this post was submitted on 26 Nov 2023
32 points (92.1% liked)

Privacy

31182 readers
1812 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

Chat rooms

much thanks to @gary_host_laptop for the logo design :)

founded 4 years ago
MODERATORS
top 13 comments
sorted by: hot top controversial new old
[–] [email protected] 36 points 9 months ago* (last edited 9 months ago)

If you're worried about time correlation attacks, to deanonymize traffic, they are things you can do:

  1. Leave the connection on all the time, so there's no time to correlate.

  2. Comingle different streams of traffic over the link, to make it harder to to traffic pattern analysis. Stream a video game, run an exit note, watch a movie, proxy variety of low intensity sporadic traffic.

  3. Leave the connection up for a random amount of time before and after whatever activity you're considering sensitive. That way there's not very clean brackets on time logs.

  4. Just like in military radio operations, keep your sensitive activity short, low density, and very fast. ( Identifying the origin of two IP packets it's much harder than identifying who is watching a video stream).

  5. Depending on how technical you want to get you can use reverse traffic shaping. You can generate false traffic to always ensure that your traffic over your first link looks uniform.

  6. Use a multi hop onion network, so different data streams take different paths, making it much harder to identify a single stream through the entire network. I.e. different Tor circuits or safing, or multihop Mullvad with different routes for different streams.

  7. Don't use a static connection to connect to the internet. Use open wi-fi, use coffee table wi-fi, use library wi-fi, use a burner phone with an esim loaded on it. Use a shotgun Pringles can Wi-Fi adapter to connect to a distant access point. You can do many things to change the origin of your traffic.

  8. If your threat model seriously considers time correlation attacks, don't have a repeatable set pattern. Break up your schedule. Don't be predictable. Make it harder to gather more intelligence from your activity. Don't do the same thing at the same time

All of this being said, don't let perfect be the enemy of good. Do whatever you can to mitigate, don't make things easy for your adversary. There's no reason to give up just because you're not perfect

[–] [email protected] 18 points 9 months ago (1 children)

Your ISP can see that you used tor but not what for

[–] [email protected] 0 points 9 months ago* (last edited 9 months ago) (5 children)

That's not what I'm saying. The point I'm making is tails feature where it wipes memory when turned off is pointless because ISP can look at the times of tor usage and see what times you were likely using tails, which us why I ask if there is any point in using it?

[–] [email protected] 23 points 9 months ago

Memory stores more data than just when you used tor, like websites visited (like resources downloaded on page load through GETs). Your ISP should only be able to tell what the first node you are using is, and if you use an unlisted bridge it should be much harder to even try to correlate, which if your smart should be near impossible anyways.

[–] [email protected] 10 points 9 months ago

What are you worried about the ISP finding out? Simply the fact you were using Tor?

If that's the case, I suppose you could use an always-on VPN, and run the Tor browser on that, for example.

[–] [email protected] 9 points 9 months ago

If you leave it on as much as you can, and make it generate random traffic, then you're effectively obfuscating the pattern.

[–] [email protected] 7 points 9 months ago (1 children)

I think the first responder @grant did understand and answered in a relevant way. I'll answer your question with a question. What is the point of using VPN if your ISP can correlate times from logs? I think you should get on the Tails site and educate yourself further to better understand use case for Tails.

[–] [email protected] 6 points 9 months ago* (last edited 9 months ago)

Don't let perfect be the enemy of good. Just because it's physically possible, doesn't mean you have to make it easy for somebody

[–] [email protected] 10 points 9 months ago

Some of possible solutions include:

  • always use Tor 24/7, Tails or not, when possible, even when browsing normal websites, or using IRC etc.
  • use bridges
[–] [email protected] 6 points 9 months ago* (last edited 9 months ago)

What is the point in using a car if it has GPS, but no internal cameras or microphones? Metadata is dangerous, but far from the only kind of data.

[–] [email protected] 1 points 9 months ago

So are you saying the "hide that you are using tails from your isp" option doesn't work? Does it still show you are using TOR?