Wednesday, February 2, 2011
Traffic analysis
I've been reading papers and Tor, Crowds, and Freenet and they all talk about traffic analysis. Basically, an eavesdropper can tell a lot about your network traffic by looking at the sequence of packets, packet sizes, and timing between packets. Using the probabilitic models, they can tell with varying degrees of certainty what websites you are connecting to. So, in this case, using encryption and proxying also may not be enough to hide your actions. I read this one article that said, how an eavesdropper was able to determine with 50% accuracy if someone was connecting to Facebook or not, even when they've gone through encryption and proxying. So both Tor and Freenet uses message padding. The overall concept is simple, make all traffic look the same, give all packets the same size and send them at constant intervals or randomize the sending. Bottom line is this, many things we do have patterns, and patterns leave trails. So encryption and indirection is a start, but traffic analysis is the harder thing to watch out for because you usually lose performance as you start implementing techniques to circumvent traffic analysis. ...... that's it.
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment