same first hops

[Gregory Maxwell]

On Wed, Oct 8, 2008 at 11:34 PM, M <moeedsalam at gmail.com> wrote:
> On Thu, Oct 9, 2008 at 6:31 AM, Gregory Maxwell <gmaxwell at gmail.com> wrote:
>>
>> On Wed, Oct 8, 2008 at 11:23 PM, M <moeedsalam at gmail.com> wrote:
>> > Thanx Gregory  and F.Fox...understood the concept. Just one note though:
>> >
>> > "Tor (like all current practical low-latency anonymity designs) fails
>> > when
>> > the attacker can see both ends of the communications channel. For
>> > example,
>> > suppose the attacker is watching the Tor relay you choose to enter the
>> > network, and is also watching the website you visit."
>> >
>> > When it says "watching" does it mean? I thought the info was encrypted
>> > (except the last hop) and the IP invisible? Does it mean timing attacks?
>>
>> Yes. A Timing/Sizing attack.  He sees the last hop exit.
> but it says "first hop"

Sorry, I accidentally hit send.

Consider: Nothing prevents you from running multiple tor nodes. A well
funded party might run dozens or hundreds.  If the attacker controls
both the entry and the exit that you are using he can look at the
unencrypted traffic leaving the exit and correlate it with the timing
and sizes of the data on the the entrances he controls.  He could also
do things like intercept your TCP connections leaving the exit and
stuff them with megabytes of junk data and then watch for the traffic
spike on any of the entrances he controls.

If you think about it for a bit you'll realize why changing entrances
all the time would maximize your exposure to this attack. Eventually
you would land on the bad guy's entrance and he could track you down.