Hidden service persistent connections (Traffic Analysis)
On 5/17/19, Memory Vandal <memvandal@gmail.com> wrote:
Are client connections to a hidden service .onion address that do not disconnect for hours safe?
It may be a big file download or multiple keep-alive transactions that uses the established connection over and over for lets say few hours.
If its not safe then what should be the max time a connection to .onion service should get disconnected so that it uses a new circuit when it reconnects?
GPA and big global and regional network operators can pull out traffic patterns. NSA's own slide decks and papers, as well as academic researchers whitepapers in tor bib and elsewhere have confirmed this. Here are some degenerate traffic pattern... while : ; do wget onion ; sleep 5 ; done ping6 -w 5 <onioncat_peer> Who thinks those is or is not observable? Now receive or send your real N-GiB file, plot the packet timings and bandwidth variations going aross your nic. Do not forget the circuit creation wavefront either. Who thinks those are or are not observable at the other end (and even throughout in some cases)? Now add in targeted DoS blinking out nodes. And add in Sybil. Who disbelieves those tools effective? Who disbelieves "Op Ivy Bells" "641a" "Bumblehive" and "parallel construction"? Tor and many other overlay networks fail to deploy traffic fill and regulation, or try traffic mix and other various means to lessen or defeat such analysis. There are a few papers and overlays and hardware hopefully trying such and other things for the near future. You can list all the ones you can find here if you want, and see about creating, running and supporting them too. Maybe if you adopt true distributed privacy cryptocurrency instead of central fiat shitcoins you can start put them spyings and so many other bad things against humanity into "max defund time" too. Wake up.
Any sort of live interaction, like that provided by Tor, is going to be traceable, but most of this stuff does not really need live interaction. It could be provided by something that works like email. To prevent traceability, needs a big pile of stuff sitting on the nodes, rather than the nodes retransmitting immediately. To defeat traffic analysis, needs data mingling. Any large object needs to be encrypted, chopped into small blocks, each identified by it hash, the blocks sent with an outer layer of encryption into a great big pile somewhere with the outer layer of encryption pulled off, and you then some considerable time later, fish them out of the great big pile. This, of course, requires that you trust the operator of the great big pile, who knows where an opaque block came from and where it is going to, so you need multiple piles, and stuff gets distributed from pile to pile. For automated interactions, like the dark web selling cocaine, you would send a request, and much later a form would be in your inbox, like email with emails running javascript in a sandbox. When you eventually got around to working your through your inbox, you would fill out the form, hit send, and eventually get a possibly automated response. Last I heard, javascript in email was not properly sandboxed, and represents a massive security hole.
On Tue, 21 May 2019 11:41:25 +1000 jamesd@echeque.com wrote:
This, of course, requires that you trust the operator of the great big pile, who knows where an opaque block came from and where it is going to, so you need multiple piles, and stuff gets distributed from pile to pile.
are you reinventing freenet?
For automated interactions, like the dark web selling cocaine, you would send a request, and much later a form would be in your inbox, like email with emails running javascript in a sandbox.
AHAHA YES! Send javashit malware through email. We haven't reached that bottom yet, but we will. But it's 'sandboxed' malware!!! yeah right. you are obviously correct about one thing though : important messages (not jewtube garbage) need their own batched mixing network.
When you eventually got around to working your through your inbox, you would fill out the form, hit send, and eventually get a possibly automated response.
Last I heard, javascript in email was not properly sandboxed, and represents a massive security hole.
participants (3)
-
grarpamp -
jamesd＠echeque.com -
Punk