Are there any #Tor or #BrowserFingerprinting or traffic fingerprinting people in my wider network that have read the #MaybeNot paper?
How do these defenses relate to the work that Tor itself does to protect from traffic analysis? Would they be enough to prevent the sort of timing attacks that the wiki describes on the TorPlusVPN page?
Does anyone have more information on the research that that wiki page is referencing?
I am just diving into this topic, so be gentle please.
@trashpanda MaybeNot relates to Tor in that we have integrated it into Arti (our ongoing effort to move to #Rust for #Tor). Once we have both the client and the relay side written in Rust, we will benefit more from the MaybeNot benefits.
If you have questions for one of the authors of the paper, then Tobias is available as @pulls here 😉
@ahf @pulls Forgive me if I am talking out my ass. I am hoping a few minutes of your time can save me several hours of research.
There is a piece of advice (hacklore?) that goes around. It says that Tor should never be used in conjunction with a VPN because it breaks Tor's security model and it opens you up to traffic analysis attacks.
🧵 1/3
@ahf @pulls The TorPlusVPN[1] page is sometimes referenced with this advice. My reading of this page is that traffic analysis would only expose that you are using Tor. And the page is marked as legacy and references research from 2012 (Touching at a Distance). My understanding is that the best fingerprinting attacks currently are those based on machine learning like Tik-Tok. It seems like the best defenses against these sorts of attacks right now using MaybeNot machines.
🧵 (2/3)
Just a trash panda 🦝
Alexander Hansen Færøy
Tobias Pulls