Tor: You’re Not As Anonymous As You Think
There’s quite a bit of talk about Tor this week.
Yesterday an article was released with the alarming, yet unsurprising, headline: MIT researchers figure out how to break Tor anonymity without cracking encryption.
The MIT researchers used a form of traffic fingerprinting to determine user identity, all without breaking the encryption. They set up a computer connected to the Tor network as an entry node, and once requests were sent through it and connected via Tor they used “machine learning algorithms to monitor that data and count the packets.” The researchers were then able to determine the type of resources the users were accessing. They then used traffic fingerprinting to additionally determine which hidden services users were accessing. All without breaking the encryption.
An article in Ars Technica also made another Tor-related discovery this week, revealing: How the way you type can shatter anonymity – even on Tor.
In this case, security researchers used a profiling technique that collects keystrokes as users enter data into websites. With this profiling in place, after a short period of time it’s possible to determine “when the same individual is conducting subsequent online sessions.” By measuring the tiny differences in the ways people type and the unique way they press on keys, the program tracked each user’s digital fingerprint. Meaning – even if your IP address is protected – you are not anonymous. Websites could use this technology to identify users – even if they do not have access to their IP addresses. This research was conducted through a Tor browser, which means that all “Tor-Anonymized websites – either because their operators are malicious or are cooperating with law enforcement agencies – can use similar profiling scripts that track people across both public and darkweb destinations.” The article points out that some banks are already using this technology to provide an extra layer of authentication for users. But it’s a threat to online privacy, nonetheless.
None of this is good news for Tor, but it doesn’t come as a surprise. We’ve previously pointed out that Tor does not make you anonymous, and we reinforced this point in our recently updated I Am Anonymous When I Use a VPN – 10 Myths Debunked article that we published in the Take Back Your Internet section of our website this week.
Learn more about Tor and other threats to anonymity online. Read I Am Anonymouse When I Use a VPN – 10 Myths Debunked now.