Stream Isolation with Tor - The Danger Beneath

General Tor and Anonymity Talk
1

we always hear about torrifying things in the the distro, but i had question on Tor Design:

Lets say im living in US , and i want to use whonix,tails…etc:

  • * = Tor relays
  • a,b,c = tor nodes as guardian,middle,exit
  • zz,zgl = connection fingerprint
    so me using Tor Browser to visit Signal website:

zzUS → a*Canada → b*France → c*Austria → signal.org (located in US) tagged as zz (lets say zz is the tag for tor browser)

on the same time i have downloaded/using signal:
(since we are using the same running Tor)

zglUS → a*Canada → b*France → c*Austria → signal.org (located in US) tagged as zgl (lets say zgl is the tag for Signal application)

now if Tor doesnt make new hops for each connection that an application connecting to it = my connection through Tor relays is very predictable/distinguishable.

if Tor does take each connection to it with a different path then that solve the issue, if not then connecting applications with one tor connection (like one GW) not really good idea.

Alternatively:

  • I2P does take each and every connection with new Tunnel.
  • Havent check what GNUnet is doing for this issue.

Note: my question above is not sure if Tor taking everything into one path or not.

2

So you’re asking if stream isolation is guaranteed?

If so, it isn’t. That feature wasn’t in Tor from the start, but it’s relied on now. See the torrc man page for the SOCKSPort isolation flags IsolateClientProtocol, IsolateDestPort, and IsolateDestAddr. It’s my understanding you can also use different SOCKSPorts to isolate streams as well.

If that wasn’t what you wanted to know, try asking your question differently. It’s hard to understand the way you put it.

3

yeah thats the problem and i think until now e.g:

WS - > GW

and inside WS we will have TBB,Signal app

TBB will use Tor as entryA,middleB,exitC
Signal App will use as well entryA,middleB,exitC

but Signal App will not use entryX,middleY,exitZ

WS1 → GWa
WS2 → GWa

both WS1&2 will get the same connections and IPs.

and so on…, so as you said it wasnt in Tor and until now.

so the good question, is it good idea to use TBB + Signal App connected to the same Tor? (in our case , same GW).

or is the future of using Tor going to be using parallel Tors installed in one place together and isolate each one for each app?

4

For question one: http://www.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion/wiki/Stream_Isolation#How_to_mitigate_identity_correlation

For question two: Multiple gateways are going to use different guard nodes, that’s kind of against the design of Tor. I think Whonix’s stance is that multiple gateways shouldn’t be used, because doing it isn’t very well understood. Look in the wiki, you might find something.

Sorry to make you wait for so long for a reply.

1 Like