Hacker News Reader

Comment by onecooldev24 | Hacker News Reader

It does obscure the size, maybe not the frequency. Best have JS disabled when you come across this.

> It does obscure the size

Encryption does not inherently obscure the size of plaintext. Protocols may choose to pad plaintext for various reasons, and both Tor (since Tor always sends fixed-width cells) and TLS (when it uses a block cipher mode) do so. However, the amount of padding is typically small and can hardly be said to "obscure" the size of a request - it is not a defense against traffic analysis.

> since Tor always sends fixed-width cells

you send 1px of data or 500px tor always send fixed width cells. There is no question of padding here.

I believe what he's saying is that it'll pad to fit those cells. If you're sending 500b of data in 16b chunks, you'll need some padding (12b) in there to fit into 32x16 = 512b.

If the data is just a few bytes, tor would pad it with null and then encrypt it. The final encrypted cell would have no revealing information except for the time it was sent out at.

As I get it, it's irrelevant to JS. "Select all X" image-based captcha can be done without it. For example, a set of checkboxes with CSS background-image for its :checked (or :hover/:active/whatever) states would also do the trick (unless you patch/configure your browser to not optimize/delay the load of resources until they're actually required)

Reply on news.ycombinator.com