Hacker News Reader

Comment by zmanian | Hacker News Reader

Netflow is a great example of the dual use aspects of tech between surveillance and defense. Making Netflow data more widely available looks like it is going to be essential for defending that Internet but at the same time Netflow data can threaten the anonymity of Tor users.[0][1]

[0] https://blog.torproject.org/blog/traffic-correlation-using-n...

[1] https://gitweb.torproject.org/torspec.git/tree/proposals/251...

View on HN

This is true, but it is a fundamental fact of the Internet, and has been since before Roger Dingledine first started presenting Tor to people at Black Hat. The major ISPs are all instrumented with Netflow, they're all collecting it, and they've all got tools (both in-house and from vendors) to analyze it.

So if you're going to try to deploy something like Tor, the table stakes are that you're secure against wide-scale Netflow instrumentation. If Netflow is an existential threat to your privacy tool, you don't have a privacy tool that is ready for deployment.

For ddos attribution, you generally only need a very small sample rate, and only headers. You might be able to use that against tor connections, but only when you're very lucky.

Of course, I'm not sure if cloudflare could care any less about tor users. They see a lot of attack traffic from tor so this probably isn't something they are concerned about. I can't really blame them from a business perspective, but I avoid cloudflare due to it.

> They see a lot of attack traffic from tor

This was debunked.

I don't believe this is actually arguable. People use tor to attempt to anonymize their (generally non-ddos) attacks.

I don't believe tor can support the type of ddos the OP is talking about, of course.

If you could provide the source of this debunk it'd be appreciated.

This is ridiculous. Anyone can grep their access logs for signs of obvious attacks and very quickly verify that very few, if any, of them originated from Tor exits.

It amuses me greatly that probably no one in this thread realizes who you are. (Except maybe Cloudflare.)

I have no clue who ryanlol is. Would it make a difference if I did?

He's a subject matter expert: Julius Kivimaki.

"This was debunked."

Where exactly?

No one claimed Tor was sending DDoS attacks -- plenty of other malicious traffic comes out of Tor however.

Where/how?

Reply on news.ycombinator.com