Tor routing algorithm is trading safety for speed, says cofounder Dingledine | Network World

Search

Menu

Topics

Close

5G<br>Analytics<br>Artificial Intelligence<br>Careers<br>Cloud Computing<br>CPUs and Processors<br>Data Center<br>Edge Computing<br>Enterprise Buyer’s Guides<br>Enterprise Storage<br>Generative AI<br>Industry<br>Internet of Things<br>IT Leadership<br>Linux<br>Network Management Software<br>Network Security<br>Networking<br>Security<br>Virtualization

by Sean Michael Kerner

Contributing Writer

Tor still runs on altruism, but cheap hosting is pulling it off course

News

Aug 10, 20266 mins

Millions of people rely on a network of unpaid volunteers to stay anonymous online, and for 25 years that network has run on altruism rather than profit. Tor, short for The Onion Router, routes a user&rsquo;s traffic through three volunteer operated relays, as many as 9,000 of them scattered across the globe, so no single relay knows both who is asking and where they are going.

At the DEF CON security conference, Tor Project cofounder Roger Dingledine walked through the operational lessons behind keeping that network running, covering routing design, bad actor detection, and a centralization problem tied to the economics of cheap hosting. He also reiterated that the goal of Tor is about privacy, not profit.

&ldquo;The building block that Tor is based on is altruism,&rdquo; Dingledine said. &ldquo;It is: I want to make the world a better place, I have these extra resources, whether it&rsquo;s bandwidth or a computer or something, and of course I&rsquo;m going to give back to my community so that people in authoritarian regimes like Egypt or the U.S. or wherever we&rsquo;re going, can have more safety on the internet.&rdquo;

How Tor works today

Tor routes traffic through three relays: an entry guard, a middle node, and an exit node that connects to the destination site. Each relay operator sets an exit policy defining which addresses and ports it will forward. Some allow only ports 80 and 443 for web traffic. Others accept no exit traffic at all and serve only as an entry or middle hop.

A directory consensus, published hourly by nine directory authorities, tells clients which relays exist and how to reach them. Dingledine runs one of the nine and knows the other eight operators personally, a tradeoff between decentralization and a manageable degree of central control. He noted that if an attacker could somehow compromise or coerce or take over a majority of those nine, then it would be possible to start doing attacks on the Tor network.

&ldquo;So, one piece is this centralization has been helpful for letting us do admission control on the Tor network,&rdquo; Dingledine said. &ldquo;If some jerk in Russia signs up 1,000 Tor relays, then we have the ability, once we&rsquo;ve identified them, to get those relays out of the network, and that has turned out to be really useful over time.&rdquo;

The directory authorities were once also a performance and censorship bottleneck, since clients bootstrapped from nine fixed IP addresses a censor could simply block. Tor fixed this by distributing directory information across all relays and adding fallback bootstrap directories, so no client has to reach a directory authority directly.

Opsec mistakes cause the most damage

Dingledine ranked the threats facing Tor users by how often they actually occur in practice, not by theoretical severity.

Opsec mistakes. The most common cause of deanonymization is user error, not a flaw in Tor itself. Dingledine cited law enforcement contacts who tracked suspects only after they briefly used an open network connection without Tor.

Browser fingerprinting. Tor Browser, a Firefox fork, works to make every user look identical to every other user by normalizing variables like JavaScript behavior and window size.

Browser exploits. Zero-day vulnerabilities purchased for Firefox frequently work against Tor Browser as well, since it shares the same rendering engine and a browser&rsquo;s attack surface remains large regardless of the anonymity layer running underneath it.

Confirmation attacks. An adversary who already suspects a specific user can monitor that person&rsquo;s network connection alongside the destination site the person is believed to visit, then correlate the two traffic flows.

Traffic analysis. Without a known suspect, an adversary instead tries to match flows within a large set of observed Tor traffic. Dingledine called this a hard research problem at scale.

Bad actors have also tried to hijack Tor&rsquo;s admission model directly by signing up botnets of compromised devices as relays. A network health team monitors for that kind of anomaly and removes the relays once identified, but the pattern keeps recurring.

&ldquo;This problem is going to keep on happening,&rdquo; Dingledine said. &ldquo;So we need to get better and better at recognizing anomalies and dealing with them.&rdquo;

Cheap hosting is recentralizing the network

Running a relay no longer...