your IP. The more traffic available to correlate, the better chances of deanonymizing. I believe the use of "common locations" denotes an AS containing many other popular sites, maybe to include gaming servers, StackExchange web servers, CDNs, etc. Perhaps an "uncommon location" in this context would be an ISP for a more rural area of some remote nation where the target would not be sending much, if any, traffic to.

Edit: Source for my explanation of how it is correlated, under the "Related Works" section:

Onion routing is vulnerable to an adversary who can monitor a user’s traffic as it enters and leaves the anonymity network; correlating that traffic using traffic analysis links the observed sender and receiver of the communication.

Improve this answer
1
  • In one degenerate case there are half a dozen exit nodes in the same datacenter. This research suggests that such colocation is a really bad idea.
    – Michael Hampton
    Mar 21, 2015 at 7:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .