What can you learn from an IP address? (2019) | Hacker News Reader

What can you learn from an IP address? (2019)

blog.apnic.net

75 pointspabs322 comments

This is quite neat, if not semi-obvious. I'm not sure how it would even be possible to hide the fact that you are visiting a certain website, while still having two-way comms with that IP. How could the ISP route the traffic if they didn't know the source/destination IP?

Clearly the IP address maps to a website, though not always one-to-one. In which case Reverse DNS gets you most of the way there. Presumably, this is better in the case of multiple sites served on the same IP through shared hosting or a CDN. Disambiguating with subqueries makes sense to get that last-mile accuracy.

While TFA claims 95% of sites are identifiable with their method, it also states 68% already would have been from IP alone in the first place. Presumably unique IP + unique resource boosts that higher. So the fingerprinting is perhaps not so dramatic, while requiring a lot more work.

What would be interesting to measure is how many sites _require_ fingerprinting to be uniquely identified. As well, the average number of sites per shared IP - to see how precise IP is even in the shared case.

Reverse DNS is pretty lousy for this, truth be told. Perhaps a couple of decades back there was a reasonable chance of reverse lookup bearing some relation to the host component of the URL that led to the exchange of packets. These days, I'd consider such commonality to be a surprising exception.

In particular, don't interpret that 68% figure of bijection to mean the reverse lookup will be meaningful. I'd wager a large number of them are public cloud instances, and a PTR string ending in "compute.amazonaws.com" isn't likely to be a famous bookshop. Hey, consider yourself lucky it wasn't a NXDOMAIN.

Note that DNS is not actually normative for HTTP. The standard does not specify how names are resolved to endpoints; it defines no service name or equivalent/alternative record. For years the standards committee has (quite shamefully and negligently in my view) relied on tacitly squatting the address (A/AAAA) record. This architectural wart forces workarounds for consequential misbehaviours both in HTTP (such as aliasing at the domain apex), and in other protocols besides since everyone else has to tiptoe around the entitled gorilla. I suspect the workarounds thus employed further contribute to the fingerprinting options available.

Welp, TIL. I tried a reverse lookup for a site I own and indeed got some long string of `a134124randomstuff.awsglobalaccelerator.com`. I suppose I naively assumed that if I put an IP address in the A record, that would be how it resolves. Clearly not! I guess whatever's under the hood of the NS records probably adds a few translation layers. Will have to read further, thanks!

it is just a different record entirely. there is a special zone for reverse lookup on ip addresses for ip4 and ip6 respectively. the address gets transformed into DNS labels to make the lookup. i.e to do a lookup for the ip address "192.0.2.1" the actual name for which the lookup is done is "1.2.0.192.in-addr.arpa." and the delegation for these zones can be and typically is entirely different from the forward zone. if you only have access to the forward zone you wont affect the reverse zone at all...

This is where Tor shines: you never connect to the destination IP directly, so this kind of tracing is made much harder.

A global passive adversary can still do correlation attacks on traffic going into and out of the network unfortunately. Would be great if Tor had traffic splitting, chaff traffic and jitter.

That's why real time networking and perfect privacy are inherently incompatible.

There was a proof of concept tor like network posted here that did away with the real time aspect and wasted quite a lot of bandwidth to conceal your true target connection but that seemed like a good solution.

Unfortunately I can't remember it's name.

I think a good commercial VPN would provide this functionality if you get used to change ip connection on a regular basis.

But then your vpn knows who you are talking to

Yes, that turns down to be the question of how to get a trustworthy VPN provider. Even if you run your own on a cloud then same question with VPS provider.

There us no definite answer to that. Even TOR nodes are heavily under surveillance.

The argument for tor is try and distribute the nodes between countries that hate each other: if russia is doing half the survelience and usa the other half, they'll be unlikely to coorporate just to catch you.

Whether that's a reasonable thing to believe in is a good question. I trust that more than most sketchy VPN providers, but that's a low bar.

Seems like traffic from a VPN hosted in a foreign hostile power to a local VPN is exactly the sort of thing that one would investigate?

You need at least 3 layers before the adversary would have to passively surveil multiple points in order to surveil you, afaik

Yeah, I suppose proxying your requests through other servers is about the only way to obfuscate the traffic. Maybe bonus points if sub-queries from the same page are routed through a set of proxies instead of one, to further challenge fingerprinting.

The page offers CDNs as a potential answer. Cloudflare's reverse proxying, for example, prevents this kind of analysis.

(An adversary could compromise Cloudflare's or any other CDN's network and snoop that way, but that takes more effort and is more risky than passive collection of internet traffic, which is otherwise all you need.)

> I'm not sure how it would even be possible to hide the fact that you are visiting a certain website, while still having two-way comms with that IP.

https://geti2p.net

> to understand whether an adversary can deduce the websites a user is trying to connect to, using a set of IP addresses originating from the user’s device alone.

If you as a residential broadband singlehomed user in, let's say, China, have all of your traffic going through an advanced DPI system run by an authoritarian state, they absolutely can correlate your activity on a number of metrics and statistical methods even if the crypto for end-to-end transport of your content is flawless.

Maybe, but the article was asking the question of what someone not doing DPI can glean.

Even with a VPN and encrypted DNS?

You can ask the question at little differently. The authoritarian state may not care about most sites, but they do care about a few selected sites which they consider "subversive." By monitoring the traffic at both ends, they could potentially correlate packet timestamps, and infer your IP without directly tracing it. Kind of like Shazam for dictators.

Typically most people would not use a vpn where both ends are in the same authortarian country.

Which there may still be other side channels, and other things, but the naive version of that attack sounds a little unlikely.

Where exactly does the adversary sit in this scenario?

Reply on news.ycombinator.com