[tor-talk] Traffic shaping attack

[Roger Dingledine]

On Sat, Mar 19, 2016 at 11:02:44AM +0000, Oskar Wendel wrote:
> Let's assume that the service is extremely popular, with over 6 terabytes 
> of traffic each day, and a gigabit port almost constantly saturated.

This assumed scenario seems extremely unlikely to be happening in
practice. First because there aren't any relays that are doing 1gbit/s
of traffic, so no onion service would be able to do that to its guard
(unless it used many entry guards and spread the load over them, in which
case it would be screwing its own anonymity). And second because the
graph at https://metrics.torproject.org/hidserv-rend-relayed-cells.html
shows there's only something like 1.4gbit/s of onion service traffic in
the whole network. And third because scalability issues in the current
design make onion services unable to keep up with the number of users
that you're describing.

So I worry that it sounds similar to the "omg they're hidden so they
must be *huge*" mistake that a lot of the media suffers from.

> This is not a theoretic attack. This is something that has been noticed 
> on one of illegal sites and I expect many busts around the globe in the 
> coming weeks.

More details please? This is not a crazy possibility, but it would be good
to know exactly what evidence we have for its being true. For example,
if somebody noticed "I get a burst of cells from this onion service,
then a few seconds of silence, then I get another burst of cells",
that's actually a property of our current load balancing algorithm,
and not necessarily evidence of an intentional signal being injected
into the circuit.

--Roger