Proposal: add Noisy to default software

[AnarSec]

AnarSec recently forked the project Noisy, for a use case of mitigating some correlation attacks on Tor, with an eye towards Tails and Whonix users. You can see the code and README document here:

anarsec / noisy · GitLab

Would the Whonix project like to take ownership of Noisy, and include it as default software in the Workstation?

If so, two paths could be pursued:

1. A GUI is made so that users uncomfortable with a CLI can use Noisy. We could contribute this. This is the “opt-in” option.
2. Noisy is a default process - the user benefits from it’s protection without needing to do anything. This is the “by default” option. In our view, this is preferable.

Currently when run in Whonix Workstation, the script continues to use the same Tor circuit, regardless of changes in the domain being requested. This is an issue, because only one Guard node is being used by the traffic. The behavior on Tails is preferable, where the circuit changes with each domain change, because all Guard nodes in the current set are used equally.

[Patrick]

Feature: default mitigation for traffic analysis

I recently posted to the Tor forum asking for clarification about a Mike Perry blog post concerning traffic analysis mitigations. Machine Learning makes this attack vector increasingly problematic. Excerpt: for users comfortable with the CLI, maybe a script exists designed for this, using torsocks? A script would have the benefit that it could be run by default on anonymity focused distributions like Tails and Whonix, so users would be protected without requiring specific behavior from them. …

@AnarSec

Would the Whonix project like to take ownership of Noisy

No. Best if it is developed independently.
(Too much to add to the existing lists: Kicksecure · GitHub / Whonix · GitHub)

And also best if discussed with the Tor community generally as well as with the anonymity research community to get wide feedback to make sure this is actually working.

Lots of things has been said about traffic analysis. Did you look into it?

Some here:

https://www.freehaven.net/anonbib/

@AnarSec

Currently when run in Whonix Workstation

Problem is when using Multiple Whonix-Workstation that this would multiply the cover traffic. Hence, better if run on Whonix-Gateway?

@AnarSec

Currently when run in Whonix Workstation, the script continues to use the same Tor circuit, regardless of changes in the domain being requested. This is an issue, because only one Guard node is being used by the traffic. The behavior on Tails is preferable, where the circuit changes with each domain change, because all Guard nodes in the current set are used equally.

Resolved by running on Whonix-Gateway?